Tivoli Identity Manager Server

Transcription

1 Tioli Identity Manager Serer Version 5.1 Installation and Configuration Guide SC

2

3 Tioli Identity Manager Serer Version 5.1 Installation and Configuration Guide SC

4 Note: Before using this information and the product it supports, read the information in Appendix E, Notices, on page 151. Edition notice This edition applies to ersion 5.1 of Tioli Identity Manager and to all subsequent releases and modifications until otherwise indicated in new editions. This edition obsoletes and replaces SC Copyright International Business Machines Corporation US Goernment Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Contents Preface ii Who should read this book ii Publications and related information ii Tioli Identity Manager library ii Prerequisite product publications ix Related publications x Accessing publications online x Accessibility xi Support information xi Conentions used in this book xi Typeface conentions xi Definitions for HOME and other directory ariables xii Operating system differences xi Chapter 1. Oeriew of the Tioli Identity Manager enironment Tioli Identity Manager components Database serer products Directory serer products IBM Tioli Directory Integrator WebSphere Application Serer An HTTP serer and WebSphere Web Serer plug-in Tioli Identity Manager Serer Tioli Identity Manager adapters Configuration options Single-serer configuration Cluster configuration Oeriew of the installation Planning actiities for deployments at large sites.. 6 Chapter 2. Installing and configuring a database Before you install the database product Installing and configuring IBM DB2 Database Recording user data Verifying the installation Installing the required fix packs Configuring IBM DB2 Database Tuning the DB2 Database for performance Installing and configuring the Oracle database Before you create a database Creating the Tioli Identity Manager database.. 21 Tuning the Oracle database for performance.. 23 Starting the Oracle product and the listener serice Installing and configuring SQL Serer 2005 on the Windows operating system Preparing to install SQL Serer Installing SQL Serer Configuring SQL Serer Creating the Tioli Identity Manager database.. 25 Chapter 3. Installing and configuring a directory serer Before you install the directory serer product Installing and configuring IBM Tioli Directory Serer Installing IBM Tioli Directory Serer Installing the required fix packs Configuring IBM Tioli Directory Serer Sun Enterprise Directory Serer Installing Sun Enterprise Directory Serer Configuring Sun Enterprise Directory Serer.. 36 Chapter 4. Optionally installing IBM Tioli Directory Integrator Before you install the directory integrator product 39 Installing IBM Tioli Directory Integrator Installing IBM Tioli Directory Integrator Installing the required fix packs Installing agentless adapters Chapter 5. Installing and configuring WebSphere Application Serer Before you install WebSphere Application Serer.. 41 Installing the WebSphere Application Serer product 41 Installing WebSphere Application Serer in a single-serer enironment Installing WebSphere Application Serer in a cluster enironment Tuning WebSphere Application Serer for performance Chapter 6. Installing Tioli Identity Manager Installing Tioli Identity Manager in a single-serer configuration Before you begin Starting the installation wizard Completing the installation wizard pages Responding to major installation actions Verifying that the Tioli Identity Manager Serer is operational Installing Tioli Identity Manager in a cluster configuration Before you begin Oeriew of the installation program in a cluster configuration Starting the installation wizard Completing the installation wizard pages Responding to major installation actions Starting clusters Verifying that the Tioli Identity Manager Serer is operational Optional post-installation tasks Optionally installing a language pack Copyright IBM Corp iii

6 Optionally installing adapter profiles Changing cluster configurations after Tioli Identity Manager is installed Chapter 7. Configuring the Tioli Identity Manager Serer Configuring the Tioli Identity Manager database 75 Completing the database configuration windows 75 Manually starting the DBConfig database configuration tool Configuring the directory serer Completing the directory serer configuration windows Manually running the ldapconfig configuration tool Configuring commonly used system properties.. 77 General tab Directory tab Database tab Logging tab Mail tab UI tab Security tab Manually starting the system configuration tool 82 Manually installing agentless adapters and adapter profiles Installing agentless adapters Installing agentless adapter profiles Modifying system properties during normal operation Modifying system properties with the system configuration tool Modifying system properties manually Modifying system properties with the Tioli Identity Manager GUI Chapter 8. Performing a silent installation and configuration of Tioli Identity Manager Before you begin Performing a silent installation in a single-serer enironment Performing a silent installation in a cluster enironment Configuring the database silently Configuring the directory serer silently Configuring the system silently in a single-serer enironment Configuring the system silently in a cluster enironment Chapter 9. Verifying and troubleshooting the installation Correcting problems with starting the installation. 95 Tioli Identity Manager configuration errors Verifying the installation Ensuring that the WebSphere Application Serer is running Verifying that the Tioli Identity Manager Serer is running Verifying that the database is running correctly 98 Verifying that the directory serer is properly running Checking the Web browser operation Troubleshooting Tioli Identity Manager within WebSphere Application Serer Correcting connection scripting errors Correcting timeout errors Determining the port number of the default host 104 Log files Chapter 10. Upgrading to Tioli Identity Manager Version Description of the upgrade process Processes and settings that the upgrade process preseres Processes and settings that are not presered, or require manual upgrade Before you begin Upgrading from Tioli Identity Manager Version 4.6 or 5.0 to Version 5.1 or Version 5.1 on Websphere Application Serer 6.1 to Websphere Application Serer Upgrading a single-serer configuration Upgrading a cluster configuration Clearing the serice integration bus Determining that the WebSphere MQ message queue is empty Presering customized data manually Manually applying Jaa security Customizing logos and style sheets Presering WebSphere Application Serer customizations Migrating notification templates Manually upgrading the access control items 123 Configuring Crystal Chapter 11. Uninstalling Tioli Identity Manager What is not remoed Before you begin Steps to uninstall Tioli Identity Manager Verifying that the Tioli Identity Manager Serer is uninstalled Manually remoing components Manually remoing the Tioli Identity Manager Serer from the WebSphere Application Serer. 126 Stopping and remoing the Tioli Identity Manager messaging engine Remoing other Tioli Identity Manager configuration settings from the WebSphere Application Serer Manually remoing other files or directories Reinstalling Tioli Identity Manager Ensuring that Tioli Identity Manager objects are remoed from the Sun Enterprise Directory Serer i IBM Tioli Identity Manager Serer: Installation and Configuration Guide

7 Appendix A. Mapping Tioli Identity Manager application modules to IBM HTTP Serer Appendix B. Configuring security for Tioli Identity Manager Configuring security for the directory serer Configuring SSL for IBM Tioli Directory Serer 133 Configuring SSL for Sun Enterprise Directory Serer Configuring the SSL client to trust the LDAP serer certificate Configuring security for WebSphere Application Serer Mapping an administratie user to a role Updating the system user and the EJB user Enabling Jaa 2 security by creating and modifying policy files Running Jaa 2 security on single-node deployments Running Jaa 2 security on multi-node deployments Increasing the timeout interal Enabling FIPS compliance for WebSphere Application Serer Running the cipher migration tool Appendix C. Installation images and fix packs Installation images Setting the SOAP timeout interal before installing fix packs Obtaining fix packs Appendix D. Worksheets Appendix E. Notices Trademarks Glossary Index Contents

8 i IBM Tioli Identity Manager Serer: Installation and Configuration Guide

9 Preface Who should read this book This guide describes how to install and configure Tioli Identity Manager. This book is intended for system and security administrators who install, maintain, or administer software on their computer systems. Readers are expected to understand system and security administration concepts. Additionally, the reader must understand administration concepts for the following types of products: Database serers Directory serers Application serers Publications and related information Read the descriptions of the Tioli Identity Manager library. To determine which additional publications you might find helpful, read the Prerequisite product publications on page ix and the Related publications on page x. After you determine the publications you need, refer to the instructions in Accessing publications online on page x. Tioli Identity Manager library The publications in the Tioli Identity Manager technical documentation library can be found at the following URL: welcome.htm The publications in the Tioli Identity Manager technical documentation library are organized into the following categories: Release information Online user assistance Serer installation and configuration Problem determination Technical supplements Adapter installation and configuration Release Information: Tioli Identity Manager Quick Start Guide Helps you install a base configuration of Tioli Identity Manager. Tioli Identity Manager Information Center Proides software and hardware requirements for Tioli Identity Manager and additional fix, patch, and other support information. This publication also includes known limitations, problems, and workarounds. Online user assistance: Copyright IBM Corp ii

10 Tioli Identity Manager Information Center proides online help topics and an information center for all Tioli Identity Manager administratie tasks. Serer installation and configuration: Tioli Identity Manager Serer Installation and Configuration Guide proides installation and configuration information for Tioli Identity Manager. Problem determination: Tioli Identity Manager Problem Determination Guide proides problem determination, and logging information for Tioli Identity Manager. Tioli Identity Manager Messages Guide proides message information for Tioli Identity Manager. Database and schema information: Tioli Identity Manager Database and Schema Reference describes some of the data structures used by Tioli Identity Manager. Technical supplements: The following technical supplements are proided by deelopers or by other groups who are interested in this product: Redbooks and white papers are aailable on the Web at: Technotes are aailable on the Web at: Field guides are aailable on the Web at: For an extended list of other Tioli Identity Manager resources, search the following IBM deeloperworks Web site: Adapter installation and configuration: The Tioli Identity Manager Serer technical documentation library also includes an eoling set of platform-specific installation documents for the adapter components of an IBM Tioli Identity Manager implementation. Locate adapter documentation on the Web at: Performance and tuning: IBM Tioli Identity Manager Performance Tuning Guide proides information to help you optimize the use of resources for Tioli Identity Manager. Skills and training: Additional skills and technical training information might be aailable at the following Web sites: iii IBM Tioli Identity Manager Serer: Installation and Configuration Guide

11 IBM Professional Certification at: Search on identity manager to locate aailable classes and certification offerings. Virtual Skills Center for Tioli Software on the Web at: Tioli Education Software Training Roadmaps on the Web at: Tioli Technical Exchange on the Web at: supp_tech_exch.html Prerequisite product publications To use the information in this book effectiely, you must hae knowledge of the products that are prerequisites for Tioli Identity Manager. Publications are aailable from the following locations: Operating systems AIX com.ibm.aix.doc/doc/base/aixinformation.htm Sun Solaris Microsoft Windows Serer Support - Documentation Red Hat Linux SUSE Linux WebSphere Application Serer Hardware and software requirements Support Information center IBM DB2 Database Support: Information center: Documentation Preface ix

12 DB2 product family: Fix packs by ersion: System requirements: IBM Tioli Directory Serer Support IBMDirectorySerer.html Information center com.ibm.ibmds.doc_6.0/welcome.htm com.ibm.ibmds.doc/welcome.htm IBM Tioli Directory Integrator Support IBMDirectoryIntegrator.html Information center com.ibm.ibmdi.doc/toc.xml Related publications Information that is related to Tioli Identity Manager Serer is aailable in the following publications: The Tioli Software Library proides a ariety of Tioli publications such as white papers, datasheets, demonstrations, redbooks, and announcement letters. The Tioli Software Library is aailable on the Web at: The Tioli Software Glossary includes definitions for many of the technical terms related to Tioli software. The Tioli Software Glossary is aailable from the Glossary link of the Tioli Software Library Web page at: Accessing publications online IBM posts publications for this and all other Tioli products, as they become aailable and wheneer they are updated, to the Tioli software information center Web site. Access the Tioli software information center at the following Web address: Click the I character in the A-Z list, and then click the Tioli Identity Manager link to access the product library. Note: If you print PDF documents on other than letter-sized paper, set the option in the File Print window that allows Adobe Reader to print letter-sized pages on your local paper. x IBM Tioli Identity Manager Serer: Installation and Configuration Guide

13 Accessibility Support information The product documentation includes the following features to aid accessibility: Documentation is aailable in conertible PDF format to gie the maximum opportunity for users to apply screen-reader software. All images in the online documentation are proided with alternatie text so that users with ision impairments can understand the contents of the images. If you hae a problem with your IBM software, you want to resole it quickly. IBM proides the following ways for you to obtain the support you need: Conentions used in this book Searching knowledge bases: You can search across a large collection of known problems and workarounds, Technotes, and other information. Obtaining fixes: You can locate the latest fixes that are already aailable for your product. Contacting IBM Software Support: If you still cannot sole your problem, and you need to work with someone from IBM, you can use a ariety of ways to contact IBM Software Support. This book uses seeral conentions for highlighting terms and actions and for operating system-dependent commands and paths. Typeface conentions This book uses the following typeface conentions: Bold Lowercase commands and mixed case commands that are otherwise difficult to distinguish from surrounding text Interface controls (check boxes, push buttons, radio buttons, spin buttons, fields, folders, icons, list boxes, items inside list boxes, multicolumn lists, containers, menu choices, menu names, tabs, property sheets), and labels (such as Tip:) Keywords and parameters in text Italic Words defined in text Emphasis of words (words as words) New terms in text (except in a definition list) Variables and alues that you must proide Monospace Examples and code examples File names, programming keywords, and other elements that are difficult to distinguish from surrounding text Message text and prompts addressed to the user Text that the user must type Values for arguments or command options Preface xi

14 Definitions for HOME and other directory ariables The following table contains the default definitions that are used in this guide to represent the HOME directory leel for arious product installation paths. You can customize the installation directory and HOME directory for your specific implementation. If this is the case, you need to make the appropriate substitution for the definition of each ariable represented in this table. The alue of path aries for these operating systems. For Windows, the default path is drie:\program Files. For UNIX/Linux, the default path is /opt Path Variable Default Definition Description DB_HOME Windows: path\ibm\sqllib UNIX/Linux: path/ibm/db2/v9.1 The directory that contains the DB2 Database for Tioli Identity Manager. DB_INSTANCE_HOME Windows: drie:\dbinstancename Solaris: /export/home/dbinstancename The directory that contains the DB2 instance for Tioli Identity Manager. ITDS_HOME Other UNIX/Linux: /home/dbinstancename Windows: Version 6.0 path\ibm\ldap\v6.0 Version 6.1 path\ibm\ldap\v6.1 UNIX/Linux: Version 6.0 path/ibm/ldap/v6.0 Version 6.1 path/ibm/ldap/v6.1 The directory that contains the IBM Tioli Directory Serer code. xii IBM Tioli Identity Manager Serer: Installation and Configuration Guide

15 Path Variable Default Definition Description ITDS_INSTANCE_HOME Windows: drie:\ idsslapd-instance_owner_name The directory that contains the IBM Tioli Directory Serer Version 6.0 The alue of drie might be C:\ on Windows systems. An example of instance_owner_name might be ldapdb2. For example, the log file might be C:\idsslapd-ldapdb2\logs\ibmslapd.log. or Version 6.1 instance. UNIX/Linux: /home/instance_owner_name/ idsslapd-instance_owner_name Solaris: /export/home/instance_owner_name/ idsslapd-instance_owner_name ITDI_HOME ITIM_HOME TIVOLI_COMMON_ DIRECTORY WAS_HOME WAS_PROFILE_HOME An example of instance_owner_name might be ldapdb2. For example, the log file might be /export/home/ldapdb2/ idsslapd-ldapdb2/logs/ibmslapd.log Windows: path\ibm\tdi\v6.1.1 UNIX/Linux: path/ibm/tdi/v6.1.1 Windows: path\ibm\itim UNIX/Linux: path/ibm/itim Windows: path\ibm\tioli\common UNIX/Linux: path/ibm/tioli/common Windows: path\ibm\websphere\appserer UNIX/Linux: path/ibm/websphere/appserer Windows: path\ibm\websphere\appserer\ profiles\profile_name UNIX/Linux: path/ibm/websphere/appserer/ profiles/profile_name The directory that contains the IBM Tioli Directory Integrator Serer code. Also, where adapters are installed. The base directory that contains the Tioli Identity Manager code, configuration, and documentation. The central location for all sericeabilityrelated files, such as logs and first-failure capture data. The directory that contains the WebSphere Application Serer code. The directory that contains the WebSphere Application Serer custom profile. Preface xiii

16 Path Variable Default Definition Description WAS_NDM_PROFILE_ HOME Windows: path\ibm\websphere\appserer\ profiles\dmgr01 UNIX/Linux: path/ibm/websphere/appserer/ profiles/dmgr01 The directory that contains the WebSphere Application Serer Network Deployment Manager profile. Operating system differences This guide uses the Windows conention for specifying enironment ariables and for directory notation. When using the UNIX/Linux command line, replace %ariable% with $ariable for enironment ariables, and replace each backslash (\) with a forward slash (/) in directory paths. The names of enironment ariables are not always the same in Windows and UNIX/Linux. For example, %TEMP% in the Windows operating system is equialent to /tmp in a UNIX/Linux operating system. Note: If you are using the bash shell on a Windows system, you can use the UNIX/Linux conention for specifying file path notation. xi IBM Tioli Identity Manager Serer: Installation and Configuration Guide

17 Chapter 1. Oeriew of the Tioli Identity Manager enironment This book focuses on the tasks that you must complete in order to install and configure Tioli Identity Manager. To determine the supported release leels and fix pack specifications for the supported UNIX, Linux and Windows operating systems, refer to the Tioli Identity Manager Information Center, which takes precedence oer this document. Tioli Identity Manager components Tioli Identity Manager proides life cycle management of user accounts on remote resources, using adapters to proide communication. The Tioli Identity Manager product: Proides user accounts to authorized users on one or more resources to which Tioli Identity Manager adapters are connected Runs in a WebSphere Application Serer enironment, either in a single-serer or a cluster configuration Stores historical and pending data in a database serer Stores user account and organizational data in an LDAP directory serer Stores Tioli Identity Manager information used for auditing and reporting in the database Proides administration from a client interface in a Web browser that communicates through an HTTP serer and WebSphere Web Serer plug-in or a WebSphere Application Serer embedded HTTP transport. Tioli Identity Manager requires the installation and configuration of the following components: A database serer A directory serer IBM Tioli Directory Integrator (optional) WebSphere Application Serer An HTTP serer (optional) Tioli Identity Manager Serer Tioli Identity Manager adapters Database serer products Tioli Identity Manager stores transactional and historical data in a database serer. For example, the Tioli Identity Manager proisioning processes use a relational database to maintain their current state as well as their history. Computers that communicate with the database require a Jaa Database Connectiity drier (JDBC drier). For example, a JDBC drier enables a Tioli Identity Manager Serer to communicate with the data source. Tioli Identity Manager supports a JDBC type 4 drier to connect a Jaa-based application to a database. Copyright IBM Corp

18 The supported database products are IBM DB2 Database, Oracle DB, and MS SQL Serer database. The following information is about the type 4 JDBC driers for each database product. IBM DB2 Database DB2 supports a Type 4 JDBC drier. The DB2 type 4 JDBC drier is bundled with the Tioli Identity Manager installation program. Oracle database The Oracle database supports a Type 4 JDBC drier. The Tioli Identity Manager installation program prompts for the location and name of this JDBC drier. Before you install the Tioli Identity Manager Serer, obtain this JDBC drier from your Oracle Database Serer installation in the ORACLE_HOME\jdbc\lib\ directory. Alternatiely, you can download the drier from this Web site: index.html For WebSphere Application Serer ersion 6.1, the JDBC drier is ojdbc5.jar. For WebSphere Application Serer ersion 7.0, the JDBC drier is ojdbc6.jar. Microsoft SQL Serer database The SQL Serer database supports a Type 4 JDBC drier. The Tioli Identity Manager installation program prompts for the location and name of this JDBC drier. You can download the drier from this Web site: For more information about supported database serer products, refer to the Tioli Identity Manager Information Center. Directory serer products Tioli Identity Manager stores the current state of managed identities in an LDAP directory, including user account and organizational data. Tioli Identity Manager supports the following products: IBM Tioli Directory Serer Sun Enterprise Directory Serer For more information about supported directory serer products, refer to the Tioli Identity Manager Information Center. IBM Tioli Directory Integrator IBM Tioli Directory Integrator is an optional installation component that synchronizes identity data residing in different directories, databases, and applications. IBM Tioli Directory Integrator synchronizes and manages information exchanges between applications or directory sources. For more information about IBM Tioli Directory Integrator, refer to the Tioli Identity Manager Information Center. 2 IBM Tioli Identity Manager Serer: Installation and Configuration Guide

19 WebSphere Application Serer The WebSphere Application Serer is the primary component of the WebSphere enironment. The WebSphere Application Serer runs a Jaa irtual machine, proiding the runtime enironment for the enterprise application code. The application serer proides containers that specialize in enabling the execution of specific Jaa application components. The Tioli Identity Manager application can run on a single-serer configuration with the WebSphere Application Serer base serer. Tioli Identity Manager can also run in a larger cluster configuration that is composed of one or more WebSphere Application Serers and a deployment manager that manages the cluster. For additional information about the WebSphere Application Serer products, refer to additional documentation cited in Prerequisite product publications on page ix. An HTTP serer and WebSphere Web Serer plug-in An HTTP serer is an optional component that proides administration of Tioli Identity Manager through a client interface in a Web browser. Tioli Identity Manager requires the installation of a WebSphere Web Serer plug-in with the HTTP serer. WebSphere Application Serer proides separate installers to install the IBM HTTP Serer and WebSphere Web Serer plug-in. You can install these components either with the WebSphere Application Serer or on a separate computer. Note: If an HTTP serer is used, you must use the WebSphere Application Serer Administratie Console to map the Tioli Identity Manager applications to the HTTP Web serer name. See Appendix A, Mapping Tioli Identity Manager application modules to IBM HTTP Serer, on page 131 for more information about mapping the applications. Tioli Identity Manager Serer The Tioli Identity Manager Serer and its adapters enable you to proision identities to a set of heterogeneous resources, which might be operating systems, data stores, or other applications. Tioli Identity Manager adapters Tioli Identity Manager adapters enable you to connect the Tioli Identity Manager Serer to a set of heterogeneous resources, which can be operating systems, data stores, or other applications, in order to proision identities. An adapter is a program that proides an interface between a managed resource and the Tioli Identity Manager Serer. Adapters function as trusted irtual administrators on the target platform for account management. For example, adapters perform such tasks as creating accounts, suspending accounts, and modifying account attributes. A Tioli Identity Manager adapter can be either agent-based or agentless: Agent-based adapter You install adapter code directly onto the managed resource with which it is designed to communicate. Chapter 1. Oeriew of the Tioli Identity Manager enironment 3

20 Configuration options Agentless adapter Deploys its adapter code onto the Tioli Identity Manager Serer and the system hosting IBM Tioli Directory Integrator. The adapter code is separate from the managed resource with which it is designed to communicate. Note: For agentless adapters, the SSH process or daemon must be actie on the managed resource. Before you install Tioli Identity Manager, you must determine how to configure WebSphere Application Serer, either in a single-serer or a cluster configuration. Single-serer configuration A single-serer configuration contains the WebSphere Application Serer base serer and Tioli Identity Manager on one computer. Other required applications can run on the same computer or a different computer. You must ensure that the computer has the required memory, speed, and aailable disk space to meet the workload. A single-serer configuration requires the following components and products: A database serer A directory serer IBM Tioli Directory Integrator (optional) WebSphere Application Serer base serer Tioli Identity Manager Serer Tioli Identity Manager adapters Cluster configuration A cluster configuration contains WebSphere Application Serer nodes, which are logical groups of one or more application serers on computers. Nodes reside within an administratie domain called a cell, which the deployment manager manages. A node agent manages all managed processes on the node by communicating with the deployment manager to coordinate and synchronize the configuration. The deployment manager is the administratie process that proides a centralized management iew and control for all elements in the cell, including the management of clusters. Tioli Identity Manager assumes that the operating system is the same for each cluster member. For example, all Tioli Identity Manager cluster members run on the IBM AIX operating system. To aoid problems with identity feeds, do not use more than one operating system type within a Tioli Identity Manager cluster. Tioli Identity Manager does not support a ertical cluster configuration, which has more than one cluster member within a WebSphere Application Serer node. For example, one cluster configuration might consist of one or more WebSphere Application Serer nodes, each node consisting of one computer, controlled by a deployment manager on a separate serer. The remaining applications are configured on additional computers. 4 IBM Tioli Identity Manager Serer: Installation and Configuration Guide

21 Oeriew of the installation This task is an example cluster configuration: On the computer where you want to hae the deployment manager, install the following components and products: The WebSphere Application Serer deployment manager A JDBC drier, if required The Tioli Identity Manager Serer A cluster member is an instance of a WebSphere Application Serer in a cluster. On each cluster member, install the following components and products: WebSphere Application Serer base serer Tioli Identity Manager Serer A JDBC drier, if required On one or more additional computers that can be in or out of the cluster, install the following components and products: A database serer A directory serer IBM Tioli Directory Integrator (optional) An IBM HTTP Serer and WebSphere Web Serer plug-in (optional) This task is an example configuration only. An alternatie topology might configure these components on computers that are all inside the cluster, and the deployment manager might reside on the same computer as the WebSphere Application Serer base serer. You must ensure that the computer has the required memory, speed, and aailable space to meet the additional load. The installation consists of a collection of actiities. The major steps to install and test Tioli Identity Manager are: 1. Determine the Tioli Identity Manager Serer topology. The information in this chapter describes the major configuration choices. 2. Ensure that the operating system of each physical serer is at the leel that Tioli Identity Manager requires. For more information about software and hardware requirements, refer to the Tioli Identity Manager Information Center. 3. Ensure that the database serer is installed and preconfigured. See Chapter 2, Installing and configuring a database, on page 9 for steps to prepare the database. 4. Ensure that the directory serer is installed and preconfigured. See Chapter 3, Installing and configuring a directory serer, on page 27 for steps to prepare the directory serer. 5. Ensure that IBM Tioli Directory Integrator is installed and preconfigured. See Chapter 4, Optionally installing IBM Tioli Directory Integrator, on page 39 for steps to prepare IBM Tioli Directory Integrator. 6. Determine that the WebSphere Application Serer is ready. See Chapter 5, Installing and configuring WebSphere Application Serer, on page 41 for steps to prepare the WebSphere Application Serer in a single-cluster or cluster configuration. 7. Install and configure Tioli Identity Manager on one of these configurations: Single-serer. Tioli Identity Manager supports both regular and silent installation. For more information about single-serer install, see Installing Tioli Identity Manager in a single-serer configuration on page 51. Chapter 1. Oeriew of the Tioli Identity Manager enironment 5

22 Cluster. Tioli Identity Manager supports both regular and silent installation. For more information about cluster install, see Installing Tioli Identity Manager in a cluster configuration on page 60. For steps to upgrade from an existing installation of Tioli Identity Manager, see Chapter 10, Upgrading to Tioli Identity Manager Version 5.1, on page 105. For steps to perform a silent installation of Tioli Identity Manager, see Chapter 8, Performing a silent installation and configuration of Tioli Identity Manager, on page Verify the installation and troubleshoot to resole any problems that happened during installation and startup. For more information, see Chapter 9, Verifying and troubleshooting the installation, on page 95. Planning actiities for deployments at large sites In large organizations, there are additional tasks that require planning before you deploy Tioli Identity Manager. For more information, refer to the Planning section of the Tioli Identity Manager Information Center To preent initial deployment problems, consider proiding a ariation of the following planning actiities that are appropriate for your site, in adance of installing Tioli Identity Manager, and also subsequent fix packs: Establish a working practice that proides comprehensie and releant Tioli Identity Manager information to all the specialists who install middleware. For example, hae the team meet regularly to enumerate their problems and share their solutions. To ensure coordination, designate one person as a focal point for concerns that flow between your site and IBM customer support specialists. If possible, reduce the number of specialists who install and configure the applications. Encourage communication flow between specialists in the following ways. Proide a comprehensie library or list of FTP and Web sites for prerequisite installation and configuration information. Ensure that the specialists installing Tioli Identity Manager hae root or Administrator authority for the prerequisite middleware on the middleware serers. Ensure that all elements of the system or solution hae sufficient priileges to proide accounts. Support a centralized problem and solution database that identifies troubleshooting actions and assigns action owners. Maintain a common library of scripts that automate start up. Create a change control database that coordinates all customization actiities. Determine a working practice in which specialists proide a record of critical alues of configuration parameters like the ones that this publication proides. Ensure that all specialists hae access to and use a common worksheet that centralizes the information. For example, each installation chapter in this manual proides a checklist of prerequisites that must be installed, configured, and running before you begin installation. Additionally, Appendix B, Configuring security for Tioli Identity Manager, on page 133 proides a centralized collection point for 6 IBM Tioli Identity Manager Serer: Installation and Configuration Guide

23 critical alues such as user IDs, passwords, and security settings. The IBM Tioli Identity Manager Information Center specifies prerequisite leels and fix packs or patches. Chapter 1. Oeriew of the Tioli Identity Manager enironment 7

24 8 IBM Tioli Identity Manager Serer: Installation and Configuration Guide

25 Chapter 2. Installing and configuring a database The Tioli Identity Manager application stores transactional and historical data, including schedules, access control item definitions (ACIs), and audit data in a database. This chapter focuses on configuring a Tioli Identity Manager database before Tioli Identity Manager installation. For more information about supported database releases and required fix packs, refer to the Tioli Identity Manager Information Center. The information in this chapter is not a substitute for the more extensie, prerequisite documentation that is proided by the database product. For more information that you must preiously know, refer to these sources: IBM DB2 Database (Information center) (Operating system prerequisites) 9pubs.d2w/en_main Oracle Microsoft SQL Serer Before you install the database product Before you install the database product, complete these steps: Read the installation information that the database product proides. Ensure that your installation meets the product hardware and software requirements. Verify that all required operating system patches are in place. Ensure that kernel settings are correct for some operating systems, such as the Solaris operating system. Each database application specifies its own requirements, such as additional operating system alues. Before installing the application, refer to its documentation for these additional settings. For example, these Web sites describe kernel settings that DB2 requires: AIX None required. Solaris com.ibm.db2.udb.uprun.doc/doc/t htm Linux (Red Hat and SUSE) Copyright IBM Corp

26 com.ibm.db2.udb.uprun.doc/doc/t htm Windows None required. Installing and configuring IBM DB2 Database This section describes installing and configuring the IBM DB2 Uniersal Database (DB2). The configuration steps in this section create a database for later use by the Tioli Identity Manager Serer installation program, which populates the database with data objects. You can install DB2 on the same computer with Tioli Identity Manager or on a separate computer. Installing DB2 on the same computer requires the installation of a Jaa Database Connectiity drier (JDBC drier, type 4). A JDBC drier enables Tioli Identity Manager to communicate with the data source. Installing DB2 automatically installs the type 4 JDBC drier. Tioli Identity Manager requires DB2 to run with a required leel of the DB2 fix pack. For more information about installing DB2 and any fix packs, refer to the Tioli Identity Manager Information Center and to documentation that the database product proides. For example, access these Web sites: Recording user data The DB2 installation requires that you specify some system data, such as the DB2 administrator user ID and password. The installation wizard proides both status reports and an initial erification actiity. Recording user names and passwords on UNIX and Linux systems Table 1 shows the default alues that are created on UNIX and Linux systems. Record this information, which is required to configure the DB2 database that Tioli Identity Manager uses. If you choose not to use the middleware configuration utility to create a DB2 instance, installing DB2 can create a default DB2 instance. Table 1. DB2 Database typical configuration parameters on UNIX and Linux systems UNIX and Linux systems Description Value DB2 administrator user ID and instance name DB2 instance password The user ID that is used to connect to DB2 as the DB2 administrator and instance owner. The password for the administrator user ID. db2admin Note: If you do not use the middleware configuration utility, this alue is db2inst1 by default. A user-defined alue. 10 IBM Tioli Identity Manager Serer: Installation and Configuration Guide

27 Table 1. DB2 Database typical configuration parameters on UNIX and Linux systems (continued) UNIX and Linux systems Description Value DB2 instance home directory The home directory of the DB2 administrator and instance owner. AIX: /home/db2admin Linux: /home/db2admin Linux for System p: /home/db2admin Linux for System z: /home/db2admin Solaris: /export/home/ db2admin Note: If you do not use the middleware configuration utility, you might need to replace db2admin with db2inst1. Recording user names and passwords on Windows systems Table 2 shows the default alues that are created on Windows systems. If you choose not to use the middleware configuration utility to create a DB2 instance, installing DB2 can also create the default DB2 instance. For more information about using the middleware configuration utility, see Running the middleware configuration utility on page 13. Table 2. Field alues on Windows systems Windows systems Description Value DB2 instance name Administratie user ID Password DB2 instance home directory The name of the DB2 instance. The user ID that is used to connect to DB2 as the DB2 administrator and instance owner. The password for the administrator user ID. The home directory of the DB2 administrator and instance owner. db2admin Note: DB2 defaults to an instance alue of DB2. db2admin A user-defined alue drie: For example, C: Verifying the installation The installation wizard proides a status report when the installation is complete. Additionally, run the DB2 First Steps operation to erify that the installation is successful. To start the operation, complete these steps: UNIX or Linux operating systems Enter this command: DB_INSTANCE_HOME/sqllib/bin/db2fs Chapter 2. Installing and configuring a database 11

28 Note: For UNIX systems, the root user has to source the db2admin profile or switch to the instance owner before running this command. You hae already created a DB2 instance. Windows operating systems Click Start > Programs > IBM DB2 > DB2 Copy Name > Set-up Tools > First Steps. For more information about erifying the DB2 installation, isit this Web site: com.ibm.db2.udb.uprun.doc/doc/t htm Installing the required fix packs If your ersion of DB2 requires a fix pack, obtain and install the fixes that are aailable at these DB2 support Web sites: Verify that the correct fix pack is installed on both the database serer and the database client computers. If you created a DB2 instance during installation, you can use the following commands: On UNIX and Linux systems, log on as the DB2 instance user ID and enter the db2leel command: su - DB2_instance_ID db2leel The alue of DB2_instance_ID is the DB2 instance name such as db2admin. On Windows, enter the db2leel command from the DB2 command window: db2leel If you did not create a DB2 instance during installation, use the following commands: On UNIX and Linux systems, enter the db2ls command: DB_HOME/install/db2ls or /usr/local/bin/db2ls On Windows, run the regedit command and look for the information in the following location: HKEY_LOCAL_MACHINE\SOFTWARE\IBM\DB2\InstalledCopies\db2_name\CurrentVersion For more information about these steps, refer to the Tioli Identity Manager Information Center and to documentation that the DB2 fix pack proides. Configuring IBM DB2 Database The Tioli Identity Manager installation product includes a middleware configuration utility that creates database instances and user IDs and configures parameters for DB2 and IBM Tioli Directory Serer. Default alues are supplied for many of the typical parameters and all the adanced parameters. If an entered parameter, such as the DB2 instance ID, exists, the middleware configuration utility skips the task of creation. You can choose to keep those alues, or proide alues 12 IBM Tioli Identity Manager Serer: Installation and Configuration Guide

29 of your own. Required fields are marked by an asterisk (*). You can reisit any panel in the deployment wizard by clicking the Back button until you reach the panel. Note: The middleware configuration utility stores by default any input you proide in a response file called db2ldap.rsp located in the system temp directory; for example, the /tmp directory. This file is normally cleaned up after the utility completes. If you cancel the utility before it completes, this file might not be erased. Running the middleware configuration utility You can run the middleware configuration utility to set DB2 parameters for later Tioli Identity Manager deployment. The middleware configuration utility: Creates user IDs if needed Creates DB2 instances if needed Creates databases if needed Tunes DB2 (buffer pool, log tuning) Configures some DB2 settings (DB2ENVLIST=EXTSHM, DB2COMM=tcpip) The middleware configuration utility can be run manually or silently. For more information about silent configuration, see Configuring DB2 silently on page 15. Before you begin: On Windows operating systems, you must be an administrator or hae administratie authority. On UNIX and Linux operating systems, you must be a root user. Additionally, the umask setting must be 022. To erify the umask setting issue the command: umask To set the umask alue to 022, issue the command: umask 022 Note: Record the alues you proide for the middleware configuration utility for later use with the DBConfig and ldapconfig utilities used during Tioli Identity Manager serer installation. Procedure: To start the middleware configuration utility for DB2 manually, complete the following steps: 1. Log on to an account with system administration priileges on the computer where DB2 is installed. 2. Start the middleware configuration utility, located on the base directory of the DVD or a download directory: AIX: Start the middleware configuration utility by running the cfg_itim_mw_aix program. Solaris: Start the middleware configuration utility by running the cfg_itim_mw_solaris program. Linux for xseries: Start the middleware configuration utility by running the cfg_itim_mw_xlinux program. Linux for pseries: Start the middleware configuration utility by running the cfg_itim_mw_plinux program. Linux for zseries: Start the middleware configuration utility by running the cfg_itim_mw_zlinux program. Chapter 2. Installing and configuring a database 13