IBM Tioli Priacy Manager for e-business Installation Guide Version 1.1 SC23-4791-00
IBM Tioli Priacy Manager for e-business Installation Guide Version 1.1 SC23-4791-00
Note: Before using this information and the product it supports, read the information in Appendix C, Notices on page 45. First Edition (July 2002) This edition applies to ersion 1.1 of Tioli Priacy Manager (product number 5724 C07) and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright International Business Machines Corporation 2002. All rights resered. US Goernment Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.
Contents Tables............... Preface.............. ii Who should read this guide......... ii Publications.............. ii Tioli Priacy Manager publications..... ii Related publications.......... iii Accessing publications online........ iii Ordering publications.......... iii Proiding feedback about publications..... iii Accessibility.............. ix Contacting customer support........ ix Typeface conentions........... ix Operating system-dependent ariables and paths.. ix Chapter 1. Setting up the enironment. 1 Installation CD-ROM........... 1 Hardware requirements........... 2 Operating system and Web browser requirements.. 2 Software requirements........... 3 Tioli Priacy Manager serer....... 3 LDAP monitor............. 3 Software deeloper kit (SDK)........ 3 Network considerations........... 4 Chapter 2. Installing the Tioli Priacy Manager components......... 7 Installation oeriew........... 7 Tioli Priacy Manager serer installation oeriew.............. 7 Tioli Priacy Manager LDAP monitor installation oeriew.............. 8 Tioli Priacy Manager SDK installation oeriew 8 Adanced install............ 8 Install procedure............. 8 Troubleshooting install problems....... 10 Chapter 3. Setting up the Tioli Priacy Manager serer........... 11 Creating the Tioli Priacy Manager DB2 database 11 Using the DB2 database creation program... 11 Manually creating the database and tables... 12 Setting up the WebSphere Application Serer... 14 Enabling security........... 15 Using the automatic deployment program... 15 Using manual deployment........ 16 Deploying Tioli Priacy Manager into the WebSphere Application Serer enironment... 18 Compile the Jaa serer pages........ 21 Starting the Tioli Priacy Manager enterprise application.............. 21 Configuring Tioli Access Manager...... 22 Configure the Jaa Runtime Enironment... 22 Configure the Tioli Access Manager enironment............. 22 Chapter 4. Setting up the LDAP monitor.............. 25 LDAP storage system data......... 25 Creating the directory information tree index.. 26 Filtering.............. 26 Master key............. 26 Configuring the LDAP monitor........ 27 Sample property file.......... 31 Starting the LDAP monitor......... 31 LDAP monitor registration process..... 33 Deploying the LDAP monitor........ 34 Monitor administration......... 35 Classifying storage locations........ 36 Identifying user keys.......... 36 Chapter 5. Uninstalling IBM Tioli Priacy Manager for e-business.... 37 Remoing the enterprise application from the WebSphere Application Serer........ 37 Remoing the product code......... 38 Remoing from Windows........ 38 Remoing from AIX and Sun Solaris..... 38 Deleting product directories......... 38 Troubleshooting problems when uninstalling... 38 Appendix A. Installation checklist... 39 Appendix B. File inentory...... 41 Base................. 41 Tioli Priacy Manager serer........ 42 LDAP monitor............. 42 SDK................. 42 Appendix C. Notices......... 45 Trademarks.............. 46 Glossary.............. 49 Index............... 53 Copyright IBM Corp. 2002 iii
i IBM Tioli Priacy Manager for e-business: Installation Guide
Tables 1. Hardware requirements minimum.... 2 2. Hardware requirements recommended 2 3. Serer software requirements....... 2 4. Client Web browser requirements..... 3 5. Tioli Priacy Manager serer enironment requirements............ 3 6. LDAP Monitor enironment requirements 3 7. SDK enironment requirements...... 4 8. Installation program.......... 9 9. Default installation directory....... 9 10. Component summary size requirements and features............ 10 11. Database creation program....... 12 12. Tioli Priacy Manager database name 12 13. Database configuration parameters..... 13 14. Automatic deployment program..... 15 15. Names for WebSphere Application Serer database-related resources........ 16 16. AIX and Sun Solaris: starting the WebSphere Application Serer and Administratie Console 17 17. Windows: starting the WebSphere Application Serer and Administratie Console..... 17 18. Required LDAP monitor properties.... 27 19. Optional LDAP monitor properties..... 28 20. Starting the LDAP monitor....... 31 Copyright IBM Corp. 2002
i IBM Tioli Priacy Manager for e-business: Installation Guide
Preface Who should read this guide Publications The IBM Tioli Priacy Manager Installation Guide proides information about how to operate and customize IBM Tioli Priacy Manager (Tioli Priacy Manager in subsequent mention). User assistance (help) on the Tioli Priacy Manager console proides additional task information not described in this publication. This document is written for systems administrators, integrators, and installers, or for Tioli Professional Serices personnel, who are planning to install Tioli Priacy Manager. The following publications are related to the Tioli Priacy Manager product. Tioli Priacy Manager publications Most of the product information for using Tioli Priacy Manager, with the exception of the integrated online help is found on the following location: http://www.tioli.com/support/documents/ The publications for this product include the following: IBM Tioli Priacy Manager Release Notes. Proides information on obtaining required fixes and APARs, and describes updates, corrections, amendments, and workarounds for tasks and topics described in the Tioli Priacy Manager library. IBM Tioli Priacy Manager for e-business Planning Guide, SC23 4789. Proides information on planning for the installation, operation, and administration of Tioli Priacy Manager. IBM Tioli Priacy Manager for e-business Monitor Deeloper s Guide Guide, SC32 4790. Proides information about the application programming interface (API) system programmers can use to create a storage system monitor. IBM Tioli Priacy Manager for e-business Problem Determination Guide, SC32 4792. Proides information on diagnosing and soling problems with Tioli Priacy Manager. Product messages are also included. Online user assistance for Tioli Priacy Manager (Tioli Assistant) Proides integrated online help topics for all Tioli Priacy Manager administratie tasks. The Tioli Glossary includes definitions for many of the technical terms related to Tioli software. The Tioli Glossary is aailable, in English only, at the following Web site: http://www.tioli.com/support/documents/glossary/termsm03.htm Copyright IBM Corp. 2002 ii
Related publications The following documents also proide useful information: IBM Tioli Access Manager for e-business The documents required to support IBM Tioli Access Manager for e-business are aailable at: http://www.tioli.com/support/documents/ IBM Uniersal DB2 Enterprise Edition The documents required to support DB2 are aailable at: http://www.ibm.com/software/data/db2/library IBM WebSphere Application Serer Access publications for this product at: http://www.ibm.com/software/webserers/appser/library.html IBM HTTP Serer Access publications for this product at: Accessing publications online Ordering publications http://www-3.ibm.com/software/webserers/httpserers/library.html You can access updated publications in the Tioli Information Center from the following Customer Support Web site: http://www.tioli.com/support/documents/ These publications are aailable in PDF or HTML format, or both. Translated documents are also aailable for some products. Note: If you print PDF documents on other than letter-sized paper, select the Fit to page check box in the Adobe Acrobat Print dialog (which is aailable when you click File --> Print ) to ensure that the full dimensions of a letter-sized page are printed on the paper that you are using. You can order publications at: http://www.elink.ibmlink.ibm.com/public/applications/publications/cgibin/ pbi.cgi Proiding feedback about publications We are ery interested in hearing about your experience with Tioli products and documentation, and we welcome your suggestions for improements. If you hae comments or suggestions about Tioli products and documentation, complete the customer feedback surey at the following Web site: http://www.tioli.com/support/surey iii IBM Tioli Priacy Manager for e-business: Installation Guide
Accessibility Contacting customer support Typeface conentions The product documentation has been modified to include features to aid accessibility: Documentation is aailable in both HTML and conertible PDF formats to gie the maximum opportunity for users to apply screen-reader software. All images in the documentation are proided with alternatie text so that users with ision impairments can understand the contents of the images. If you hae a problem with any Tioli product, you can contact IBM Customer Support for Tioli products. See the Tioli Customer Support Handbook at the following Web site: http://www.tioli.com/support/handbook The handbook proides information about how to contact Customer Support, depending on the seerity of your problem, and the following information: Registration and eligibility Telephone numbers and e-mail addresses, depending on the country in which you are located The information you should gather before contacting support The following typeface conentions are used in this book: Bold Italic Monospace Lowercase and mixed-case commands, command options, and flags that appear within text appear like this, in bold type. Graphical user interface elements (except for titles of windows and dialogs) and names of keys also appear like this, in bold type. Variables, alues you must proide, new terms, and words and phrases that are emphasized appear like this, in italic type. Commands, command options, and flags that appear on a separate line, code examples, output, and message text appear like this, in monospace type. Names of files and directories, text strings you must type, when they appear within text, names of Jaa methods and classes, and HTML and XML tags also appear like this, inmonospace type. Operating system-dependent ariables and paths This book uses the UNIX conention for specifying enironment ariables and for directory notation. When using the Windows command line, replace $ariable with %ariable% for enironment ariables and replace each forward slash (/) with a backslash (\) in directory paths. Note: If you are using the bash shell on a Windows system, you can use the UNIX conentions. Preface ix
x IBM Tioli Priacy Manager for e-business: Installation Guide
Chapter 1. Setting up the enironment Installation CD-ROM Before installing IBM Tioli Priacy Manager for e-business, you must perform certain pre-installation tasks. During the installation process, the installation program erifies that your system has the prerequisite software installed. If a prerequisite is missing or is not at the correct leel, a message is displayed. The message describes the appropriate action for continuing the installation. This chapter describes the hardware, enironment, and software prerequisites for installing the Tioli Priacy Manager product. The IBM Tioli Priacy Manager for e-business installation CD-ROM contains the following components: Tioli Priacy Manager serer Tioli Priacy Manager LDAP monitor Tioli Priacy Manager software deelopment kit The Tioli Priacy Manager components can be installed separately or in any combination. Tioli Priacy Manager serer The Tioli Priacy Manager serer proides the interfaces that allow you to define priacy policies, categorize data as personally identifiable information (PII), define users authorized to access PII, gather and iew audit reports. LDAP monitor The LDAP monitor obseres the data traffic to and from the LDAP directory storage system. The LDAP monitor resides between the LDAP client and LDAP serer. The LDAP monitor interacts with the Tioli Priacy Manager serer to identify PII and to record PII submission and access requests for data maintained on the LDAP storage system. The Tioli Priacy Manager LDAP monitor can reside on the same machine as the LDAP serer or another machine. Software Deeloper Kit (SDK) Proides a toolkit for the deelopment of storage system monitors. The toolkit proides application programming interfaces (API) used to communicate with the Tioli Priacy Manager serer. For detailed SDK information, refer to the IBM Tioli Priacy Manager Monitor Deeloper s Guide. The SDK can be installed on the same machine as the Tioli Priacy Manager serer or on a different machine. This document addresses each installation option proided on the CD-ROM. After installing the components, proceed to the appropriate configuration chapter. Copyright IBM Corp. 2002 1
Hardware requirements Table 1 lists the minimum machine requirements necessary to install Tioli Priacy Manager. Table 1. Hardware requirements minimum Operating System Windows AIX Sun Solaris Processor Intel RS/6000 Sparc RAM 1 GB 1 GB 1 GB CD-ROM Yes Yes Yes Network Yes Yes Yes connectiity Temporary storage 100 MB 100 MB 100 MB Table 2 lists the suggested machine requirements for installing Tioli Priacy Manager. Table 2. Hardware requirements recommended Operating System Windows AIX Sun Solaris Processor Intel RS/6000 UltraSparc II RAM 2 GB 2 GB 2 GB CD-ROM Yes Yes Yes Network Yes Yes Yes connectiity Temporary storage 100 MB 100 MB 100 MB Enironment disk space 4GB 4GB 4GB Note: The enironment disk space includes the Tioli Priacy Manager and prerequisite products. Operating system and Web browser requirements The Tioli Priacy Manager serer must be installed on a machine with one of the operating systems listed in Table 3. To use the Tioli Priacy Manager console a Web browser is required. Table 4 on page 3 lists the supported Web browsers. Table 3. Serer software requirements Operating System Microsoft Windows 2000 Professional SP1 or later Microsoft Windows 2000 Serer SP1 or later Microsoft Windows 2000 Adanced Serer SP1 or later AIX 4.3.3 MR 8 or later AIX 5.1 Sun Solaris 2.8 for Sparc with patch cluster after January 2001 2 IBM Tioli Priacy Manager for e-business: Installation Guide
Table 4. Client Web browser requirements AIX Sun Solaris Windows Netscape 4.76i Netscape 4.73 Netscape 4.73 Internet Explorer 5.5 SP1 Software requirements This section contains the software requirements for the Tioli Priacy Manager components. Note: Refer to the Release Notes located at the following Web site for fixes and updates to the prerequisites: http://www.tioli.com/support/documents Tioli Priacy Manager serer Table 5 lists the prerequisites for the Tioli Priacy Manager serer. Table 5. Tioli Priacy Manager serer enironment requirements Product Name Version WebSphere Application Serer Adanced Edition Version 4.0.3 IBM HTTP Serer Version 1.3.19 IBM Tioli Access Manager for e-business Jaa Runtime Version 3.9 Enironment IBM DB2 Uniersal Database Version 7.2.1 LDAP monitor The Tioli Priacy Manager LDAP monitor component proides for monitoring of an LDAP storage system. In addition to the serices of the Tioli Priacy Manager serer, the LDAP monitor requires the prerequisites listed in Table 6. Note: The J2EE client is included with WebSphere Application Serer. Table 6. LDAP Monitor enironment requirements J2EE LDAP WebSphere J2EE Client Version 4.0.2 IBM SecureWay Directory Version 3.2.2 iplanet Directory Serer 5.0 iplanet Directory Serer 5.1 Software deeloper kit (SDK) The Tioli Priacy Manager SDK requires the serices of a Jaa deelopment enironment for code compilation. In order for a monitor to operate, it needs to communicate with the Tioli Priacy Manager serer. Additionally, the monitor must hae access to a J2EE client enironment. Table 7 on page 4 lists the prerequisites for the Tioli Priacy Manager SDK component. Chapter 1. Setting up the enironment 3
Table 7. SDK enironment requirements JDK J2EE Jaa Deelopment Kit (JDK) 1.3 SR 9a WebSphere J2EE Client Version 4.0.2 Network considerations Understanding the hardware and software requirements is only part of the decisions that must be made before installing the product. The location of Tioli Priacy Manager components in the network affects the installation process. Figure 1 on page 5 shows a simple Tioli Priacy Manager enironment. For details concerning network considerations, refer to the IBM Tioli Priacy Manager Planning Guide. The Tioli Priacy Manager enironment includes the following: Tioli Access Manager Jaa Runtime Enironment Tioli Access Manager Policy Serer DB2 Monitor SDK Tioli Priacy Manager console Tioli Priacy Manager serer Storage system Storage system monitor Web serer WebSphere Application Serer WebSphere Application Serer J2EE client Tioli Access Manager Jaa Runtime Enironment Proides the communication between the Tioli Priacy Manager serer and the Tioli Access Manager serer. Tioli Access Manager Policy serer The Tioli Access Manager Policy serer proides authorization serices by identifying data users and their group memberships to Tioli Priacy Manager. DB2 Database used by Tioli Priacy Manager serer for maintaining data, such as policy definitions and audit records. Monitor SDK The Monitor SDK is an application programming interface (API) made up of a set of Jaa classes and methods used to create storage system monitors. No network connectiity is required to deelop and compile a monitor. To test and implement the monitor in your enironment, the Tioli Priacy Manager serer is required, along with the necessary storage system the monitor supports. Tioli Priacy Manager console Authorized users can perform their tasks from any client equipped with a supported browser. The browser proides access to the Tioli Priacy Manager console. Any number of users can use the Tioli Priacy Manager console at the same time. 4 IBM Tioli Priacy Manager for e-business: Installation Guide
Tioli Priacy Manager serer The Tioli Priacy Manager serer proides the core Tioli Priacy Manager functions. The Tioli Priacy Manager serer must be installed on the same machine as the WebSphere Application Serer. Storage system The storage system is the medium for maintaining PII used by data collector applications. Storage system monitor The storage system monitor is code deeloped using the Tioli Priacy Manager SDK. The monitor enables communication between the Tioli Priacy Manager serer and the storage system. The LDAP monitor proided with the product allows for monitoring of PII associated with an LDAP storage system. The LDAP monitor component must be installed on a machine that has access to the LDAP storage system and the applications accessing and submitting data to the LDAP storage system. The LDAP client application communicates with the LDAP monitor as if it is LDAP serer. Logically, the LDAP monitor and any other storage monitor is a liaison between the data collector application and the storage system. Web serer Proides hypertext transport protocol (HTTP) communication used by Web browsers and Web serers to transfer HTML and other files. WebSphere Application Serer Proides infrastructure under which the Tioli Priacy Manager serer enterprise application operates. WebSphere Application Serer J2EE client Allows monitors to communicate with the WebSphere Application Serer. Tioli Priacy Manager console WebSphere Application Serer Tioli Priacy Manager serer PD Jaa RTE DB2 UDB Tioli Access Manager LDAP client application LDAP monitor Monitor SDK LDAP serer WebSphere Application Serer Client Directory Figure 1. Tioli Priacy Manager network Chapter 1. Setting up the enironment 5
6 IBM Tioli Priacy Manager for e-business: Installation Guide
Chapter 2. Installing the Tioli Priacy Manager components Installation oeriew This chapter proides step-by-step information for installing Tioli Priacy Manager. An oeriew of the installation process for each component is proided along with detailed installation steps. The installation process places the Tioli Priacy Manager component code on the designated machine. Some components require additional steps to be operational. Before you begin installing IBM Tioli Priacy Manager for e-business, refer to IBM Tioli Priacy Manager Planning Guide. There are a number of planning considerations to reiew before starting the installation process. Reiew the Release Notes located at the following Web site for late-breaking product information before you begin: http://www.tioli.com/support/documents The following descriptions proide high-leel oeriews of installing the Tioli Priacy Manager components. The descriptions also include post-installation tasks. If you are installing multiple components, you need to reiew the process for each component. Before you begin the installation procedures, refer to Appendix A, Installation checklist on page 39 for information that is needed during the installation and configuration processes. Tioli Priacy Manager serer installation oeriew Because the Tioli Priacy Manager serer communicates with other network entities (such as, WebSphere Application Serer and DB2), you need to hae information aailable about them (such as the DB2 administrator ID and password). The following list shows the tasks that must be completed before you can start the Tioli Priacy Manager serer. Verify that the proper prerequisites are installed Install the Tioli Priacy Manager serer Create DB2 database Create the Tioli Priacy Manager database tables Prepare to deploy the Tioli Priacy Manager enterprise application into the WebSphere Application Serer enironment: Create a JDBC Proider Create a data source Verify the module isibility Deploy the Tioli Priacy Manager serer into the WebSphere Application Serer enironment Compile the Jaa Serer Pages (JSPs) After the Tioli Priacy Manager serer component is installed, go to Chapter 3, Setting up the Tioli Priacy Manager serer on page 11 for details on the configuration and deployment steps. Copyright IBM Corp. 2002 7
Tioli Priacy Manager LDAP monitor installation oeriew The Tioli Priacy Manager LDAP monitor is installed on the machine that acts as a proxy between the LDAP storage system and LDAP client applications accessing data to and from the storage system. Verify that the proper prerequisites are installed Install the Tioli Priacy Manager LDAP monitor component Configure the LDAP monitor by updating the monitor properties file Start the Tioli Priacy Manager enterprise application Start the LDAP monitor Monitor administration Classify storage locations Identify user keys After the LDAP monitor component is installed, go to Chapter 4, Setting up the LDAP monitor on page 25 for details on the configuration and starting the LDAP monitor. Tioli Priacy Manager SDK installation oeriew The Tioli Priacy Manager SDK install places the Jaa classes and documentation on a machine used by deelopers for creating a storage system monitor. Install procedure Verify that the proper prerequisites are installed Install the Tioli Priacy Manager SDK After the installation is complete, there are no further setup steps. Refer to the IBM Tioli Priacy Manager Monitor Deeloper s Guide for details on setting up the monitor deelopment and test enironments. Adanced install Selecting the Adanced install option allows for the installation of all or any combination of Tioli Priacy Manager components on a single machine. This install option is intended for users who are already familiar with installing and deploying the Tioli Priacy Manager components. The configuration process for each installed component must be performed to complete the process. Additionally, you must complete the configuration of the Jaa Runtime Enironment, see Configure the Jaa Runtime Enironment on page 22 for details. The installation program proides a graphical user interface that guides you through the process. The installation process places the appropriate code in the installation directory. When the installation process completes, you must complete the appropriate configuration tasks. 1. Log on to the operating system as a user with root or Administrator priileges. 2. Insert the Tioli Priacy Manager installation CD-ROM into the CD-ROM drie. 3. Switch to the CD-ROM root directory. For some UNIX systems, this requires creation of a mount point. 8 IBM Tioli Priacy Manager for e-business: Installation Guide
4. Start the installation program by issuing the appropriate command shown in Table 8. Table 8. Installation program Operating system Windows AIX Sun Solaris Installation program command win32_install.exe aix_install sparc_install Note: It is not recommended to run the install program remotely using a Xwindows client. 5. When the installation program starts, a message box is displayed, which indicates the start of a Jaa Virtual Machine. 6. From the IBM Tioli Priacy Manager for e-business Welcome window, click Next to continue. 7. You must accept the product terms and conditions before continuing with the install process. Reiew the terms and conditions of the product. To continue, click I agree >Next. 8. Enter the installation directory. Table 9 shows the default installation directories for each operating system. Click Next. Table 9. Default installation directory Operating system AIX Sun Solaris Windows Install directory /opt/priacy /opt/priacy C:\Program Files\Priacy Note: After you hae installed one Tioli Priacy Manager component and later install another component, the installation program uses the existing installation directory for installing the subsequent component. For example, if you install the Tioli Priacy Manager serer in a directory named d:\priacy and later install the Tioli Priacy Manager LDAP monitor on the same machine, the LDAP Monitor component will be installed in the d:\priacy directory with the Tioli Priacy Manager Serer component. To specify another directory on a subsequent installation, you must go through the uninstall process to remoe the existing installation directory and Tioli Priacy Manager components. 9. Select the component to install and click Next. Tioli Priacy Manager Serer Tioli Priacy Manager LDAP Monitor Tioli Priacy Manager SDK Adanced 10. From the installation summary window, the component size requirements and associated product features to be installed are displayed. Click Next to proceed with the installation. You can change the features to be installed by selecting or de-selecting features. Table 10 on page 10 displays the features associated with each Tioli Priacy Manager component. It also contains the storage size used by each Chapter 2. Installing the Tioli Priacy Manager components 9
component. Table 10. Component summary size requirements and features Component Size Features Tioli Priacy Manager Serer 53.6 MB Priacy Runtime Enironment Tioli Priacy Manager Serer LDAP Monitor 53.9 MB Priacy Runtime Enironment Priacy LDAP Monitor Priacy SDK 53.9 MB Priacy Runtime Enironment Priacy SDK Adanced 54.3 MB Priacy Runtime Enironment Priacy Serer Priacy SDK Priacy LDAP Monitor 11. During the Tioli Priacy Manager serer installation a Jaa session is created between the Tioli Priacy Manager serer and the Tioli Access Manager serer. The Tioli Access Manager Jaa Runtime enironment (PDJRE) configuration sets the WebSphere Application Serer to use the Tioli Access Manager libraries. This is a one time task done by the installation program. If the session is not established, the task can be completed manually. See Configure the Jaa Runtime Enironment on page 22 for manual instructions. 12. After the installation completes, a completion message is displayed. Click Finish to exit the installation program. Troubleshooting install problems During the installation process, the install program alidates the prerequisites and issues messages, if applicable. A log file, log.txt may be created for errors that occur during the install process. This file is created in the installation root directory and should be reiewed. In addition, the final panel of the install process can contain error information. Refer to the IBM Tioli Priacy Manager Problem Determination Guide for troubleshooting problems, message descriptions, and information on contacting the Tioli Support Center. 10 IBM Tioli Priacy Manager for e-business: Installation Guide
Chapter 3. Setting up the Tioli Priacy Manager serer After the Tioli Priacy Manager serer has been successfully installed, it must be configured and deployed into the WebSphere enironment. This chapter describes the tasks to complete for the Tioli Priacy Manager serer to be operational. Instructions are proided for completing the tasks manually and automatically using programs proided with the product. Note: The use of the automatic programs should be limited to installation on a test enironment. Refer to the IBM Tioli Priacy Manager Planning Guide for tuning information. Creating the Tioli Priacy Manager DB2 database The IBM DB2 Uniersal Database is a prerequisite for installing Tioli Priacy Manager. Tioli Priacy Manager requires certain tables to be created in DB2 prior to its use. You can create a new database for this purpose or use an existing database. In either case, the DB2 database must be created prior to installing the Tioli Priacy Manager enterprise application into the WebSphere enironment. Refer to the IBM DB2 Uniersal Database documentation for instructions on installing IBM DB2 Uniersal Database. This document does not coer details related to IBM DB2 Uniersal Database. When the DB2 database is aailable, the following must be done: 1. Create the Tioli Priacy Manager database. 2. Create the Tioli Priacy Manager database tables. 3. Update the database configuration parameters. Steps 1 through 3 can be completed using the DB2 command line interface or by starting the Tioli Priacy Manager database creation program. Using the DB2 database creation program The Tioli Priacy Manager installation proides a program you can use to create the Tioli Priacy Manager database, set configuration alues, and create the Tioli Priacy Manager database tables. The setuppmdb program or manual database creation must be completed before using the Tioli Priacy Manager product. Before starting setuppmdb, DB2 must be actie. For AIX and Sun Solaris, the setuppmdb command must run as root. The root user must be part of the db2iadm group. The db2iadm group is created during the DB2 Uniersal Database installation. To run the DB2 database creation tool, you will need to open a DB2 command interface. Table 11 on page 12 contains the name of the database creation program. The database creation program is located in the pm_install/autodeploy directory where pm_install is the name of the Tioli Priacy Manager installation directory. Copyright IBM Corp. 2002 11
Table 11. Database creation program Operating system AIX and Sun Solaris Windows Command for database creation setuppmdb.sh setuppmdb.bat From a command interface, start the database creation program by issuing the following command: setuppmdb db2_userid db2_pw where: db2_userid DB2 instance owner user ID db2_pw DB2 instance owner password A series of messages are displayed that show the progress of the database creation program. Status information related to the database creation process is located in a log file. The log file, dbsetup.log, is created in the pm_install/log directory where pm_install is the name of the Tioli Priacy Manager installation directory. Upon successful completion of the database creation program, the Tioli Priacy Manager database and tables are created. Table 12 shows the name of the database created and its alias name. Table 12. Tioli Priacy Manager database name Database name BTB_PMDB Database alias name BTB_PMDB Manually creating the database and tables To manually create and configure the Tioli Priacy Manager database, use the DB2 command interface. From the DB2 command interface, you can: Create the Tioli Priacy Manager database Create the Tioli Priacy Manager tables Configure the Tioli Priacy Manager database Creating the database The database is created from the DB2 command interface. Before starting the command interface: DB2 must be actie. For AIX and Sun Solaris, the DB2 instance owner ID, such as db2inst1, must be part of the db2iadm group. The db2iadm group is created during the DB2 Uniersal Data Base installation. From a command line interface, issue the following command to create the database: db2 create database db_name alias alias_name using codeset UTF-8 territory US db_name Name assigned to the database 12 IBM Tioli Priacy Manager for e-business: Installation Guide
alias_name Database alias name The alias name is not required, howeer, if an alias name is used it must be the same as the database name. Creating the database tables During the installation of the Tioli Priacy Manager serer component, files defining the required DB2 tables are placed in the pm_install/ddl directory where pm_install is the name of the Tioli Priacy Manager installation directory. Each DDL file contains SQL code for creating a database table. 1. Change to the pm_install/ddl directory. 2. Issue the following commands to connect to the DB2 database being used for Tioli Priacy Manager: db2 attach to instancename user db2_userid using db2_pw db2 connect to db_name user dh2_userid using db2_pw where: instancename Name of the database instance where the Tioli Priacy Manager tables are to be created db2_userid User ID of the database instance owner (userid) db2_pw Password associated with the instance userid specified db_name Name of the Tioli Priacy Manager database 3. Issue the db2 -tf command for each DDL file contained in the Tioli Priacy Manager installation directory. Issue the following commands to create the Tioli Priacy Manager database tables: db2 -tf IBM_Tioli_Priacy_admin_ejb_jar-jar_Table.ddl db2 -tf IBM_Tioli_Priacy_cms-jar_Table.ddl db2 -tf IBM_Tioli_Priacy_deploy-jar_Table.ddl db2 -tf IBM_Tioli_Priacy_pes-jar_Table.ddl db2 -tf IBM_Tioli_Priacy_rpt_serer_ejb-jar_Table.ddl db2 -tf IBM_Tioli_Priacy_SAESerer-jar_Table.ddl Configuring the database Once the Tioli Priacy Manager database is created, certain database parameters must be configured. Table 13 lists the database parameters and the alues needed for using Tioli Priacy Manager. Table 13. Database configuration parameters Database parameter Value applheapsz 256 app_ctl_heap_sz 256 logsecond 4 maxappls 250 Issue the following command for each of the database parameters to customize the DB2 program enironment. db2 update database cfg for db_name using db_parm alue Chapter 3. Setting up the Tioli Priacy Manager serer 13
where: db_name Name of the Tioli Priacy Manager database db_parm DB2 database parameter alue Value for the DB2 database parameter specified For example: db2 update database cfg for BTB_PMDB using applheapsz 256 db2 update database cfg for BTB_PMDB using app_ctl_heap_sz 256 db2 update database cfg for BTB_PMDB using logsecond 4 db2 update database cfg for BTB_PMDB using maxappls 250 Note: Refer to the IBM Tioli Priacy Manager Planning Guide for tuning the database parameters to meet the needs of your enironment. Setting up the WebSphere Application Serer Before you can start Tioli Priacy Manager, you must deploy it into the WebSphere enironment. Setting up the WebSphere Application Serer inoles configuring the serer and supporting resources. For Tioli Priacy Manager to communicate with the DB2 database, data access settings are required. This includes JDBC proiders and data source configurations. Enable security Security must be enabled for users to be authenticated to the WebSphere Application Serer. Create a JDBC proider The JDBC proider is software that enables Jaa applications to connect to JDBC-compliant databases, such as DB2, through the use of DataSource objects. The JDBC proider specifies database connection pooling parameters, such as the maximum number of connections to maintain in the pool. Create a data source A data source instance is needed for eery application serer instance that uses the DataSource object. The connection pool associated with a data source is shared by all application components running in an application serer. A data source is associated with a JDBC Proider. Set the module isibility alue The module isibility alue is used to resole references to classes. The default alue is Module. The Module alue allows for one classloader per module. The default Module Visibility setting and Application setting are appropriate for Tioli Priacy Manager. Creating the JDBC proider and creating a data source can be accomplished using the Tioli Priacy Manager automatic deployment program or manually using the WebSphere Administratie Console. For detailed instructions on starting the automatic deployment program, see Using the automatic deployment program on page 15. For detailed instructions on the manual deployment procedures, see Using manual deployment on page 16. 14 IBM Tioli Priacy Manager for e-business: Installation Guide
The preceding WebSphere Application Serer setup tasks must be completed before Tioli Priacy Manager serer can be deployed into the WebSphere Application Serer enironment. Enabling security Use the WebSphere Administratie Console to enable security. 1. From the WebSphere Administratie Console menu, click Console > Security Center. 2. From the General tab, erify Enable Security is checked. 3. From the Authentication tab, click Local Operating System and complete the following: Security Serer ID Security Serer Password 4. Click OK. 5. Restart the WebSphere Application Serer for the change to take effect. Using the automatic deployment program The Tioli Priacy Manager installation directory contains an automatic deployment program that sets up the JDBC proider and data source. The automatic deployment program: Sets the security for the administratie domain to actie. Installs the Tioli Priacy Manager application on the first node in the administratie domain. Deploys the Tioli Priacy Manager application to the WebSphere Application Serer Default Serer. Assigns the WebSphere Administrator to all roles and the RunAs role. These alues can be changed later using the WebSphere security console. Note: The use of the automatic program should be limited to installation on a test enironment. The automatic deployment program must be started on the same machine where the WebSphere administratie serer is installed. Table 14 contains the name of the automatic deployment program for each operating system. The program is located in the pm_install/autodeploy directory where pm_install is the name of the Tioli Priacy Manager installation directory. Table 14. Automatic deployment program Operating system Window AIX and Sun Solaris Command AutoDeploy.bat AutoDeploy.sh To start the program, the following information is needed: DB2 instance owner user ID and password WebSphere administrator user ID and password Fully qualified pathname for db2jaa.zip file. The typical location for this file is DB2_home/SQLLIB/jaa12 directory. Fully qualified path location where DB2 is installed Chapter 3. Setting up the Tioli Priacy Manager serer 15
To start the automatic deployment process: 1. Open an operating system command interface 2. Issue the following command: AutoDeploy was_userid was_pw db2_userid db2_pw path_db2jaa where: was_userid User ID haing access to the WebSphere Control Program. The same user ID is used to assign Tioli Priacy Manager roles and RunAs users. was_pw Password associated with the WebSphere Control Program administrator db2_userid Instance owner user ID haing access to the DB2 db2_pw Instance owner password path_db2jaa Location of the db2jaa.zip file associated with the JDBC For example: AutoDeploy wasroot waspwd db2root db2pwd /opt/ibmdb2/v7.1/jaa12/db2jaa.zip A series of messages that show the progress of the automatic deployment are displayed. Status information related to the deployment process is located in a log file. The log file, pmautodeploy.log, is created in the pm_install/log directory where pm_install is the name of the Tioli Priacy Manager installation directory. Table 15 contains the WebSphere Application Serer resources created upon completion of the AutoDeploy program. From the WebSphere Administratie Console, you can expand the tree iew to see the Resources created. Table 15. Names for WebSphere Application Serer database-related resources Object created JDBC Proider Data source name JNDI name Value DB2UDBjdbcProider PriacyDataSource jdbc/btb1101/priacy When the automatic deployment program is complete, the next step is to compile the Jaa Serer Pages. Refer to Compile the Jaa serer pages on page 21 for details. Using manual deployment If you did not complete the deployment process using the automatic deployment program, proceed with the instructions in this section. To complete the deployment process manually, use the WebSphere Administratie Console. Starting the WebSphere Administratie Console The WebSphere Administratie Console is used to setup the WebSphere Application Serer so that it recognizes the Tioli Priacy Manager serer. The WebSphere Administratie Console is a graphical, Jaa-based administratie client 16 IBM Tioli Priacy Manager for e-business: Installation Guide
to the IBM WebSphere Application Serer administratie serer. This administratie console proides the full range of product administratie actiities. The WebSphere administratie serer must be running before you start the WebSphere Administratie Console. By default, the serer does not start automatically when you start the machine. Table 16 and Table 17 show the commands for starting the WebSphere Application Serer and Administratie Console for the supported operating systems. The commands must be issued from the was_install/bin directory, where was_install is the WebSphere Application Serer installation directory. Table 16. AIX and Sun Solaris: starting the WebSphere Application Serer and Administratie Console Operation Start serer Start console Command startupserer.sh adminclient.sh Table 17. Windows: starting the WebSphere Application Serer and Administratie Console Operation Start serer Start console Command From the Control Panel, click Serices > IBM WS AdminSerer 4.0 >Start Click Start > Programs > IBM WebSphere > Application Serer 4.0 > Administrator s Console Creating a JDBC proider Before you can create the necessary data source for Tioli Priacy Manager, a JDBC Proider must be aailable. To create a JDBC proider do the following: 1. From the WebSphere Administrator Console menu, click Console > New > JDBC Proider. 2. On the Proider Properties General tab, complete the following fields: Name Assign a name for the JDBC Proider associated with Tioli Priacy Manager connection to the DB2 database. Description Enter a description for the JDBC Proider being created. Implementation Class Locate and click com.ibm.db2.jdbc.db2connectionpooldatasource as the implementation class from the list. 3. On the Proider Properties Nodes windows, do the following: a. Click Install New to iew a list of machines. b. Click Specify Drier Files to locate the db2jaa.zip file. The typical location for this file is DB2_home/SQLLIB/jaa12 directory. Click the file. c. Click Set. d. Click Install. 4. Click OK. Chapter 3. Setting up the Tioli Priacy Manager serer 17
The JDBC proider is now ready to be used. From the WebSphere Administratie Console, you can expand the tree iew to see the JDBC resource created. Creating a data source The data source configuration proides for connections between Tioli Priacy Manager serer and the required DB2 database. Before you start to configure the data source, be sure a JDBC Proider is created and aailable. Complete the following tasks to create a data source: 1. From the WebSphere Administrator Console menu, click Console > New > Data Source 2. Complete the Data Source Properties panel with the following information: Name Assign a name for the data source. Use PriacyDataSource as the data source name. JNDI name Enter a JNDI name for the resource, including any naming subcontexts. This name is used as the linkage between the platform s binding information for resources defined in the client application s deployment descriptor and actual resources bound into JNDI by the platform. Use jdbc/btb110/priacy as the JNDI name. Description Enter a description for the data source being created. JDBC Proider Enter the name of the JDBC Proider with which this data source is associated. Use the JDBC proider created earlier. Database Name Enter the name of the DB2 database created for Tioli Priacy Manager. For example, use BTB_PMDB if the database creation tool is used to create the database. User Enter the DB2 instance owner user ID. Password Enter the password associated with the specified DB2 instance owner user ID. 3. Click Test Connection to erify the connection works. 4. Click OK. The JDBC proider and data source are now ready to be used. From the WebSphere Administratie Console, you can expand the tree iew to see the JDBC proider and data source created. Deploying Tioli Priacy Manager into the WebSphere Application Serer enironment After the JDBC Proider and data source hae been created for data access, additional WebSphere Application Serer configuration must be done to ensure that the Tioli Priacy Manager enterprise application is fully functional within the enironment. This task is called Install Enterprise Application. Installing the application refers to the process of placing an Enterprise Archie (EAR) file in the 18 IBM Tioli Priacy Manager for e-business: Installation Guide
run-time enironment of an application serer. A number of tasks must be performed during this process. Some of these tasks are accomplished through the Tioli Priacy Manager deployment descriptor packaged with its EAR file. Other configuration tasks are performed using the WebSphere Administratie Console. The WebSphere Install Enterprise Application Wizard leads you through all the tasks for installing the Tioli Priacy Manager enterprise application into the WebSphere Application Serer enironment. Because the Tioli Priacy Manager application is already generated and contains a set of deployment descriptors, the default options can be taken for a number of steps. 1. From the WebSphere Adanced Administratie Console, click Console > Wizards > Install Enterprise Application to start the install enterprise application wizard. 2. Specifying the Enterprise Application as Application or Module Specifies whether the enterprise application being installed is an application or module. Also, proides the name and location of the application or module to the WebSphere Application Serer. Tioli Priacy Manager is defined as an WebSphere Application Serer enterprise application. From the Specifying the Application or Module panel: a. Click Install application. b. Enter the fully qualified pathname for the priacy.ear file or use the Browse function to locate the file. The file is located in the pm_install\lib directory, where pm_install is the name of the Priacy Manager installation directory. c. Click Next. 3. From the Unprotected Methods window, click Yes to deny access to all unprotected methods. 4. Mapping Users to Roles Assign users or groups to the roles defined by Tioli Priacy Manager. Mapping operating system users or groups to a role authorizes those users or groups to access applications defined by the role. There are six roles defined by Tioli Priacy Manager. The Mapping Users to Roles window displays the roles defined by Tioli Priacy Manager. a. From the list of roles, click on a role and click Select. b. From the Select Users/Groups window, select the users/groups to be associated with the role. c. Click OK when you are finished mapping a user or group to the role. d. Repeat steps 4a to 4c for each of the Tioli Priacy Manager roles. e. When completed, click Next to exit the Role Mapping window. 5. Mapping EJB RunAs Roles to Users The SERVER role is a predefined RunAs role. This step identifies the SERVER role to WebSphere as the RunAs role. The Mapping EJB RunAs Roles to Users window displays the Tioli Priacy Manager roles defined as RunAs. The SERVER role is the only one defined by the Tioli Priacy Manager application as RunAs. a. Click SERVER from the list and click Select. b. From the Select User SERVER window, enter a user ID and password mapped to the SERVER role and click OK. The user ID and password were created in step 4, during the mapping a user or group to the SERVER role. If the SERVER role is mapped to a group, use one of the users associated with the group. Chapter 3. Setting up the Tioli Priacy Manager serer 19
c. Click Next. 6. Binding Enterprise Beans to JNDI Names Connects each Tioli Priacy Manager enterprise bean to a JNDI name. Use the defaults. From the Binding Enterprise Beans to JNDI Names window, click Next. 7. Mapping EJB References to Enterprise Beans Associate each Tioli Priacy Manager EJB reference to an enterprise bean. Use the defaults. From the Mapping EJB References to JNDI Names window, click Next. 8. Mapping Resource References to Resources Map each Tioli Priacy Manager resource reference to a resource. Use the defaults. From the Mapping Resource References to Resources window, click Next. 9. Specifying the Default Data Source for EJB Modules Define the default data source for the EJB Module containing the CMP beans. Use the defaults. From the Specifying the Default Data Source for EJB Modules window, click Next. 10. Specifying Data Sources for Indiidual CMP Beans Associates a data source to a CMP bean. Use the defaults. From the Specifying Data Sources for Indiidual CMP Beans window, click Next. 11. Specifying Virtual Hosts for Web Modules Define a irtual host name for the location of the Tioli Priacy Manager Web modules. Use the defaults. From the Selecting Virtual Hosts for Web Modules window, click Next. 12. Selecting Application Serers Defines the application serer the Tioli Priacy Manager Web modules to installed. Use the defaults. From the Selecting Application Serers window, click Next. 13. Completing the Enterprise Application Install Wizard Proides a summary of the installation process. Listed is the node where the Tioli Priacy Manager application is installed. After you click Finish, the Install Wizard starts the installation process and creates the install directory. From the Completing the Application Install Wizard window, erify the information and click Finish. 14. From the Deploy window, click No so the Tioli Priacy Manager application code is not generated. The Tioli Priacy Manager code is already generated. 15. After the installation process is complete, an information dialog displays the following-command EnterpriseApp.install completed successfully. Click OK. When the Tioli Priacy Manager enterprise application is installed, an entry is created under the Enterprise Application subtree. From the WebSphere Administratie Console, click WebSphere Administratie Domain > Enterprise Applications to expand the tree. The IBM Tioli Priacy Manager for e-business enterprise application is named IBM_Tioli_Priacy_Manager. The next step is to compile the Jaa Serer Pages. See Compile the Jaa serer pages on page 21 for details. 20 IBM Tioli Priacy Manager for e-business: Installation Guide