How To Use An Org.Org Adapter On An Org Powerbook (Orb) With An Org Idm.Org (Orber) Powerbook With An Adapter (Orbor) With A Powerbook 2 (Orbi) With The Power

Transcription

1 Tivoli Identity Manager Version 4.6 Oracle ERP Adapter Installation and Configuration Guide SC

2

3 Tivoli Identity Manager Version 4.6 Oracle ERP Adapter Installation and Configuration Guide SC

4 Note: Before using this information and the product it supports, read the information in Appendix C, Notices, on page 65. Third Edition (June 2005) This edition applies to version 4.6 of this adapter and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright International Business Machines Corporation 2003, All rights reserved. US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Contents Preface v Who should read this book v Publications and related information......v Tivoli Identity Manager library v Prerequisite Product Publications vii Related Publications viii Accessing publications online viii Accessibility viii Support information viii Conventions used in this book ix Typeface conventions ix Operating system differences ix Definitions for HOME and other directory variables x Chapter 1. Overview of the Oracle ERP adapter Features of the adapter Chapter 2. Installing and configuring the Oracle ERP adapter Prerequisites Installing the adapter Importing the adapter profile into the IBM Tivoli Identity Manager Server Importing the adapter profile Creating an Oracle ERP service Configuring the adapter Chapter 3. Configuring the Oracle ERP Adapter for IBM Tivoli Identity Manager. 9 Starting the adapter configuration tool Viewing configuration settings Changing protocol configuration settings Configuring event notification Setting event notification triggers Modifying an event notification context Changing the configuration key Changing activity logging settings Changing registry settings Modifying non-encrypted registry settings...21 Modifying encrypted registry settings Changing advanced settings Viewing statistics Changing code page settings Accessing help and additional options Chapter 4. Oracle services modifications Accessing the service configuration tool main menu 29 Viewing current Oracle services Adding a new Oracle service Example of adding an Oracle service Modifying an Oracle service Example of modifying an Oracle service Removing an Oracle service Example of removing an Oracle service Testing an Oracle connection Example of testing an Oracle connection Chapter 5. Configuring SSL authentication for the Oracle ERP Adapter Overview of SSL and digital certificates Private keys, public keys, and digital certificates 36 Self-signed certificates Certificate and key formats The use of SSL authentication Configuring certificates for SSL authentication...38 Configuring certificates for one-way SSL authentication Configuring certificates for two-way SSL authentication Configuring certificates when the adapter operates as an SSL client Managing SSL certificates using CertTool Starting CertTool Generating a private key and certificate request 43 Installing the certificate Installing the certificate and key from a PKCS12 file Viewing the installed certificate Installing a CA certificate Viewing CA certificates Deleting a CA certificate Viewing registered certificates Registering a certificate Unregistering a certificate Exporting a certificate and key to PKCS12 file..47 Chapter 6. Customizing the Oracle ERP adapter Copy the ERPProfile.jar file and extract the files..49 Create a new JAR file and install the new attributes on the IBM Tivoli Identity Manager Server Managing passwords when restoring accounts...50 Chapter 7. Upgrading the Oracle ERP Adapter or the ADK Upgrading the Oracle ERP adapter Upgrading the ADK Log files Chapter 8. Uninstalling the Oracle ERP adapter Appendix A. Adapter attributes Copyright IBM Corp. 2003, 2005 iii

6 Attributes descriptions Attributes by Oracle ERP Adapter actions System Login Add System Login Change System Login Delete System Login Suspend System Login Restore Reconciliation Appendix B. Support information Searching knowledge bases Search the information center on your local system or network Search the Internet Contacting IBM Software Support Determine the business impact of your problem 62 Describe your problem and gather background information Submit your problem to IBM Software Support 63 Appendix C. Notices Trademarks Index iv IBM Tivoli Identity Manager: Oracle ERP Adapter Installation and Configuration Guide

7 Preface Who should read this book The IBM Tivoli Identity Manager Oracle ERP for Windows Adapter (Oracle ERP Adapter) enables connectivity between the IBM Tivoli Identity Manager Server and a network of systems running the Oracle ERP resources. After the adapter is installed and configured, IBM Tivoli Identity Manager manages access to Windows resources with your site s security system. This manual describes how to install and prepare an Oracle ERP Adapter. Note: The program that is used to connect the managed resource to the IBM Tivoli Identity Manager Server is now called an adapter. The term adapter replaces the previously used term agent. The user interface used to configure the adapter still refers to an adapter as an agent. This book is intended for Oracle ERP resources security administrators responsible for installing software on their site s computer systems. Readers are expected to understand Windows and Oracle ERP resources concepts. The person completing the Oracle ERP Adapter installation procedure must also be familiar with their site system standards and needs to have appropriate Windows and Oracle experience and knowledge. Readers should be able to perform routine Windows and Oracle system and security administration tasks. Publications and related information Read the descriptions of the IBM Tivoli Identity Manager library. To determine which additional publications you might find helpful, read the Prerequisite Product Publications on page vii and the Related Publications on page viii. After you determine the publications you need, refer to the instructions in Accessing publications online on page viii. Tivoli Identity Manager library The publications in the technical documentation library for your product are organized into the following categories: v Release information v Online user assistance v Server installation and configuration v Problem determination v Technical supplements v Adapter installation and configuration Release Information: v Release Notes Provides software and hardware requirements for the product, and additional fix, patch, and other support information. v Read This First Card Lists the publications for the product. Online user assistance: Copyright IBM Corp. 2003, 2005 v

8 Provides online help topics and an information center for administrative tasks. Server installation and configuration: Provides installation and configuration information for the product server. Problem determination: Provides problem determination, logging, and message information for the product. Technical supplements: The following technical supplements are provided by developers or by other groups who are interested in this product: v Performance and tuning information Provides information needed to tune your production environment, available on the Web at: Click the I character in the A-Z product list to locate IBM Tivoli Identity Manager products. Click the link for your product, and then browse the information center for the Technical Supplements section. v Redbooks and white papers are available on the Web at: IBMTivoliIdentityManager.html Browse to the Self Help section, in the Learn category, and click the Redbooks link. v Technotes are available on the Web at: v Field guides are available on the Web at: v For an extended list of other Tivoli Identity Manager resources, search the following IBM developerworks Web address: Adapter installation and configuration: The technical documentation library also includes a set of platform-specific installation documents for the adapter components of the product. Adapter information is available on the Web at: Passport_Advantage_Home Click Support & downloads. Browse to the Downloads and drivers. Click the link for the adapter. Skills and training: The following additional skills and technical training information were available at the time that this manual was published: v Virtual Skills Center for Tivoli Software on the Web at: vi IBM Tivoli Identity Manager: Oracle ERP Adapter Installation and Configuration Guide

9 v Tivoli Education Software Training Roadmaps on the Web at: v Tivoli Technical Exchange on the Web at: supp_tech_exch.html Prerequisite Product Publications To use the information in this book effectively, you must have knowledge of the products that are prerequisites for your product. Publications are available from the following locations: v Oracle ERP resources v Operating systems IBM AIX Solaris Operating Environment Red Hat Linux Microsoft Windows Server v Database servers IBM DB2 Universal Database - Support: - Information center: index.jsp - Documentation: winos2unix/support/v8pubs.d2w/en_main - DB2 product family: - Fix packs: downloadv8.html - System requirements: sysreqs.html Oracle Microsoft SQL Server v Directory server applications IBM Directory Server en_us/html/ldapinst.htm Sun ONE Directory Server Preface vii

10 Related Accessibility v WebSphere Application Server Additional information is available in the product directory or Web sites. v WebSphere embedded messaging v IBM HTTP Server Publications Information that is related to your product is available in the following publications: v The Tivoli Software Library provides a variety of Tivoli publications such as white papers, datasheets, demonstrations, redbooks, and announcement letters. The Tivoli Software Library is available on the Web at: v The Tivoli Software Glossary includes definitions for many of the technical terms related to Tivoli software. The Tivoli Software Glossary is available from the Glossary link of the Tivoli Software Library Web page at: Accessing publications online IBM posts publications for this and all other Tivoli products, as they become available and whenever they are updated, to the Tivoli software information center Web site. Access the Tivoli software information center at the following Web address: Click the I character in the A-Z list, and then click the link for your product to access the product library. Note: If you print PDF documents on other than letter-sized paper, set the option in the File Print window that allows Adobe Reader to print letter-sized pages on your paper. The product documentation includes the following features to aid accessibility: v Documentation is available in convertible PDF format to give the maximum opportunity for users to apply screen-reader software. v All images in the documentation are provided with alternative text so that users with vision impairments can understand the contents of the images. Support information If you have a problem with your IBM software, you want to resolve it quickly. IBM provides the following ways for you to obtain the support you need: v Searching knowledge bases: You can search across a large collection of known problems and workarounds, Technotes, and other information. viii IBM Tivoli Identity Manager: Oracle ERP Adapter Installation and Configuration Guide

11 v Contacting IBM Software Support: If you still cannot solve your problem, and you need to work with someone from IBM, you can use a variety of ways to contact IBM Software Support. For more information about these ways to resolve problems, see Appendix B, Support information, on page 61. Conventions used in this book Typeface This reference uses several conventions for special terms and actions and for operating system-dependent commands and paths. conventions This guide uses the following typeface conventions: Bold Italic v Lowercase commands and mixed case commands that are otherwise difficult to distinguish from surrounding text v Interface controls (check boxes, push buttons, radio buttons, spin buttons, fields, folders, icons, list boxes, items inside list boxes, multicolumn lists, containers, menu choices, menu names, tabs, property sheets), labels (such as Tip:, and Operating system considerations:) v Keywords and parameters in text v Words defined in text v Emphasis of words (words as words) v New terms in text (except in a definition list) v Variables and values you must provide Monospace v Examples and code examples v File names, programming keywords, and other elements that are difficult to distinguish from surrounding text v Message text and prompts addressed to the user v Text that the user must type v Values for arguments or command options Operating system differences This guide uses the UNIX convention for specifying environment variables and for directory notation. When using the Windows command line, replace $variable with %variable% for environment variables and replace each forward slash (/) with a backslash (\) in directory paths. The names of environment variables are not always the same in Windows and UNIX. For example, %TEMP% in the Windows operating system is equivalent to $tmp in a UNIX operating system. Note: If you are using the bash shell on a Windows system, you can use the UNIX conventions. Preface ix

12 Definitions for HOME and other directory variables The following table contains the default definitions that are used in this guide to represent the HOME directory level for various product installation paths. You can customize the installation directory and HOME directory for your specific implementation. If this is the case, you need to make the appropriate substitution for the definition of each variable represented in this table. The value of path varies for these operating systems: v Windows: drive:\program Files v AIX: /usr v Other UNIX: /opt Path Variable Default Definition Description DB_INSTANCE_HOME Windows: path\ibm\sqllib UNIX: v AIX, Linux: /home/dbinstancename v Solaris: /export/home/dbinstancename LDAP_HOME v For IBM Directory Server Version 5.2 Windows: path\ibm\ldap UNIX: path/ibm/ldap AIX, Linux: path/ldap Solaris: path/ibmldaps v For IBM Directory Server Version 6.0 Windows: path\ibm\ldap UNIX: /opt/ibm/ldap/ AIX, Solaris: /opt/ibm/ldap/ Linux: /opt/ibm/ldap/ v For Sun ONE Directory Server Windows: path\sun\mps UNIX: /var/sun/mps The directory that contains the database for your Tivoli Identity Manager product. The directory that contains the directory server code. x IBM Tivoli Identity Manager: Oracle ERP Adapter Installation and Configuration Guide

13 Path Variable Default Definition Description IDS_instance_HOME For IBM Directory Server Version 6.0 Windows: drive\ idsslapd-instance_owner_name The value of drive might be C:\. An example of instance_owner_name might be ldapdb2. For example, the log file might be C:\idsslapd-ldapdb2\logs\ ibmslapd.log. UNIX: INSTANCE_HOME/idsslapd-instance_name The directory that contains the IBM Directory Server Version 6.0 instance. HTTP_HOME ITIM_HOME WAS_HOME WAS_MQ_HOME WAS_NDM_HOME Tivoli_Common_Directory On Linux and AIX systems, the default home directory is the /home/instance_name/idsslapdinstance_name directory. On Solaris systems, for example, the directory is the /export/home/ldapdb2/idsslapdldapdb2. directory. Windows: path\ibmhttpserver UNIX: path/ibmhttpserver Windows: path\ibm\itim UNIX: path/ibm/itim Windows: path\websphere\appserver UNIX: path/websphere/appserver Windows: path\ibm\websphere MQ UNIX: path/mqm Windows: path\websphere\deploymentmanager UNIX: path/websphere/deploymentmanager Windows: path\ibm\tivoli\common\ UNIX: path/ibm/tivoli/common/ The directory that contains the IBM HTTP Server code. The base directory that contains the Tivoli Identity Manager code, configuration, and documentation. The WebSphere Application Server home directory The directory that contains the WebSphere MQ code. The home directory on the Deployment Manager The central location for all serviceability-related files, such as logs and first-failure data capture Preface xi

14 xii IBM Tivoli Identity Manager: Oracle ERP Adapter Installation and Configuration Guide

15 Chapter 1. Overview of the Oracle ERP adapter Features of the adapter An adapter is a program that provides an interface between a managed resource and the IBM Tivoli Identity Manager Server. Adapters might or might not reside on the managed resource and the IBM Tivoli Identity Manager Server manages access to the resource by using your security system. Adapters function as trusted virtual administrators on the target platform, performing such tasks as creating login IDs, suspending IDs, and performing other functions administrators normally run manually. The adapter runs as a service, independent of whether or not a user is logged on to the IBM Tivoli Identity Manager Server. The IBM IBM Tivoli Identity Manager Oracle ERP Adapter enables connectivity between the IBM Tivoli Identity Manager Server and the Oracle ERP resources. This installation guide provides the basic information that you need to install and configure the Oracle ERP Adapter. This chapter provides an overview of the adapter and the features of the adapter. You can use the Oracle ERP Adapter to automate the following administrative tasks: v Creating an Oracle ERP account. v Changing an Oracle ERP account. v Suspending an Oracle ERP account. v Restoring an Oracle ERP account. v Reconciling all Oracle ERP accounts and supported data. Copyright IBM Corp. 2003,

16 2 IBM Tivoli Identity Manager: Oracle ERP Adapter Installation and Configuration Guide

17 Chapter 2. Installing and configuring the Oracle ERP adapter Installing and configuring the Oracle ERP Adapter involves several steps that you must complete in the appropriate sequence. Review the prerequisites before you begin the installation process. You can also create an account on the managed resource for the adapter to use. Prerequisites Table 1 identifies hardware, software, and authorization prerequisites to install the Oracle ERP Adapter. Verify that all of the prerequisites have been met before installing the Oracle ERP Adapter. Table 1. Prerequisites to install the adapter System v A 32-bit x86-based microprocessor. Operating System v Windows 2000 v A minimum of 256 MB of memory. v A minimum of 300 MB of free disk space. v Windows 2003 v Windows XP Oracle Client Software v 8i, versions and later v 9i Note: The system where the Oracle ERP Application software is installed must be able to communicate to the system where the adapter is installed. Oracle Server Software ERP 11i Network Connectivity TCP/IP network System Administrator The person completing the Oracle ERP Adapter Authority installation procedure must have system administrator authority to complete the steps in this chapter. IBM Tivoli Identity Manager Version 4.6 Server Installing the adapter The IBM Tivoli Identity Manager Oracle ERP Adapter installation files are available for download from the IBM Web site. Contact your IBM account representative for the Web address and download instructions. In order to install the adapter, complete the following steps: 1. Download the Oracle ERP Adapter installation compressed file from the IBM Web site. 2. Extract the contents of the file into a temporary directory. For example, C:/Temp. 3. Start the installation program using the setup.exe file in the temporary directory. For example, select Run... from the Start menu, and type C:\Temp\Setup.exe, in the Open field. Copyright IBM Corp. 2003,

18 4. On the Welcome window, click Next. 5. On the License Agreement window, review the license agreement and decide if you accept the terms of the license. If you do, select Accept and then click Next. 6. On the Select Destination Directory window, specify where you want to install the adapter in the Directory Name field. You can accept the default location, or click Browse to specify a different directory. Then, click Next. Figure 1. Select Destination Directory window 7. On the Oracle ERP Service Names window, type the following information: Oracle ERP service name, Oracle ERP account name, and Oracle ERP account password. Then select the Oracle version you are using and then click Next. Oracle Instances must define service names before the adapter works properly. The service names are case sensitive. Oracle ERP Service Name Specifies the service name for the database instance the adapter manages Oracle ERP Account Specifies the name of the Oracle ERP service account that the adapter uses to manage the Oracle ERP instance Account ERP Password Specifies the Oracle ERP service account password Note: You may add additional service names for the adapter to manage after the installation is completed. See Chapter 3, Configuring the Oracle ERP Adapter for IBM Tivoli Identity Manager, on page 9 and Chapter 4, Oracle services modifications for more information about adding, modifying, and deleting managed instances. 8. On the Installation Summary window, click Next to begin the installation. 4 IBM Tivoli Identity Manager: Oracle ERP Adapter Installation and Configuration Guide

19 9. On the Installation Completed window, click Finish to exit the program. 10. In the temporary directory, locate the storedpr.sql file and commit the file against the Oracle ERP database the adapter is intended to manage. The storedpr.sql file contains procedures and views that the adapter uses to manage Oracle ERP accounts. Importing the adapter profile into the IBM Tivoli Identity Manager Server Before you can add an adapter as a service to the IBM Tivoli Identity Manager Server, the server must have an adapter profile to recognize the adapter as a service. The files that are packaged with the Oracle ERP Adapter include the adapter JAR file, ERPProfile.jar. Using the Import feature of the Tivoli Identity Manager Server, you can import the adapter profile into the server as a service profile. The ERPProfile.jar file includes all of the files that are needed to define the adapter schema, account form, service form and profile properties. The ERPProfile.jar file will be referenced in this document to make any changes to the schema or the profile. You will be required to extract the files from the JAR file, make changes to the necessary files, and repackage the JAR file with the updated files. For more information on how to update the JAR files, see Copy the ERPProfile.jar file and extract the files on page 49. Importing the adapter profile An adapter profile defines the types of resources that the IBM Tivoli Identity Manager Server can manage. You must import the adapter profile into the IBM Tivoli Identity Manager Server before using the Oracle ERP Adapter. The profile is used to create a Oracle ERP Adapter service on the IBM Tivoli Identity Manager Server and to communicate with the adapter. Before you begin to import the adapter profile, verify that the following conditions are met: v The IBM Tivoli Identity Manager Server must be installed and running. v You must have Administrator authority on the IBM Tivoli Identity Manager Server. In order to import the adapter profile, complete the following steps: 1. Log in to the IBM Tivoli Identity Manager Server using an account that has the authority to perform administrative tasks. 2. On the Main Menu Navigation Bar, select the Configuration tab. 3. On the Configuration window, select Import/Export Import tabs. 4. On the Import window, in the File to Upload field, type the location of the ERPProfile.jar file, or click Browse to locate the file. 5. Click the Import data into Identity Manager link to import the adapter profile into the IBM Tivoli Identity Manager Server. v If the adapter profile is imported successfully, the following message is displayed: Profile installation complete. v If the adapter profile is not imported successfully, the following message is displayed: Profile installation failed. Chapter 2. Installing and configuring the Oracle ERP adapter 5

20 Creating an Oracle ERP service When you import the adapter profile, if you receive an error related to the schema, the trace.log file will contain information about that error. The trace.log file location is specified by the handler.file.filedir property that is defined in the IBM Tivoli Identity Manager enrolelogging.properties file, which is installed in the IBM Tivoli Identity Manager \data directory. After the adapter profile is imported into the IBM Tivoli Identity Manager Server, you must create a provisioning service to allow IBM Tivoli Identity Manager to communicate with the adapter. In order to create a provisioning service, complete the following steps: 1. Log in to the IBM Tivoli Identity Manager Server using an account that has the authority to perform administrative tasks. 2. On the Main Menu Navigation Bar, click the Provisioning tab. 3. On the Provisioning window, click the Manage Services tab. 4. On the Manage Services window, click Add. 5. From the list of service types, select Oracle ERP Profile, and then click Continue. The Oracle ERP Adapter service form is displayed. The service form contains the following fields: Service Name Specify a name that defines this Oracle ERP service on the IBM Tivoli Identity Manager Server. Service Name is a required field. Description Specify an optional description for this service. URL Specify the location and port number of the Oracle ERP Adapter. The port number is defined in the protocol configuration using the agentcfg program. For additional information about protocol configuration settings, see Changing protocol configuration settings on page 10. URL is a required field. User If https is specified as part of the URL, the adapter must be configured to use SSL authentication. If the adapter is not configured to use SSL authentication, specify http for the URL. For additional information about configuring the adapter to use SSL authentication, see Chapter 5, Configuring SSL authentication for the Oracle ERP Adapter, on page 35. ID Specify a Directory Access Markup Language (DAML) protocol user name. The user name is defined in the protocol configuration using the agentcfg program. For additional information about the protocol configuration settings, see Changing protocol configuration settings on page 10. User ID is a required field. Password Specify the password for the DAML protocol user name. This password is defined in the protocol configuration using the agentcfg program. For additional information about the protocol configuration settings, see Changing protocol configuration settings on page 10. Password is a required field. Oracle Service Specify the Oracle Service Name that is managed by this service. For 6 IBM Tivoli Identity Manager: Oracle ERP Adapter Installation and Configuration Guide

21 Configuring the adapter additional information about the Oracle Service Name, see Chapter 4, Oracle services modifications, on page 29. Oracle Service is a required field. Owner Specify the service owner, if any. Owner is an optional field. Service Prerequisite Specify an existing IBM Tivoli Identity Manager service that is a prerequisite for the Oracle ERP service. 6. To verify the connection, press Test. 7. To create the service, press Submit. Once you have installed the IBM Tivoli Identity Manager Oracle ERP Adapter, configuration is required to ensure that it functions properly. In order to configure the Oracle ERP Adapter, complete the following steps: 1. Start the Oracle ERP Adapter service using the Windows Services Tool. 2. Configure DAML to ensure communication with the Tivoli Identity Manager Server. For more information on configuring DAML, see Changing protocol configuration settings on page Configure the Oracle ERP Adapter to communicate with the IBM Tivoli Identity Manager Server by configuring the adapter for event notification. For more information on configuring event notification, see Configuring event notification on page For secure communication, install a certificate on the machine where the adapter resides and on the IBM Tivoli Identity Manager Server. For more information on installing certificates, see Chapter 5, Configuring SSL authentication for the Oracle ERP Adapter, on page Add optional extended attributes to the schema of the adapter. For more information on extending the attributes, see Chapter 6, Customizing the Oracle ERP adapter, on page Install the adapter profile on the IBM Tivoli Identity Manager Server. For more information on installing the adapter profile, see Importing the adapter profile into the IBM Tivoli Identity Manager Server on page Use the agentcfg utility to modify the adapter parameters. For more information on parameter configuration, see Chapter 3, Configuring the Oracle ERP Adapter for IBM Tivoli Identity Manager, on page Define the Oracle Service Names for the Oracle ERP Adapter to manage, see Chapter 4, Oracle services modifications, on page Add and then configure the service form on the IBM Tivoli Identity Manager Server. For additional information about adding and configuring a service form, see Creating an Oracle ERP service on page Configure the adapter account form. For more information on configuring the adapter account form, refer to the IBM Tivoli Identity Manager Information Center. Chapter 2. Installing and configuring the Oracle ERP adapter 7

22 8 IBM Tivoli Identity Manager: Oracle ERP Adapter Installation and Configuration Guide

23 Chapter 3. Configuring the Oracle ERP Adapter for IBM Tivoli Identity Manager Use the adapter configuration program, agentcfg, to view or modify the Oracle ERP Adapter parameters. All changes that you make to parameters with this tool take effect immediately. Starting the adapter configuration tool In order to start the adapter configuration tool, agentcfg, for Oracle ERP Adapter parameters, complete these steps: 1. From the Start Menu, select Programs Accessories Command Prompt. 2. At the command prompt, change to the \bin directory for the adapter. For example, type the following command, if the Oracle ERP Adapter is in the default location: cd C:\Tivoli\Agents\OracleERPAgent\bin 3. Type the following command: agentcfg -agent OracleERPAgent You can also use agentcfg to view or change configuration settings from a remote computer. See the table in Accessing help and additional options on page 25 for procedures on using additional arguments. 4. At the Enter configuration key for Agent OracleERPAgent prompt, type the configuration key for the Oracle ERP Adapter. The default configuration key is agent. You must change the configuration key once installation completes, to prevent unauthorized access to the configuration of the adapter. See Changing protocol configuration settings on page 10 for procedures to change the configuration key. The Main Configuration Menu is displayed. OracleERPAgent 4.6 Agent Main Configuration Menu A. Configuration Settings. B. Protocol Configuration. C. Event Notification. D. Change Configuration Key. E. Activity Logging. F. Registry Settings. G. Advanced Settings. H. Statistics. I. Codepage Support. X. Done. Select menu option: From the Main Menu, you can configure the protocol, view statistics, and modify settings, including configuration, registry, and advanced settings. Table 2. Options for the main configuration menu Option Configuration task For more information A Viewing protocol configuration settings See page 10. Copyright IBM Corp. 2003,

24 Table 2. Options for the main configuration menu (continued) Option Configuration task For more information B Changing protocol configuration settings See page 10. C Configuring event notification See page 13. D Changing the configuration key See page 19. E Changing activity logging settings See page 19. F Changing registry settings See page 21. G Changing advanced settings See page 23. H Viewing statistics See page 24. I Changing code page settings See page 25. Viewing configuration settings The following procedure describes how to view the Oracle ERP Adapter configuration settings. 1. At the Agent Main Configuration Menu, type A. The configuration settings for the Oracle ERP Adapter are displayed. The following screen is an example of the Oracle ERP Adapter configuration settings. Configuration Settings Name : OracleERPAgent Version : 4.6 ADK Version : 4.67 ERM Version : 4.67 enrole Version : 4.0 License : NONE Asynchronous ADD Requests : FALSE (Max.Threads:3) Asynchronous MOD Requests : FALSE (Max.Threads:3) Asynchronous DEL Requests : FALSE (Max.Threads:3) Asynchronous SEA Requests : FALSE (Max.Threads:3) Available Protocols : DAML Configured Protocols : DAML Logging Enabled : TRUE Logging Directory : C:\Tivoli\Agents\OracleERPAgent\Log Log File Name : OracleERPAgent.log Max. log files : 3 Max.log file size (Mbytes) : 1 Debug Logging Enabled : TRUE Detail Logging Enabled : FALSE Thread Logging Enabled : FALSE Press any key to continue 2. Press any key to return to the Main Menu. Changing protocol configuration settings The Oracle ERP Adapter uses the DAML protocol to communicate with the IBM Tivoli Identity Manager Server. By default, when the adapter is installed, the DAML protocol is configured to be used in nonsecure mode. In order to configure a secure environment, you must configure the DAML protocol to use SSL and install a certificate. Refer to Installing the certificate on page 44 for more information about installing certificates. 10 IBM Tivoli Identity Manager: Oracle ERP Adapter Installation and Configuration Guide

25 In previous versions of this adapter, you could add and remove protocols. However, in the latest version of this adapter, the DAML protocol is the only supported protocol that you can use. Therefore, you will not need to add or remove a protocol. In order to configure the DAML protocol for the Oracle ERP Adapter, complete the following steps: 1. At the Agent Main Configuration Menu, type B. The DAML protocol is configured and available by default for the Oracle ERP Adapter. Agent Protocol Configuration Menu Available Protocols: DAML Configured Protocols: DAML A. Add Protocol. B. Remove Protocol. C. Configure Protocol. X. Done Select menu option 2. At the Agent Protocol Configuration Menu, type C. The DAML Protocol Properties Menu is displayed. 3. At the DAML Protocol Properties Menu, type C. The protocol properties for the configured protocol is displayed. The properties on your menu might be different from the ones shown in the examples. The following screen is an example of the DAML protocol properties: DAML Protocol Properties A. USERNAME ****** ;Authorized user name. B. PASSWORD ****** ;Authorized user password. C. MAX_CONNECTIONS 100 ;Max Connections. D. PORTNUMBER ;Protocol Server port number. E. USE_SSL FALSE ;Use SSL secure connection. F. SRV_NODENAME ;Event Notif. Server name. G. SRV_PORTNUMBER 9443 ;Event Notif. Server port number. H. HOSTADDR ANY ;Listen on address < or "ANY" > I. VALIDATE_CLIENT_CE FALSE ;Require client certificate. J. REQUIRE_CERT_REG FALSE ;Require registered certificate. X. Done Select menu option: 4. Type the letter of the menu option for the protocol property that you want to configure. See Table 3 below for additional information about the properties that you can configure for the DAML protocol. Table 3. Options for the DAML protocol menu Option Configuration task A The following prompt is displayed: Modify Property USERNAME : Type a user ID. This value is the user ID that the IBM Tivoli Identity Manager Server uses to connect to the adapter. The default user ID is agent. Chapter 3. Configuring the Oracle ERP Adapter for IBM Tivoli Identity Manager 11

26 Table 3. Options for the DAML protocol menu (continued) Option Configuration task B The following prompt is displayed: Modify Property PASSWORD : Type a password. This value is the password for the user ID that the IBM Tivoli Identity Manager Server uses to connect to the adapter. The default password is agent. C The following prompt is displayed: Modify Property MAX_CONNECTIONS : Enter the maximum number of concurrent open connections that the adapter supports. The default number is 100. D The following prompt is displayed: Modify Property PORTNUMBER : Type a different port number. This value is the port number that the IBM Tivoli Identity Manager Server uses to connect to the adapter. The default port number is E The following prompt is displayed: Modify Property USE_SSL : Enter TRUE or FALSE to specify whether a secure SSL connection will be used to connect to or from the adapter. The default value is FALSE. You must install a certificate when USE_SSL is set to TRUE. For more information on certificate installation, see Installing the certificate on page 44. F The following prompt is displayed: Modify Property SRV_NODENAME : Type a server name or an IP address, for example, This value is the DNS name or IP address of the IBM Tivoli Identity Manager Server that is used for event notification and asynchronous request processing. Note: If your platform supports Internet Protocol version 6 (IPv6) connections, you can specify an IPv6 server. G The following prompt is displayed: Modify Property SRV_PORTNUMBER : Type a different port number to access the IBM Tivoli Identity Manager Server. This value is the port number that the adapter uses to connect to the IBM Tivoli Identity Manager Server. The default port number for WebLogic is The default port number for WebSphere Application Server (WAS) is IBM Tivoli Identity Manager: Oracle ERP Adapter Installation and Configuration Guide

27 Table 3. Options for the DAML protocol menu (continued) Option Configuration task H The HOSTADDR option is useful when the system where the adapter is running has more than one network adapter. The user can select which IP Address the adapter will listen to. The default value is ANY. I The following prompt is displayed: Modify Property VALIDATE_CLIENT_CE : Type TRUE to require the IBM Tivoli Identity Manager Server to send a certificate when it communicates with the adapter. Type FALSE to allow the IBM Tivoli Identity Manager Server to communicate with the adapter without a certificate. The default value is FALSE. Notes: 1. If you set this option to TRUE, you must configure options D through I. 2. The property name is actually VALIDATE_CLIENT_CERT. It is truncated by agentcfg to fit onto the screen. 3. You must use CertTool to install the appropriate CA certificates and optionally register the IBM Tivoli Identity Manager Server certificate. For more information on using CertTool, see Managing SSL certificates using CertTool on page 41. J The following prompt is displayed: Modify Property REQUIRE_CERT_REG : This value only applies when option I is set to TRUE. Type TRUE to require the client certificate from the IBM Tivoli Identity Manager Server to be registered with the adapter before it will accept an SSL connection. Type FALSE to require the client certificate only be verified against the list of CA certificates. The default value is FALSE. For more information on certificates, see Chapter 5, Configuring SSL authentication for the Oracle ERP Adapter, on page 35. Configuring event notification 5. At the prompt, change the value, and press Enter. The Protocol Properties Menu is displayed with your new settings. If you do not want to change the value, just press Enter to return to the Protocol Properties Menu. 6. Repeat steps 4 and 5 to configure as many protocol properties as you need to. 7. At the Protocol Properties Menu, type X to exit the menu. Event notification is a feature of the Oracle ERP Adapter that updates the IBM Tivoli Identity Manager Server at set intervals. Event notification detects changes that are made on the managed resource and updates the IBM Tivoli Identity Manager Server with the changes. You can enable event notification if you want to have updated information from the managed resource sent back to the IBM Tivoli Identity Manager Server between full reconciliations. Event notification is not intended to replace reconciliations on the IBM Tivoli Identity Manager Server. Chapter 3. Configuring the Oracle ERP Adapter for IBM Tivoli Identity Manager 13

28 When event notification is enabled, a database of the reconciliation data is kept on the machine where the adapter is installed. The database is updated with the changes that are requested by the IBM Tivoli Identity Manager Server and will remain synchronized with the server. You can specify an interval for the event notification process to compare the database to data that currently exists on the managed resource. When the interval has elapsed, any differences between the managed resource and the database are forwarded to the IBM Tivoli Identity Manager Server and updated in the local snapshot database. There are several steps to enabling event notification. These steps assume that the adapter is communicating successfully with the managed resource and the IBM Tivoli Identity Manager Server. First, you must configure the host name, port number, and login information for the IBM Tivoli Identity Manager Server. In order to identify the server for the DAML protocol to use, complete the following steps: 1. At the Agent Protocol Configuration Menu, select Configure Protocol. For more information on configuring a protocol, see Changing protocol configuration settings on page Type the letter of the menu option for the SRV_NODENAME property. 3. Specify the IP address or server name that identifies the IBM Tivoli Identity Manager Server, and press Enter. The Protocol Properties Menu is displayed with your new settings. 4. Type the letter of the menu option for the SRV_PORTNUMBER property. 5. Specify the port number that the adapter uses to connect to the Tivoli Identity Manager Server for event notification and press Enter. The Protocol Properties Menu is displayed with your new settings. The example menu shows all of the options displayed when Event Notification is enabled. If Event Notification is disabled, not all of the options are displayed. In order to set Event Notification for the IBM Tivoli Identity Manager Server, complete the following steps: 1. At the Agent Main Configuration Menu, type C. The Event Notification Menu is displayed. Event Notification Menu * Reconciliation interval : 1 day(s) * Next Reconciliation time : 23 hour(s) 56 min(s). 23 sec(s). * Configured Contexts : Jupiter, dd309 A. Enabled B. Time interval between reconciliations. C. Set Processing cache size. (currently: 50 Mbytes) D. Start event notification now. E. Set attributes to be reconciled. F. Reconciliation process priority. (current: 1) G. Add Event Notification Context. H. Modify Event Notification Context. I. Remove Event Notification Context. J. List Event Notification Contexts. X. Done Select menu option: Note: This menu shows all of the options that are displayed when Event Notification is enabled. If Event Notification is disabled, all of the options will not be displayed. 14 IBM Tivoli Identity Manager: Oracle ERP Adapter Installation and Configuration Guide

29 2. Type the letter of the menu option that you want to change. Option A must be enabled in order for the values of the other options to take effect. Press Enter to return to the Agent Event Notification Menu without changing the value. Table 4. Options for the event notification menu Option Configuration task A If this option is enabled, the adapter updates the IBM Tivoli Identity Manager Server with changes to the adapter at regular intervals. When the option is set to: v Disabled, pressing the A key changes to enabled v Enabled, pressing the A key changes to disabled Type A to toggle between the options. B The following prompt is displayed: Enter new interval ([ww:dd:hh:mm:ss]) Type a different reconciliation interval. For example, [00:01:00:00:00] Note: This value is the interval to wait once event notification completes before it is run again. The event notification process is resource intensive, therefore this value must not be set to run too frequently. C The following prompt is displayed: Enter new cache size[50]: Type a different value to change the processing cache size. D If this option is selected, event notification is started. E The Event Notification Entry Types Menu is displayed. See Setting event notification triggers on page 16 for more information. F The following prompt is displayed: Enter new thread priority [1-10]: Type a different thread value to change the event notification process priority. Note: Setting the thread priority to a lower value reduces the impact that the event notification process has on the performance of the adapter. A lower value might also cause event notification to take longer. G The following prompt is displayed: Enter new context name: Type the new context name, and press Enter. The new context is added. H A menu listing the available contexts is displayed. See Modifying an event notification context on page 17 for more information. I The Remove Context Menu is displayed. Select the context to remove. The following prompt is then displayed: Delete context context1? [no]: Press Enter to exit without deleting the context, or type Yes and press Enter to delete the context. Chapter 3. Configuring the Oracle ERP Adapter for IBM Tivoli Identity Manager 15

30 Table 4. Options for the event notification menu (continued) Option Configuration task J The Event Notification Contexts are displayed in the following format: Context Name : Context1 Target DN : erservicename=context1,o=ibm, ou=ibm,dc=com --- Attributes for search request --- {search attributes listed} If you changed the value for options B, C, E, or F, press Enter. The other options are automatically changed when you type the corresponding letter of the menu option. The Event Notification Menu is displayed with your new settings. Setting event notification triggers By default, all attributes are queried for value changes. Certain attributes that change frequently (for example, password age or last successful logon) must be omitted. 1. At the Event Notification Menu, type E. The Event Notification Entry Types Menu is displayed. Event Notification Entry Types A. USER B. GROUP X. Done Select menu option: The USER and GROUP types will not appear in the above menu until the following conditions have been met: a. Event notification has been enabled b. A context has been created and configured c. A full reconciliation has been run 2. Type A for a list of the attributes returned during a user reconciliation, or type B for attributes returned during a group reconciliation. The Event Notification Attribute Listing for the selected reconciliation type is displayed. The default setting lists all attributes that the adapter supports. The example below lists example attributes, and might differ from the list that is displayed on your machine. Event Notification Attribute Listing (a) **eroraerpcustomer (b) **eroraerpsupplier (c) **eroraerpfax (d) **eroraerp (e) **eruid (f) **eroraerppassworddays (g) **eroraerpowner (h) **eroraerpuserenddate (i) **eroraerpdescription (j) **eroraerpperson (k) **eraccountstatus (l) **eroraerpidcustomer (m) **eroraerppersonid (n) **eroraerpnamesupplier (o) **eroraerppasswdaccesses (p) **erpassword (q) **eroraerpidsupplier (r) **eroraerpinstancename (p)rev page 1 of 3 (n)ext X. Done Select menu option: 16 IBM Tivoli Identity Manager: Oracle ERP Adapter Installation and Configuration Guide