IBM Tivoli Identity Manager Active Directory Reverse Password Synchronization Supplemental

Transcription

1 IBM Tivoli Identity Manager Active Directory Reverse Password Synchronization Supplemental

2 Sample Environment: ITIM 5.0 FP3 on AIX 5.3 ADAgent Version Active Directory 64-Bit (WinAD64) Adapter Tivoli Password Sync for Windows WinHttp Access Rights: ITIM Admin and Domain Administrator Windows Files needed: ITIM_HOME/enRole.Properties and WebSphere Server cert.

3 Step 1: You will need to have a working ITIM 5.0 server and Active Directory Adapter. The ADAdapter must be able to complete a recon and user modifications prior to installing and configuring the reverse password sync utility. A service and policy must be present for the ADAdapter.

4 Step 2: Review the operating system information and ensure you have a 64 bit Windows 2003 server to install the reverse password sync on This is the OS info These are the adapter binary files used to install the adapter Reverse Password Sync (RPS). Use your IBM Passport Advantage account to locate the files needed. Adapter-WinAD64-5[1].0.6\PW-Sync-x86-x \WinHTTP\SetupPwdSynch.exe

5 Step 3: Take the certificate from the ITIM WAS server and load it on the target server where the reverse password Sync Utility will be installed. Note if you have more then one member server you will do this on all member servers in the domain. Log into the ITIM server on the SSL port. Select the View Certificates Button on the popup window Click on the details tab of the new window Select Copy to File The Cert Wizard will open Select Der Encoded BinaryX.509 (.cer) Name the cert c:\temp\itim_was_cert.cer The Wizard will end with a success. Take that file ITIM_WAS_CERT.cer and move it to the member server where the sync util will be installed.

6 Step 4: Run the installer as an domain administrator on the member server. Here are screen shots of the install page by page.

7

8

9

10

11

12 We will now configure the details to the reverse password sync and the ITIM server host.

13 The ITIM principal must be a valid ITIM account. You then start the configuration of the target services.

14 Select ADD and take the values from the ITIM_HOME/enRole.properties file

15 You can use the MMC to get the domain name. You can use an LDAP browser to get the O, OU and Suffix for the ITIM instance. This is the same date in the $ITIM_HOME/enRole.properties file.

16 Fill in the correct info dc=cm64dom,dc=ibm,dc=com erservicename=ad2003x64_on_129,o=acem Fern 50,ou=af50,dc=FERN

17

18 Select Done and complete the install.

19 We will now set the ADAgent to talk SSL using DEMO certs from IBM. If you have already installed certs for your adapter and it is communicating SSL you can skip this section.

20

21

22

23 Once you have a cert installed re-start the adapter and test a recon to ensure the adapter is working properly with the new cert.

24 You will need to set the ITIM server ADAgent Service form to have a certstore location.

25 Here is a sample service form.

26 Ensure your new SSL changes allow the adapter to recon Ensure you can access the ITIM servlet at the following URL. This is what the page will look like if you can access the servlet.

27 You config and install is now complete. You can test the solution by performing a password change for an Active directory user on the MMC and observing the PasswordSync.log. Example of the log for a managed ITIM Active Directory Account. Thu Mar 12 08:47: c8 Password validation requested for user: ttummy Thu Mar 12 08:47: c Thu Mar 12 08:47: c8 Password Validation is disabled. Ignoring password validation action for user: ttummy Thu Mar 12 08:47: c8 Starting new thread. Thread count: 1 Thu Mar 12 08:47: Thu Mar 12 08:47: Password change detected for user: ttummy Thu Mar 12 08:47: Thu Mar 12 08:47: Sending request to server... Thu Mar 12 08:47: User: ttummy TargetDN: erservicename=ad2003x64_ on_129,o=acem Fern 50,ou=af50,dc=FERN Thu Mar 12 08:47: Response: <SYNCH_PSWDS_RESP code= success desc= success /> Thu Mar 12 08:47: Thread exiting. Thread count: 0

28 The user ttummy had one ITIM account and one AD account and since the AD password was changed by the MMC ITIM will only send a multiple account password change for the managed accounts for the user except for the initiating AD account.

29 To by pass the configuration of the adapter registry you cna set the ITIM servers enrole.properties file to manage the Reverse sync order for multiple password sync agents. ############################################################# # This is the configuration flag to bypass the password # validation on the orphan account when the request is # submitted from the agent. reversepasswordsynch.bypasspwdvalidationonorphanaccount=false # Enable/Disable notifications when password # synchronization is triggered via password synch module (win AD) # not from ITIM UI. Value true will enable notification. # Value false will disable notification for this event. enrole.passwordsynch.module.sendmail=true

30