Tivoli Directory Integrator : un produit complémentaire aux environnements Lotus

Transcription

1 Session S40 Tivoli Directory Integrator : un produit complémentaire aux environnements Lotus Christian Châteauvieux Tivoli Security Consultant Christian.chateauvieux@fr.ibm.com 13

2 Simplify... Portal App Server eprovisioning Security Content Management ERP TSRM TSRM NOS Legacy App Legacy App PBX ebusiness Directory 2 2

3 Simplify... TDI and Solve AssemblyLine Portal App Server eprovisioning Security Content Management ERP TSRM TSRM NOS ebusiness Directory Legacy App Legacy App PBX 3 3

4 Central Tivoli Directory Integrator (TDI) concepts AssemblyLine (AL) The unit of work in TDI. All data movement/massaging is done by ALs. Activates any number of components, one-by-one, in sequence from top-down For example, Script components with JavaScript code that is executed, s where the selected Mode logic is carried out (like Update or Lookup), Branches and Loops used to articulate flow logic in the AL May implement multiple Operations, like SyncDBfromSource does (add, modify & delete) TDI Components provides a connection to some external data source may require a Parser (like FileSystem or MemoryStream) behaves according to its Mode setting, eg. AddOnly, Iterator, Lookup, Delete & Update offers Input & Output Map (Mode dependant) Script contains JavaScript code to execute Function (FC) perform some function, like calling a web service or sending offers Output Map (call parameters) & Input Map (return values) AttMap Attribute map from work to work (conn not involved) Branch, Switch, Loop flow control components 4 4

5 Kernel/Component architecture Kernel accelerates development through: automated data pipeline behaviors integrated scripting framework solution deployment features & tools: - log-files, tracing - error handling - security - management interface/api... Components create a level playing field by abstracting away the details of: transports APIs protocols data/file formats 5 5

6 TDI architecture TDI server Execution run-time environment Logging & tracing Files XML, CSV LDIF, DMSL Integrated development environment Web administration and monitoring Action Manager: Automatic monitor, control, and alternate action API Event service JavaScript Engine ACT event processing Functions & libraries Pooling, threads & tombstones AssemblyLine Delta detection Persistence service: SystemStore SystemQueue LDAP Web Services HTTP, TCP CCMDB, CEI POP, IMAP JDBC JMS / MQ Script, Java SAP, Siebel Peoplesoft GLA, RAC Domino SNMP, JMX Commandline interface Java VM Windows, Linux, AIX, iseries, zos, Sun, HP 6 6

7 Rapid Integration Development Isolate a single data flow. Identify data access method (API, protocol, transport, format...) Click suitable components together (Quickly & easily create new ones as needed) Component Library JDBC SQL Database XML File XML FileSystem AssemblyLine A collection of components that form a continuous path from source(s) to target(s) is called an AssemblyLine 7 7

8 Data Pipeline AssemblyLine Fixed flow logic for driving components in the specified order User-defined flow logic through component ordering Components All components have a fixed flow logic, except Scripts and AttMaps flow determined by Mode setting Error/Exception Flows Connection Failure (& Auto-Reconnect feature) Exceptional situations (e.g. Lookup finds none or multiple entries) Error Handling User-defined (JavaScript) DataFlow Diagrams: 8 8

9 AssemblyLine Flow The built-in pipeline drives the Assemblyline, allowing default behavior to be augmented or even overridden wherever needed by scripting in Hooks. The AssemblyLine visualizes custom data flows in the graphical development UI. Each component is configurable and is controlled by additional pipeline models 9 9

10 The component pipelines specific to the role of each component, and just like the AL flow are also configurable and can either be enhanced or overridden by scripting Hooks. Component Flow The comprehensive list of Flow diagrams are found here:

11 TDI Entry-Attribute-value data model Similar to how LDAP directories represent data: entries attributes values Two main Entry objects: 1.Work Entry (work) 2. Entry (conn) Entry object Attribute_1 value_a value_b Attribute_2 value_c.. Attribute_n 11 11

12 Input Maps moves data from conn to work. AssemblyLine cycling The work Entry is passed down the AssemblyLine, sharing data between components Each Interface has a conn Entry used to cache reads and writes Output Maps move data from work to conn

13 Read DB, Join from LDAP, Write to File XML SQL Database LDAP Directory XML Document 13 13

14 Read DB, Join from LDAP, Write to File XML SQL Database XML Document 14 14

15 Step1. Read DB, Write to File XML Document JDBC FileSystem w/ XML Parser SQL database 15 15

16 Step 2. Add Join from LDAP XML Document JDBC LDAP FileSystem w/ XML Parser SQL database LDAP directory 16 16

17 Inside an AssemblyLine The kernel/component architecture is visible in every AL component. The generic part of a component, called the AL component, provides kernel functionality like Attribute Maps, Link Criteria, Hooks, etc. The data source-specific part of a component is called the component Interface, and these are interchangeable 17 17

18 Inside an AssemblyLine Entry objects are used to store and transport the data (Java bucket ). The Work Entry is the AL s storage and transport object and can be manipulated directly through the script variable work Each caches its data locally in its own Entry, accessible through the conn variable 18 18

19 Inside an AssemblyLine When the AL starts, it fires up all components, performing any custom initialization logic

20 Inside an AssemblyLine The first component (Iterator ) reads a row from the SQL database

21 Inside an AssemblyLine Selected attributes are mapped into the flow, moving from the local conn bucket to the work entry (Input Map)

22 Inside an AssemblyLine The work entry moves to the next component (Lookup LDAP ) which reads data from the connected directory

23 Inside an AssemblyLine More attributes are mapped from the local conn cache to the work entry (Input Map)

24 Inside an AssemblyLine Now the work entry is passed to the last component (AddOnly File ) and selected attributes are mapped out (Output Map)

25 Inside an AssemblyLine Finally, the output operation is performed. The work entry is passed back to the first component, emptied and the cycle repeats

26 Axis Easy Web Service IBM Server Corporation Axis Easy Web Service Invoke Axis Java-to-Soap Invoke Soap Web Service Axis Soap-to-Java Complex Types Generator Wrap Soap LDAP LDAP Server Tivoli Access Manager Windows Users and Groups TDI Server Active Correlation Technology Generic Log Adapter RAC Entry to CommonBaseEvent Function JMX SNMP SNMP Server TCP TCP Server Remedy/Peregrine /CCMDB tickets CCMDB Netcool Active Directory Changelog v2 IBM Directory Server Changelog Netscape/iPlanet Changelog zos LDAP Changelog BTree JDBC Properties SystemStore RDBMS Changelog AssemblyLine Many Custom Components downloadable from OPAL or tdi-users.org or on request PeopleSoft Siebel SAP ALE IDoc SAP R/3 Business Object Repository SAP R/3 User Registry SAP R/3 RFC Functional Component RSS 26 AssemblyLine Server Notifications AssemblyLine Function Component Domino Change Detection Domino Users Lotus Notes Exchange Changelog Mailbox Send Function Component TIM DSMLv2 DSMLv2 SOAP DSML v2 SOAP Server Generic JNDI ITIM Agent EMF SDOToXML Function Component EMF XMLToSDO Function Component Timer 26 1 er et 2 octobre 2007 Script Generic Java Method Parser FC Scripted Function Component Remote Command Line Function Component z/os TSO/E Command Line Function Component Command Line Memory Queue FC MemQ Memory Stream File System FTP Client URL HTTP Client HTTP Server IBM MQ Series JMS Pub/Sub MQe Password Store System Queue 2008 IBM Corporation CSV Parser DSML v1 Parser DSML v2 Parser Fixed Record Parser HTTP Parser LDIF Parser Line Reader/Writer SOAP Parser Script Parser Simple Parser XML Parser XML Sax Parser XSL based XML Parser

27 Extract, <do something>, Load TDI Read data and changes from source Custom filtering, mapping, transformation, enrichment, including calling your own Java libraries. Optionally adding in extra lookup connectors to add correlated data TDI has the capability to detect changes in the source data each time it reads from it. For example, an HR report might not contain information about changes, only the entire snapshot of the entire employee database. TDI is able to determine the change from previous versions and only propagate added, changed and deleted records 27 27

28 Directory/Datastore Synchronization TDI Applications Sync adds/mods/deletes to Domino Applications AD change connector Domino Users connector Microsoft Active Directory Sync change to mail address back to AD Lotus Domino LDAP connector Domino change connector In this scenario, users are managed in AD and need to be synchronized with Domino 1.All data is pushed into Domino when new Users are added in AD. 2. is owned by Domino, so changes in AD will not overwrite the Internet Address in Domino. 3.Changes to the internet mail address in Domino are sync ed to AD. 4.Any of the above logic can be easily and quickly modified and extended. As Seen on YouTube 28 28

29 Adapter framework for ITIM (Tivoli Identity Manager) TDI Adapter AssemblyLines The field and customers are enabled by being able to modify the adapters in the field TIM services TIM manages life cycle of users in the enterprise IT systems TIM operations handler TDI logic and connectors TDI logic and connectors TDI logic and connectors Target system Target system Target system 29 29

30 IBM Service Desk integrated with monitoring TDI AssemblyLine Create ticket ISM applications NetCool Omnibus EIF connector MRO connector TSRM CCMDB TEC Custom integration configuration and scripting for both directions AssemblyLine Incident closed When ticket is closed EIF EIF connector MRO connector CEI / ESB Events (EIF) are augmented with relevant data and produces a ticket in TSRM. When tickets are closed, a corresponding EIF message is sent back that closes the incident 30 30

31 3rd Party Help Desk integrated with CCMDB TDI AssemblyLine Monitor HelpDesk CCMDB connector CCMDB ITSM components Remedy, Peregrine, custom AssemblyLine Update HelpDesk CEI connector ESB CEI Logging Remedy incidents are transferred to CCMDB. As the ITSM components complete steps of the appropriate process, messages are sent to CEI. TDI subscribes to these messages and update Remedy accordingly so that users can follow the progress of their tickets

32 EAI authentication service for TAM TDI AssemblyLine EAI server Access Manager WebSeal EAI connector any connector TAM LDAP Policy API Optional looping logic LDAP connector Optional TAM API code TDI provides a generic authentication server for TAM, where the AssemblyLine can lookup multiple sources, as well as format and transform data. The AssemblyLine above does not illustrate any specific scenario, but illustrates who the integration with the TAM EAI (External Authentication Interface) service works

33 Websphere RFID Information Center (EPCIS) TDI WS RFID IC AssemblyLine RFID Feed IBM MQ MQ connector Customer specific configuration EPCIS connector EPCIS AssemblyLine Exception handler Custom data handlers EPCIS connector Logging RFID data is delivered through MQ, and needs to be filtered, validated and possibly transformed before loaded into EPCIS. The solution allows field personell to insert customer specific data handlers and exception handlers

34 Lotus Connections TDI Identity Management AssemblyLines Connections Identity Store Profiles Database Initial deployment and provisioning Ongoing synchronization 34 34

35 IBM Mashup Center (Lotus Mashups) TDI REST request for RSS/Atom AssemblyLine service Controller HTTP connector Custom AssemblyLines JDBC connector RDBMS Java connector Access any Java API AssemblyLine service Controller Transient AssemblyLines Widget builder REST based service to build complete calls into the Service Controller JDBC connector LDAP connector SAP connector MQ connector 35 35

36 TCIM (Insight) - Audit integration TDI Customer ad-hoc OMP custom any connector Audit and compliance Windows Security Log or any other logs (140+) supported by GLA CARS GLA connector CARS connector CBE connector CBE parser Optional Customer and product specific configuration, including other TDI connectors to augment and transform data W7 connector WEF connector (Future) TCIM Tivoli Compliance Insight Manager CBE file Suggested approach for tactical and long-term integration of CBEs, CARS, W7 and insight for IBM products, ISV s and customer developed applications. Benefit of flexible and simple adjustments and customization in the field 36 36

37 TDI is part of several IBM product offerings TSRM (IBM Service Desk) IBM CCMDB (Change Configuration & Management DB) Lotus Connections IBM Mashup Center (incl. Lotus Mashup) WebSphere RFID Information Center Tivoli Identity Manager Tivoli Access Manager for ebusiness Lotus Domino 8 Tivoli Directory Server Federated Identity Manager

38 Data Synchronization Two distinct activites: Discovering changes in one system Applying these changes to one or more targets. Delta 38 38

39 Change Detection s LDIF Parser (specifically, incremental LDIF) Delta Engine Delta Detection TDI provides three mechanisms for Delta Detection: 39 39

40 Change Detection s (CDCs) TDS Changelog Netscape/iPlanet Changelog MS Active Directory Changelog Domino Change Detection RDBMS Changelog Exchange Changelog (NT4 support) Password Sync plugins for Active Directory, TDS, Sun/iPlanet, Domino HTTP, UNIX/Linux and Z/OS (mainframe) 40 40

41 Delta Engine (Iterator mode) If enabled, the Delta Engine maintains a Delta store (in the System Store) for keeping track of each entry read during AL execution. FileSystem Delta Store HR Dump 41 41

42 Delta Engine (first run) The Delta Store is a checklist over entries that are read during an AL run. FileSystem On the first run, the Delta Store is built from scratch and in-sync with source data. Peter Paul Mary Delta Store Peter Paul Mary HR Dump 42 42

43 Delta Engine (subsequent runs) On subsequent runs, the Iterator marks each Delta entry as it is found in the Delta Store. FileSystem Data that has changed (added or modified) is passed to the AL. Roger Peter Paula Mary Delta Store Roger Peter Paula add modify HR Dump 43 43

44 Delta Engine (subsequent runs) When iteration is complete, integrator then looks through the Delta store to see if any entries were not found. These are passed to the AL tagged as delete. FileSystem Roger Peter Paula Mary Delta Store delete Roger Peter Paula HR Dump 44 44

45 Synchronization AL logic Change Detection If delete No Yes Delete Mode Update Mode 45 45

46 Bi-directional AD - Domino Sync Applications TDI Sync adds/mods/deletes to Domino Applications AD change connector Domino Users connector Active Directory Sync change to mail address back to AD Lotus Domino LDAP connector Domino change connector In this scenario, users are managed in AD and need to be synchronized with Domino 1.All data is pushed into Domino when new Users are added in AD. 2. is owned by Domino, so changes in AD will not overwrite the Internet Address in Domino. 3.Changes to the internet mail address in Domino are sync ed to AD. 4.Any of the above logic can be easily and quickly modified and extended

47 TDI Resources (pass these one to colleagues, partners and users) Forums External: news://news.software.ibm.com/ibm.software.network.directory-integrator IBM Internal: news://forums.ibm.com/forums.software.directory Online docs, including the Getting Started Guide TDI community assets HowTo s guides, like these on data synchronization features and error handling: TDI Flow Diagrams: Video Tutorials External link for partners and customers IBM internal