Tivoli Identity Manager

Transcription

1 Tivoli Identity Manager 4.6 AIX SA

2

3 Tivoli Identity Manager 4.6 AIX SA

4 !, 65 C. 3 ( ), 4.6. Copyright International Business Machines Corporation 2003, All rights reserved.

5 v v v Tivoli Identity Manager..... v viii ix ix x x x x xi (HOME).... xi 1 AIX AIX Tivoli Identity Manager AIX IBM Tivoli Identity Manager AIX AIX SSL SSL , SSL SSL SSL SSL SSL 35 CertTool SSL CertTool PKCS CA CA CA PKCS AIX AIXProfile.jar JAR Tivoli Identity Manager AIX ADK AIX ADK AIX A AIX Copyright IBM Corp. 2003, 2005 iii

6 B IBM Software Support IBM Software Support C iv IBM Tivoli Identity Manager: AIX

7 IBM Tivoli Identity Manager AIX (AIX ) AIX IBM Tivoli Identity Manager. Tivoli Identity Manager AIX. AIX. : Tivoli Identity Manager... AIX. AIX. AIX., AIX. AIX.. Tivoli Identity Manager. viii ix., ix. Tivoli Identity Manager Tivoli Identity Manager. v v v v Copyright IBM Corp. 2003, 2005 v

8 v v v IBM Tivoli Identity Manager Tivoli Identity Manager,. v IBM Tivoli Identity Manager Read This First Card Tivoli Identity Manager. Tivoli Identity Manager. IBM Tivoli Identity Manager Configuration Guide IBM Tivoli Identity Manager Policy and Organization Administration Guide. WebSphere IBM Tivoli Identity Manager Server Tivoli Identity Manager. IBM Tivoli Identity Manager Configuration Guide IBM Tivoli Identity Manager. IBM Tivoli Identity Manager Tivoli Identity Manager,.. v IBM Tivoli Identity Manager Performance Tuning Guide Tivoli Identity Manager. vi IBM Tivoli Identity Manager: AIX

9 A-Z I, IBM Tivoli Identity Manager. Technical Supplements. v Redbook. IBMTivoliIdentityManager.html Self Help Learn Redbooks. v. v. v Tivoli Identity Manager IBM developerworks. Tivoli Identity Manager Tivoli Identity Manager.. Passport_Advantage_Home Support & downloads. Downloads and drivers... v Virtual Skills Center for Tivoli Software: v Tivoli Education Software Training Roadmaps: v Tivoli Technical Exchange: supp_tech_exch.html vii

10 Tivoli Identity Manager.. v AIX v IBM AIX Sun Solaris Red Hat Linux Microsoft Windows Server v IBM DB2 - : - : - : winos2unix/support/v8pubs.d2w/en_main - DB2 : - : - : Oracle Microsoft SQL Server viii IBM Tivoli Identity Manager: AIX

11 v IBM Directory Server en_us/html/ldapinst.htm Sun ONE Directory Server v WebSphere Application Server. v WebSphere v IBM HTTP Server Tivoli Identity Manager. v Tivoli,,, Redbook Tivoli. Tivoli. v Tivoli Software Glossary Tivoli. Tivoli Software Glossary Tivoli Glossary. IBM Tivoli Tivoli. Tivoli. ix

12 A-Z I Tivoli Identity Manager. : PDF, Adobe Reader.. v PDF. v. IBM,. IBM. v :,. v :. v IBM Software Support : IBM, IBM Software Support. 61 B.,.. v v (,,,,,,,,,,,,,, ), ( : : :) v x IBM Tivoli Identity Manager: AIX

13 v v ( ) v ( ) v v v, v v v UNIX. Windows, $variable %variable% (/) (\). Windows UNIX., Windows %TEMP% UNIX $tmp. : Windows bash, UNIX. (HOME) (HOME). (HOME).,.. v Windows: drive:\program Files v AIX: /usr v UNIX: /opt xi

14 DB_INSTANCE_HOME Windows: path\ibm\sqllib Tivoli Identity Manager UNIX:. v AIX, Linux: /home/dbinstancename v Solaris: /export/home/dbinstancename LDAP_HOME v IBM Directory Server 5.2 Windows:. path\ibm\ldap UNIX: AIX, Linux: path/ldap Solaris: path/ibmldaps path/ibm/ldap v IBM Directory Server 6.0 Windows: path\ibm\ldap\v6.0 UNIX: path/ibm/ldap/v6.0 AIX, Solaris Linux: opt/ibm/ldap/v6.0 v Sun ONE Directory Server Windows: path\sun\mps UNIX: /var/sun/mps xii IBM Tivoli Identity Manager: AIX

15 IDS_instance_HOME IBM Directory Server 6.0 Windows: drive\ ibmslapd-instance_owner_name drive Windows C:\. instance_owner_name ldapdb2. C:\idsslapdldapdb2\logs\ibmslapd.log. UNIX: INSTANCE_HOME/idsslapd-instance_name IBM Directory Server 6.0. HTTP_HOME Linux AIX, /home/instance_owner_name. Solaris /export/home/ldapdb2/idsslapd-ldapdb2. Windows: path\ibmhttpserver UNIX: IBM HTTP Server. ITIM_HOME WAS_HOME WAS_MQ_HOME WAS_NDM_HOME path/ibmhttpserver Windows: path\ibm\itim UNIX: path/ibm/itim Windows: path\websphere\appserver UNIX: path/websphere/appserver Windows: path\ibm\websphere MQ UNIX: path/mqm Windows: path\websphere\deploymentmanager UNIX: path/websphere/deploymentmanager Tivoli Identity Manager,. WebSphere Application Server. WebSphere MQ. Deployment Manager. xiii

16 Tivoli_Common_Directory Windows: path\ibm\tivoli\common\ctgim UNIX: path/ibm/tivoli/common/ctgim ( : ). xiv IBM Tivoli Identity Manager: AIX

17 1 AIX Tivoli Identity Manager. Tivoli Identity Manager. ID, ID. Tivoli Identity Manager. IBM Tivoli Identity Manager AIX Tivoli Identity Manager AIX. AIX.. AIX. v AIX ID. v AIX ID. v ID., AIX ID. v AIX. v AIX. v AIX. v AIX. v AIX. Copyright IBM Corp. 2003,

18 2 IBM Tivoli Identity Manager: AIX

19 2 AIX AIX... 1 AIX,. AIX. 1. v Power PC Power PC v v 256MB 300MB v AIX 5.1 v AIX 5.2 v AIX 5.3 Tivoli Identity Manager 4.6 TCP/IP AIX. AIX. AIX AIX Tivoli Identity Manager. Tivoli Identity Manager ping. 1. root superuser AIX. 2. Tivoli Identity Manager AIX., ping AIX_host_name. Copyright IBM Corp. 2003,

20 Tivoli Identity Manager AIX IBM. IBM.. 1. IBM AIX /setupaix.bin Enter. FTP AIX, , IBM Tivoli Identity Manager: AIX

21 , Tivoli Identity Manager Tivoli Identity Manager. AIX JAR AIXProfile.jar. Tivoli Identity Manager. AIXProfile.jar,,. AIXProfile.jar. JAR, JAR. JAR 45 AIXProfile.jar. Tivoli Identity Manager. AIX Tivoli Identity Manager. Tivoli Identity Manager AIX.. v Tivoli Identity Manager. v Tivoli Identity Manager root Administrator.. 1. Tivoli Identity Manager /. 4. AIXProfile.jar. 5. Identity Manager Tivoli Identity Manager. 2 AIX 5

22 v.. v.. trace.log. trace.log Tivoli Identity Manager \data Tivoli Identity Manager enrolelogging.properties handler.file.filedir. AIX Tivoli Identity Manager, Tivoli Identity Manager.. 1. Tivoli Identity Manager AIX. AIX.. Tivoli Identity Manager AIX.. URL.. AIX. agentcfg. 11. URL. https URL, SSL. SSL URL http. SSL 29 4 AIX SSL. ID DAML(Directory Access Markup Language) 6 IBM Tivoli Identity Manager: AIX

23 . agentcfg. 11. ID. DAML. agentcfg AIX Tivoli Identity Manager Tivoli Identity Manager AIX. AIX. 1. AIX. /bin./startagent.sh. 2. Tivoli Identity Manager DAML. DAML Tivoli Identity Manager AIX Tivoli Identity Manager AIX SSL. 5. Tivoli Identity Manager. 5 Tivoli Identity Manager AIX. 2 AIX 7

24 7. agentcfg. 9 3 IBM Tivoli Identity Manager AIX. 8.. IBM Tivoli Identity Manager. 8 IBM Tivoli Identity Manager: AIX

25 3 IBM Tivoli Identity Manager AIX agentcfg AIX.. AIX agentcfg. 1. AIX. 2. \bin., AIX. # cd /usr/tivoli/agents/aixagent/bin 3.. agentcfg -agent AixAgent agentcfg Enter configuration key for Agent AixAgent, AIX. agent., SybaseAgent 4.6 Agent Main Configuration Menu A. Configuration Settings. B. Protocol Configuration. C. Event Notification. D. Change Configuration Key. E. Activity Logging. F. Registry Settings. G. Advanced Settings. H. Statistics. I. Codepage Support. X. Done. Select menu option: Copyright IBM Corp. 2003,

26 , (, ). 2. A 10 B 11 C 14 D 20 E 20 F 22 G 24 H 25 I 26 AIX. 1. A. AIX. AIX. Configuration Settings Name : SybaseAgent Version : 4.6 ADK Version : 4.65 ERM Version : 4.65 License : NONE Asynchronous ADD Requests : TRUE (Max.Threads:3) Asynchronous MOD Requests : TRUE (Max.Threads:3) Asynchronous DEL Requests : TRUE (Max.Threads:3) Asynchronous SEA Requests : TRUE (Max.Threads:3) Available Protocols : DAML Configured Protocols : DAML Logging Enabled : TRUE Logging Directory : /home/itim/aixagent/log Log File Name : SybaseAgent.log Max. log files : 3 Max.log file size (Mbytes) : 1 Debug Logging Enabled : TRUE Detail Logging Enabled : FALSE Press any key to continue IBM Tivoli Identity Manager: AIX

27 AIX DAML Tivoli Identity Manager. DAML., SSL DAML DAML.. AIX DAML. 1. B. DAML AIX. Agent Protocol Configuration Menu Available Protocols: DAML Configured Protocols: DAML A. Add Protocol. B. Remove Protocol. C. Configure Protocol. X. Done Select menu option 2. C. DAML. 3. DAML C... DAML. DAML Protocol Properties A. USERNAME ****** ;Authorized user name. B. PASSWORD ****** ;Authorized user password. C. MAX_CONNECTIONS 100 ;Max Connections. D. PORTNUMBER ;Protocol Server port number. E. USE_SSL FALSE ;Use SSL secure connection. F. SRV_NODENAME ;Event Notif. Server name. G. SRV_PORTNUMBER 9443 ;Event Notif. Server port number. H. VALIDATE_CLIENT_CE FALSE ;Require client certificate. I. REQUIRE_CERT_REG FALSE ;Require registered certificate. X. Done Select menu option: IBM Tivoli Identity Manager AIX 11

28 DAML DAML A. Modify Property USERNAME : ID. Tivoli Identity Manager ID. B ID agent.. Modify Property PASSWORD :. Tivoli Identity Manager ID. C agent.. Modify Property MAX_CONNECTIONS :. D Modify Property PORTNUMBER :. E Tivoli Identity Manager Modify Property USE_SSL : TRUE FALSE SSL. FALSE. USE_SSL TRUE IBM Tivoli Identity Manager: AIX

29 3. DAML () F. Modify Property SRV_NODENAME : IP ( : ). G Tivoli Identity Manager DNS IP. : IPv6(Internet Protocol version 6), IPv6.. Modify Property SRV_PORTNUMBER : Tivoli Identity Manager. H Tivoli Identity Manager Modify Property VALIDATE_CLIENT_CE : Tivoli Identity Manager TRUE. Tivoli Identity Manager FALSE. FALSE. : 1. TRUE D-H. 2. VALIDATE_CLIENT_CERT. agentcfg. I 3. CertTool CA Tivoli Identity Manager. CertTool 36 CertTool SSL.. Modify Property REQUIRE_CERT_REG : H TRUE. SSL Tivoli Identity Manager TRUE. CA FALSE. FALSE AIX SSL. 5. Enter. 3 IBM Tivoli Identity Manager AIX 13

30 . Enter X. Tivoli Identity Manager AIX. Tivoli Identity Manager. Tivoli Identity Manager. Tivoli Identity Manager.. Tivoli Identity Manager.., Tivoli Identity Manager.. Tivoli Identity Manager. Tivoli Identity Manager,. DAML SRV_NODENAME. 3. Tivoli Identity Manager IP Enter.. 4. SRV_PORTNUMBER. 5. Tivoli Identity Manager Enter.. 14 IBM Tivoli Identity Manager: AIX

31 .. Tivoli Identity Manager. 1. C.. Event Notification Menu * Reconciliation interval : 1 day(s) * Next Reconciliation time : 23 hour(s) 56 min(s). 23 sec(s). * Configured Contexts : Jupiter, dd309 A. Enabled B. Time interval between reconciliations. C. Set Processing cache size. (currently: 50 Mbytes) D. Start event notification now. E. Set attributes to be reconciled. F. Reconciliation process priority. (current: 1) G. Add Event Notification Context. H. Modify Event Notification Context. I. Remove Event Notification Context. J. List Event Notification Contexts. X. Done Select menu option: : A. Enter. 4. A, Tivoli Identity Manager.. v, A. v, A. B A.. Enter new interval ([ww:dd:hh:mm:ss]).,. [00:01:00:00:00] :.. 3 IBM Tivoli Identity Manager AIX 15

32 4. () C. Enter new cache size[5]: D E F G H I J..... Enter new thread priority [1-10]:. :... Context name : Enter Delete context context1? [no]: Enter, Yes Enter.. Context Name : Context1 Target DN : erservicename=context1,o=ibm, ou=ibm,dc=com --- Attributes for search request --- {search attributes listed} B, C, E, F Enter.... ( : ). 1. E.. 16 IBM Tivoli Identity Manager: AIX

33 Event Notification Entry Types A. USER B. GROUP X. Done Select menu option: USER GROUP. a. b. c. 2. A, B.... Event Notification Attribute Listing (a) **eraixgroupid (b) **eraixgroupmember (c) **eraixgroupname (d) **eraixat (e) **eraixcron (f) **erunixduplicateuid (g) **erexpirationdate (h) **erpasswordforcechange (i) **erhomedirpermissions (j) **erhomedir (k) **erpasswordminage (l) **erlastaccessdate (m) **erpassword (n) **erunixprimarygroup (o) **erpasswordlastchange (o) **erpasswordmaxage (q) **eraixpasswordmaxexpire (r) **eraixpassworddmaxrepeats (p)rev page 1 of 3 (n)ext X. Done Select menu option: 3.. (**).. Tivoli Identity Manager.. AIX Tivoli Identity Manager. AIX. (OU, organizational unit) (DC, domain container).. 3 IBM Tivoli Identity Manager AIX 17

34 . Context1, Context2 Context3,.. 1. H.. Modify Context Menu A. Context1 B. Context2 C. Context3 X. Done Select menu option: 2... A. Set attributes for search B. Target DN: C. Delete Baseline Database X. Done Select menu option: 5. A 18 B DN 19 C 19, v,. v... v Tivoli Identity Manager.. 1. A.. 18 IBM Tivoli Identity Manager: AIX

35 Reconciliation Attributes Passed to Agent for Context: Context A. Add new attribute B. Modify attribute value C. Remove attribute X. Done Select menu option: AIX. 2.. (**).... DN DN. DN. 1. B. 2. Enter Target DN, DN Enter. DN. erservicename=erservicename,o=organizationname,ou=tenantname,rootsuffix DN. 6. DN erservicename o ou rootsuffix tenant DN.. C.. 3 IBM Tivoli Identity Manager AIX 19

36 . AIX. 1. Main Menu D. 2. Enter. Enter. agent... Configuration key successfully changed. Main Menu., AIX AixAgent.log. \log. AIX. 1. Main Menu E... Agent Activity Logging Menu A. Activity Logging (Enabled). B. Logging Directory (current: /home/itim/aixagent/log). C. Activity Log File Name (current: SybaseAgent.log). D. Activity Logging Max. File Size ( 1 mbytes) E. Activity Logging Max. Files ( 3) F. Debug Logging (Enabled). G. Detail Logging (Disabled). H. Base Logging (Disabled). I. Thread Logging (Disabled). X. Done Select menu option: 2.. A. 20 IBM Tivoli Identity Manager: AIX

37 Enter. 7. A.. v, A. v, A. B C D E F A.. Enter log file directory:. : /home/log.,.. Enter log file name:.,.. Enter maximum size of log files (mbytes): ( : 10).. MB... Enter maximum number of log files to retain: 100 ( : 5).... v, F. v, F. F. 3 IBM Tivoli Identity Manager AIX 21

38 7. () G..,.. v, G. v, G. H G. ADK... v, H. v, H. I H. ID.. v, I. v, I. I. 3. B, C, D E Enter... AIX. 1. F.. AixAgent 4.6 Agent Registry Menu A. Modify Non-encrypted registry settings. B. Modify encrypted registry settings. C. Multi-instance settings. X. Done Select menu option: 2.. :. 22 IBM Tivoli Identity Manager: AIX

39 . 1. A.. Agent Registry Items ENROLE_VERSON deletehomedir true 03. SetupHomeDir /usr/tivoli/agent/aixagent 04. UseShadowFile true 05. processatcron true 06. processpath false 07. processumask true Page 1 of 1 A. Add new attribute B. Modify attribute value C. Remove attribute X. Done Select menu option: A B C 3. Enter A B Enter deletehomedir SetupHomeDir UseShadowFile delete_user. TRUE.... TRUE. 3 IBM Tivoli Identity Manager AIX 23

40 9. () processatcron. v cron_allowed v v v cron_deny at_allowed at_deny processpath processumask TRUE.. FALSE. UMASK. TRUE. AIX. v v v v AIX.. 1. Main Menu G... SybaseAgent 4.6 Advanced Settings Menu A. Single Thread Agent (current:true) B. ADD max. thread count. (current:3) C. MODIFY max. thread count. (current:3) D. DELETE max. thread count. (current:3) E. SEARCH max. thread count. (current:3) F. Allow User EXEC procedures (current:false) G. Archive Request Packets (current:false) H. UTF8 Conversion support (current:true) I. Pass search filter to agent (current:false) J. Thread Priority Level (1-10) (current:4) X. Done Select menu option: IBM Tivoli Identity Manager: AIX

41 10. A. B C D E F G H I J TRUE pre- post-exec.. FALSE.... FALSE Enter.. AIX. 1. Main Menu H.. SybaseAgent 4.6 Agent Request Statistics Date Add Mod Del Ssp Res Rec /15/ X. Done 3 IBM Tivoli Identity Manager AIX 25

42 2. X. AIX.. agentcfg -agent [adapter_name] -codepages AIX. 1. Main Menu I.. SybaseAgent 4.6 Codepage Support Menu * Configured codepage: US-ASCII * ******************************************* * Restart Agent After Configuring Codepages ******************************************* A. Codepage Configure. X. Done Select menu option: 2. A. : AixAgent. 3. X. agentcfg. 1. Main Menu X. \bin. 2. agentcfg -help.. 26 IBM Tivoli Identity Manager: AIX

43 -version ; -hostname < value> ; -findall ; -list ; -agent <value> ; -tail ; -schema ; -portnumber <value>; -netsearch <value> ; -confidencetest ; -setup ; -help ; Show version Target nodename to connect to (Default:Local host IP address) Find all agents on target node List available agents on target node Name of agent Display agent s activity log Display agent s attribute schema Specified agent s TCP/IP port number Lookup agents hosted on specified subnet Confidence test Confidence test setup Display this help screen agentcfg -version -hostname <value> agentcfg. -hostname. v -findall v v v -list -tail -agent -findall -list -agent <value> -tail -schema -portnumber <value> IP hostname. AIX., hostname... -hostname. -tail. -agent. -hostname.. agentcfg -agent. 3 IBM Tivoli Identity Manager AIX 27

44 11. agentcfg () -netsearch <value> -findall.. -confidencetest,,. AIX. Tivoli Identity Manager AIX. -setup confidence. -help agentcfg. 3. agentcfg. agentcfg. IP agentcfg -list. Tivoli Identity Manager Agent(s) installed on node AixAgent (44970) AIX agentcfg agentcfg -agent AixAgent. IP agentcfg -list -hostname Agent(s) installed on node AixAgent (44970) IP agentcfg agentcfg -agent AixAgent -hostname AIX. 28 IBM Tivoli Identity Manager: AIX

45 4 AIX SSL Tivoli Identity Manager Tivoli Identity Manager DAML SSL(Secure Sockets Layer). SSL Tivoli Identity Manager. Tivoli Identity Manager SSL. Tivoli Identity Manager. SSL., Tivoli Identity Manager, ( Tivoli Identity Manager ) SSL. SSL, SSL. ( : Tivoli Identity Manager ), SSL. SSL CertTool SSL. SSL Tivoli Identity Manager, Tivoli Identity Manager. CA(Certificate Authority) SSL Tivoli Identity Manager. SSL... SSL SSL. SSL SSL. (third-party) CA(Certificate Authority). OpenSSL. Copyright IBM Corp. 2003,

46 CA (Certificate-Authority )., CA. CA(Certificate Authority). (certificate authorities) CA CA.,, CA. SSL.....,. (third-party) CA(Certificate Authority).. CA., SSL. 30 IBM Tivoli Identity Manager: AIX

47 , CA. SSL.,. (third-party). SSL SSL. CA. CA.,...,, Tivoli Identity Manager., CA...pem.pem(privacy-enhanced mail) -----BEGIN CERTIFICATE END CERTIFICATE-----.pem., CA. 4 AIX SSL 31

48 .arm.arm base-64 ASCII..arm IBM Key Management..der.der 2..der.pem..pfx (PKCS12) PKCS12. SSL., IBM Key Management PKCS12 CertTool. SSL. DAML SSL. DAML SSL. DAML SSL. CertTool. DAML 11. SSL SSL. CertTool. SSL Tivoli Identity Manager Tivoli Identity Manager SSL.. Tivoli Identity Manager SSL. SSL Tivoli Identity Manager. Tivoli Identity Manager CA. 32 IBM Tivoli Identity Manager: AIX

49 2 A Tivoli Identity Manager, B Tivoli Identity Manager. Tivoli Identity Manager (SSL ) 1 Hello Tivoli Identity Manager ( SSL ) CA A B A 2. SSL ( ) SSL,. 1.. a. CertTool. b. CA(Certificate Authority) SSL. 1) CSR(Certificate Signing Request). PENDING_KEY. 2) CA CA CSR. CSR CA. 2. Tivoli Identity Manager. v CA, Tivoli Identity Manager CA (CA ). CA, CA. v, Tivoli Identity Manager., Tivoli Identity Manager. 4 AIX SSL 33

50 SSL Tivoli Identity Manager Tivoli Identity Manager SSL,. Tivoli Identity Manager, ID. CA. 3 Tivoli Identity Manager A, Tivoli Identity Manager B. Tivoli Identity Manager (SSL ) Hello Tivoli Identity Manager (SSL C) C CA A A A Send Certificate A B CA B Send Certificate B 3. SSL ( ) 32 SSL SSL Tivoli Identity Manager. CA. v CA. v Tivoli Identity Manager CA CA. SSL,. 1. Tivoli Identity Manager CSR, CA, CA CA. 2. Tivoli Identity Manager CA., CA CA. 34 IBM Tivoli Identity Manager: AIX

51 SSL SSL SSL. (Tivoli Identity Manager ).,. 4 Tivoli Identity Manager SSL SSL. Tivoli Identity Manager,.,. A CA C Tivoli Identity Manager A Hello A CA A Tivoli Identity Manager B Hello C C Web Server C 4. SSL SSL Tivoli Identity Manager SSL, ID ( ). SSL CertTool CA. 4. CA. (Tivoli Identity Manager ) Tivoli Identity Manager. 4 AIX SSL 35

52 CertTool SSL CertTool.. v CertTool v 39 v 40 v 40 PKCS12 v 41 v 41 CA v 41 CA v 41 CA v 42 v 42 v 42 CertTool CertTool AIX. 1. AIX. 2. bin., AIX. # cd /usr/tivoli/agents/aixagent/bin 3. CertTool -agent AixAgent.. 36 IBM Tivoli Identity Manager: AIX

53 Main menu - Configuring agent: SybaseAgent A. Generate private key and certificate request B. Install certificate from file C. Install certificate and key from PKCS12 file D. View current installed certificate E. List CA certificates F. Install a CA certificate G. Delete a CA certificate H. List registered certificates I. Register certificate J. Unregister a certificate K. Export certificate and key to PKCS12 file X. Quit Choice:,,.. (A-D) CSR. A. Generate private key and certificate request( ) CA CSR. A 39. B. Install certificate from file( ). CA A CSR. B 40. C. Install certificate and key from a PKCS12 file(pkcs12 ) PKCS12. A B, PKCS12. C 40 PKCS12. D. View current installed certificate( ). D 41. CA. CA Tivoli Identity Manager Tivoli Identity Manager. 4 AIX SSL 37

54 E. List CA certificates(ca ) CA. CA, Tivoli Identity Manager. F. Install a CA certificate(ca ) CA CA. CA X.509 PEM. CA 41 CA. G. Delete a CA certificate(ca ) CA. CA 41 CA. (H - K) ( : Tivoli Identity Manager ).. Tivoli Identity Manager 4.5, Tivoli Identity Manager. CA Tivoli Identity Manager. DAML, CA ( F) Tivoli Identity Manager CA. H. List registered certificates( ). 42. I. Register a certificate( ). Base 64 X.509 PEM. 42. J. Unregister a certificate( ) (). 42. K. Export certificate and key to PKCS12 file( PKC12 ).. PKCS12 43 PKCS IBM Tivoli Identity Manager: AIX

55 CSR(certificate signing request),. CA(Certificate Authority) CA CA. CSR. CSR,. CSR. 1. CertTool A.. Enter values for certificate request (press enter to skip value) Organization Enter. 3. Organizational Unit Enter. 4. Agent Name Enter. 5. Enter. 6. State (state) ( ) Enter. CA(Certificate Authority) Country Enter. 8. Locality Enter. 9. Accept these values Y, N Enter Enter name of file to store PEM cert request, Enter. 11. Enter.,..pem CA(Certificate Authority) CA. CSR(Certificate Signing Request) CSR BEGIN CERTIFICATE REQUEST----- MIIB1jCCAT8CAQAwgZUxEjAQBgNVBAoTCWFjY2VzczM2MDEUMBIGA1UECxMLZW5n aw5lzxjpbmcxedaobgnvbamtb250ywdlbnqxjdaibgkqhkig9w0bcqewfw50ywdl bnraywnjzxnzmzywlmnvbtelmakga1uebhmcvvmxezarbgnvbagtcknhbglmb3ju 4 AIX SSL 39

56 awexdzanbgnvbactbklydmluztcbnzanbgkqhkig9w0baqefaaobjqawgykcgyea mr6acpnwf6hllc72bmukawaxcebtxcocnnth9uc8vumhpbimagjuc4s91hprilg7 UtlbOfy6X3R3kbeR8apRR9uLYrPIvQ1b4NK0whsytij6syCySaFQIB6V7RPBatFr 6XQ9hpsARdkGytZmGTgGTJ1hSS/jA6mbxpgmttz9HPECAwEAAaAAMA0GCSqGSIb3 DQEBAgUAA4GBADxA1cDkvXhgZntHkwT9tCTqUNV9sim8N/U15HgMRh177jVaHJqb N1Er46vQSsOOOk4z2i/XwOmFkNNTXRVl9TLZZ/D+9mGZcDobcO+lbAKlePwyufxK Xqdpu3d433H7xfJJSNYLYBFkrQJesITqKft0Q45gIjywIrbctVUCepL END CERTIFICATE REQUEST----- CA.. 1.,, bin.,. /usr/tivoli/agents/aixagent/bin 2. CertTool B.. Enter name of certificate file: Enter name of certificate file Enter.. PKCS12 CSR CertTool, PKCS12. CA PKCS12 (.pfx ). PKCS PKCS12 bin.,. /usr/tivoli/agents/aixagent/bin 2. CertTool C.. Enter name of PKCS12 file: Enter name of PKCS12 file PKCS12 Enter. : DamlSrvr.pfx 4. Enter password Enter.. 40 IBM Tivoli Identity Manager: AIX

57 CertTool D... The following certificate is currently installed. Subject: c=us,st=california,l=irvine,o=daml,cn=daml Server CA CA CA. CA CA(Certificate Authority). CA. 1. Main Menu F(Install a CA certificate).. Enter name of certificate file: 2. Enter name of certificate file DamlCACerts.pem Enter.. e=admin@ibm.com,c=us,st=california,l=irvine,o=ibm,ou=engineering,cn=eng Install the CA? (Y/N) 3. Install the CA Y Enter. CACerts.pem. CertTool. CA Main Menu E. CA. CA. Subject: o=ibm,ou=samplecacert,cn=testca Valid To: Wed Jul 26 23:59: CA CA. 1. Main Menu G. CA. 4 AIX SSL 41

58 0 - e=admin@ibm.com,c=us,st=california,l=irvine,o=ibm,ou=engineering,cn=eng 1 - e=support@ibm.com,c=us,st=california,l=irvine,o=ibm,ou=support,cn=support Enter number of CA certificate to remove: 2. Enter number of CA certificate to remove CA Enter. CA CACerts.pem.. Main Menu H e=admin@ibm.com,c=us,st=california,l=irvine,o=ibm,ou=engineering,cn=eng 1 - e=support@ibm.com,c=us,st=california,l=irvine,o=ibm,ou=support,cn=support. 1. Main Menu I.. Enter name of certificate file: 2. Enter name of certificate file Enter..,. e=admin@ibm.com,c=us,st=california,l=irvine,o=ibm,ou=engineering,cn=eng Register this CA? (Y/N) 3. Register this CA Y Enter Main Menu J IBM Tivoli Identity Manager: AIX

59 0 - e=admin@ibm.com,c=us,st=california,l=irvine,o=ibm,ou=engineering,cn=eng 1 - e=support@ibm.com,c=us,st=california,l=irvine,o=ibm,ou=support,cn=support 2. Enter..,. e=admin@ibm.com,c=us,st=california,l=irvine,o=ibm,ou=engineering,cn=eng Unregister this CA? (Y/N) 3. Unregister this CA Y Enter.. PKCS12 PKCS Main Menu K.. Enter name of PKCS12 file: 2. Enter name of PKCS12 file PKCS12 Enter. 3. Enter Password PKCS12 Enter. 4. Confirm Password Enter. PKCS12. 4 AIX SSL 43

60 44 IBM Tivoli Identity Manager: AIX

61 5 AIX AIX JAR AIXProfile.jar,,. JAR,, JAR. AIX. 1. JAR. AIXProfile.jar Tivoli Identity Manager. 46 JAR Tivoli Identity Manager. AIXProfile.jar JAR AIXProfile.jar IBM AIX. AIXProfile.jar. v CustomLabels.properties v eraixaccount.xml v eraixdamlservice.xml v resource.def v schema.dsml v xforms.xml. JAR Tivoli Identity Manager. 5 Tivoli Identity Manager. AIXProfile.jar. 1. AIX. 2. AIXProfile.jar. 3. AIXProfile.jar. Copyright IBM Corp. 2003,

62 #cd /tmp jar -xvf AIXProfile.jar jar /tmp/aixprofile. 4.. JAR Tivoli Identity Manager schema.dsml CustomLabels.properties Tivoli Identity Manager.. 1. /temp JAR. #cd /tmp jar -cvf AIXProfile.jar AIXProfile 2. AIXProfile.jar Tivoli Identity Manager Application Server AIX... AIX ( )..., Tivoli Identity Manager., AIX. resource.def. schema.dsml xforms.xml. 46 IBM Tivoli Identity Manager: AIX

63 ... AIX. 1. Tivoli Identity Manager. 2. AIXProfile.jar. 45 AIXProfile.jar. 3. resource.def \AIXProfile. 4. resource.def.,. <Property Name = "com.ibm.itim.remoteservices.resourceproperties. PASSWORD_NOT_REQUIRED_ON_RESTORE" Value = "TRUE"/> <Property Name = "com.ibm.itim.remoteservices.resourceproperties. PASSWORD_NOT_ALLOWED_ON_RESTORE" Value = "FALSE"/>. 5. resource.def AIXProfile.jar Tivoli Identity Manager. 46 JAR Tivoli Identity Manager. 6. Tivoli Identity Manager. :,. Tivoli Identity Manager. 49 AIX. 5 AIX 47

64 48 IBM Tivoli Identity Manager: AIX

65 6 AIX ADK AIX ADK(Adapter Development Kit). ADK. ADK,. ( : )... ADK, ADK. AIX,.,. 3 2 AIX AIX, AIX. 2..,. ADK ADK,,.,,. ADK,. Copyright IBM Corp. 2003,

66 ADK ADK. ADK. ADK ADK DAML. agentcfg CertTool 2. ADK, ADK.. AIX ADK. 1. IBM ADK : # cd /tmp 4. ADK. #./adkinst_<operating system>.bin, <operating system> aix, solaris, linux hpux , Invalid Install Location - Cannot Install ADK , ADK ADK. <ADKVersion>Installer.log <ADKVersion>Installeropt.log, <ADKVersion> ADK. 50 IBM Tivoli Identity Manager: AIX

67 : ADK46Installer.log ADK46Installeropt.log. 6 AIX ADK 51

68 52 IBM Tivoli Identity Manager: AIX

69 7 AIX, AIX., AIX. AIX. 1. /bin./stopagent.sh AIX. 2. <adapter_directory>/_uninst directory./uninstaller.bin Enter., adapter_directory AIX. 5.,. 6.. AIX,. Copyright IBM Corp. 2003,

70 54 IBM Tivoli Identity Manager: AIX

71 A. AIX AIX root. AIX Tivoli Identity Manager. root ID root. 12., Tivoli Identity Manager AIX. Tivoli Identity Manager AIX. 12 AIX.. GroupId eraixgroupid ID. GroupMember eraixgroupmember ID. GroupName eraixgroupname. lu_at eraixat. lu_cron eraixcron cron. lu_dupuid erunixduplicateuid ID. lu_expire erexpirationdate MM/DD/ YY. lu_force erpasswordforcechange. lu_gid gidnumber ID. lu_gecos gecos GECOS. lu_home_mode erhomedirpermissions 3. ASCII Copyright IBM Corp. 2003,

72 12., () lu_home_path erhomedir UNIX. lu_last_access erlastaccessdate. lu_passwd erpassword. lu_primary_group erunixprimarygroup ID. lu_pwd_last_change erpasswordlastchange. lu_pwd_max_age erpasswordmaxage. lu_pwd_max_expired eraixpasswordmaxexpire (Week). lu_pwd_max_repeats eraixpasswordmaxrepeats. lu_pwd_min_age erpasswordminage. lu_pwd_warn_age erpasswordwarnage. lu_secondary_groups erunixsecondarygroup ID. lu_shell erunixshell. lu_uid uidnumber ID. lu_umask erunixumask 3. lu_admin_user eraixadminuser Admin ID. USERNAME eruid. UserStatus eraccountstatus. AIX AIX. AIX.. 56 IBM Tivoli Identity Manager: AIX

73 13. eruid erpassword. 14. eruid. 15. eruid eruid erpassword eraccountstatus eruid eraccountstatus A. 57

74 Tivoli Identity Manager eruid erunixsecondarygroup. 20. eruid erunixsecondarygroup. 21. eruid erunixprimarygroup 58 IBM Tivoli Identity Manager: AIX

75 . 22. eruid erunixprimarygroup A. 59

76 60 IBM Tivoli Identity Manager: AIX

77 B. IBM. v v 62 v 63 IBM Software Support IBM,.. IBM.,,.,.. v IBM Tivoli Identity Manager Performance Tuning Guide Tivoli Identity Manager. A-Z I, IBM Tivoli Identity Manager. Technical Supplements. v Redbook. IBMTivoliIdentityManager.html Self Help Learn Redbooks. v. Copyright IBM Corp. 2003,

78 v. v Tivoli Identity Manager IBM developerworks. IBM. 1. IBM Software Support ( 2. Products support pages A to Z. 3. IBM Tivoli Identity Manager. 4. Self help,. 5.. IBM. 1. IBM My support. 2.,., ID. 3. My support. 4. My support Edit profiles Select Mail Preferences.. 5. Submit Software Support Handbook ( 62 IBM Tivoli Identity Manager: AIX

79 IBM Software Support IBM Software Support. IBM Software Support IBM IBM.. v IBM (Tivoli, Lotus Rational Windows UNIX DB2 WebSphere ), Passport Advantage. : Passport Advantage ( nsf/webdocs/ Passport_Advantage_Home) How to Enroll. : IBM Software Support ( v IBM eserver (zseries, pseries iseries DB2 WebSphere ), IBM IBM. eserver IBM Technical Support Advantage ( IBMSERV ( ) IBM Software Support Handbook ( IBM Software Support IBM Software Support. IBM,.,.. B. 63

80 :.. :,. :. :. IBM,. IBM Software Support.. v? v,? IBM Software Support. v?,? v? ( :,, ) v?,. IBM Software Support. v : IBM Software Support ( probsub.html) Submit and track problems.. v : IBM Software Support Handbook ( IBM Software Support APAR(Authorized Program Analysis Report). APAR. IBM Software Support APAR. IBM APAR IBM.. 64 IBM Tivoli Identity Manager: AIX

81 C.. IBM,. IBM. IBM, IBM,. IBM,,. IBM,. IBM ,.. : (DBCS) IBM. IBM World Trade Asia Corporation Licensing 2-31 Roppongi 3-chome, Minato-ku Tokyo , Japan. IBM, (, ).,..,. IBM / /. Copyright IBM Corp. 2003,

82 IBM,. IBM. IBM. (1) ( ) (2) ,.. (, ). IBM IBM, IBM (IPLA)....,.. IBM,. IBM IBM,,. IBM. IBM Corporation. IBM IBM AIX 66 IBM Tivoli Identity Manager: AIX

83 DB2 Novell SecureWay Tivoli Tivoli Universal Database WebSphere Lotus IBM Corporation / Lotus Development Corporation. Domino IBM Corporation Lotus Development Corporation. Microsoft, Windows, Windows NT Windows Microsoft Corporation. Intel, Intel Inside(), MMX Pentium Intel Corporation. UNIX Open Group. Linux Linus Torvalds. Sun, Sun Microsystems Sun Sun Microsystems, Inc.. Java Java Sun Microsystems, Inc..,. C. 67

84 68 IBM Tivoli Identity Manager: AIX

85 29, 39 45, xi 46 Software Support agentcfg 9 agentcfg 10 9, 20 9 agentcfg 20 SSL 32 x x DB_INSTANCE_HOME xii HTTP_HOME xiii ITIM_HOME xiii LDAP_HOME xii WAS_HOME xiii WAS_MQ_HOME xiii WAS_NDM_HOME xiii Tivoli_Common_Directory xiv UNIX, xi x 3 DB2 UDB xii IBM Directory Server xii IBM HTTP Server xiii WebSphere Application Server Network Deployment xiii WebSphere Application Server xiii WebSphere MQ xiii, UNIX xi DB_INSTANCE_HOME xii HTTP_HOME xiii ITIM_HOME xiii LDAP_HOME xii Sun ONE Directory Server xii WAS_HOME xiii WAS_MQ_HOME xiii WAS_NDM_HOME xiii agentcfg / , 23, agentcfg /, agentcfg 21, adaptercfg 21, agentcfg 21 21, , agentcfg 20 Copyright IBM Corp. 2003,

86 (), 10 ADK46Installeropt.log 50 ADK46Installer.log 50 agentcfg 27 trace.log 6 ix ix Tivoli Identity Manager v, 24 IBM Software Support 63 IBM Software Support 64 IBM Software Support 64 5, 46 PKCS12 32, 24 ix ix ix Tivoli Identity Manager v DB2 UDB xii IBM Directory Server xii IBM HTTP Server xiii Sun ONE Directory Server xii WebSphere Application Server Network Deployment xiii WebSphere Application Server xiii WebSphere MQ xiii Tivoli Identity Manager agentcfg / AIX , agentcfg 24 3, x 20, 9, 20 PKCS12 DAML SSL 29, 30 22, 23 22, agentcfg DAML IBM Tivoli Identity Manager: AIX

87 SSL ADK 49 1 agentcfg 49 5 ADK 49 ix 3 / DN agentcfg () () CSR(Certificate Signing Request) CertTool CertTool CA , 61, 62 31, , , DN 19 71

88 () 16 17, SSL 35 34, x, agentcfg 12 x, x pdf, agentcfg 12, agentcfg 12 DAML 11 11, agentcfg 12 agentcfg 11 SSL , 35 DB_INSTANCE_HOME xii HTTP_HOME xiii ITIM_HOME xiii LDAP_HOME xii WAS_HOME xiii WAS_MQ_HOME xiii WAS_NDM_HOME xiii UNIX xi 20 x A ADK46Installeropt.log 50 ADK46Installer.log 50 agentcfg agentcfg / 20 agentcfg 26 -help 26 C CA(certificate authority) 29 CertTool, , CA IBM Tivoli Identity Manager: AIX

89 CertTool () CA () 41 CSR 39, 39 CSR(Certificate Signing Request) 39 D DAML , agentcfg password 12 require_cert_reg 13 srv_nodename 13 srv_portnumber 13 username 12 validate_client_ce 13 agentcfg 11 SSL 32 DB_INSTANCE_HOME xii DB2 UDB xii H HTTP_HOME xiii IBM HTTP Server xiii I ITIM_HOME xiii xiii L LDAP_HOME xii IBM Directory Server xii Sun ONE Directory Server xii P pdf, x PKCS R require_cert_reg, agentcfg 13 S Software Support 63 IBM Software Support 63 IBM Software Support 64 IBM Software Support 64 srv_nodename, agentcfg 13 srv_portnumber, agentcfg 13 SSL , SSL, DAML 32 T Tivoli Identity Manager SSL 32 Tivoli Identity Manager 3 Tivoli Identity Manager 34, 35 SSL 34, 35 Tivoli ix Tivoli_Common_Directory xiv trace.log 6 73

90 U username, agentcfg 12 UTF8 24 V validate_client_ce, agentcfg 13 W WAS_HOME xiii WebSphere Application Server xiii WAS_MQ_HOME xiii WebSphere MQ xiii WAS_NDM_HOME xiii WebSphere Application Server Network Deployment xiii 74 IBM Tivoli Identity Manager: AIX

91

92 Printed in Denmark by IBM Danmark A/S SA