Oracle Identity Manager

Transcription

1 Oracle Identity Manager Connector Guide for IBM AS/400 Advanced Release E July 2014

2 Oracle Identity Manager Connector Guide for IBM AS/400 Advanced, Release E Copyright 2013, 2014 Oracle and/or its affiliates. All rights reserved. Primary Author: Gowri.G.R Contributing Author: Prakash Hulikere, Gauhar Khan, Deena Purushothaman This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing. If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate failsafe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.

3 Contents Preface... ix Audience... Documentation Accessibility... Related Documents... Documentation Updates... Conventions... ix ix ix ix x What's New in the Oracle Identity Manager Connector for IBM AS/400?... xi Software Updates... Documentation-Specific Updates... xi xv 1 About the Connector 1.1 Certified Components Usage Recommendation Certified Languages Connector Architecture Connector Components Connector Operations Full Reconciliation Process Incremental Reconciliation Process Incremental (Real-Time) Reconciliation Process Provisioning Process Features of the Connector Target Resource and Trusted Source Reconciliation Full and Incremental Reconciliation Encrypted Communication Between the Target System and Oracle Identity Manager High Availability Feature of the Connector Connector Objects Used During Reconciliation and Provisioning Supported Functions for Target Resource and Trusted Source Reconciliation Supported Functions for Provisioning User Attributes for Target Resource Reconciliation and Provisioning User Attributes for Trusted Source Reconciliation Reconciliation Rule Reconciliation Action Rules iii

4 2 Connector Deployment on Oracle Identity Manager 2.1 Files and Directories that Comprise the Connector Determining the Release Number of the Connector Before Running the Connector Installer Running the Connector Installer Configuring the IT Resource Configuring Oracle Identity Manager Clearing Content Related to Connector Resource Bundles from the Server Cache Enabling Logging Copying the log4j JAR File Configuring Trusted Source Reconciliation Configuring Oracle Identity Manager for Request-Based Provisioning Copying Predefined Request Datasets Importing Request Datasets into the MDS Enabling the Auto Save Form Feature Running the PurgeCache Utility Installing and Configuring the LDAP Gateway Connector Deployment on the iseries 3.1 Deploying the Reconciliation Agent Installing the Exits for the Reconciliation Agent Configuring the Message Transport Layer Using the Connector 4.1 Configuring Reconciliation Configuring Account Status Reconciliation Guidelines on Using the Connector Performing Provisioning Operations Direct Provisioning Request-Based Provisioning End User's Role in Request-Based Provisioning Approver's Role in Request-Based Provisioning Switching Between Request-Based Provisioning and Direct Provisioning on Oracle Identity Manager Release Extending the Functionality of the Connector 5.1 Adding New Attributes for Target Resource Reconciliation Adding New Attributes for Provisioning Removing Attributes Mapped for Target Resource Reconciliation and Provisioning Using the Additional Reconciliation Scheduled Tasks Configuring the Connector for Multiple Installations of the Target System Configuring One LDAP Gateway for Each Installation of the Target System Configuring the LDAP Gateway to Work with Multiple Installations of the Target System 5-7 iv

5 6 Troubleshooting 7 Known Issues Index v

6 vi

7 List of Figures 1 1 Incremental (Real-Time) Reconciliation Process Provisioning Process vii

8 List of Tables 1 1 Certified Components Supported Provisioning Functions User Attributes for Target Resource Reconciliation and Provisioning User Attributes for Trusted Source Reconciliation Reconciliation Action Rules Files and Directories That Comprise the Connector IT Resource Parameters LDAP Gateway Properties in the as400.properties File Attributes of the User Target Recon Scheduled Task Scheduled Task Scheduled Tasks and Properties Troubleshooting viii

9 Preface This guide describes the connector that is used to integrate Oracle Identity Manager with IBM AS/400. Audience This guide is intended for resource administrators and target system integration teams. Documentation Accessibility For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at Access to Oracle Support Oracle customers have access to electronic support through My Oracle Support. For information, visit or visit if you are hearing impaired. Related Documents For information about installing and using Oracle Identity Manager, see the Oracle Identity Manager documentation library. For generic information about connectors, see Oracle Fusion Middleware User's Guide for Oracle Identity Manager. The following Oracle Technology Network page provides links to Oracle Identity Manager documentation: Documentation Updates Oracle is committed to delivering the best and most recent information available. For information about updates to the Oracle Identity Manager Connectors documentation, visit Oracle Technology Network at ix

10 ml Conventions The following text conventions are used in this document: Convention boldface italic monospace Meaning Boldface type indicates graphical user interface elements associated with an action, or terms defined in text or the glossary. Italic type indicates book titles, emphasis, or placeholder variables for which you supply particular values. Monospace type indicates commands within a paragraph, URLs, code in examples, text that appears on the screen, or text that you enter. x

11 What's New in the Oracle Identity Manager Connector for IBM AS/400? This chapter provides an overview of the updates made to the software and documentation for the Oracle Identity Manager Connector for IBM AS/400 in release The updates discussed in this chapter are divided into the following categories: Software Updates This section describes updates made to the connector software. This section also points out the sections of this guide that have been changed in response to each software update. Documentation-Specific Updates This section describes major changes made to this guide. These changes are not related to software updates. Software Updates The following sections discuss software updates: Updates in Releases Through Software Updates in Release Software Updates in Release Software Updates in Release Software Updates in Release Software Updates in Release Updates in Releases Through The following are software updates in releases through : IBM AS/400 user profile commands supported by the Provisioning Agent have been added in "Supported Functions for Provisioning" on page 1-8. The list of functions supported by the Provisioning Agent has been updated in "Supported Functions for Provisioning" on page 1-8. The commands supported by the Reconciliation Agent have been updated in "Supported Functions for Target Resource and Trusted Source Reconciliation" on page 1-8. xi

12 The list of functions supported by the Reconciliation Agent has been updated in "Supported Functions for Target Resource and Trusted Source Reconciliation" on page 1-8. The list of fields reconciled between Oracle Identity Manager and IBM AS/400 has been updated in "User Attributes for Target Resource Reconciliation and Provisioning" on page 1-9. The IT resource parameters and their corresponding descriptions and sample values have been updated in "Importing the Connector XML File" on page 2-6. The procedure to configure the connector for multiple installations of the target system has been added in "Configuring the Connector for Multiple Installations of the Target System" on page 5-6. Information about reconciliation based on user status has been added in "Configuring Account Status Reconciliation" on page 4-4. Known issues related to the following bugs have been added in Chapter 7, "Known Issues": Bug Bug Software Updates in Release The following are the software updates in release : Support for Configuring a Single LDAP Gateway to Work with Multiple Installations of the Target System Support for Reconciliation Through a Scheduled Task Support for Configuring a Single LDAP Gateway to Work with Multiple Installations of the Target System In the earlier release, one installation of the LDAP Gateway worked with one target system installation. If you had multiple target system installations, you had to install multiple LDAP Gateways. From this release onward, you can configure a single LDAP Gateway to work with multiple target system installations. See Section 5.5.1, "Configuring One LDAP Gateway for Each Installation of the Target System" for more information. This item was tracked by Bug Support for Reconciliation Through a Scheduled Task The User Target Recon Scheduled Task scheduled task has been introduced in this release. You can configure this scheduled task to schedule reconciliation with the target system. See Section 4.1, "Configuring Reconciliation" for information about using this scheduled task. In addition, the Last Modified Time Stamp parameter has been added in the IT resource definition. See Section 2.5, "Configuring the IT Resource" for information about this parameter. This item was tracked by Bug Software Updates in Release The following are the software updates in release : Support for New Oracle Identity Manager Release Support for Request-Based Provisioning xii

13 Resolved Issues in Release Support for New Oracle Identity Manager Release From this release onward, the connector can be installed and used on Oracle Identity Manager 11g release 1 (11.1.1). Where applicable, instructions specific to this Oracle Identity Manager release have been added in the guide. See Section 1.1, "Certified Components" for the full list of certified Oracle Identity Manager releases. Support for Request-Based Provisioning From this release onward, the connector provides support for request-based provisioning on Oracle Identity Manager 11g release 1 (11.1.1). See Section 4.4.2, "Request-Based Provisioning" for more information. Resolved Issues in Release The following table lists issues resolved in release : Bug Number Issue Resolution At the end of a successful Delete User provisioning operation, the connector showed the status R (that is, Rejected) instead of C (Completed). This issue has been resolved. The connector now shows status C at the end of a successful Delete User provisioning operation and Initial reconciliation did not work correctly The connector could not be used to manage more than one supplemental group The password of the target system user account used for connector operations could be viewed in plaintext in the LDAP Gateway Under certain conditions, a Delete User provisioning operation resulted in the creation of a Delete User reconciliation event The connector did not support some standard IBM AS/400 attributes During trusted source reconciliation, when an OIM User is created for a user that is in the Disabled state on the target system, the OIM User is not in the Disabled state. This issue has been resolved. Initial reconciliation now works as expected. This issue has been resolved. The connector can now be used to manage multiple supplemental groups. This issue has been resolved. The password is not stored in the LDAP Gateway. This issue has been resolved. A Delete User provisioning operation does not cause the creation of a Delete User reconciliation event. This issue has been resolved. All standard IBM AS/400 attributes are now supported. In addition, you can add new attributes for reconciliation and provisioning. Section 5.1, "Adding New Attributes for Target Resource Reconciliation" describes the procedure. This issue has been resolved. When an OIM User is created for a user that is in the Disabled state on the target system, the OIM User is also in the Disabled state. Software Updates in Release The following is the software update in release : From this release onward, reconciliation using external.jar files is no longer supported. Instead, both initial and real-time reconciliation are performed by running the scheduled task. See Section 4.1, "Configuring Reconciliation" for detailed instructions. xiii

14 Software Updates in Release The following are the software updates in release : Support for ignoreevent() During Reconciliation Support for SSL Configuration in LDAP Gateway Support for new IT Resource Parameters and LDAP Gateway Properties Support for ignoreevent() During Reconciliation From this release onwards, the connector supports the Oracle Identity Manager reconciliation API feature ignoreevent(). The LDAP Gateway will now confirm whether a reconciliation event should be ignored prior to creating the event in Oracle Identity Manager. Both real-time reconciliation and full reconciliation utilize this feature. See Section , "Full Reconciliation Process," and Section , "Incremental (Real-Time) Reconciliation Process," for more details. Support for SSL Configuration in LDAP Gateway From this release onwards, SSL configuration in LDAP Gateway has been supported. See Section 2.9, "Installing and Configuring the LDAP Gateway," for more information. Support for new IT Resource Parameters and LDAP Gateway Properties From this release onwards, the connector supports new IT resource parameters and LDAP gateway properties. See Table 2 2 and Table 2 3 for more details. Resolved Issues in Release The following table lists issues resolved in release Bug Number Issue Resolution The Oracle Identity Manager 11G cannot connect to LDAPGATEWAY provided by OS400 connector AS 400 connector feature cannot run a CPYUSRPR command on the target system. This issue has been resolved. The Oracle Identity Manager 11G can now successfully connect to the LDAPGATEWAY. This issue has been resolved. The CPYUSRPR command on the target system can be run and can configure the LDAP and OIM adapters. Software Updates in Release The following are the software updates in release : Additional Features for Scheduled Task- User Reconciliation Support for Scheduled Task- Single Connection User Reconciliation Support for Scheduled Task- Delete User Reconciliation Using LDAP Support for Scheduled Task- Delete User Reconciliation Using Oracle Identity Manager Additional Features for Scheduled Task- User Reconciliation From this release onward, the user reconciliation scheduled task supports the "LDAP Time Zone" property. This property can be used to specify the local time zone of the LDAP server machine in cases where Oracle Identity Manager and the LDAP gateway are hosted on separate servers in separate time zones. See Section 4.1, "Configuring Reconciliation," and Section 5.4, "Using the Additional Reconciliation Scheduled Tasks" for more details. xiv

15 Support for Scheduled Task- Single Connection User Reconciliation From this release onward, the connector supports an additional scheduled task for user profile reconciliation. This task creates a single connection to the target system and retrieves both user IDs and the user's profile attributes. Each user is stored in the internal LDAP store, if needed, and then those users are reconciled to Oracle Identity Manager. See Section 5.4, "Using the Additional Reconciliation Scheduled Tasks" for more details. Support for Scheduled Task- Delete User Reconciliation Using LDAP From this release onward, the connector supports an additional scheduled task for reconciling deleted users on the target system. This task retrieves a list of users from the target system and compares that list with a list of users from the internal LDAP store. If a user is found to exist within the internal LDAP store, but not on the target system, then the internal LDAP store is updated and a delete reconciliation event for the user is sent to Oracle Identity Manager. See Section 5.4, "Using the Additional Reconciliation Scheduled Tasks" for more details. Support for Scheduled Task- Delete User Reconciliation Using Oracle Identity Manager From this release onward, the connector supports an additional scheduled task for reconciling deleted users on the target system. This task retrieves a list of users from the target system and compares that list with a list of users from Oracle Identity Manager. If a user is found to exist within Oracle Identity Manager, but not on the target system, then a delete reconciliation event for the user is sent to Oracle Identity Manager. See Section 5.4, "Using the Additional Reconciliation Scheduled Tasks" for more details. Resolved Issues in Release The following table lists issues resolved in release Bug Number Issue Resolution Reconciliation failing due to special characters (such as #) in UID Connector updates the date on IT Resource are not time zone transparent User profile attribute USEDATE is not made available for reconciliation on the gateway. This issue has been resolved. The LDAP gateway now supports UIDs that begin with special characters. This issue has been resolved. All scheduled tasks now include an "LDAP Time Zone" property that specifies the local time zone of the LDAP gateway server. This issue has been resolved. The USEDATE property is now supported. Documentation-Specific Updates The following sections discuss documentation-specific updates: Documentation-Specific Updates in Releases Through Documentation-Specific Updates in Release Documentation-Specific Updates in Release Documentation-Specific Updates in Release Documentation-Specific Updates in Release xv

16 Documentation-Specific Updates in Release Documentation-Specific Updates in Releases Through The following are software updates in releases through : The "Certified Components" section on page 1-2 has been updated with specific IBM AS/400 versions that can be used to deploy the Oracle Identity Manager IBM AS/400 Advanced connector. The user profile field mappings between Oracle Identity Manager and the target system have been added in "User Attributes for Target Resource Reconciliation and Provisioning" on page 1-9. "Appendix A: Attribute Mapping Between Oracle Identity Manager and IBM i5/as" has been removed. The components of the IBM AS/400 Advanced connector and the connector architecture for reconciliation and provisioning have been added in "Connector Architecture" on page 1-3. "Appendix B: Connector Architecture" has been removed. Guidelines that were earlier documented in Chapter 7, "Known Issues" have been moved to "Guidelines on Using the Connector" on page 4-4. In "Certified Languages" on page 1-2, Arabic has been added to the list of languages that the connector supports. In "Certified Components" on page 1-2, changes have been made in the "Target System" row. Information about certified deployment configurations has been removed from "Certified Components" on page 1-2. In "Certified Components" on page 1-2, the minimum Oracle Identity Manager release has been changed to and the JDK requirement of release 1.5 or later has been added. Documentation-Specific Updates in Release There are no documentation-specific updates in this release. Documentation-Specific Updates in Release There are no documentation-specific updates in this release. Documentation-Specific Updates in Release There are no documentation-specific updates in this release. Documentation-Specific Updates in Release The following are the documentation-specific updates in release : Table 2 1 has been updated for file or directory on the installation media. A new Section 2.3, "Before Running the Connector Installer" has been added. Table 4 1 has been updated for new attributes. Documentation-Specific Updates in Release The following are the documentation-specific updates in revision "10" of release : Table 4 1 has been updated for new attributes. Table 2 3 has been updated for new properties. xvi

17 A new Section 5.4, "Using the Additional Reconciliation Scheduled Tasks" has been added on reconciliation scheduled tasks. The following are the documentation-specific updates in revision "11" of release : The "Oracle Identity Manager" row of Section 1.1, "Certified Components" has been modified. Section 1.2, "Usage Recommendation" has been added. xvii

18 xviii

19 1 1 About the Connector Oracle Identity Manager automates access rights management, security, and provisioning of IT resources. Oracle Identity Manager connectors are used to integrate Oracle Identity Manager with external, identity-aware applications. This guide discusses the connector that enables you to use IBM AS/400 either as a managed (target) resource or as an authoritative (trusted) source of identity data for Oracle Identity Manager. The advanced connector for IBM AS/400 provides a native interface between IBM AS/400 and Oracle Identity Manager. The connector functions as a trusted virtual administrator on the target system, performing tasks related to creating and managing user profiles. In the account management (target resource) mode of the connector, information about users created or modified directly on the target system is reconciled into Oracle Identity Manager. In addition, you can use Oracle Identity Manager to perform provisioning operations on the target system. In the identity reconciliation (trusted source) configuration of the connector, users are created or modified only on the target system and information about these users is reconciled into Oracle Identity Manager. In the IBM AS/400 context, the term "user profile" is synonymous with "user account." If IBM AS/400 is configured as a target resource, then user profiles on IBM AS/400 correspond to accounts or resources assigned to OIM Users. In contrast, if IBM AS/400 is configured as a trusted source, then user profiles on IBM AS/400 correspond to OIM Users. Note: In earlier releases, IBM AS/400 was known as IBM AS/400 or IBM i5/as. Because the connector development project started before the change in nomenclature was formally announced by IBM, the IBM AS/400 connector code, scripts, and nomenclature applied in the connector pack may contain instances of IBM AS/400 or IBM i5/as. These instances are not documentation errors in this guide. This chapter is divided into the following sections: Section 1.1, "Certified Components" Section 1.2, "Usage Recommendation" Section 1.3, "Certified Languages" Section 1.4, "Connector Architecture" Section 1.5, "Features of the Connector" About the Connector 1-1

20 Certified Components Section 1.6, "Connector Objects Used During Reconciliation and Provisioning" 1.1 Certified Components Table 1 1 Item Table 1 1 lists the certified components. Certified Components 1.2 Usage Recommendation Depending on the Oracle Identity Manager version that you are using, you must deploy and use one of the following connectors: 1.3 Certified Languages If you are using an Oracle Identity Manager release that is or later and earlier than Oracle Identity Manager 11g Release 1 ( ), then use the x version of this connector. If you are using Oracle Identity Manager 11g Release 1 ( ) or later, then use the latest x version of this connector. The connector supports the following languages: Arabic Chinese (Simplified) Chinese (Traditional) Requirement Oracle Identity Manager Oracle Identity Manager Release and any later BP in this release track Note: In this guide, Oracle Identity Manager release x has been used to denote Oracle Identity Manager release and future releases in the x series that the connector supports. JDK Target System Infrastructure Requirements: Message transport layer between the Oracle Identity Manager and the mainframe environment Target system user account for Oracle Identity Manager Oracle Identity Manager 11g Release 1 ( ) and any later BP in this release track Note: In this guide, Oracle Identity Manager release has been used to denote Oracle Identity Manager 11g release and future releases in the x series that the connector supports. Oracle Identity Manager 11g Release 1 PS1 ( ) and any later BP in this release track The JDK version can be one of the following: For Oracle Identity Manager release x, use JDK 1.5 or later. For Oracle Identity Manager release , use JDK 1.6 update 18 or later. IBM i5/as and AS/400 releases V5R2, V5R3, V5R4, V6R1 JTOpen versions and 5.2 (open source or commercially supported version) IBM AS/400-authorized account with SystemAdministrators privileges Section 2.9, "Installing and Configuring the LDAP Gateway" describes the procedure to specify the credentials of this user. 1-2 Oracle Identity Manager Connector Guide for IBM AS/400 Advanced

21 Connector Architecture Danish English French German Italian Japanese Korean Portuguese (Brazilian) Spanish 1.4 Connector Architecture The connector architecture is described in the following sections: Section 1.4.1, "Connector Components" Section 1.4.2, "Connector Operations" Connector Components See Also: On Oracle Identity Manager release x, see Oracle Identity Manager Globalization Guide. On Oracle Identity Manager release , see Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager. The connector contains the following components: LDAP Gateway: The LDAP Gateway receives instructions from Oracle Identity Manager in the same way as any LDAP version 3 identity store. These LDAP commands are then converted into native commands for IBM AS/400 and sent to the Provisioning Agent. The response, which is also native to IBM AS/400, is parsed into an LDAP-format response and returned to Oracle Identity Manager. JTOpen Provisioning Agent: The connector provides the provisioning functionality through the JTOpen Provisioning Agent. The Provisioning Agent receives IBM AS/400 identity and authorization change events from the LDAP Gateway. These events are processed against the IBM AS/400 authentication repository, in which all provisioning updates from the LDAP Gateway are stored. The response is parsed and returned to the LDAP Gateway. Message Transport Layer: The message transport layer enables the exchange of messages between the LDAP Gateway and the Provisioning Agent. JTOpen is used as the messaging protocol for the message transport layer. About the Connector 1-3

22 Connector Architecture See Also: Connector Operations JTOpen Web site at the following URL for information about the JTOpen project: IBM Toolbox for Java documentation at the following URL for information about the JTOpen functionality: lbox/overview.html This section provides an overview of the following connector processes: Section , "Full Reconciliation Process" Section , "Incremental Reconciliation Process" Section , "Incremental (Real-Time) Reconciliation Process" Section , "Provisioning Process" Full Reconciliation Process Full reconciliation involves fetching existing user profile data from the mainframe to Oracle Identity Manager. If you configure the target system as a target resource, then the user profile data is converted into accounts or resources for OIM Users. If you configure the target system as a trusted source, then the user profile data is used to create OIM Users. The following is a summary of the full reconciliation process: Note: Detailed instructions are provided later in this guide. 1. You specify the full reconciliation configuration in the AS400 User Reconciliation scheduled task (located in the Oracle Identity Manager 9.x Design console). 2. In the scheduled task form, you enter a list of user IDs of the user profiles that you want to reconcile. If no users are specified, then all existing users on the target system will be reconciled. 3. You specify whether you want to configure IBM AS/400 as a target resource or trusted source of Oracle Identity Manager. 4. You set a start time for the task and run the scheduled task. The task sends the list of user IDs to the LDAP Gateway. 5. The LDAP Gateway encrypts the list of user IDs and then sends it to the Provisioning Agent on the mainframe. The user ID and status of each user profile is stored in an internal meta-store, and a flag is set for the user profile in the meta-store. 6. The Provisioning Agent encrypts user profile data for the specified user IDs and then passes this data to the LDAP Gateway. 7. The LDAP Gateway decrypts the user profile data and passes it to Oracle Identity Manager. 8. The next step depends on the setting in the scheduled task: 1-4 Oracle Identity Manager Connector Guide for IBM AS/400 Advanced

23 Connector Architecture If you configure the target system as a target resource, then the user profile data is converted into accounts or resources assigned for OIM Users. If you configure the target system as a trusted source, then the user profile data is used to create OIM Users Incremental Reconciliation Process The following is a summary of the incremental reconciliation process: 1. IBM AS/400 identity and authorization events take place in the target system. After each event, the modified time stamp on the changed profile is updated. Note: Identity and authorization events in the IBM AS/400 system include the running of a command, real-time password synchronization, creation or deletion of a user, or a change in user data. 2. You specify a date/time timestamp in the OIM As400 IT Resource. The AS400 User Reconciliation scheduled task, using the LDAP Gateway, sends scheduled requests to the Provisioning Agent to search the target system for events made after the specified timestamp. 3. The Provisioning Agent encrypts user profile data for the events and then passes this data to the LDAP Gateway. 4. The LDAP Gateway decrypts the user profile data and passes it to Oracle Identity Manager. 5. The next step depends on the setting in the scheduled task: If you configure the target system as a target resource, then the user profile data is converted into accounts or resources assigned for OIM Users. If you configure the target system as a trusted source, then the user profile data is used to create OIM Users Incremental (Real-Time) Reconciliation Process Real-time reconciliation is initiated by the EXIT(s) that work in conjunction with the Reconciliation Agent. See Figure 1 1. About the Connector 1-5

24 Connector Architecture Figure 1 1 Incremental (Real-Time) Reconciliation Process 1. IBM AS/400 identity and authorization events take place in the target system. After each event the EXIT will populate an encrypted file on the OS that contains all changed events. Note: Identity and authorization events in the IBM AS/400 system include the running of a command, real-time password synchronization, creation or deletion of a user, or a change in user data. 2. To retrieve these events you run the newas400 Reconcile All Changed Users scheduled task. This process will read the file and store the contents of event changes in an internally configured directory in the LDAP (based on the domainou configuration). After the contents have been stored in the Internal LDAP the Task will query the internal store based on the Last Mod Timestamp in the OIM As400 IT Resource and reconcile any changes during that time to OIM. 3. The next step depends on the setting in the scheduled task: If you configure the target system as a target resource, then the user profile data is converted into accounts or resources assigned for OIM Users. If you configure the target system as a trusted source, then the user profile data is used to create OIM Users. 1-6 Oracle Identity Manager Connector Guide for IBM AS/400 Advanced

25 Features of the Connector Provisioning Process Figure 1 2 shows the flow of data during provisioning. Figure 1 2 Provisioning Process The following is a summary of the provisioning process: 1. Provisioning data submitted from the Administrative and User Console is sent to the LDAP Gateway. 2. The LDAP Gateway translates the provisioning data to IBM AS/400 commands. 3. The data is encrypted and then sent to the JTOpen Provisioning Agent, which also functions as the message transport layer. 4. The connector also updates the internal meta-store of the LDAP Gateway with the changes in user data. 5. JTOpen decrypts the data, sends the data to the IBM AS/400 repository, and returns a success or error message to the LDAP Gateway. 1.5 Features of the Connector This section discusses the following topics: Section 1.5.1, "Target Resource and Trusted Source Reconciliation" Section 1.5.2, "Full and Incremental Reconciliation" Section 1.5.3, "Encrypted Communication Between the Target System and Oracle Identity Manager" Section 1.5.4, "High Availability Feature of the Connector" Target Resource and Trusted Source Reconciliation You can use the connector to configure IBM AS/400 as either a target resource or trusted source of Oracle Identity Manager Full and Incremental Reconciliation After you deploy the connector, you can perform full reconciliation to bring all existing user profile data from the target system to Oracle Identity Manager. About the Connector 1-7

26 Connector Objects Used During Reconciliation and Provisioning Additionally, change-based or incremental reconciliation is available. Both forms of reconciliation are configured using the scheduled reconciliation task. Section 4.1, "Configuring Reconciliation" describes the procedure. You can perform a full reconciliation run at any time Encrypted Communication Between the Target System and Oracle Identity Manager AES-128 encryption is used to encrypt data that is exchanged between the LDAP Gateway and the Provisioning Agent on the mainframe High Availability Feature of the Connector If you have multiple installations of the target system, then you can configure one LDAP Gateway to work with each installation of the target system. Alternatively, you can configure a single LDAP Gateway installation to work with multiple installations of the target system. Section 5.5, "Configuring the Connector for Multiple Installations of the Target System" describes the procedure. 1.6 Connector Objects Used During Reconciliation and Provisioning The following sections provide information about connector objects used during reconciliation and provisioning: Section 1.6.1, "Supported Functions for Target Resource and Trusted Source Reconciliation" Section 1.6.2, "Supported Functions for Provisioning" Section 1.6.3, "User Attributes for Target Resource Reconciliation and Provisioning" Section 1.6.4, "User Attributes for Trusted Source Reconciliation" Section 1.6.5, "Reconciliation Rule" Section 1.6.6, "Reconciliation Action Rules" Supported Functions for Target Resource and Trusted Source Reconciliation The connector supports reconciliation of user data from the following events: Create user Modify user Delete user Password change Disable user Enable user Supported Functions for Provisioning Table 1 2 lists the provisioning functions supported by the connector. 1-8 Oracle Identity Manager Connector Guide for IBM AS/400 Advanced

27 Connector Objects Used During Reconciliation and Provisioning Table 1 2 Supported Provisioning Functions Function Description Mainframe Command Create users Adds new users on IBM AS/400 CRTUSRPRF Modify users Modifies user data on IBM AS/400 CHGUSRPRF Delete users Removes users from IBM AS/400 DLTUSRPRF Change passwords Reset passwords Changes user passwords on IBM AS/400 in response to password changes made on Oracle Identity Manager through user self-service Resets user passwords on IBM AS/400 The passwords are reset by the administrator. CHGUSRPRF CHGUSRPRF Revoking user accounts Sets IBM AS/400 users to a REVOKED state CHGUSRPRF Resuming user accounts Sets IBM AS/400 users to an ENABLED state CHGUSRPRF User Attributes for Target Resource Reconciliation and Provisioning Table 1 3 lists attribute mappings between IBM AS/400 and Oracle Identity Manager for target resource reconciliation and provisioning. Note: You can add new attributes for target resource reconciliation. Section 5.1, "Adding New Attributes for Target Resource Reconciliation" describes the procedure. Table 1 3 User Attributes for Target Resource Reconciliation and Provisioning Oracle Identity Manager Field IBM AS/400 Field Description uid USER User login ID cn NAME User full name sn NAME User last name userpassword PASSWORD Password used to login owner OWNER Owner of the user profile status STATUS User status (enable, disable) spcaut SPECAUTH Special access permissions for the user usrcls USRCLS Special access control for the user inlprg INLPRG User initial program text TEXT Free form text field lmtcpb LMTCPB Limit capabilities jobd JOBD Job description supgrpprf SUPGRPPRF Supplemental group inlmnu INLMNU Initial menu grpprf GRPPRF Group profile passwordexpire PWDEXP User password is set to expire About the Connector 1-9

28 Connector Objects Used During Reconciliation and Provisioning User Attributes for Trusted Source Reconciliation Reconciliation Rule Table 1 4 lists attribute mappings between IBM AS/400 and Oracle Identity Manager for trusted source reconciliation. Table 1 4 During target resource reconciliation, Oracle Identity Manager tries to match each user profile fetched from IBM AS/400 with existing IBM AS/400 resources provisioned to OIM Users. This is known as process matching. A reconciliation rule is applied for process matching. If a process match is found, then changes made to the user profile on the target system are copied to the resource on Oracle Identity Manager. If no match is found, then Oracle Identity Manager tries to match the user profile against existing OIM Users. This is known as entity matching. The reconciliation rule is again applied during this process. If an entity match is found, then an IBM AS/400 resource is provisioned to the OIM User. Data for the newly provisioned resource is copied from the user profile. During trusted reconciliation, the same reconciliation rule is applied for entity matching. If an entity match is found, then an OIM User is created out of the data in the reconciliation event. The following is the reconciliation rule for both target resource and trusted source reconciliation: Rule name: AS400AdvReconRule Rule element: User Login Equals uid In this rule element: User Login is the User ID field on the process form and the OIM User form. uid is the USER attribute on IBM AS/400. After you deploy the connector, you can view this reconciliation rule by performing the following steps: 1. On the Design Console, expand Development Tools and then double-click Reconciliation Rules. 2. Search for and open the AS400AdvReconRule rule Reconciliation Action Rules User Attributes for Trusted Source Reconciliation OIM User Field IBM AS/400 Attribute Description cn NAME Full name uid USER Login ID userpassword PASSWORD Password used to log in See Also: Oracle Identity Manager Connector Concepts for generic information about reconciliation matching and action rules Reconciliation action rules specify actions that must be taken depending on whether or not matching IBM AS/400 resources or OIM Users are found when the reconciliation rule is applied. Table 1 5 lists the reconciliation action rules for this connector Oracle Identity Manager Connector Guide for IBM AS/400 Advanced

29 Connector Objects Used During Reconciliation and Provisioning Table 1 5 Reconciliation Action Rules Rule Condition No Matches Found One Entity Match Found One Process Match Found Action Assign to Administrator With Least Load Establish Link Establish Link Note: No action is performed for rule conditions that are not predefined for this connector. You can define your own action rules for such rule conditions. See Oracle Identity Manager Design Console Guide for information about modifying or creating reconciliation action rules. After you deploy the connector, you can view the reconciliation action rules for target resource reconciliation by performing the following steps: 1. On the Design Console, expand Resource Management and double-click Resource Objects. 2. Search for and open the OIMAs400ResourceObject resource object. 3. Click the Object Reconciliation tab, and then click the Reconciliation Action Rules tab. The Reconciliation Action Rules tab displays the action rules defined for this connector. About the Connector 1-11

30 Connector Objects Used During Reconciliation and Provisioning 1-12 Oracle Identity Manager Connector Guide for IBM AS/400 Advanced

31 2 2 Connector Deployment on Oracle Identity Manager The LDAP Gateway acts as the intermediary between Oracle Identity Manager and the connector components on the mainframe. The following sections of this chapter describe the procedure to deploy some components of the connector, including the LDAP Gateway, on the Oracle Identity Manager host computer: Note: The procedure to deploy the mainframe components of the connector is described in the next chapter. Section 2.1, "Files and Directories that Comprise the Connector" Section 2.2, "Determining the Release Number of the Connector" Section 2.3, "Before Running the Connector Installer" Section 2.4, "Running the Connector Installer" Section 2.5, "Configuring the IT Resource" Section 2.6, "Configuring Oracle Identity Manager" Section 2.7, "Configuring Trusted Source Reconciliation" Section 2.8, "Configuring Oracle Identity Manager for Request-Based Provisioning" Section 2.9, "Installing and Configuring the LDAP Gateway" 2.1 Files and Directories that Comprise the Connector Table 2 1 Table 2 1 lists the contents of the connector installation media. Files and Directories That Comprise the Connector File or Directory on the Installation Media configuration/as400adv.xml DataSets/ProvisionResource_OIMAS400Resourc eobject.xml DataSets/ModifyResource_OIMAS400Resource Object.xml etc/ldap Gateway/ldapgateway.zip Description This XML file contains configuration information that is used during connector installation. This XML file specifies the information to be submitted by the requester during a request-based provisioning operation. Section 2.8, "Configuring Oracle Identity Manager for Request-Based Provisioning" provides more information. This ZIP file contains the files required to deploy the LDAP Gateway. Connector Deployment on Oracle Identity Manager 2-1

32 Files and Directories that Comprise the Connector Table 2 1 (Cont.) Files and Directories That Comprise the Connector File or Directory on the Installation Media etc/provisioning and Reconciliation Connector/OIMIDFEX.SAVF lib/as400-adv-provisioning.jar For Oracle Identity Manager release : lib-11g/as400-adv-provisioning.jar Files in the resources directory For Oracle Identity Manager release x: scripts/propertyencrypt.bat scripts/propertyencrypt.sh Description This ZIP file contains the files required to deploy the Reconciliation Agent on the mainframe. Section 3.1, "Deploying the Reconciliation Agent" describes the files bundled in this ZIP file. This JAR file containing the files required for reconciliation and provisioning. During connector installation, this file is copied to the following location: For Oracle Identity Manager release x: OIM_HOME/xellerate/ScheduledTask OIM_HOME/xellerate/JavaTasks For Oracle Identity Manager release : Oracle Identity Manager database Each of these resource bundles contains locale-specific information that is used by the connector. During connector installation, this file is copied to the following location: For Oracle Identity Manager release x: OIM_HOME/xellerate/connectorResources For Oracle Identity Manager release : Oracle Identity Manager database Note: A resource bundle is a file containing localized versions of text strings that are displayed on the Administrative and User Console. These text strings include GUI element labels and messages. You use this script to encrypt passwords that you enter in the as400connection.properties and beans.xml files. Section 2.9, "Installing and Configuring the LDAP Gateway" provides more information. For Oracle Identity Manager release : scripts-11g/propertyencrypt.bat scripts-11g/propertyencrypt. xml/oimas400advconnector.xml xml/as400trustedxellerateuser.xml This XML file contains definitions of the connector components, such as the IT resource and resource object. These objects are created in Oracle Identity Manager when you import the XML file. Copy these XML files into the following directory: OIM_HOME/XLIntegrations/as400/xml/ This XML file contains definitions of the connector components that are used for trusted source reconciliation. Copy these XML files into the following directory: OIM_HOME/XLIntegrations/as400/xml/ 2-2 Oracle Identity Manager Connector Guide for IBM AS/400 Advanced

33 Running the Connector Installer 2.2 Determining the Release Number of the Connector Note: If you are using Oracle Identity Manager release x, then the procedure described in this section is optional. If you are using Oracle Identity Manager release , then skip this section. You might have a deployment of an earlier release of the connector. While deploying the latest release, you might want to know the release number of the earlier release. To determine the release number of the connector that has already been deployed: 1. In a temporary directory, extract the contents of the connector JAR file that is in the OIM_HOME/xellerate/JavaTasks directory. 2. Open the Manifest.mf file in a text editor. The Manifest.mf file is one of the files bundled inside the connector JAR file. In the Manifest.mf file, the release number of the connector is displayed as the value of the Version property. 2.3 Before Running the Connector Installer Prior to running the Connector Installer, you will need to delete the script and lib directories that do not pertain to your Oracle Identity Manager release version. If running Oracle Identity Manager release 9.1.x: Delete the "scripts-11g" directory from the connector package. Delete the "lib-11g" directory from the connector package. If running Oracle Identity Manager release : Delete the "scripts" directory from the connector package. Delete the "lib" directory from the connector package. Rename the "scripts-11g" directory to "scripts". Rename the "lib-11g" directory to "lib". 2.4 Running the Connector Installer To run the Connector Installer: 1. Copy the contents of the connector installation media directory into the following directory: Note: In an Oracle Identity Manager cluster, copy this JAR file to each node of the cluster. For Oracle Identity Manager release x: OIM_HOME/xellerate/ConnectorDefaultDirectory For Oracle Identity Manager release : OIM_HOME/server/ConnectorDefaultDirectory 2. If you are using Oracle Identity Manager release x, then delete the files that are meant for Oracle Identity Manager release Similarly, if you are using Connector Deployment on Oracle Identity Manager 2-3