Tivoli Identity Manager

Transcription

1 Tioli Identity Manager Version 5 Actie Directory Adapter Users Guide SC

2

3 Tioli Identity Manager Version 5 Actie Directory Adapter Users Guide SC

4 Note Before using this information and the product it supports, read the information in Appendix F, Notices, on page 57. This edition applies to ersion 5 of this adapter and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright International Business Machines Corporation All rights resered. US Goernment Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Preface About this book This users guide proides information that you need to manage user accounts on the Actie Directory using the IBM Tioli Identity Manager. This book describes user account management tasks, such as reconciliation, add, modify, suspend, restore, delete, and password change. Intended audience for this book This book is intended for the Actie Directory administrators responsible for managing user accounts on the Actie Directory serer. Readers are expected to understand the account management tasks in Tioli Identity Manager. Readers must also be familiar with the routine security administration tasks and operating system concepts. Publications and related information This section lists publications in the Actie Directory Adapter library and related documents. The section also describes how to access Tioli publications online and how to order Tioli publications. Read the descriptions of the Tioli Identity Manager library. To determine which additional publications you might find helpful, read the Prerequisite product publications on page and the Related publications on page i. After you determine the publications you need, refer to the instructions in Accessing publications online on page ii. Tioli Identity Manager library The publications in the technical documentation library for your product are organized into the following categories: Release information Online user assistance Serer installation and configuration Problem determination Technical supplements Adapter documentation Release Information: Release Notes Proides software and hardware requirements for the product, additional fix pack, and other support information. Read This First card Lists the publications for the product. Online user assistance: Proides online help topics and an information center for administratie tasks. Copyright IBM Corp iii

6 Serer installation and configuration: Proides installation and configuration information for the product serer. Problem determination: Proides problem determination, logging, and message information for the product. Technical supplements: The following technical supplements are proided by deelopers or by other groups who are interested in this product: Performance and tuning information Proides information needed to tune your production enironment, aailable on the Web at: Click the I character in the A-Z product list to locate Tioli Identity Manager products. Click the link for your product, and then browse the information center for the Technical Supplements section. Redbooks and white papers are aailable on the Web at: IBMTioliIdentityManager.html Naigate to the Self Help section, in the Learn category, and click the Redbooks link. Technotes are aailable on the Web at: Field guides are aailable on the Web at: For an extended list of other Tioli Identity Manager resources, search the following IBM deeloperworks Web address: Adapter documentation: The technical documentation library also includes a set of platform-specific documents for the adapter components of the product. Adapter information is aailable on the Web at: Click the I character in the A-Z product list to locate IBM Tioli Identity Manager products. Click the link for your product, and then browse the information center for the adapter information that you want. Skills and training: The following additional skills and technical training information were aailable at the time that this manual was published: Virtual Skills Center for Tioli Software on the Web at: Tioli Education Software Training Roadmaps on the Web at: i IBM Tioli Identity Manager: Actie Directory Adapter Users Guide

7 Tioli Technical Exchange on the Web at: supp_tech_exch.html Prerequisite product publications To use the information in this book effectiely, you must hae knowledge of the products that are prerequisites for your product. Publications are aailable from the following locations: Actie Directory Microsoft Windows 2000 Serer running Actie Directory Microsoft Windows 2003 Serer running Actie Directory WindowsSer/2003/standard/proddocs/en-us/default.asp Microsoft Windows XP Serer running Actie Directory Windows/XP/all/reskit/en-us/Default.asp?url=/resources/documentation/ Windows/XP/all/reskit/en-us/prcf_omn_gjj.asp Operating systems z/os IBM AIX Solaris Operating Enironment Red Hat Linux Microsoft Windows Serer Database serers IBM DB2 Uniersal Database - Support: - Information center: index.jsp - Documentation: winos2unix/support/8pubs.d2w/en_main - DB2 product family: - Fix packs: download8.html - System requirements: sysreqs.html Oracle Microsoft SQL serer Preface

8 Directory serer applications Related IBM Directory Serer en_us/html/ldapinst.htm Sun ONE Directory Serer WebSphere Additional information is aailable in the product directory or Web sites. WebLogic Serer WebSphere embedded messaging IBM HTTP Serer Web Proxy Serer IBM HTTP Serer Microsoft IIS HTTP Serer Apache HTTP Serer publications Information that is related to your product is aailable in the following publications: The Tioli Software Library proides a ariety of Tioli publications such as white papers, datasheets, demonstrations, redbooks, and announcement letters. The Tioli Software Library is aailable on the Web at: The Tioli Software Glossary includes definitions for many of the technical terms related to Tioli software. The Tioli Software Glossary is aailable from the Glossary link of the Tioli Software Library Web page at: Accessing terminology online The Tioli Software Glossary includes definitions for many of the technical terms related to Tioli software. The Tioli Software Glossary is aailable at the following Tioli software library Web site: i IBM Tioli Identity Manager: Actie Directory Adapter Users Guide

9 Accessibility The IBM Terminology Web site consolidates the terminology from IBM product libraries in one conenient location. You can access the Terminology Web site at the following Web address: Accessing publications online IBM posts publications for this and all other Tioli products, as they become aailable and wheneer they are updated, to the Tioli software information center Web site. Access the Tioli software information center at the following Web address: Ordering Tioli technical training Click the I character in the A-Z list, and then click the link for your product to access the product library. Note: If you print PDF documents on other than letter-sized paper, set the option in the File Print window that allows Adobe Reader to print letter-sized pages on your paper. publications You can order many Tioli publications online at You can also order by telephone by calling one of these numbers: In the United States: In Canada: In other countries, contact your software account representatie to order Tioli publications. To locate the telephone number of your local representatie, perform the following steps: 1. Go to cgibin/pbi.cgi. 2. Select your country from the list and click Go. 3. Click About this site in the main panel to see an information page that includes the telephone number of your local representatie. Accessibility features help users with a physical disability, such as restricted mobility or limited ision, to use software products successfully. With this product, you can use assistie technologies to hear and naigate the interface. You can also use the keyboard instead of the mouse to operate all features of the graphical user interface. For additional information, see Appendix D, Accessibility features for the Actie Directory Adapter, on page 51. For Tioli technical training information, refer to the following IBM Tioli Education Web site at Preface ii

10 Support information If you hae a problem with your IBM software, you want to resole it quickly. IBM proides the following ways for you to obtain the support you need: Searching knowledge bases: You can search across a large collection of known problems and workarounds, Technotes, and other information. Contacting IBM Software Support: If you still cannot sole your problem, and you need to work with someone from IBM, you can use a ariety of ways to contact IBM Software Support. For more information about these ways to resole problems, see Appendix E, Support information, on page 53. Conentions used in this book Typeface This reference uses seeral conentions for special terms and actions and for operating system-dependent commands and paths. conentions This guide uses the following typeface conentions: Bold Italic Lowercase commands and mixed case commands that are otherwise difficult to distinguish from surrounding text Interface controls (check boxes, push buttons, radio buttons, spin buttons, fields, folders, icons, list boxes, items inside list boxes, multicolumn lists, containers, menu choices, menu names, attribute names, tabs, property sheets), labels (such as Tip:, and Operating system considerations:) Keywords and parameters in text Command names Words defined in text Emphasis of words (words as words) New terms in text (except in a definition list) Variables and alues you must proide Monospace Examples and code examples File names, programming keywords, and other elements that are difficult to distinguish from surrounding text Message text and prompts addressed to the user Text that the user must type Values for arguments or command options Names of object classes Operating system-dependent ariables and paths This guide uses the Windows conention for specifying enironment ariables and for directory notation. iii IBM Tioli Identity Manager: Actie Directory Adapter Users Guide

11 When using the Unix command line, replace %ariable% with $ariable for enironment ariables and replace each backslash (\) with a forward slash (/) in directory paths. The names of enironment ariables are not always the same in Windows and UNIX. For example, %TEMP% in the Windows operating system is equialent to $tmp in a UNIX operating system. Note: If you are using the bash shell on a Windows system, you can use the UNIX conentions. Preface ix

12 x IBM Tioli Identity Manager: Actie Directory Adapter Users Guide

13 Contents Preface iii About this book iii Intended audience for this book iii Publications and related information iii Tioli Identity Manager library iii Prerequisite product publications Related publications i Accessing terminology online i Accessing publications online ii Ordering publications ii Accessibility ii Tioli technical training ii Support information iii Conentions used in this book iii Typeface conentions iii Operating system-dependent ariables and paths iii List of tables xiii Chapter 1. Introduction to the Actie Directory Adapter Features of the Actie Directory Adapter Chapter 2. Checklist for configuring Tioli Identity Manager to run the adapter Chapter 3. Actie Directory Adapter user account management tasks Reconciling user accounts Attributes reconciled Attributes not reconciled Reconciling support data Reconciling the useraccountcontrol attribute..7 Filter reconciliation Adding user accounts Attributes for adding user account Creating a distinguished name for a user account 13 User principal name of a user account Specifying controls for a user account Creating a home directory for a user account..16 Enabling a user account for mail Creating a proxy address for a user account..17 Modifying user accounts Modifying the container attribute Modifying the Home Directory attribute Modifying user password Modifying the Mailbox Store attribute Suspending user accounts Restoring user accounts Deleting user accounts Deleting a mailbox Chapter 4. Troubleshooting the Actie Directory Adapter errors Appendix A. Country and region codes 33 Appendix B. Actie Directory Adapter attributes Appendix C. APIs used by the Actie Directory Adapter ADSI interfaces and the corresponding APIs used by the Actie Directory Adapter WIN32 APIs used by the Actie Directory Adapter 50 Appendix D. Accessibility features for the Actie Directory Adapter Accessibility features Keyboard naigation Related accessibility information IBM and accessibility Appendix E. Support information Searching knowledge bases Search the information center on your local system or network Search the Internet Contacting IBM Software Support Determine the business impact of your problem 54 Describe your problem and gather background information Submit your problem to IBM Software Support 55 Appendix F. Notices Trademarks Index Copyright IBM Corp xi

14 xii IBM Tioli Identity Manager: Actie Directory Adapter Users Guide

15 List of tables 1. Attributes supported by the adapter for filter reconciliation Attributes not supported by the adapter for filter reconciliation Objects and their corresponding object class List of attributes and their default alues on the Actie Directory The order of attributes on the Actie Directory account form that the adapter checks to generate an RDN Attributes on the Actie Directory account form and their corresponding property flags Home Directory NTFS Access attribute alues and their corresponding permissions on the home directory Troubleshooting the Actie Directory Adapter errors Countries and regions and their corresponding codes Mapping of attributes on Tioli Identity Manager to the attributes on the Actie Directory ADSI Interfaces and the corresponding APIs used by the Actie Directory Adapter WIN32 APIs used by the Actie Directory Adapter Copyright IBM Corp xiii

16 xi IBM Tioli Identity Manager: Actie Directory Adapter Users Guide

17 Chapter 1. Introduction to the Actie Directory Adapter The Actie Directory Adapter is an application that proides connectiity between Tioli Identity Manager and the network of systems running the Actie Directory. The adapter runs as a serice, independent of whether you are logged on to Tioli Identity Manager. You can automate the following user account management tasks using the Actie Directory Adapter and Tioli Identity Manager: Adding Actie Directory user accounts Creating a home directory for a user account Modifying attributes of Actie Directory user accounts Changing passwords of Actie Directory user accounts Suspending, restoring, and deleting Actie Directory user accounts Retrieing user accounts from the Actie Directory Managing mailboxes on the Exchange serer Moing a user in the Actie Directory hierarchy Features of the Actie Directory Adapter The Actie Directory Adapter supports: Reconciliation of user accounts from the Actie Directory to the directory serer of Tioli Identity Manager. User account management tasks, such as add, modify (including password change), suspend, restore, and delete to manage accounts on the Actie Directory using Tioli Identity Manager. Management of the Exchange 2000 and the Exchange 2003 mailboxes. Customization of the Actie Directory account form. Password synchronization of different accounts of a domain user by proiding registry access to the Password Synchronization plug-in. Copyright IBM Corp

18 2 IBM Tioli Identity Manager: Actie Directory Adapter Users Guide

19 Chapter 2. Checklist for configuring Tioli Identity Manager to run the adapter To configure the Tioli Identity Manager to run the Actie Directory Adapter, perform the following steps: 1. Install the Actie Directory Adapter. For more information, see the Actie Directory Adapter Installation and Configuration Guide and search for the section "Installing the adapter." 2. Import the Actie Directory profile into the Tioli Identity Manager. For more information, see the Actie Directory Adapter Installation and Configuration Guide and search for the section "Importing the adapter profile into the Tioli Identity Manager." 3. Create an Actie Directory serice. For more information, see the Actie Directory Adapter Installation and Configuration Guide and search for the section "Creating an Actie Directory serice." 4. Create a proisioning policy for the Actie Directory Adapter serice. For more information about adding a proisioning policy, see the Tioli Identity Manager information center. 5. Perform a reconciliation operation to retriee user accounts from the Actie Directory and store them in the Tioli Directory Serer. For more information about running a reconciliation operation, see the Tioli Identity Manager information center. 6. Adopt orphan accounts on the Tioli Identity Manager. For more information about adopting orphan accounts, see the Tioli Identity Manager information center. Copyright IBM Corp

20 4 IBM Tioli Identity Manager: Actie Directory Adapter Users Guide

21 Chapter 3. Actie Directory Adapter user account management tasks Tioli Identity Manager manages user accounts stored on the Actie Directory using the Actie Directory Adapter. You can perform arious operations, such as reconciliation, add, modify (including password change), suspend, restore, and delete to manage your accounts. You can manage: Accounts for a specific person Accounts for a serice instance Reconciling user accounts Specific accounts using the search function of Tioli Identity Manager Before performing any operation using the adapter: 1. Ensure that you perform the steps gien in Chapter 2, Checklist for configuring Tioli Identity Manager to run the adapter, on page Start the Actie Directory Adapter using one of the following methods: Windows serices in serice mode a. In the Windows control panel, double-click Administratie Tools. b. Double-click Serices. c. Right-click the Tioli Actie Directory Agent serice, and click Start. Windows command prompt in console mode Go to the adapter installation directory and run the following command: adagent -console 3. Verify that the Actie Directory Adapter registry key settings are configured according to your requirements. To modify the alues of the registry keys, use the Actie Directory Adapter configuration tool, agentcfg. For more information, see the Actie Directory Adapter Installation and Configuration Guide and search for "Registry key descriptions" and "Starting the adapter configuration tool." The reconciliation operation retriees the user account information from the Actie Directory and stores it in the directory serer of Tioli Identity Manager. Reconciliation first compares the user account information on the Actie Directory with the existing user IDs on Tioli Identity Manager and then searches for an existing owner within Tioli Identity Manager. If a match exists between the user login ID and an account, Tioli Identity Manager creates an owner relationship between the person and the account. If the user login ID does not match an account, Tioli Identity Manager lists the unmatched account as an orphan account. Adopting an orphan account assigns ownership of the account to an existing person in Tioli Identity Manager. You can schedule reconciliation to run at specific times and to return specific parameters. Running a reconciliation before its scheduled time does not preent the reconciliation from running at the scheduled time. For more information about scheduling reconciliation and running a scheduled reconciliation, see the Tioli Identity Manager information center. Copyright IBM Corp

22 Attributes reconciled During reconciliation, the alue of the samaccountname attribute of the Actie Directory is returned to Tioli Identity Manager as the User Id attribute. When you perform a reconciliation, the Actie Directory Adapter returns all containers to the base point that is specified in the Actie Directory Adapter serice form. If you do not specify a base point at the time of creating an Actie Directory serice, then the adapter returns all containers to the Actie Directory. In a reconciliation operation, you can configure the adapter to return the Windows Terminal serices (WTS) attributes and the attributes that are related to the home directory security. To reconcile the WTS attributes, set the registry keys WtsDisableSearch to FALSE and WtsEnabled to TRUE. The Actie Directory Adapter retriees the following WTS attributes from the Actie Directory: Allow Logon Initial Program Inherit Initial Program Profile Path Connect Client Dries Connect Client Printers Client Printer Is Default Working Directory WTS Home Directory WTS Home Directory Drie WTS Callback Settings WTS Callback Number Idle Timeout Connection Timeout Disconnection Timeout Broken Timeout Setting Reconnect Settings Shadow Settings The default alue of the registry key WtsDisableSearch is TRUE. If you retain the default alue, then the adapter does not return the WTS attributes to Tioli Identity Manager and the reconciliation takes less time. Use the registry key ReconHomeDirSecurity to retriee the attributes that are related to the home directory security, such as NTFS security, share name, and share security from the Actie Directory. Attributes corresponding to the home directory security are: Home Directory NTFS Access Home Directory Share Home Directory Share Access WTS Home Directory NTFS Access WTS Home Directory Share 6 IBM Tioli Identity Manager: Actie Directory Adapter Users Guide

23 WTS Home Directory Share Access The default alue of the registry key ReconHomeDirSecurity is FALSE. If you retain the default alue, then the adapter does not retriee the attributes that are related to the home directory security and the reconciliation takes less time. To reconcile the attributes that are related to the home directory security, set the alue of the registry key ReconHomeDirSecurity to TRUE. Attributes not reconciled The Actie Directory Adapter does not return the following attributes to Tioli Identity Manager after reconciliation: User password System Call (This attribute is not supported by the Actie Directory Adapter.) WTS Serer Name Except for these attributes and the attributes that are retrieed depending on the alues of the registry keys, all other attributes are always reconciled. Reconciling support data In addition to reconciling user accounts, the Actie Directory Adapter also reconciles support data, such as groups, containers, and mailbox stores to Tioli Identity Manager. The support data is reconciled only when you perform a full reconciliation. Reconciling the useraccountcontrol attribute The user account status on Tioli Identity Manager can be either actie or inactie. During reconciliation, the Actie Directory Adapter retriees the status of a user account from the useraccountcontrol attribute on the Actie Directory. The ACCOUNTDISABLE property flag alue of the useraccountcontrol attribute determines the status of a user account. For more information about property flags of the useraccountcontrol attribute, see the Microsoft Windows Serer documentation. Filter reconciliation Filter reconciliation enables the Actie Directory Adapter to reconcile users, groups, containers, and mail stores from the Actie Directory based on the filters specified for the reconciliation. To enable the Actie Directory Adapter for filter reconciliation, set the alue of the Pass search filter to agent registry key to TRUE. To set the alue of the Pass search filter to agent registry key, use the adapter configuration tool, agentcfg. For more information about using the agentcfg tool, see the Actie Directory Adapter Installation and Configuration Guide and search for the section "Starting the adapter configuration tool." The search filter must be a Lightweight Directory Access Protocol (LDAP) ersion 2 filter. For information about specifying filters, see the Tioli Identity Manager information center. Supported attributes Table 1 on page 8 lists the attributes on the Actie Directory account form that the adapter supports for filter reconciliation. Chapter 3. Actie Directory Adapter user account management tasks 7

24 Table 1. Attributes supported by the adapter for filter reconciliation cn eradesmtp description eradestorequota eradallowdialin eradetargetaddress eradbadlogincount eradex400 eradcallbacknumber eradfax eradcountrycode eradhomedir eraddialincallback eradhomedirdrie eraddisplayname eradhomepage eradealias eradinitial eradedaysbeforegarbage eradloginscript eradeenablestoredeflts eradloginworkstations eradeextension1 eradnameprefix eradeextension10 eradnamesuffix eradeextension11 eradofficelocations eradeextension12 eradothername eradeextension13 eradpasswordforcechange eradeextension14 eradprimarygroup eradeextension15 eradupn eradeextension2 ercompany eradeextension3 erdepartment eradeextension4 erdiision eradeextension5 ermaxstorage eradeextension6 erprofile eradeextension7 eruid eradeextension8 gienname eradeextension9 homephone eradeforwardingstyle l eradeforwardto mail eradehardlimit mobile eradehidefromaddrsbk pager eradeincominglimit postalcode eradelanguages postofficebox erademployeeid sn eradeoutgoinglimit st eradeoerquotalimit street eradeoerridegarbage telephonenumber eradeproxyaddresses title eraderecipientlimit Note: The adapter supports extended attributes with the following syntax types: String Integer Boolean Examples of supported filters This section gies examples of supported filters. 8 IBM Tioli Identity Manager: Actie Directory Adapter Users Guide

25 Example 1: To retriee user accounts that hae the alue of the employeeid attribute on the Actie Directory account form as 1, specify the filter as (erademployeeid=1). Example 2: To retriee user accounts that hae the alue of the cn attribute on the Actie Directory account form as thomas, specify the filter as (cn=thomas). Example 3: To retriee user accounts that hae the alue of the Department name attribute as ibm and the Country attribute as United States, specify the filter as (&(eraddepartment=ibm*)(eradcountrycode=840)). Non-supported attributes Table 2 lists the attributes on the Actie Directory account form that the adapter does not support for filter reconciliation. Table 2. Attributes not supported by the adapter for filter reconciliation All WTS attributes eraccountstatus eradallowencryptedpassword eradcannotbedelegated eradcontainer eraddistinguishedname eradeapplyontoallow eradeapplyontodeny eradeassociatedextacc eradeautogen addrs eradechgpermissions eradedelegates eradedelmailboxstorage eradedenypermto1leel eradefullmailboxaccess eradegarbageafterbckp eradehomemdb erad boxstore eradereadpermissions eraderstrctadrsfg eraderstrctadrsls Examples of non-supported filters eradeserername eradeshowinaddrbook eradetakeownership eradexpirationdate eradisaccountlocked eradlastfailedlogin eradlastlogoff eradlastlogon eradmanager eradnochangepassword eradpasswordlastchange eradpasswordminimumlength eradpasswordneerexpires eradpasswordrequired eradrequireuniquepassword eradsmartcardrequired eradtrustedfordelegation ergroup erlogontimes erpassword This section gies examples of non-supported filters. Example 1: Filter reconciliation of attributes not supported The adapter does not support filter reconciliation of attributes, such as manager, distinguishedname, and memberof, because the alues of these attributes are stored in the distinguished name (DN) format in the Actie Directory. Chapter 3. Actie Directory Adapter user account management tasks 9

26 A group, group1, exists inside the organization unit Test under the domain adlab. This domain lies inside the parent domain com that exists on the Actie Directory. The Group attribute on the Actie Directory account form is mapped to the memberof attribute of the Actie Directory. If you specify the alue of the Group attribute on the Actie Directory account form as group1, then the adapter sets the alue of the memberof attribute in the DN format as CN=group1,OU=Test,DC=adalb,DC=com. To retriee users that are members of the group, group1, specify the filter as (ergroup=group1). The adapter searches for the alue group1 in the memberof attribute. Because the alue of the memberof attribute is stored in the DN format, the adapter fails to retriee users that are members of the group, group1. Example 2: Bit-leel filtering not supported The adapter does not support bit-leel filtering. The useraccountcontrol attribute in Actie Directory is a bit-mapped alue attribute. The Actie Directory Adapter retriees the status of a user account from the useraccountcontrol attribute on the Actie Directory. The attribute is of data type integer and its alue can be zero or a combination of one or more of the property flags. For more information about the property flags of the useraccountcontrol attribute, see the Microsoft Windows Serer documentation. To reconcile status of user accounts, specify the filter as (eraccountstatus=1). Because the alue of the useraccountcontrol is a combination of one or more property flags, the adapter fails to retriee any of the user accounts. Example 3: Attribute format differences not supported The adapter does not support filter reconciliation for attributes that hae their alues stored in the Actie Directory in a different format from those displayed on the Actie Directory account form. For example, if India is specified as the country on the Actie Directory account form, the adapter sets the three digit code 356 as the alue of the countrycode attribute in the Actie Directory. The countrycode attribute on the Actie Directory is mapped to the Country attribute on the Actie Directory account form. To reconcile all objects that hae the Country attribute set to India, specify the filter as (eradcountrycode=india). The adapter searches for the alue India in the countrycode attribute. Because the alue of the country India is stored as 356 in the countrycode attribute, the adapter returns success, but does not reconcile any user accounts. For a successful reconciliation, specify the country code of India as 356 in the filter in the following format: (eradcountrycode=356) Example 4: Not format filtering leads to unexpected results A filter using the not format (!(Attribute name=value)) leads to unexpected results. Though the format of the filter is alid, and the search is successful, the adapter retriees entire sets of data for all objects for which the specified attribute is not set. For example, to retriee user accounts that hae the empoyeeid attribute not equal to 1000, specify the filter as (!(erademployeeid=1000)). The adapter retriees: All user accounts that hae the employeeid attribute not equal to All groups because the group object does not contain the employeeid attribute. 10 IBM Tioli Identity Manager: Actie Directory Adapter Users Guide

27 All containers because the container object does not contain the employeeid attribute. All mail stores because the mail stores object does not contain the employeeid attribute. For a successful reconciliation, specify the object class with the attribute name. Therefore, to retriee user accounts that hae employeeid attribute not equal to 1000, specify the eradaccount object class with the employeeid attribute in the following format: (&((!(erademployeeid=1000))(objectclass=eradaccount))) Table 3 lists the objects and their corresponding object class that you must specify in addition to the attribute name for a successful filter reconciliation. Table 3. Objects and their corresponding object class Object Object class Group eradgroup Container eradcontainer Mail store eradmailstore User eradaccount Chapter 3. Actie Directory Adapter user account management tasks 11

28 Adding user accounts Perform the add operation from Tioli Identity Manager to add user accounts to the Actie Directory. You can add user accounts for either an existing person in the organization or a new person in the organization. For more information about adding user accounts, see the Tioli Identity Manager information center. Attributes for adding user account Specify a alue for the User Id attribute to add a user account on the Actie Directory. This attribute can contain: Alphabets Unicode characters Numbers Special characters, such as #, + \ < > The User Id attribute cannot include control characters, or any other special characters other than #, + \ < >. If the User Id attribute contains non-supported characters, the Actie Directory Adapter gies an error message. The adapter stores the alue of the User Id attribute in the samaccountname attribute on the Actie Directory. Note: The User Id attribute is the only attribute that is required to add an Actie Directory account. To add a user account, if you specify only the User Id attribute on the Actie Directory account form, then the following attributes are set on the Actie Directory. Table 4. List of attributes and their default alues on the Actie Directory Attribute Default alue Set by cn Value of the User Id attribute on the Actie Directory account form. countrycode 0 If country is specified on the Actie Directory account form, then the corresponding three-digit code is set on the Actie Directory Actie Directory Adapter Actie Directory lastlogoff 0 Actie Directory lastlogon 0 Actie Directory distinguishedname cn=rdn,cn=users,domain name (if no base point is specified on the Actie Directory Adapter serice form) cn=rdn,container,base point (if base point is specified on the Actie Directory Adapter serice form) Actie Directory Adapter primarygroupid 513 Actie Directory samaccountname Value of the User Id attribute on the Actie Directory account form. Actie Directory Adapter 12 IBM Tioli Identity Manager: Actie Directory Adapter Users Guide

29 Table 4. List of attributes and their default alues on the Actie Directory (continued) Attribute Default alue Set by name Value of the User Id attribute on the Actie Directory account form. Actie Directory userprincipalname Actie Directory Adapter badpwdcount 0 Actie Directory objectcategory CN=Person,CN=Schema, CN=Configuration,DC=domain name Actie Directory Creating a distinguished name for a user account The Actie Directory Adapter computes alues of arious attributes on the Actie Directory account form to create a distinguished name (DN) for a user account. To create a DN, the adapter: 1. Generates a Relatie Distinguished Name (RDN) for the user account. The following table lists the order in which the Actie Directory Adapter checks the alues of the attributes on the Actie Directory account form to generate an RDN. Table 5. The order of attributes on the Actie Directory account form that the adapter checks to generate an RDN Attributes on the Tioli Identity Manager RDN alue Full Name Full Name Display Name Display Name First Name First Name First Name Initial Last Name First Name Initial. Last Name Initial First Name Initial. Last Name First Name Last Name First Name First Name Last Name Last Name User Id User Id The following figure displays the decision tree for the process of generating an RDN. Chapter 3. Actie Directory Adapter user account management tasks 13

30 Is Full Name specified? No Yes Is Display Name specified? Generate RDN= Full Name No Yes Is First Name specified? Generate RDN= Display Name No Yes Is Last Name specified? Is Initial specified? No Yes No Yes Generate RDN= User Id Generate RDN= Last Name Is Last Name specified? Is Last Name specified? No Yes No Yes Generate RDN= First Name Generate RDN= First Name Last Name Generate RDN= First Name Initial. Generate RDN= First Name Initial. Last Name Figure 1. Decision tree for generating an RDN If the adapter finds an attribute alue, that alue is used for generating the RDN. For example, if the Full Name attribute is not found, then the adapter checks for the alue in the Display Name attribute. If a alue is found, the adapter uses the display name as the RDN; otherwise the adapter checks for the next attribute alue in the First Name attribute, and so on. User Id is the default alue of an RDN. The maximum length of an RDN is 64 characters. 2. Adds the string cn= as a prefix to the generated RDN. For example, cn=rdn. 3. Adds a container that contains the user account as a suffix to cn=rdn. The container is separated by a comma. The adapter adds the default user container cn=users as a suffix, if: You do not specify the Container attribute on the Actie Directory account form. You do not specify the Base Point DN attribute on the Actie Directory Adapter serice form. The base point that you specify on the Actie Directory Adapter serice form does not contain a container. Containers other than the Users container are represented as ou=organization unit, where organization unit is the name of the container. 4. Adds a domain name as a suffix to cn=rdn,cn=users. The domain name is separated by a comma. If a base point is specified on the Actie Directory Adapter serice form, then the domain name is the specified base point. Howeer, if no base point is specified on the Actie Directory Adapter serice form, then the adapter finds the default domain name where the adapter is running. Therefore, the distinguished name is: cn=rdn,cn=users,domain name. User principal name of a user account User principal name is an account name of a user in an address format. A user principal name consists of two parts: User identification: Contains the user log-on name Domain: Contains the domain name where the user account is located A user principal name is computed by separating these two parts by symbol. For example, username@domain name. If you specify the User Principal Name attribute on the Actie Directory account form, then the adapter sets the specified alue to the userprincipalname attribute on the Actie Directory. If the User Principal Name attribute is not specified, then 14 IBM Tioli Identity Manager: Actie Directory Adapter Users Guide

31 the adapter uses the alue of the User Id attribute as user principal name, and name to the user principal name. Specifying controls for a user account To specify controls for a user account, set the following attributes on the Actie Directory account form: Password Neer Expires Specifies whether a password can eer expire Password Required Specifies whether a password is required Smart Card Required Specifies whether a smart card is required for login User Cannot Change Password Specifies whether the user can change their password Allow Encrypted Password Specifies whether encrypted passwords are allowed These attributes correspond to the property flags of the useraccountcontrol attribute on the Actie Directory. The attribute names and their corresponding property flags are listed in the following table. Table 6. Attributes on the Actie Directory account form and their corresponding property flags Attribute Property flag Password Neer Expires DONT_EXPIRE_ PASSWORD Hexadecimal alue for the property flag 0x Password Required PASSWD_NOTREQD 0x Smart Card Required SMARTCARD_ REQUIRED User Cannot Change Password Allow Encrypted Password PASSWD_CANT_ CHANGE ENCRYPTED_TEXT _PWD_ALLOWED 0x x x Decimal alue for the property flag The alue of the useraccountcontrol attribute is the sum of the alues of the property flags that are enabled. For more information about property flags of the useraccountcontrol attribute, see the Microsoft Windows Serer documentation. You can force a user account to change the password on next log on by selecting the Force Password Change check box on the PASSWORD page of the Actie Directory account form. The Actie Directory Adapter maps the Force Password Change attribute to the pwdlastset attribute on the Actie Directory. If you select the Force Password Change check box, then the adapter sets the alue of the pwdlastset attribute to -1. If you do not select the Force Password Change check box, then the adapter sets the alue of the pwdlastset attribute to 0. Chapter 3. Actie Directory Adapter user account management tasks 15

32 Creating a home directory for a user account Before you create a home directory for a user account, ensure that you hae: Created a shared directory on the Windows serer Proided full access rights on that shared directory to the user account under which Actie Directory Adapter is running To create a home directory for a user account, set the alue of the following registry keys to TRUE: CreateUNCHomeDirectories ManageHomeDirectories Specify the following attributes on the Actie Directory account form: Home Directory Home Directory Drie The Home Directory attribute must be in the Uniersal Naming Conention (UNC) format. UNC is a format for specifying the location of resources in a Local Area Network (LAN). UNC uses the format: \\HOME_AD_SERVER\ SHARED_DIR\HOME DIR, where: HOME_AD_SERVER is the shared serer name SHARED_DIR is the shared directory HOME DIR is the name of the home directory for the user account For example, consider a user account with the following attribute settings on the Actie Directory account form. User Id Thomas Home Directory \\H20\homedir\thomas Home Directory Drie F: Because the alues of the registry keys CreateUNCHomeDirectories and ManageHomeDirectories are TRUE, the adapter creates a UNC home directory thomas on serer H20, inside the shared directory homedir, and maps the home directory thomas with drie F. To specify permissions on the home directory for a user account, set the Home Directory NTFS Access attribute for the user on the Actie Directory account form. The following table lists the alues of the Home Directory NTFS Access attribute and their corresponding permissions on the home directory. Table 7. Home Directory NTFS Access attribute alues and their corresponding permissions on the home directory Home Directory NTFS Access attribute alue Permissions Full You hae full control oer the home directory. You can: Change permissions Take ownership Delete subfolders and files Read, write, and change files 16 IBM Tioli Identity Manager: Actie Directory Adapter Users Guide

33 Table 7. Home Directory NTFS Access attribute alues and their corresponding permissions on the home directory (continued) Home Directory NTFS Access attribute alue Permissions Change You hae following controls oer files and subfolders in the home directory: Read Write Modify Enabling a user account for mail There can be two types of user accounts: Mail-enabled An Actie Directory user account that has an address associated with it, but has no mailbox on the Exchange serer. A mail-enabled user can send and receie using another messaging system. If you send messages to a mail-enabled user account, then these messages pass through the Exchange serer, and are forwarded to an external ID of that user account. For example, Thomas is an employee of company1, with a mailbox on the Exchange serer of company1, and an ID thomas1@company1.com. Company2 takes oer company1. The employees of company1 hae mail-enabled user accounts in the domain of company2. The new ID of Thomas is thomas1@company2.com. Therefore, Thomas can send and receie mail with the new ID, but the mailbox for Thomas is not on the Exchange serer of company2. It is on the Exchange serer of company1. Mailbox-enabled An Actie Directory user account that has a mailbox on the Exchange serer. A mailbox-enabled user can send and receie messages, and store messages on the Exchange serer mailboxes. To create a mail-enabled user account, you must specify the alues of the Alias and the Target Address attributes on the Actie Directory account form. To create a mailbox-enabled user account, you must specify the alues of the Alias and the Mailbox Store attributes on the Actie Directory account form. The Exchange serer uses the alue of the Alias attribute to generate an ID for a user account. If the alue of the Alias attribute of another user account matches an existing alias, then the Exchange serer appends a number to the ID of the other user account. For example, a user account Thomas with alias thomas1 exists on the Actie Directory. The ID of Thomas is thomas1@ibm.com. If you create another user account Nancy with alias thomas1, then the Exchange serer generates the ID thomas12@ibm.com for Nancy. Note: If you specify both the attributes, Mailbox Store and Target Address, then the Actie Directory Adapter gies an error. Creating a proxy address for a user account By default, the Exchange serer assigns a primary Simple Mail Transfer Protocol (SMTP) proxy address to a user account when a mailbox is created. Chapter 3. Actie Directory Adapter user account management tasks 17

34 Modifying user accounts To create multiple proxy addresses for a user account specify the Proxy Addresses attribute on the Actie Directory account form. The primary proxy address of an SMTP address type cannot be deleted. Note: Always specify a primary proxy address in uppercase and a secondary proxy address in lowercase. For example, a user account Thomas exists on the Actie Directory with the following alues in the Actie Directory account form. User Id Thomas Proxy Addresses SMTP:Thomas@ibm.com smtp:thomas2@ibm.com In this example, SMTP:Thomas@ibm.com is the primary SMTP proxy address, and smtp:thomas2@ibm.com is the secondary SMTP proxy address. Note: To create an X.400 proxy address for a user account, you must specify the primary SMTP proxy address. You can modify user account attributes in Tioli Identity Manager. For more information about modifying user accounts, see the Tioli Identity Manager information center. Modifying the container attribute If you do not specify a base point at the time of creating an Actie Directory serice, the Actie Directory Adapter, by default, creates new users in the Users container of the Actie Directory. Modifying the Container attribute means moing a user from one container to another. You can moe a user between: Containers that are stored at the specified base point All containers, if no base point is specified When you modify the Container attribute, the distinguished name of a user changes because the user moes to a different position in the Actie Directory hierarchy. The following example illustrates changes in the distinguished name of a user, when you modify the Container attribute: For example, a user account with the name Thomas Daniel exists on the Actie Directory. The Actie Directory has the following structure. 18 IBM Tioli Identity Manager: Actie Directory Adapter Users Guide

35 dc=ibm,dc=com Users Thomas Daniel Nancy Kerry Departments The distinguished name of Thomas Daniel is: cn=thomas Daniel,cn=Users,dc=ibm,dc=com Modify the Container attribute on Tioli Identity Manager from cn=users to ou=marketing. After this change, the distinguished name of Thomas Daniel changes to the following alue: cn=thomas Daniel,ou=Marketing,ou=Departments,dc=ibm,dc=com Modifying the Home Directory attribute The Actie Directory Adapter supports creation and deletion of home directories only in the shared folders on the Windows serer. The adapter does not support the creation and deletion of local home directories. The following examples describe the behaior of the Actie Directory Adapter when you modify the attributes that are related to the home directory on the Actie Directory account form, for an existing user account. Example 1: A user account Thomas Daniel exists on the Actie Directory with the following alues in the Actie Directory account form. Attribute Sales Marketing Figure 2. Example of an Actie Directory structure Value Home Directory \\H20\shareddir\thomas Home Directory Drie F: Home Directory Share homedirshare1 Values of the registry keys are: ManageHomeDirectories = TRUE DeleteUNCHomeDirectories = FALSE CreateUNCHomeDirectories = TRUE Delete alues of the attributes that are related to the home directory. Because the alue of the registry key DeleteUNCHomeDirectories is FALSE, the adapter: Does not delete the home directory thomas from the serer H20 Does not remoe the share homedirshare1 Deletes alues of the Home Directory and the Home Directory Drie attributes on the Actie Directory Chapter 3. Actie Directory Adapter user account management tasks 19