IBM Tivoli Identity Manager. Windows NT Agent SA

Transcription

1 IBM Tivoli Identity Manager Windows NT Agent SA

2

3 IBM Tivoli Identity Manager Windows NT Agent SA

4 !, 51 C. ( ), Copyright International Business Machines Corporation All rights reserved.

5 v v v Tivoli Identity Manager.. v v vi vi vi vii : : : : : : : : : : : : : : SSL SSL Tivoli Identity Manager request.pem PKCS CA CA CA A Windows NT Agent B Copyright IBM Corp iii

6 C iv IBM Tivoli Identity Manager: Windows NT Agent

7 Windows NT Agent Windows NT Windows 2000( Active Directory) IBM Tivoli Identity Manager Server. Tivoli Identity Manager Windows NT Windows 2000 Active Directory. Windows NT Agent..... Tivoli Identity Manager.. Tivoli Identity Manager Tivoli Identity Manager. v Tivoli Identity Manager Tivoli Identity Manager. v Tivoli Identity Manager Policy and Organization Administration Guide Tivoli Identity Manager. v Tivoli Identity Manager Server Configuration Guide Tivoli Identity Manager. Tivoli Identity Manager. v Tivoli Software Library,,, Tivoli. Tivoli Software Library. Copyright IBM Corp v

8 v Tivoli Software Glossary Tivoli. Tivoli Software Glossary Tivoli Software Library Glossary. IBM Tivoli Software Library PDF(Portable Document Format) HTML(Hypertext Markup Language). Product manuals. Tivoli Software Information Center.,,,. : PDF Adobe Acrobat ( ).. v HTML PDF. v. IBM Tivoli IBM Tivoli Software Support. IBM Software Support Guide. vi IBM Tivoli Identity Manager: Windows NT Agent

9 . v v v,.., ( )... v v v v v v vii

10 viii IBM Tivoli Identity Manager: Windows NT Agent

11 1 Windows NT Agent..,,. v. v Windows NT Agent. v Windows NT Agent Tivoli Identity Manager Server. v Tivoli Identity Manager Server. v Tivoli Identity Manager Server. Windows NT Agent Windows NT Agent A B C... Tivoli Identity Manager Server. Tivoli Identity Manager Server Tivoli Identity Manager Server. Tivoli Identity Manager Server, Tivoli Identity Manager Server Windows NT. agentcfg. agentcfg,. CertTool. CertTool,,.... Copyright IBM Corp

12 2 IBM Tivoli Identity Manager: Windows NT Agent

13 2 Windows NT Agent... Windows NT Agent,. Windows NT Agent x86, 128MB 100MB. SP6 Windows NT 4.0 Windows 2000 Server( Active Directory). : Active Directory Windows 2000 Server. TCP/IP Tivoli Identity Manager Server. Windows NT. Windows NT Agent. IBM Windows NT Tivoli Identity Manager Server.. Windows NT Agent.. IBM. Windows NT Agent., Windows NT Agent Windows,. Copyright IBM Corp

14 1 : Tivoli Identity Manager Windows NT Agent IBM. IBM. Windows NT Agent. Windows NT Agent C:\Tivoli\Agents\NTAgent. 1 :. 2 : Windows NT Agent. 6 2 :. 3 : DAML Tivoli Identity Manager Server. 6 3 :. 4 :. Tivoli Identity Manager Server DAML. 6 4 :. 5 : Tivoli Identity Manager Server. 6 5 :. 6 : Windows NT Agent :. 7 : Tivoli Identity Manager Server. 8 7 :. 1 : Windows NT Agent.. 4 IBM Tivoli Identity Manager: Windows NT Agent

15 Tivoli Identity Manager Windows NT Agent IBM. IBM.. 1. IBM Windows NT Agent zip. 2. Windows NT Agent zip Setup.exe. : C:\Temp\Setup.exe ,

16 : Windows NT Agent Windows NT.. Windows NT Agent Windows NT Agent. 3 : Windows NT Agent DAML Tivoli Identity Manager Server.. DAML. 14. : DAML : DAML. CA(Certificate Authority) CA. Windows NT Agent Tivoli Identity Manager Server CA. Tivoli Identity Manager Server Configuration Guide. : DAML.. 5 : Tivoli Identity Manager Server,. Tivoli Identity Manager Server IBM Tivoli Identity Manager: Windows NT Agent

17 :,. Tivoli Identity Manager.. Tivoli Identity Manager. 6 : DAML.. :. Tivoli Identity Manager Server. Tivoli Identity Manager Server DAML. 3. SRV_NODENAME. 4. Tivoli Identity Manager Server IP Enter.. 5. SRV_PORTNUMBER. 6. Tivoli Identity Manager Server Enter.. 7. SRV_USERNAME. 8. Tivoli Identity Manager Server Enter.. 9. SRV_PASSWORD. 10. Tivoli Identity Manager Server Enter.. 2 7

18 7 : Tivoli Identity Manager Server. Tivoli Identity Manager Policy and Organization Administration Guide. 8 IBM Tivoli Identity Manager: Windows NT Agent

19 3 Tivoli Identity Manager Server. Windows NT Agent Tivoli Identity Manager Server. Tivoli Identity Manager Server Windows NT Agent... : 1. Tivoli Identity Manager Server,.. 2., Tivoli Identity Manager Server. 3. WebLogic Application Server.,. 4. WebSphere Application Server, Network Deployment Manager.. Tivoli Identity Manager Server Windows NT Agent,. Windows NT Agent. 2. Tivoli Identity Manager Server. Windows NT Agent Tivoli Identity Manager Server root. Copyright IBM Corp

20 1. root Tivoli Identity Manager Server. 2. IBM Windows NT Agent zip zip. : IBM. 3.. v UNIX Tivoli Identity Manager Server :. #cd/tmp, tmp. Windows NT Agent. #./nt40profile_<operating system>.bin, <operating system> aix, solaris hpxxxx.. v Windows Tivoli Identity Manager Server :..., nt40profile.exe.,. C:\temp\nt40profile.exe. 4.. Tivoli Identity Manager. 5. Tivoli Identity Manager Server..... Tivoli Identity Manager Server. : Tivoli Identity Manager Server, ITIM. 10 IBM Tivoli Identity Manager: Windows NT Agent

21 , remote_resources.,. Windows: C:\itim\data\remote_resources\nt40profile\ UNIX: /itim/data/remote_resources/nt40profile/ 3 11

22 12 IBM Tivoli Identity Manager: Windows NT Agent

23 4 agentcfg Windows NT Agent.. Windows NT Agent agentcfg. 1.,. DOS. 2. bin. Windows NT Agent,. cd \Tivoli\Agents\NTAgent\bin 3. agentcfg -agent NTAgent. Enter configuration key for Agent NTAgent : agentcfg. -hostname Windows NT Agent NTAgent Agent Main Configuration Menu A. Configuration Settings. B. Protocol Configuration. C. Event Notification D. Change Configuration Key. E. Activity Logging. F. Registry Settings. G. Advanced Settings. H. Statistics X. Done Select menu option:. Copyright IBM Corp

24 v A, v B, v C, 18 v D, 22 v E, 22 v F, 24 v G, 26 v H, 27 Windows NT Agent. 1. A(Configuration Settings). Windows NT Agent. Windows NT Agent. Configuration Settings Name : NTAgent Version : ADK Version : 4.27 ERM Version : 4.27 enrole Version : 4.0 License : NONE Asynchronous ADD Requests : TRUE (Max.Threads:3) Asynchronous MOD Requests : TRUE (Max.Threads:3) Asynchronous DEL Requests : TRUE (Max.Threads:3) Asynchronous SEA Requests : TRUE (Max.Threads:3) Available Protocols : DAML, FTP Configured Protocols : DAML Logging Enabled : TRUE Logging Directory : C:\Tivoli\Agents\NTAgent\Log Log File Name : NTAgent.log Max. log files : 3 Max.log file size (Mbytes) : 1 Debug Logging Enabled : TRUE Detail Logging Enabled : FALSE Press any key to continue 2.. DAML FTP Tivoli Identity Manager Server. DAML. DAML. FTP. 14 IBM Tivoli Identity Manager: Windows NT Agent

25 Windows NT Agent.. 1. B(Protocol Configuration)... DAML Windows NT Agent. Agent Protocol Configuration Menu Available Protocols: DAML, FTP Configured Protocols: DAML A. Add Protocol. B. Remove Protocol. C. Configure Protocol. X. Done Select menu option 2.. v A, v B, v C, 16 X. 1. A(Add Protocol).., B(Remove Protocol)..,

26 1. C(Configure Protocol) :. DAML. DAML Protocol Properties A. PORTNUMBER ;Protocol Server port number. B. USERNAME ****** ;Authorized user name. C. PASSWORD ****** ;Authorized user password. D. SRV_NODENAME ;Event Notif. Server name. E. SRV_PORTNUMBER 443 ;Event Notif. Server port number. F. SRV_USERNAME ****** ;Event Notif. user name. G. SRV_PASSWORD ****** ;Event Notif. Server password. H. VALIDATE_CLIENT_CE FALSE ;Require client certificate. X. Done Select menu option: 3.. DAML. 3. DAML A(PORTNUMBER). Modify Property PORTNUMBER :. : 7004 B(USERNAME) Tivoli Identity Manager Server.. Modify Property USERNAME :. : admin C(PASSWORD) Tivoli Identity Manager Server.. Modify Property PASSWORD :. : ******* Tivoli Identity Manager Server. 16 IBM Tivoli Identity Manager: Windows NT Agent

27 3. DAML () D(SRV_NODENAME). Modify Property SRV_NODENAME :. : E(SRV_PORTNUMBER) Tivoli Identity Manager Server IP DNS.. Modify Property SRV_PORTNUMBER : Tivoli Identity Manager Server. : 7004 F(SRV_USERNAME) Tivoli Identity Manager Server.. Modify Property SRV_USERNAME :. : admin G(SRV_PASSWORD) Tivoli Identity Manager Server.. Modify Property SRV_PASSWORD :. : ***** H(VALIDATE_CLIENT_CE) Tivoli Identity Manager Server.. Modify Property VALIDATE_CLIENT_CE : Tivoli Identity Manager Server. Tivoli Identity Manager Server. : CertTool D - H. 4. Enter.. : Enter. 4 17

28 Tivoli Identity Manager Server. Tivoli Identity Manager Server Tivoli Identity Manager Server. :.. 1. C(Event Notification).. Event Notification Menu * Reconciliation interval : 1 day(s) * Next Reconciliation time : 23 hour(s) 56 min(s). 23 sec(s). * Configured Contexts : Jupiter, dd309 A. Enabled B. Time interval between reconciliations. C. Set Processing cache size. (currently: 50 Mbytes) D. Start event notification now. E. Set attributes to be reconciled. F. Reconciliation process priority. (current: 1) G. Add Event Notification Context. H. Modify Event Notification Context. I. Remove Event Notification Context. J. List Event Notification Contexts. X. Done Select menu option: 2.. : A. 4. A, Tivoli Identity Manager Server.. v,. B(Time interval between reconciliations) v,.. Enter new interval ([ww:dd:hh:mm:ss]) [00:01:00:00:00]:. Enter. 18 IBM Tivoli Identity Manager: Windows NT Agent

29 4. () C(Set processing cache. size) Enter new cache size[5]:. Enter. D(Start event notification. now) E(Set attributes to be reconciled) F(Reconciliation process priority) Enter new thread priority [1-10]:. G(Add Event Notification Context) H(Modify Event Notification Context) I(Remove Event Notification Context) Enter.. Context name : Enter Delete context context1? [no]: J(List Event Notification Contexts) Enter, Enter.. Context Name : Context1 Target DN : erservicename=context1,o=ibm, ou=ibm,dc=com --- Attributes for search request --- {search attributes listed} B, C, E F Enter.. :. 4 19

30 . ( : ). 1. E(Set attributes to be reconciled).. Event Notification Entry Types A. USER B. GROUP X. Done Select menu option: 2. A B.. :. Event Notification Attribute Listing (a) ** (b) ** (c) ** (d) ** (e) ** (f) ** (g) ** (h) ** (i) ** (j) ** (k) ** (l) ** (m) ** (o) ** (q) ** (r) ** (s) ** (t) ** (p)rev page 1 of 3 (n)ext X. Done Select menu option: H(Modify Event Notification Context).. Modify Context Menu A. Context1 B. Context2 C. Context3 X. Done Select menu option: IBM Tivoli Identity Manager: Windows NT Agent

31 . A. Set attributes for search B. Target DN: C. Delete Baseline Database X. Done Select menu option: A. B DN. C A(Set attributes for search).. Reconciliation Attributes Passed to Agent for Context: Context A. Add new attribute B. Modify attribute value C. Remove attribute X. Done Select menu option: 2... DN 1. B(Target DN).. Enter Target DN: 2. DN Enter. DN. erservicename=nameofservice,o=organizationname,ou=tenantname,dc=com DN. erservicename o 4 21

32 ou (tenant).,. dc=com DN.. C(Delete Baseline Database).. Windows NT Agent.. 1. D(Change Configuration Key). 2. Enter. Enter new configuration key for Agent NTAgent : Enter.. :.. Configuration key successfully changed.. Windows NT Agent., Tivoli Identity Manager NTAgent.log. 1. E(Activity Logging). 22 IBM Tivoli Identity Manager: Windows NT Agent

33 .. Agent Activity Logging Menu A. Activity Logging (Enabled). B. Logging Directory (current: C:\Tivoli\Agents\NTAgent\Log). C. Activity Log File Name (current: NTAgent.log). D. Activity Logging Max. File Size ( 1 mbytes) E. Activity Logging Max. Files ( 3) F. Debug Logging (Enabled). G. Detail Logging (Disabled). H. Base Logging (Disabled). X. Done Select menu option: 2.. : A(Activity Logging). 5. A(Activity Logging), Tivoli Identity Manager.. v,. B(Logging Directory) v,.. : C:\Log,. Enter. C(Activity Log File Name).,. D(Activity Logging Max File Size) Enter. ( : 10).. MB.. E(Activity Logging Max Files) Enter. ( : 100). : 5.. Enter. 4 23

34 5. () F(Debug Logging),.. v,. G(Detail Logging) v,.,. :.,.. v,. H(Base Logging) v,., ADK.. v,. v,. 3. B, C, D E Enter.. :. Windows NT Agent. 1. F(Registry Settings).. NTAgent Agent Registry Menu A. Modify Non-encrypted registry settings. B. Modify encrypted registry settings. C. Multi-instance settings. X. Done Select menu option: 2.. :. 24 IBM Tivoli Identity Manager: Windows NT Agent

35 1. A(Modifying Non-encrypted Registry Settings).. Agent Registry Items ENROLE_Version ExecTimeout ManageHomeDirs TRUE 04. ReconBufferSize ReconHomeDirSecurity FALSE 06. ReconLastLogon FALSE 07. ReconLastLogonAllowErrors FALSE 08. WtsEnable FALSE Page1of1 A. Add new attribute B. Modify attribute value C. Remove attribute X. Done Select menu option: 2.. v A) Add new attribute v B) Modify attribute value v C) Remove attribute v X) Done 3. Enter. 4. A B Enter... :. 1. C(Multi-instance Settings). Windows NT Agent. NTAgent Agent Instance Class Menu A. Select instance class. X. Done

36 3. Enter. Windows NT Agent. Windows NT Agent. v v v v Windows NT Agent. 1. G(Advanced Settings)... NTAgent Advanced Settings Menu A. Single Thread Agent (current:true) B. ADD max. thread count. (current:3) C. MODIFY max. thread count. (current:3) D. DELETE max. thread count. (current:3) E. SEARCH max. thread count. (current:3) F. Allow User EXEC procedures (current:false) G. Archive Request Packets (current:false) H. UTF8 Conversion support (current:true) I. Pass search filter to agent (current:false) J. Thread Priority Level (1-10) (current:4) X. Done Select menu option: 2.. : UTF8 Conversion support FALSE. 6. DAML A(Single Thread Agent) B(ADD max. thread count) C(MODIFY max. thread count) D(DELETE max. thread count) E(SEARCH max. thread count) F(Allow User EXEC procedures)..... pre- post-exec IBM Tivoli Identity Manager: Windows NT Agent

37 6. DAML () G(Archive Request Packets). FTP.. H(UTF8 Conversion support). I(Pass search filter to agent). J(Thread Priority Level (1-10)) Enter.. Windows NT Agent. 1. H(Statistics).. NTAgent Agent Request Statistics Date Add Mod Del Ssp Res Rec /15/ X. Done 2. X. agentcfg. 1. Windows NT Agent bin. v X. v agentcfg -help. 4 27

38 . -version ; -hostname < value> ; -findall ; -list ; -agent <value> ; -tail ; -schema ; -portnumber <value>; -netsearch <value> ; -confidencetest ; -setup ; -help ; Show version Target nodename to connect to (Default:Local host IP address) Find all agents on target node List available agents on target node Name of agent Display agent s activity log Display agent s attribute schema Specified agent s TCP/IP port number Lookup agents hosted on specified subnet Confidence test Confidence test setup Display this help screen. 7. -version -hostname <value> agentcfg. -hostname. v -findall v v v -list -tail -agent -findall -list -agent <value> -tail -schema -portnumber <value> -netsearch <value> -confidencetest IP.. -list. -hostname.. Windows NT Agent. -hostname... -hostname. -tail. -agent. -hostname. -agent. TCP/IP -agent. -agent.,,,. Tivoli Identity Manager Server. 28 IBM Tivoli Identity Manager: Windows NT Agent

39 7. () -setup -help. agentcfg. 3. agentcfg. agentcfg. 8. -argument -argument <value> -argument <value> -argument -argument -argument <value> -argument <value> -argument <value> : agentcfg -list IP. Tivoli Identity Manager Server Agent(s) installed on node NTAgent (44970) : agentcfg -agent NTAgent Windows NT Agent agentcfg. : agentcfg -list -hostname IP Windows NT Agent Agent(s) installed on node NTAgent (44970) : agentcfg -agent NTAgent -hostname IP agentcfg. Windows NT Agent. 4 29

40 30 IBM Tivoli Identity Manager: Windows NT Agent

41 5 (CertTool) Tivoli Identity Manager (digital certificate). Tivoli Identity Manager Server SSL(Secure Sockets Layer)., CA(Certificate Authority) CA.. Tivoli Identity Manager. SSL Tivoli Identity Manager Server IBM Tivoli Identity Manager System Configuration Guide Managing Digital Certificates. :,. SSL Tivoli Identity Manager. Tivoli Identity Manager SSL(Secure Sockets Layer). SSL ID. SSL. ( ) ID.. SSL. v SSL. v SSL ID. v ID. Copyright IBM Corp

42 v CA(Certificate Authority) ( ). CA. v, CA. : SSL Tivoli Identity Manager. - SSL WebSphere WebLogic Application Server Tivoli Identity Manager. Tivoli Identity Manager Server (-). : v Tivoli Identity Manager Server SSL. v RSA SSL-C Open SSL. Tivoli Identity Manager, Tivoli Identity Manager Server CA. : ITIM IBM Tivoli Identity Manager Server SSL 32 IBM Tivoli Identity Manager: Windows NT Agent

43 Tivoli Identity Manager Tivoli Identity Manager Tivoli Identity Manager Server. Tivoli Identity Manager Server CA. CA. Windows NT Agent CertTool. 1.,. Microsoft Windows DOS. 2. bin. Windows NT Agent,. cd \Tivoli\Agents\NTAgent\bin 3. CertTool -agent NTAgent.. Main menu - Configuring agent: NTAgent A. Generate private key and certificate request B. Install certificate from file C. Install certificate and key from PKCS12 file D. View current installed certificate E. List CA certificates F. Install a CA certificate G. Delete a CA certificate H. List registered certificates I. Register certificate J. Unregister a certificate X. Quit Choice: : CSR(Certificate Signing Request).. A CA(Certificate Authority) CSR(Certificate Signing Request). 5 33

44 B C D. CA A CSR. PKCS12. A B, PKCS12.. SSL : ( ). : SSL Tivoli Identity Manager. CA. CA Tivoli Identity Manager Tivoli Identity Manager Server. E F G CA. CA Tivoli Identity Manager Server. CA CA. CA X.509, 2 PEM. CA. SSL : ( ). : SSL Tivoli Identity Manager. Tivoli Identity Manager Server. SSL Tivoli Identity Manager Server. CA Tivoli Identity Manager Server, Tivoli Identity Manager Server. H. 34 IBM Tivoli Identity Manager: Windows NT Agent

45 I J. Base 64 X.509. ().. v A, v B, 37 v C, 37 PKCS12 v D, 37 v E, 38 CA v F, 38 CA v G, 38 CA v H, 39 v I, 39 v J, 39 X. Windows NT Agent. 1. A(Generate a private key and certificate request). Enter values for certificate request (press enter to skip value) Enter. Organization: 3. Enter. Organizational Unit: 4. Enter. Agent Name: 5. Enter Enter. Country: 7. ( ) Enter. 5 35

46 State: : CA(Certificate Authority) Enter. Locality: 9. Y N Enter. Accept these values (y/n)?. 10. PEM Enter. Enter name of file to store PEM cert request (Enter to cancel): 11. Enter.. CA.. Enter values for certificate request (press enter to skip value) Organization: ibm Organizational Unit: engineering Agent Name: ntagent admin@ibm.com Country: US State: California Locality: Irvine Accept these values (y/n)? y Generating key pair and certificate request... Enter name of file to store PEM cert request (Enter to cancel) : request.pem Certificate request written to request.pem. Press Enter to continue. request.pem -----BEGIN CERTIFICATE REQUEST----- MIIB1jCCAT8CAQAwgZUxEjAQBgNVBAoTCWFjY2VzczM2MDEUMBIGA1UECxMLZW5n aw5lzxjpbmcxedaobgnvbamtb250ywdlbnqxjdaibgkqhkig9w0bcqewfw50ywdl bnraywnjzxnzmzywlmnvbtelmakga1uebhmcvvmxezarbgnvbagtcknhbglmb3ju awexdzanbgnvbactbklydmluztcbnzanbgkqhkig9w0baqefaaobjqawgykcgyea mr6acpnwf6hllc72bmukawaxcebtxcocnnth9uc8vumhpbimagjuc4s91hprilg7 UtlbOfy6X3R3kbeR8apRR9uLYrPIvQ1b4NK0whsytij6syCySaFQIB6V7RPBatFr 6XQ9hpsARdkGytZmGTgGTJ1hSS/jA6mbxpgmttz9HPECAwEAAaAAMA0GCSqGSIb3 DQEBAgUAA4GBADxA1cDkvXhgZntHkwT9tCTqUNV9sim8N/U15HgMRh177jVaHJqb N1Er46vQSsOOOk4z2i/XwOmFkNNTXRVl9TLZZ/D+9mGZcDobcO+lbAKlePwyufxK Xqdpu3d433H7xfJJSNYLYBFkrQJesITqKft0Q45gIjywIrbctVUCepL END CERTIFICATE REQUEST IBM Tivoli Identity Manager: Windows NT Agent

47 . CA(Certificate Authority). :, ( ) bin. 1. B(Install certificate from file).. Enter name of certificate file: 2. Enter.. PKCS12 PKCS12(.pfx).. : bin. : C:\Tivoli\Agents\<agentname>\bin 1. C(Install certificate and key from PKCS12 file). 2. PKCS12 Enter. Enter name of PKCS12 file: : DamlSrvr.pfx 3. Enter. Enter password:. D(View currently installed certificates). D(View currently installed certificates). 5 37

48 .. The following certificate is currently installed. Subject: c=us,st=california,l=irvine,o=daml,cn=daml Server CA CA. E(List CA certificates). CA.. Subject: o=ibm,ou=samplecacert,cn=testca Valid To: Wed Jul 26 23:59: CA CA. 1. F(Install a CA certificate).. Enter name of certificate file: 2. Enter.. e=admin@ibm.com,c=us,st=california,l=irvine,o=ibm,ou=engineering,cn=eng Install the CA? (Y/N) 3. Y Enter. CA CACerts.pem. CA CA. 1. G(Delete a CA certificate). CA. 0 - e=admin@ibm.com,c=us,st=california,l=irvine,o=ibm,ou=engineering,cn=eng 1 - e=support@ibm.com,c=us,st=california,l=irvine,o=ibm,ou=support,cn=support Enter number of CA certificate to remove: 2. CA Enter. CA CACerts.pem. 38 IBM Tivoli Identity Manager: Windows NT Agent

49 .. H(List registered certificates) e=admin@ibm.com,c=us,st=california,l=irvine,o=ibm,ou=engineering,cn=eng 1 - e=support@ibm.com,c=us,st=california,l=irvine,o=ibm,ou=support,cn=support. 1. I(Register certificate).. Enter name of certificate file: 2. Enter.. e=admin@ibm.com,c=us,st=california,l=irvine,o=ibm,ou=engineering,cn=eng Register this CA? (Y/N) 3. Y Enter J(Unregister a certificate) e=admin@ibm.com,c=us,st=california,l=irvine,o=ibm,ou=engineering,cn=eng 1 - e=support@ibm.com,c=us,st=california,l=irvine,o=ibm,ou=support,cn=support 2. Enter.. 3. Y Enter

50 40 IBM Tivoli Identity Manager: Windows NT Agent

51 A. Windows NT Agent Tivoli Identity Manager. Tivoli Identity Manager Tivoli Identity Manager Server. 9. Tivoli Identity Manager Server Windows NT Agent. Tivoli Identity Manager Server Windows NT Agent. Windows NT Agent.. Directory Server DOMAIN_SERVERNAME erntdomainservername : DOMAIN_SERVERNAME Windows NT. \\<machine name> erntlocalname erntlocalname - erntglobalname erntglobalname - GROUP erntglobalgroups NT GroupId erntglobalgroupid ID GroupComment erntgroupcomment - GroupName erntgroupname - GroupType erntgrouptype Windows NT 4.0 (0 =, 1= ) HomeDirNtfsAccess ernthomedirntfsaccess NTFS.. HomeDirRemove ernthomedirremove, UserHomeDir UNC LOCALGROUP erntlocalgroups Windows NT. ( ) PRIMARYGROUP erntprimarygroupid ID RASEXEC ersystemcall User erntaccount Copyright IBM Corp

52 9. () Directory Server UserAccountDuplicate erntaccountduplicate. UserAccountInterDomain erntaccountinterdomain. UserAccountNormal erntaccountnormal. UserAccountServer erntaccountserver BDC. UserAccountWorkstation erntaccountworkstation. UserAcctExpires erntexpirationdate / UserAuthAccounts erntaccountauthaccounts. UserAuthComm erntaccountauthcomm. UserAuthPrint erntaccountauthprint. UserAuthServer erntaccountauthserver. UserBadPWCount erntuserbadpwcount UserCallback erntcallback.. v (0,1, 2) v v UserCallBackNumber erntcallbacknumber UserCantChangePassword erntcantchangepassword. UserPasswordExpired. UserCodePage erntcodepage UserCountryCode erntusercountrycode UserComment description UserFullName cn UserGrantDialin erntgrantdialin. UserHomeDir ernthomedir UserHomeDirDrive ernthomedirdrive UNC. UNC. UserHomeDirRequired ernthomedirrequired UserLastLogoff erntlastlogoff UserLastLogon erntlastaccessdate 42 IBM Tivoli Identity Manager: Windows NT Agent

53 9. () Directory Server UserLockedOut erntlockedout.. UserLogonHours erlogontimes. 00: *. 168 UserLogonServer erntuserlogonserver UserMaxStorage erntmaxstorage UserName eruid UserNumLogons ernumlogons UserPassword erpassword UserPasswordAge erntpasswordage ( ) UserPasswordExpired erntpasswordexpired., UserCantChangePassword. UserPasswordNeverExpires erntpasswordneverexpires. UserPasswordNotRequired erntpasswordnotrequired. UserProfile erntprofile UserScriptPath erntscriptpath UserStatus eraccountstatus. UserUsrComments erntusrcomment UserWorkstations erntworkstations WtsAllowLogon erntwtsallowlogon WtsBrokenTimeout erntwtsbrokentimeout WtsCallbackNumber erntwtscallbacknumber Citrix ICA :, WtsCallbackSettings erntwtscallbacksettings Citrix ICA : WtsClientDefaultPrinter erwtsclientdefaultprinters WtsClientDrives erntwtsclientdrives Citrix ICA : A. 43

54 9. () Directory Server WtsClientPrinter erntwtsclientprinter RDP 5.0 Citrix ICA : WtsHomeDir erntwtshomedir,. UNC (\\machine\share\path). WtsHomeDirDrive erntwtshomedirdrive WtsHomeDir UNC, WtsHomeDirNTFSAccess erntwtshomedirntfsaccess WtsInheritInitialProg erntwtsinheritinitialprogram., WtsInitialProgram.. WtsInitialProgram erntwtsinitialprogram,. WtsInheritInitialProgram 1,. WtsProfilePath erntwtsprofilepath, ( ) 44 IBM Tivoli Identity Manager: Windows NT Agent

55 9. () Directory Server WtsReconnectSettings erntwtsreconnectsettings. 1..,. 2..,. WtsRemoteHomeDir erntwtsremotehomedir.. WtsServerName erntwtsservername Windows WtsShadowSettings erntwtsshadowsettings RDP 5.0 Citrix ICA : , 2-, 3-, 4-, WtsTimeoutConnections erntwtstimeoutconnections ( ). 1. WtsBrokenTimeout.. 0. A. 45

56 9. () Directory Server WtsTimeoutDisconnections erntwtstimeoutdisconnections ( ). 0. WtsTimeoutIdle erntwtstimeoutidle ( )., WtsBrokenTimeout. 0. WtsWorkingDir erntwtsworkingdir, Windows NT Agent Windows NT Agent. Windows NT Agent LoginID. 11. Active Directory IBM Tivoli Identity Manager: Windows NT Agent

57 Tivoli Identity Manager.. (*). 15. ExpirationDate HomeDirRemove PasswordNeverExpires CantChangePassword LogonServer Description Comment CountryCode DontExpirePassword AccountDuplicate CodePage FaxNumber AccountServer Callback FullName UsrComments HomeDirectory HomeDirectoryDrive HomeDirNtfsAccess CallbackNumber PasswordNotRequired AccountNormal AccountWorkstation IsAccountLocked AccountInterDomain AuthAccounts LastAccessDate LastLogoff* AuthComm LoginTimes LoginScript AuthPrin AuthServer MaxStorage NumLogons PasswordAge BadPWCount Profile HomeDirRequired UserName UserAccountDisabled systemcall Password DOMAIN_SERVERNAME WtsAllowLogon WtsBrokenTimeout WtsCallbackNumber WtsCallbackSettings WtsClientDefaultPrinter WtsClientDrives WtsClientPrinters A. 47

58 15. () WtsHomeDir WtsHomeDirDrive WtsHomeDirNtfsAccess GroupType GroupComment WtsInheritInitialProg WtsInitialProgram WtsProfilePath WtsReconnectSettings WtsRemoteHomeDir WtsServerName WtsShadowSettings WtsTimeoutConnections WtsTimeoutDisconnections WtsTimeoutIdle WtsWorkingDir GroupComment LocalName GlobalName UserStatus 48 IBM Tivoli Identity Manager: Windows NT Agent

59 B..,.... setupconsole.exe. setupconsole.exe Java setup.exe... <agent or profile install>.exe -is:javaconsole -console GUI. Telnet.. -is:javaconsole -console GUI. <agent or profile install>.exe -options-record <filename>. <agent or profile install>.exe -options-template <filename>.. Copyright IBM Corp

60 <agent or profile install>.exe -options-silent <filename>. Windows NT Agent.., Windows NT Agent. Windows NT Agent. 1. Windows NT Agent. 2. Windows uninstaller.exe Windows NT Agent. 4.. Windows NT Agent. 5.. : Windows NT Agent,. Windows NT Agent. 50 IBM Tivoli Identity Manager: Windows NT Agent

61 C.. IBM,. IBM. IBM, IBM,. IBM,,. IBM,. IBM ,.. : (DBCS) IBM. IBM World Trade Asia Corporation Licensing 2-31 Roppongi 3-chome, Minato-ku Tokyo , Japan. IBM, (, ).,..,. IBM / /. Copyright IBM Corp

62 IBM,. IBM. IBM. (1) ( ) (2) ,.. (, ). IBM IBM, IBM (IPLA)....,.. IBM,. IBM, IBM,. IBM. IBM Corporation. AIX DB2 IBM 52 IBM Tivoli Identity Manager: Windows NT Agent

63 IBM SecureWay Tivoli Tivoli Universal Database WebSphere Lotus IBM Corporation / Lotus Development Corporation. Domino IBM Corporation Lotus Development Corporation. Microsoft, Windows, Windows NT Windows Microsoft Corporation. Java Java Sun Microsystems, Inc.. UNIX Open Group.,. C. 53

64 54 IBM Tivoli Identity Manager: Windows NT Agent

65 3 14 agentcfg 13 agentcfg 14 13, agentcfg 22 vii i agentcfg / , 25, agentcfg 23 /, agentcfg 23, agentcfg 24 / / 23 / , 23 () 27, agentcfg 22, 23 / 16 vii vi, Windows NT Agent , 9, 26 vi 3, 9 3 3, agentcfg / 23 Copyright IBM Corp

66 agentcfg , Windows NT Agent agentcfg 3 / () () DN agentcfg 18, CertTool request.pem CertTool CA CertTool IBM Tivoli Identity Manager: Windows NT Agent

67 agentcfg 16 agentcfg 16 agentcfg 15 agentcfg A agentcfg , 27 agentcfg -agent 28 -confidencetest 28 -findall 28 -help 28 -hostname 28 -list 28 -netsearch 28 -portnumber 28 -schema 28 -setup 28 -tail 28 -version 28 -help 27 C CertTool, , CA D DAML 16, agentcfg password 16 srv_nodename 17 srv_password 17 srv_portnumber 17 srv_username 17 username 16 validate_client_ce 17 P password agentcfg 16 portnumber

68 S srv_nodename, agentcfg 17 srv_password, agentcfg 17 srv_portnumber, agentcfg 17 srv_username, agentcfg 17 T Tivoli Identity Manager 33 U username, agentcfg 16 UTF8 26 V validate_client_ce, agentcfg IBM Tivoli Identity Manager: Windows NT Agent

69

70 Printed in Denmark by IBM Danmark A/S SA