PeopleTools Adapter User Guide

Transcription

1 IBM Security Identity Manager Version 6.0 PeopleTools Adapter User Guide SC

2

3 IBM Security Identity Manager Version 6.0 PeopleTools Adapter User Guide SC

4 Note Before using this information and the product it supports, read the information in Notices on page 37. Edition notice Note: This edition applies to version 6.0 of IBM Security Identity Manager (product number 5724-C34) and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright IBM Corporation 2009, US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Contents Figures v Tables vii Preface ix About this publication ix Access to publications and terminology..... ix Accessibility x Technical training x Support information x Statement of Good Security Practices x Chapter 1. Overview of the PeopleTools Adapter Features of the adapter Chapter 2. Checklist for configuring IBM Security Identity Manager to run the adapter Chapter 3. PeopleTools Adapter user account management tasks Preparing to use the PeopleTools Adapter User account reconciliation User accounts Attributes for adding user accounts Alternate user ID User supervisor Specification of addresses ID Type specification Permission Role names User account modification User account suspension User account restoration User account deletion Chapter 4. Customizing the PeopleTools account form Modifying the CompIntfc.jar file Attributes in the adapter profile Mapping attributes of Component Interfaces supported by IBM Security Identity Manager Assembly line icons Mapping attributes to the PeopleToolsAddAL assembly line Mapping attributes to the PeopleToolsModifyAL assembly line Mapping attributes to the PeopleToolsSearchAL assembly line Mapping attributes of Component Interfaces not supported by IBM Security Identity Manager Mapping attributes to the PeopleToolsAddAL assembly line Mapping attributes to the PeopleToolsModifyAL assembly line Mapping attributes to the PeopleToolsSearchAL assembly line Chapter 5. Troubleshooting of the PeopleTools Adapter errors Appendix A. PeopleTools Adapter attributes Appendix B. Adapter customization for collection attributes Appendix C. Support information Searching knowledge bases Obtaining a product fix Contacting IBM Support Appendix D. Accessibility features for IBM Security Identity Manager Notices Index Copyright IBM Corp. 2009, 2014 iii

6 iv IBM Security Identity Manager: PeopleTools Adapter User Guide

7 Figures Copyright IBM Corp. 2009, 2014 v

8 vi IBM Security Identity Manager: PeopleTools Adapter User Guide

9 Tables 1. Checklist for configuring IBM Security Identity Manager Required attributes for adding user accounts 6 3. Assembly line icons Specific error messages and recommended actions General error messages, warnings, and corrective actions Attributes on the PeopleTools account form, their corresponding names on the IBM Tivoli Directory Server, and the PeopleSoft server.. 27 Copyright IBM Corp. 2009, 2014 vii

10 viii IBM Security Identity Manager: PeopleTools Adapter User Guide

11 Preface About this publication The PeopleTools Adapter User Guide provides the basic information that you can use to complete PeopleSoft administrative tasks with the IBM Security Identity Manager PeopleTools Adapter. The PeopleTools Adapter enables connectivity between the IBM Security Identity Manager server and a managed resource. IBM Security Identity Manager was previously known as Tivoli Identity Manager. The IBM Security Identity Manager server is the server for your IBM Security Identity Manager product. Access to publications and terminology This section provides: v A list of publications in the IBM Security Identity Manager library. v Links to Online publications. v A link to the IBM Terminology website. IBM Security Identity Manager library For a complete listing of the IBM Security Identity Manager and IBM Security Identity Manager Adapter documentation, see the online library ( Online publications IBM posts product publications when the product is released and when the publications are updated at the following locations: IBM Security Identity Manager library The product documentation site ( knowledgecenter/ssrmwj/welcome) displays the welcome page and navigation for the library. IBM Security Systems Documentation Central IBM Security Systems Documentation Central provides an alphabetical list of all IBM Security Systems product libraries and links to the online documentation for specific versions of each product. IBM Publications Center The IBM Publications Center site ( linkweb/publications/servlet/pbi.wss) offers customized search functions to help you find all the IBM publications you need. IBM Terminology website The IBM Terminology website consolidates terminology for product libraries in one location. You can access the Terminology website at software/globalization/terminology. Copyright IBM Corp. 2009, 2014 ix

12 Accessibility Technical training Support information Accessibility features help users with a physical disability, such as restricted mobility or limited vision, to use software products successfully. With this product, you can use assistive technologies to hear and navigate the interface. You can also use the keyboard instead of the mouse to operate all features of the graphical user interface. For technical training information, see the following IBM Education website at IBM Support provides assistance with code-related problems and routine, short duration installation or usage questions. You can directly access the IBM Software Support site at Appendix C, Support information, on page 31 provides details about: v What information to collect before contacting IBM Support. v The various methods for contacting IBM Support. v How to use IBM Support Assistant. v Instructions and problem-determination resources to isolate and fix the problem yourself. Note: The Community and Support tab on the product information center can provide additional support resources. Statement of Good Security Practices IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access. IBM systems, products and services are designed to be part of a comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM DOES NOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY. x IBM Security Identity Manager: PeopleTools Adapter User Guide

13 Chapter 1. Overview of the PeopleTools Adapter Features of the adapter An adapter is a program that provides an interface between a managed resource and the IBM Security Identity Manager server. Adapters might reside on the managed resource. The IBM Security Identity Manager server manages access to the resource by using the security system. Adapters function as trusted virtual administrators on the target platform. The adapter performs tasks, such as creating login IDs, suspending IDs, and other functions that administrators run manually. The adapter runs as a service, independently of whether you are logged on to IBM Security Identity Manager. The PeopleTools Adapter is an application that provides connectivity between IBM Security Identity Manager and the PeopleSoft server. The adapter runs as a service, independent of whether you are logged on to IBM Security Identity Manager. You can automate the following user account management tasks using the PeopleTools Adapter and IBM Security Identity Manager: v Adding user accounts to the PeopleSoft server v Creating multiple addresses for a user account v Modifying attributes of PeopleSoft user accounts v Changing passwords of PeopleSoft user accounts v Suspending, restoring, and deleting PeopleSoft user accounts v Retrieving user accounts from the PeopleSoft server The PeopleTools Adapter supports multiple functions. v Reconciliation of user accounts and other support data, such as languages, currency code, roles, and permissions from the PeopleSoft server to the directory server of IBM Security Identity Manager. v User account management tasks, such as add, modify (including password change), suspend, restore, and delete to manage accounts on the PeopleSoft server using IBM Security Identity Manager. v Creation of multiple addresses for a user account. v Customization of the PeopleTools account form. Copyright IBM Corp. 2009,

14 2 IBM Security Identity Manager: PeopleTools Adapter User Guide

15 Chapter 2. Checklist for configuring IBM Security Identity Manager to run the adapter You can use a checklist when you configure IBM Security Identity Manager to run the adapter. The following table provides an overview of the process for configuring IBM Security Identity Manager. Table 1. Checklist for configuring IBM Security Identity Manager Task Install the PeopleTools Adapter Import the adapter profile into IBM Security Identity Manager Create a service for the PeopleTools Adapter Configure the PeopleTools Adapter Perform a reconciliation operation to retrieve user accounts and store them in the IBM Security Identity Manager server Adopt orphan accounts on IBM Security Identity Manager For information, see the section in the following documentation: Installing the PeopleTools Adapter in the PeopleTools Adapter Installation and Configuration Guide Importing the adapter profile into the IBM Security Identity Manager server in the PeopleTools Adapter Installation and Configuration Guide Creating the service in the Directory Integrator-Based PeopleTools Adapter Installation and Configuration Guide Note: After you create a PeopleTools Adapter service, the IBM Security Identity Manager server creates a default provisioning policy for the adapter service. You can customize a provisioning policy for the PeopleTools Adapter service according to your organization's requirements. For more information, see the section about customizing a provisioning policy in the IBM Security Identity Manager product documentation. Configuring the PeopleTools Adapter in the PeopleTools Adapter Installation and Configuration Guide Managing reconciliation schedules in the IBM Security Identity Manager product documentation Assigning an orphan account to a user in the IBM Security Identity Manager product documentation Copyright IBM Corp. 2009,

16 4 IBM Security Identity Manager: PeopleTools Adapter User Guide

17 Chapter 3. PeopleTools Adapter user account management tasks IBM Security Identity Manager manages user accounts stored on the PeopleSoft server using the PeopleTools Adapter. You can perform operations, such as reconciliation, add, modify (including password change), suspend, restore, and delete to manage your accounts. You can manage: v Accounts for a specific person v Accounts for a service instance v Specific accounts using the search function of IBM Security Identity Manager Preparing to use the PeopleTools Adapter You must do several tasks before doing any operation with the adapter. Procedure User account reconciliation 1. Ensure that you do the steps in Chapter 2, Checklist for configuring IBM Security Identity Manager to run the adapter, on page Run the RMI Dispatcher using one of the following methods. The RMI Dispatcher in turn runs the PeopleTools Adapter. v Windows services in service mode a. In the Windows control panel, double-click Administrative Tools. b. Double-click Services. c. Right-click the IBM Security Identity Manager Adapter service, and click Start. v Windows command prompt in console mode Go to the adapter installation directory and run the following command: ibmdisrv -s "Adapter solution directory" -c ITIM_RMI.xml d The reconciliation operation retrieves the user account information from the PeopleSoft server and stores it in the directory server of IBM Security Identity Manager. You can schedule reconciliation to run at specific times and to return specific parameters. Running a reconciliation before its schedule time does not cancel the scheduled reconciliation. For more information about scheduling reconciliation and running a scheduled reconciliation, see the IBM Security Identity Manager product documentation. You can also perform the following reconciliation tasks at any time from IBM Security Identity Manager: v Reconciling support data v Reconciling a single user account Copyright IBM Corp. 2009,

18 Reconciling supporting data Supporting data for a PeopleSoft user account includes the following information: v Language codes v Currency codes v Permission Lists v Role For more information about each of these attributes, see the PeopleSoft documentation. To reconcile only the supporting data, without reconciling the user accounts: 1. Log on to IBM Security Identity Manager as an administrator. 2. In the My Work pane, click Manage Services. The Manage Services page is displayed. 3. Select the type of service from the Service type list and click Search. 4. Select the name of the service that you created for the PeopleTools Adapter. 5. Click the View popup menu icon and select Reconcile Now from the pop-up menu. The Reconcile Now page is displayed. 6. Click Define query. 7. Select the Reconcile supporting data only check box and click Submit. User accounts You can add user accounts at any time for either an existing person or a new person in the organization. This section describes the adapter attributes that define the accounts on the account form. For specific procedures, see the IBM Security Identity Manager product documentation. Attributes for adding user accounts To add user accounts to the PeopleSoft server, specify the required attributes on the PeopleTools account form. Table 2. Required attributes for adding user accounts Attribute User ID Symbolic ID Description User ID of the account. Symbolic ID of the account. The symbolic ID is used to retrieve the access ID and the access password of a user. You must type the correct symbolic ID associated with a user. For more information about the symbolic ID, see the PeopleTools documentation. When you specify the User ID and the Symbolic ID attributes on the PeopleTools account form, the PeopleTools Adapter sets the following attributes on the PeopleSoft server: v User ID v Symbolic ID v ID Type 6 IBM Security Identity Manager: PeopleTools Adapter User Guide

19 Note: If no ID Type is specified, the adapter automatically sets the value of the ID Type attribute to None. In addition to the required attributes, you can also specify the following optional attributes on the PeopleTools account form: v Description v Language Code v Multi Language Enabled v Enable Expert Entry v Navigator Homepage v Process Profile v Primary v Row Security v User Supervisor v Alternate User ID v Effective Date v To Date v Routing - Worklist User v Routing - User v Addresses v Currency Code v Roles Alternate user ID If a user is temporarily unavailable, you can assign the role of the unavailable user to an available Peoplesoft user. Specify the user ID of the alternate user as the value of the Alternate User ID attribute. Note: The value of the User ID and the Alternate User ID attributes must be different. When you specify the Alternate User ID attribute, you must also specify the following attributes on the PeopleTools account form: Effective Date: Date The start date from when the alternate user ID is effective. The default value of this attribute is Never. To specify a date, follow these steps: 1. Clear the Never check box. 2. Click the View Calendar icon and select the month, year, and date. 3. Click OK. Effective Date: Time The Effective Date attribute on IBM Security Identity Manager is of type date which has independent controls for specifying the date and time values. You can enter the date and time values of this attribute by using the Effective Date: Date and Effective Date: Time controls on IBM Security Identity Manager. The Effective Date attribute maps to the From Date attribute in the PeopleSoft pure internet architecture user interface that does not take the time value. Therefore, when you submit the add or modify request, the adapter does not take the value specified for the Effective Date: Time control. Chapter 3. PeopleTools Adapter user account management tasks 7

20 To Date: Date The end date up to which the alternate user ID is effective. The default value of this attribute is Never. To specify a date, follow these steps: 1. Clear the Never check box. 2. Click the View Calendar icon and select the month, year, and date. 3. Click OK. To Date: Time The To Date attribute on IBM Security Identity Manager is of type date which has independent controls for specifying the date and time values. You can enter the date and time values of this attribute by using the To Date: Date and To Date: Time controls on IBM Security Identity Manager. The To Date attribute maps to the To Date attribute in the PeopleSoft pure internet architecture user interface that does not take the time value. Therefore, when you submit the add or modify request, the adapter does not take the value specified for the To Date: Time control. User supervisor If a user has a supervisor, specify the user ID of the supervisor as the value of the User Supervisor attribute on the PeopleTools account form. The PeopleTools Adapter maps the User Supervisor attribute to the Supervising User ID attribute on the PeopleSoft server. Note: The value of the User ID and the User Supervisor attributes must be different. Specification of addresses To create multiple addresses for a user account, specify the Addresses attribute on the PeopleTools account form. The Addresses attribute is a collection of the following attributes: Type Specify the type of address, such as Blackberry, Business, Home, Other, or Work, as the value of this attribute. Address Specify an address for the user account as the value of this attribute. You can specify multiple addresses for a user account. However, you can specify only one address per type. Primary Select this check box to assign the specified address as a primary address. You can assign only one address as a primary address for a user account. By default, the adapter selects the first address as a primary . ID Type specification To create ID Types for a user, you must modify the adapter profile to specify the ID Types attribute on the account form. The ID Types attribute is a collection attribute that has the child attributes OPRALIASTYPE and ID Type. You specify the value for the ID Types with a name-value pair, separated by a $. attribute_name$attribute_value 8 IBM Security Identity Manager: PeopleTools Adapter User Guide

21 For example, to add an Employee ID Type with the EmplID attribute the value format sent to the adapter is: EMP#Empl ID$1234 where EMP is the Employee ID and 1234 is employee ID you want to set. If an ID Type has multiple attributes the name-value pairs are separated by a. attribute_name$attribute_value attribute_name2$attribute_value For example, if you have a custom typed defined as Custom with two attributes, MyCustAttr1 and MyCustAttr2, the format is: Custom#MyCustAttr1$Myvalue1 MyCustAttr2$Myvalue2 where Myvalue1 and Myvalue2 are values you want to set. After you import the modified profile, use the Design Forms function of IBM Security Identity Manager to add the attribute to the account form. Then you can use the drop-down menu on the account form to assign ID Types such as Employee, Vendor, or None to the user. Permission For displaying purpose, the permission list displays permission code and permission description in the format of Permission code : Permission description. However, only the permission code value is sent to the adapter. Role names For displaying purpose, the role list displays role name and role description in the format of Role Name : Role Description. However, only the role name value is sent to the adapter. User account modification You can modify the value of attributes on the PeopleTools account form. v Symbolic ID v Description v Addresses v Language Code v Multi Language Enabled v Currency Code v Enable Expert Entry v Navigator Homepage v Process Profile v Primary v Row Security v Roles v User Supervisor v Alternate User ID v Effective Date v To Date v Routing - Worklist User Chapter 3. PeopleTools Adapter user account management tasks 9

22 v v Routing - User ID Types and Values User account suspension User account restoration User account deletion Note: The User Id attribute cannot be modified. Password change of user accounts You can change the password of any of the PeopleTools accounts that exist on IBM Security Identity Manager. For information about changing passwords, see the IBM Security Identity Manager product documentation. When you suspend a user account, the status of the user account on IBM Security Identity Manager becomes inactive, and the user account becomes unavailable for use. Suspending a user account does not remove the user account from IBM Security Identity Manager. For more information about suspending user accounts, see the IBM Security Identity Manager product documentation. When you suspend a user account from IBM Security Identity Manager, the PeopleTools Adapter sets the value of the Account Locked Out attribute on the PeopleSoft server to TRUE. When you restore a user account from IBM Security Identity Manager, the PeopleTools Adapter sets the value of the Account Locked Out attribute on the PeopleSoft server to FALSE. Use the deprovision feature of IBM Security Identity Manager to delete user accounts. For more information about deleting user accounts, see the IBM Security Identity Manager product documentation. 10 IBM Security Identity Manager: PeopleTools Adapter User Guide

23 Chapter 4. Customizing the PeopleTools account form You can add attributes of different Component Interfaces to the PeopleTools account form. These Component Interfaces can be supported or not supported by IBM Security Identity Manager. About this task The Project file PT850_Component.zip for PeopleTools 8.50, 8.51, and 8.52, which contains Component Interfaces, is provided with the IBM Security Identity Manager PeopleTools Adapter software. These interfaces are in the ENROLE_AGENT subdirectory. This subdirectory is imported into the PeopleTools Application Designer as a PeopleTools Project. Procedure 1. Modify the CompIntfc.jar file. For more information about modifying the CompIntfc.jar file, see Modifying the CompIntfc.jar file on page Log on to the workstation where the PeopleTools Adapter is installed. 3. Copy the PeopleToolsProfile.jar file to the \temp directory. 4. Extract the contents of the PeopleToolsProfile.jar file to the \temp directory by running the following command: cd c:\temp jar -xvf PeopleToolsProfile.jar PeopleToolsProfile This command creates the c:\temp\peopletoolsprofile directory. 5. Add the attribute to the PeopleTools Adapter profile. For more information about adding an attribute to the adapter profile, see Attributes in the adapter profile on page Map the attribute to the assembly lines. v To map an attribute of a Component Interface supported by IBM Security Identity Manager, see Mapping attributes of Component Interfaces supported by IBM Security Identity Manager on page 14. v To map an attribute of a Component Interface not supported by IBM Security Identity Manager, see Mapping attributes of Component Interfaces not supported by IBM Security Identity Manager on page Go to the Tivoli Directory Integrator installation directory, and run the following command to break the assembly lines: java classpath ITDI_HOME\jars\ITLMToolkit.jar;ITDI_HOME\jars\miconfig.jar; ITDI_HOME\jars\miserver.jar;ITDI_HOME\jars\mmconfig.jar; ITDI_HOME\jars\diserverapi.jar;ITDI_HOME\jars\log4j jar; ITDI_HOME\jars\itdiAgents-common.jar com.ibm.di.utils.idiconfighelper "c:\temp\peopletoolsadapterals.xml""c:\temp" In this command, ITDI_HOME is the name of the IBM Security Identity Manager installation directory and c:\temp\peopletoolsadapterals.xml is the path of the PeopleToolsAdapterALs.xml file. 8. Create a JAR file by using the files in the \temp directory by running the following command: cd c:\temp jar -cvf PeopleToolsProfile.jar PeopleToolsProfile 9. Import the PeopleToolsProfile.jar file to the IBM Security Identity Manager server. For more information about importing the PeopleToolsProfile.jar file, Copyright IBM Corp. 2009,

24 see the PeopleTools Adapter Installation and Configuration Guide. In the section that describes installing the PeopleTools Adapter, search for the topic about importing the adapter profile into the IBM Security Identity Manager server. 10. Stop and start the IBM Security Identity Manager server. Modifying the CompIntfc.jar file To add an attribute to a Component Interface, modify the CompIntfc.jar file. Procedure 1. Logon to PeopleSoft Application Designer. 2. Open the ENROLE_AGENT Component Interface project. 3. Open the Component Interface by double clicking the Component Interface, for example, ENROLE_USERS. 4. If the name of the attribute is not listed in the right pane of the Component Interface window, then drag the attribute from the left pane to the right pane. 5. Save the changes and generate the CompIntfc.jar file. For more information about generating CompIntfc.jar file, see the PeopleTools Adapter Installation and Configuration Guide and under the topic about configuring the PeopleTools Adapter, search for the section that describes generating the CompIntfc.jar file. Attributes in the adapter profile You must update the profiles or specifications of new attributes. Update the attributes in these files: CustomLabels.properties The CustomLabels.properties file contains a list of attributes that are supported by IBM Security Identity Manager and their corresponding labels. For example, you want to add an attribute erpt84xuseridalias to the Logon Information page of the PeopleTools account form. This attribute is supported by the ENROLE_USERS Component Interface of IBM Security Identity Manager. The following example shows the CustomLabels.properties file with the specifications of the erpt84xuseridalias attribute: ### erpt84xuseraccount Login Tab erpt84xuseridalias=user ID Alias In this example: erpt84xuseraccount Login Tab Defines the tab on which the erpt84xuseridalias attribute is displayed. erpt84xuseridalias=user ID Alias Defines the label, User ID Alias, for the erpt84xuseridalias attribute. IBM Security Identity Manager recognizes the new attribute by the name erpt84xuseridalias. erpt84xuseraccount.xml All the information about the structure of the PeopleTools account form 12 IBM Security Identity Manager: PeopleTools Adapter User Guide

25 exist in the erpt84xuseraccount.xml file. When you specify a structure for an attribute, you must specify the structure under the tab where you want to display that attribute. Following is an example of the erpt84xuseraccount.xml file that defines the structure for the erpt84xuseridalias attribute: <tabbedform> <tab index="0" selected="true"> <title>$erpt84xlogintab</title> <formelement name="data.erpt84xuseridalias" label="$erpt84xuseridalias"> <input name="data.erpt84xuseridalias" size="30" type="text"/> </formelement> </tab> In this example, a text box element on the Logon Information page of the PeopleTools account form is mapped to the erpt84xuseridalias attribute. schema.dsml Defines an attribute. It contains the schema for attributes and object classes in the profile. Following is an example of the schema.dsml file that defines the erpt84xuseridalias attribute and adds the erpt84xuseridalias attribute to the erpt84xuseraccount class: <!-- erpt84xuseridalias--> <!-- ******************************************************** --> <attribute-type single-value = "true"> <name> erpt84xuseridalias </name> <description> User ID Alias </description> <object-identifier> </object-identifier> <syntax> </syntax> </attribute-type> <class superior="top"> <name>erpt84xuseraccount</name> <description>peopletools Account</description> <object-identifier> </object-identifier> <attribute ref = "erpt84xuseridalias" required = "false"/> </class> In this example: <attribute-type single-value = "true"> Specifies the value of the attribute type as single. <name>erpt84xuseridalias</name> Defines the name of the erpt84xuseridalias attribute. <description>user ID Alias</description> Provides the description of the erpt84xuseridalias attribute. <object-identifier> </object-identifier> Specifies the unique identifier for the erpt84xuseridalias attribute. <syntax> </syntax> Refers to the syntax of the erpt84xuseridalias attribute type. Chapter 4. Customizing the PeopleTools account form 13

26 <class superior="top"><name>erpt84xuseraccount</ name><description>peopletools Account</description><objectidentifier> </object-identifier><attribute ref = "erpt84xuseridalias" required = "false"/></class> Adds the erpt84xuseridalias attribute to the erpt84xuseraccount class. Note: Each attribute must have a unique identifier. In addition, the identifier must be unique in the directory server where the attribute is stored. Mapping attributes of Component Interfaces supported by IBM Security Identity Manager You can map the newly added attributes of Component Interfaces supported by IBM Security Identity Manager to the assembly lines. Procedure 1. Run the Tivoli Directory Integrator. 2. Click File > Open. 3. Select the PeopleToolsAdapterALs.xml file from the temporary folder where the PeopleTools Adapter profile was extracted, and click Open. 4. In the navigation pane, expand the AssemblyLines tree, and perform these steps: v Select the PeopleToolsAddAL assembly line and map the attributes to the PeopleToolsAddAL assembly line. For more information about mapping attributes to the PeopleToolsAddAL assembly line, see Mapping attributes to the PeopleToolsAddAL assembly line on page 15. v Select the PeopleToolsModifyAL assembly line and map the attributes to the PeopleToolsModifyAL assembly line. For more information about mapping attributes to the PeopleToolsModifyAL assembly line, see Mapping attributes to the PeopleToolsModifyAL assembly line on page 16. v Select the PeopleToolsSearchAL assembly line and map the attributes to the PeopleToolsSearchAL assembly line. For more information about mapping attributes to the PeopleToolsSearchAL assembly line, see Mapping attributes to the PeopleToolsSearchAL assembly line on page Save the changes to the assembly lines. Assembly line icons Assembly line icons of the Tivoli Directory Integrator are used while mapping attributes. Table 3. Assembly line icons Icon Name Add a new Attribute to the Attribute map Switch between List, Detail and Schema view Connect to the data source 14 IBM Security Identity Manager: PeopleTools Adapter User Guide

27 Table 3. Assembly line icons (continued) Icon Name Read the next entry Add new Link Criteria Mapping attributes to the PeopleToolsAddAL assembly line You can add a value to an attribute by mapping the attribute to the PeopleToolsAddAL assembly line. About this task To view the list of assembly line icons used while mapping attributes see Table 3 on page 14. For example, you can map the erpt84xuseridalias attribute of the ENROLE_USERS Component Interface to the PeopleToolsAddAL assembly line. Procedure 1. Select the PeopleToolsAddAL assembly line. The PeopleToolsAddAL page opens. 2. Click the Call/Return tab. The Initial Work Entry page opens. a. Click the Add a new Attribute to the Attribute map toolbar button. b. Type the name of the new attribute as erpt84xuseridalias, and click OK. The erpt84xuseridalias attribute is listed in the Work Attribute list. 3. Click the Data Flow tab. The Data Flow page opens. a. In the left pane, expand the Flow folder and select conadduser. b. On the Data Flow page, click the Config tab. The Config page opens. c. Type the PeopleSoft server, port, login, and Component Interface details. 4. Click the Output Map tab. The Output Map page opens. a. Click the Switch between List, Detail and Schema view toolbar button until you see the Schema pane. b. Click the Connect to the data source toolbar button. c. Click the Read the next entry toolbar button. All the attributes supported by the ENROLE_USERS Component Interface are displayed in the Schema pane. d. Click the Switch between List, Detail and Schema view toolbar button until you see the Attribute Map details pane. e. Select the erpt84xuseridalias check box to map the erpt84xuseridalias attribute to the PeopleToolsAddAL assembly line. Note: v The erpt84xuseridalias attribute is a simple attribute; that is, a single-valued attribute. To map a collection attribute; that is, a collection of simple attributes, you must select the Advance Mapping Settings check box on the Output Map page, and write scripts to map the collection attribute to the PeopleToolsAddAL assembly line. v The Tivoli Directory Integrator version 7.0 fix pack 6 and higher does not allow Java objects such as, com.ibm.di.entry.entry, Chapter 4. Customizing the PeopleTools account form 15

28 com.ibm.di.entry.attribute, and so on in advanced attribute mapping in the Ouput Map page. You must move these mappings to the Before Execute connector hook. For example, see the mapping of attributes erpt84x add and erpt84xrole in Before Execute connector hook and the attributes PSUSER and PSROLEUSER_VW in the Output Map page of connector conadduser in the PeopleToolsAddAL assembly line. 5. Save the changes to the PeopleToolsAddAL assembly line. Mapping attributes to the PeopleToolsModifyAL assembly line You can make an attribute modifiable by mapping the attribute to the PeopleToolsModifyAL assembly line. About this task To view the list of assembly line icons used while mapping attributes see Table 3 on page 14. For example, you can map the erpt84xuseridalias attribute of the ENROLE_USERS Component Interface to the PeopleToolsModifyAL assembly line. Procedure 1. Select the PeopleToolsModifyAL assembly line. The PeopleToolsModifyAL page opens. 2. Click the Call/Return tab. The Initial Work Entry page opens. a. Click the Add a new Attribute to the Attribute map toolbar button. b. Type the name of the new attribute as erpt84xuseridalias, and click OK. The erpt84xuseridalias attribute is listed in the Work Attribute list. 3. Click the Data Flow tab. The Data Flow page opens. a. In the left pane, expand the Flow folder and select conmodifyuser. b. On the Data Flow page, click the Config tab. The Config page opens. c. Type the PeopleSoft server, port, login, and Component Interface details. 4. Click the Output Map tab. The Output Map page opens. a. Click the Switch between List, Detail and Schema view toolbar button until you see the Schema pane. b. Click the Connect to the data source toolbar button. c. Click the Read the next entry toolbar button. All the attributes supported by the ENROLE_USERS Component Interface are displayed in the Schema pane. d. Click the Switch between List, Detail and Schema view toolbar button until you see the Attribute Map details pane. e. Select the erpt84xuseridalias check box to map the erpt84xuseridalias attribute to the PeopleToolsModifyAL assembly line. Note: v The erpt84xuseridalias attribute is a simple attribute; that is, a single-valued attribute. To map a collection attribute; that is, a collection of simple attributes, you must select the Advance Mapping Settings check box on the Output Map page, and write scripts to map the collection attribute to the PeopleToolsModifyAL assembly line. v The Tivoli Directory Integrator version 7.0 fix pack 6 and higher does not allow Java objects such as, com.ibm.di.entry.entry, 16 IBM Security Identity Manager: PeopleTools Adapter User Guide

29 com.ibm.di.entry.attribute, and so on in advanced attribute mapping in the Ouput Map page. You must move these mappings to the Before Modify connector hook. For example, see the mapping of attributes erpt84x add and erpt84xrole in Before Modify connector hook and the attributes PSUSER and PSROLEUSER_VW in the Output Map page of connector conmodifyuser in the PeopleToolsModifyAL assembly line. 5. Save the changes to the PeopleToolsModifyAL assembly line. Mapping attributes to the PeopleToolsSearchAL assembly line You can make the value of an attribute reconcilable by mapping the attribute to the PeopleToolsSearchAL assembly line. About this task To view the list of assembly line icons used while mapping attributes see Table 3 on page 14. For example, you can map the erpt84xuseridalias attribute of the ENROLE_USERS Component Interface to the PeopleToolsSearchAL assembly line. Procedure 1. Select the PeopleToolsSearchAL assembly line. The PeopleToolsSearchAL page opens. 2. Click the Call/Return tab. The Initial Work Entry page opens. a. Click the Add a new Attribute to the Attribute map toolbar button. b. Type the name of the new attribute as erpt84xuseridalias, and click OK. The erpt84xuseridalias attribute is listed in the Work Attribute list. 3. Click the Data Flow tab. The Data Flow page opens. a. In the left pane, expand the Feeds folder and select congetusers. b. On the Data Flow page, click the Config tab. The Config page opens. c. Type the PeopleSoft server, port, login, and Component Interface details. 4. Click the Input Map tab. The Input Map page opens. a. Click the Switch between List, Detail and Schema view toolbar button until you see the Schema pane. b. Click the Connect to the data source toolbar button. c. Click the Read the next entry toolbar button. All the attributes supported by the ENROLE_USERS Component Interface are displayed in the Schema pane. d. Click the Switch between List, Detail and Schema view toolbar button until you see the Attribute Map details pane. e. Select the erpt84xuseridalias check box to map the erpt84xuseridalias attribute to the PeopleToolsSearchAL assembly line. Note: v The erpt84xuseridalias attribute is a simple attribute; that is, a single-valued attribute. To map a collection attribute; that is, a collection of simple attributes, you must select the Advance Mapping Settings check box on the Input Map page, and write scripts to map the collection attribute to the PeopleToolsSearchAL assembly line. Chapter 4. Customizing the PeopleTools account form 17

30 v The Tivoli Directory Integrator version 7.0 fix pack 6 and higher does not allow Java objects such as com.ibm.di.entry.entry, com.ibm.di.entry.attribute, and so on in advanced attribute mapping in the Input Map page. You must move these mappings to the After GetNext connector hook. For example, see the in the Input Map of the connector congetusers PeopleToolsSearchAL to map collection attributes to work attributes without using objects of type com.ibm.di.entry.entry and com.ibm.di.entry.attribute. 5. Save the changes to the PeopleToolsSearchAL assembly line. Mapping attributes of Component Interfaces not supported by IBM Security Identity Manager You can add attributes of the Component Interfaces not supported by IBM Security Identity Manager. However, the value of the create key and the find key of the Component Interfaces must be OPRID. Procedure 1. Run the Tivoli Directory Integrator. 2. Click File > Open. 3. Select the PeopleToolsAdapterALs.xml file from the temporary folder where the PeopleTools Adapter profile was extracted, and click Open. 4. In the navigation pane, expand the AssemblyLines tree, and perform these steps: v Select the PeopleToolsAddAL assembly line and map the attributes to the PeopleToolsAddAL assembly line. For more information about mapping attributes to the PeopleToolsAddAL assembly line, see Mapping attributes to the PeopleToolsAddAL assembly line. v Select the PeopleToolsModifyAL assembly line and map the attributes to the PeopleToolsModifyAL assembly line. For more information about mapping attributes to the PeopleToolsModifyAL assembly line, see Mapping attributes to the PeopleToolsModifyAL assembly line on page 19. v Select the PeopleToolsSearchAL assembly line and map the attributes to the PeopleToolsSearchAL assembly line. For more information about mapping attributes to the PeopleToolsSearchAL assembly line, see Mapping attributes to the PeopleToolsSearchAL assembly line on page 21. Mapping attributes to the PeopleToolsAddAL assembly line You can add a value to an attribute by mapping the attribute to the PeopleToolsAddAL assembly line. About this task To view the list of assembly line icons used while mapping attributes, see Table 3 on page 14. Procedure 1. Select the PeopleToolsAddAL assembly line. The Data Flow page opens. 2. On the Data Flow page, right-click the Flow folder, and click Add connector component. The Select Connector window opens. a. Select ibmdi.peoplesoftconnector. 18 IBM Security Identity Manager: PeopleTools Adapter User Guide

31 b. In the Name field, type a name for the add connector component, for example, add_users. c. From the Mode list, select AddOnly. d. Click OK. Note: On the Data Flow page, ensure that the value of the State list is Enabled. 3. Click the Call/Return tab. The Initial Work Entry page opens. a. Click the Add a new Attribute to the Attribute map toolbar button. b. Type a name for the new attribute and click OK. The new attribute is listed in the Work Attribute list. 4. Click the Data Flow tab. The Data Flow page opens. a. In the left pane, expand the Flow folder and select the new connector component, add_users. b. On the Data Flow page, click the Config tab. The Config page opens. c. Type the PeopleSoft server, port, login, and Component Interface details. 5. Click the Output Map tab. The Output Map page opens. a. Click the Switch between List, Detail and Schema view toolbar button until you see the Schema pane. b. Drag the attribute to the Connector Attribute pane. The attribute is listed in the Connector Attribute pane. c. Click the Connect to the data source toolbar button. d. Click the Read the next entry toolbar button. All the attributes supported by the Component Interface are displayed in the Schema pane. e. Click the Switch between List, Detail and Schema view toolbar button until you see the Attribute Map details pane. f. Select the checkbox corresponding to the newly added attribute. Note: v To map a collection attribute; that is, a collection of simple attributes, you must select the Advance Mapping Settings check box on the Output Map page, and write scripts to map the collection attribute to the PeopleToolsAddAL assembly line. v The Tivoli Directory Integrator version 7.0 fix pack 6 and higher does not allow Java objects such as com.ibm.di.entry.entry, com.ibm.di.entry.attribute, and so on in advanced attribute mapping in the Ouput Map page. You must move these mappings to the Before Execute connector hook. For example, see the mapping of attributes erpt84x add and erpt84xrole in Before Execute connector hook and the attributes PSUSER and PSROLEUSER_VW in the Output Map page of connector conadduser in the PeopleToolsAddAL assembly line. 6. Save changes to the PeopleToolsAddAL assembly line. 7. Define the newly added connector component in the service.def file. The service.def file is available in the \temp directory where the adapter profile was extracted. Mapping attributes to the PeopleToolsModifyAL assembly line You can make an attribute modifiable by mapping the attribute to the PeopleToolsModifyAL assembly line. Chapter 4. Customizing the PeopleTools account form 19

32 About this task To view the list of assembly line icons used while mapping attributes, see Table 3 on page 14. Procedure 1. Select the PeopleToolsModifyAL assembly line. The Data Flow page opens. 2. Right-click the Flow folder, and click Add connector component. The Select Connector window opens. a. Select ibmdi.peoplesoftconnector. b. In the Name field, type a name for the add connector component, for example, mod_users. c. From the Mode list, select Delta. d. Click OK. Note: On the Data Flow page, ensure that the value of the State list is Enabled. 3. Click the Call/Return tab. The Initial Work Entry page opens. a. Click the Add a new Attribute to the Attribute map toolbar button. b. Type a name for the new attribute and click OK. The new attribute is listed in the Work Attribute list. 4. Click the Data Flow tab. The Data Flow page opens. a. In the left pane, expand the Flow folder and select the new connector component, mod_users. b. On the Data Flow page, click the Config tab. The Config page opens. c. Type the PeopleSoft server, port, login, and Component Interface details. 5. Click the Output Map tab. The Output Map page opens. a. Click the Switch between List, Detail and Schema view toolbar button until you see the Schema pane. b. Drag the attribute to the Connector Attribute pane. The attribute is listed in the Connector Attribute pane. c. Click the Connect to the data source toolbar button. d. Click the Read the next entry toolbar button. All the attributes supported by the Component Interface are displayed in the Schema pane. e. Click the Switch between List, Detail and Schema view toolbar button until you see the Attribute Map details pane. f. Select the checkbox corresponding to the newly added attribute. Note: v To map a collection attribute; that is, a collection of simple attributes, you must select the Advance Mapping Settings check box on the Output Map page, and write scripts to map the collection attribute to the PeopleToolsModifyAL assembly line. v The Tivoli Directory Integrator version 7.0 fix pack 6 and higher does not allow Java objects such as com.ibm.di.entry.entry, com.ibm.di.entry.attribute, and so on in advanced attribute mapping in the Ouput Map page. You must move these mappings to the Before Modify connector hook. For example, see the mapping of attributes erpt84x add and erpt84xrole in Before Modify connector hook and the attributes PSUSER and PSROLEUSER_VW in the Output Map page of connector conmodifyuser in the PeopleToolsModifyAL assembly line. 20 IBM Security Identity Manager: PeopleTools Adapter User Guide

33 6. Click the Link Criteria tab. a. Click the Add new Link Criteria toolbar button. b. From the Connector Attribute list, select OPRID. c. From the Operator list, select equals. d. From the Value list, select $eruid. e. Click OK. 7. From the Flow folder, select conmodifyuser, and click the Hooks tab. a. Expand the Data Flow folder and select Delta Successful. The Delta Successful pane opens to the right. b. Type // before the line work.removeallattributes();. 8. Save the changes to the PeopleToolsModifyAL assembly line. 9. Define the newly added connector component in the service.def file. The service.def file is available in the \temp directory where the adapter profile was extracted. Mapping attributes to the PeopleToolsSearchAL assembly line You can make the value of an attribute reconcilable by mapping the attribute to the PeopleToolsSearchAL assembly line. About this task To view the list of assembly line icons used while mapping attributes see Table 3 on page 14. Procedure 1. Select the PeopleToolsSearchAL assembly line. The Data Flow page opens. 2. Right-click the Flow folder, and click Add connector component. The Select Connector window opens. a. Select ibmdi.peoplesoftconnector. b. In the Name field, type a name for the add connector component, for example, recon_users. c. From the Mode list, select Lookup. d. Click OK. 3. From the State list, select Passive. 4. Click the Call/Return tab. The Initial Work Entry page opens. a. Click the Add a new Attribute to the Attribute map toolbar button. b. Type a name for the new attribute, and click OK. The new attribute is listed in the Work Attribute list. 5. Click the Data Flow tab. The Data Flow page opens. a. In the left pane, expand the Flow folder and select the new connector component, recon_users. b. On the Data Flow page, click the Config tab. The Config page opens. c. Type the PeopleSoft server, port, login, and Component Interface details. 6. Click the Input Map tab. The Input Map page opens. a. Click the Switch between List, Detail and Schema view toolbar button until you see the Schema pane. b. Drag the attribute to the Connector Attribute pane. The attribute is listed in the Connector Attribute pane. Chapter 4. Customizing the PeopleTools account form 21