ibm security privileged identity manager: oracle ebs...
TRANSCRIPT
IBM Security Privileged Identity Manager
Oracle eBS Adapter Installation andConfiguration Guide
IBM
IBM Security Privileged Identity Manager
Oracle eBS Adapter Installation andConfiguration Guide
IBM
ii IBM Security Privileged Identity Manager: Oracle eBS Adapter Installation and Configuration Guide
Contents
Figures . . . . . . . . . . . . . . . v
Tables . . . . . . . . . . . . . . . vii
Chapter 1. Overview . . . . . . . . . 1Features of the adapter . . . . . . . . . . . 1Architecture of the adapter . . . . . . . . . 1Supported configurations . . . . . . . . . . 2
Chapter 2. Planning. . . . . . . . . . 5Roadmap for IBM Tivoli Directory Integrator basedadapters, for IBM Security Privileged IdentityManager . . . . . . . . . . . . . . . . 5Prerequisites . . . . . . . . . . . . . . 6Software downloads . . . . . . . . . . . . 8Installation worksheet . . . . . . . . . . . 8
Chapter 3. Installing . . . . . . . . . 9Installing the dispatcher . . . . . . . . . . 9Installing the adapter binaries or connector . . . . 9Restarting the adapter service . . . . . . . . 10Importing the adapter profile . . . . . . . . 10Deploying the custom subforms . . . . . . . 11Creating an adapter service/target. . . . . . . 12Service/Target form details . . . . . . . . . 13Verifying that the adapter is working correctly . . 16
Chapter 4. Upgrading . . . . . . . . 17Upgrading the dispatcher. . . . . . . . . . 17Upgrading the adapter profile . . . . . . . . 17
Chapter 5. Configuring . . . . . . . . 19Enabling SSL communication . . . . . . . . 19
Configuring Oracle eBS database tier . . . . . 19Configuring the Tivoli Directory Integrator forOracle eBS database tier authentication . . . . 20Configuring Tivoli Directory Integrator for OracleeBS Adapter authentication . . . . . . . . 21Changes to the adapter service form . . . . . 21JDBC driver location for SSL . . . . . . . 22
Customizing the adapter profile . . . . . . . 23Editing adapter profiles on the UNIX or LINUXoperating system . . . . . . . . . . . . 24Password management when restoring accounts . . 24Verifying that the adapter is working correctly . . 25
Chapter 6. Troubleshooting . . . . . . 27Techniques for troubleshooting problems . . . . 27Error messages and problem solving . . . . . . 29
Chapter 7. Uninstalling . . . . . . . . 31Uninstalling the dispatcher . . . . . . . . . 31Deleting the adapter profile . . . . . . . . . 31
Chapter 8. Reference . . . . . . . . 33Adapter attributes and object classes . . . . . . 33Adapter attributes by operations . . . . . . . 35
System Login Add . . . . . . . . . . . 35System Login Change . . . . . . . . . . 35System Login Delete . . . . . . . . . . 36System Login Suspend . . . . . . . . . 36System Login Restore . . . . . . . . . . 36Test . . . . . . . . . . . . . . . . 36Reconciliation . . . . . . . . . . . . 36
Index . . . . . . . . . . . . . . . 37
iii
iv IBM Security Privileged Identity Manager: Oracle eBS Adapter Installation and Configuration Guide
Figures
1. The architecture of the Oracle eBS Adapter 22. Example of a single server configuration . . . 2
3. Example of a multiple server configuration 3
v
vi IBM Security Privileged Identity Manager: Oracle eBS Adapter Installation and Configuration Guide
Tables
1. Prerequisites to run the adapter . . . . . . 72. Required information to install the adapter 83. Warning and error messages . . . . . . . 294. Attributes, descriptions, constraints, and
permissions . . . . . . . . . . . . 335. Add request attributes for Oracle . . . . . 35
6. Change request attributes for Oracle . . . . 357. Suspend request attributes for Oracle . . . . 368. Restore request attributes for Oracle . . . . 369. Test attributes . . . . . . . . . . . . 36
10. Reconciliation request attributes for Oracle 36
vii
viii IBM Security Privileged Identity Manager: Oracle eBS Adapter Installation and Configuration Guide
Chapter 1. Overview
An adapter is an interface between a managed resource and the IBM® SecurityIdentity server. The Oracle eBS Adapter enables communication between the IBMSecurity Identity server and the Oracle eBS user database, also known as theFND_USER directory.
Adapters can be installed on the managed resource. The IBM Security Identityserver manages access to the resource by using the security system. Adaptersfunction as trusted virtual administrators on the target operating system. Theadapter creates, suspends, restores user accounts, and other functions thatadministrators run manually. The adapter runs as a service, independently ofwhether you are logged on to the IBM Security Identity server.
Features of the adapterThe adapter automates several administrative and management tasks.
Automated user account management tasks include:v Reconciling user accounts and support datav Adding user accountsv Modifying user account attributesv Modifying user account passwordsv Suspending and restoring user accounts
Architecture of the adapterSeveral components are involved in running and using the adapter. Install all thesecomponents so that the adapter can function correctly.
The adapter contains Tivoli® Directory Integrator AssemblyLines that serve one ormore account operation. When IBM Security Identity Manager sends the firstrequest, the required AssemblyLine is loaded into the Tivoli Directory Integrator.The same Assemblyline is then cached to serve subsequent operations of the sametype.
You must install the following components for the adapter to function correctly:v The RMI Dispatcherv The Tivoli Directory Integrator connectorv IBM Security Identity Adapter profile
You need to install the RMI Dispatcher and the adapter profile; however, the TivoliDirectory Integrator connector might already be installed with the base TivoliDirectory Integrator product.
Figure 1 on page 2 describes the components that work together to complete theuser account management tasks in a Tivoli Directory Integrator environment.
1
Supported configurationsThe adapter supports both single and multiple server configurations.
The fundamental components in each environment are:v The IBM Security Identity serverv The IBM Tivoli Directory Integrator serverv The managed resourcev The adapter
The adapter must be installed directly on the server that runs the Tivoli DirectoryIntegrator server.
Single server configuration
In a single server configuration, install the IBM Security Identity server, the TivoliDirectory Integrator server, and the Oracle eBS Adapter on one server to establishcommunication with the Oracle eBS. The Oracle eBS is installed on a differentserver as described Figure 2.
Multiple server configuration
In a multiple server configuration, install the IBM Security Identity server, theTivoli Directory Integrator server, the Oracle eBS Adapter, and the Oracle eBS ondifferent servers.
RMI callsIBM SecurityIdentityServer
DispatcherService(an instanceof the IBMTivoliDirectoryIntegrator)
Adapterresource
Figure 1. The architecture of the Oracle eBS Adapter
IBM SecurityIdentity Server
Tivoli DirectoryIntegrator Server
Adapter
Managedresource
Figure 2. Example of a single server configuration
2 IBM Security Privileged Identity Manager: Oracle eBS Adapter Installation and Configuration Guide
Install the Tivoli Directory Integrator server and the Oracle eBS Adapter on thesame server as described in Figure 3.
IBM SecurityIdentity Managerserver
Security DirectoryIntegrator server Managed
resource
Adapter
Figure 3. Example of a multiple server configuration
Chapter 1. Overview 3
4 IBM Security Privileged Identity Manager: Oracle eBS Adapter Installation and Configuration Guide
Chapter 2. Planning
Installing and configuring the adapter involves several steps that you mustcomplete in a specific sequence. Follow the roadmap for the main tasks.
Roadmap for IBM Tivoli Directory Integrator based adapters, for IBMSecurity Privileged Identity Manager
Follow this section when using the guide to install, configure, troubleshoot, oruninstall the adapter.
Pre-installation
Complete these tasks.1. Verify that your environment meets the software and hardware requirements
for the adapter. See Prerequisites.2. Obtain the installation software. See Software downloads.3. Obtain the necessary information for the installation and configuration. See
Installation worksheet.
Installation
Complete these tasks.1. Install the dispatcher.2. Install the adapter binaries or connector.3. Install 3rd party client libraries.4. Set up the adapter environment.5. Restart the adapter service.6. Import the adapter profile.7. Create an adapter service/target.8. Install the adapter language package.9. Verify that the adapter is working correctly.
Upgrade
To upgrade the adapter, do a complete re-installation of the adapter. Follow theInstallation roadmap.
Configuration
Complete these tasks.1. Configure secure communication between the IBM Security Identity server and
the adapter.a. Configure 1-way authentication.b. Configure 2-way authentication.
2. Configure secure communication between the adapter and the managed target.a. Configure 1-way authentication.b. Configure 2-way authentication.
5
3. Configure the adapter.4. Modify the adapter profiles.5. Customize the adapter.
Troubleshooting
See the following topics.v Techniques for troubleshooting problemsv Configure debuggingv Logsv Error messages and problem solving
Uninstallation
Complete these tasks.1. Stop the adapter service.2. Remove the adapter binaries or connector.3. Remove 3rd party client libraries.4. Delete the adapter service/target.5. Delete the adapter profile.
Reference
See the following topics.v Adapter attributes and object classesv Adapter attributes by operationsv Special attributes
PrerequisitesVerify that your environment meets the software and hardware requirements forthe adapter.
Table 1 on page 7 identifies the software and operating system prerequisites for theadapter installation.
Ensure that you install the adapter on the same workstation as the IBM TivoliDirectory Integrator server.
Note: See the release notes in the adapter package for the most current list ofrequirements.
6 IBM Security Privileged Identity Manager: Oracle eBS Adapter Installation and Configuration Guide
Table 1. Prerequisites to run the adapter
Prerequisite Description
Directory Integrator v IBM Tivoli Directory Integrator Version 7.1.1+ 7.1.1-TIV-TDI-FP0004 +7.2.0-ISS-SDI-LA0008
v IBM Security Directory Integrator Version 7.2
Note:
v Earlier versions of IBM Tivoli DirectoryIntegrator that are still supported mightfunction properly. However, to resolve anycommunication errors, you must upgradeyour Directory Integrator release to theversions that the adapter officially supports.
v The adapter supports IBM Security DirectoryIntegrator 7.2, which is available only tocustomers who have the correct entitlement.Contact your IBM representative to find outwhether you have the entitlement todownload IBM Security Directory Integrator7.2.
IBM Security Identity server The following servers are supported:
v IBM Security Identity Manager server Version6.0
v IBM Security Identity Manager server Version7.0
v IBM Security Privileged Identity ManagerVersion 2.0
v IBM Security Identity Governance andIntelligence server Version 5.2.2
Oracle e-Business Suite A system that runs the Oracle eBS release:
v 12.0
v 12.1.1
v 12.1.3
v 12.2.4
Oracle Thin JDBC DriverNote: For information about the JDBCdriver installation, seehttp://www.oracle.com/technology/software/tech/java/sqlj_jdbc/index.html.
All the listed JDBC driver can talk with all thesupported version of Oracle except Oracle 10gr2:
v JDBC 8.1.7 Driver
v JDBC 9.0.1 Driver
For Oracle 10g r2:
v JDBC 10.2.0.1.0 Driver
Network Connectivity The adapter must be installed on a system thatcan communicate with the IBM SecurityPrivileged Identity Manager service through theTCP/IP network.
System Administrator AuthorityTo complete the adapter installation procedure,you must have system administrator authority.
Tivoli Directory Integrator adapterssolution directory
A Tivoli Directory Integrator adapters solutiondirectory is a Tivoli Directory Integrator workdirectory for adapters. See the DispatcherInstallation and Configuration Guide.
Chapter 2. Planning 7
For information about the prerequisites and supported operating systems for TivoliDirectory Integrator, see the IBM Tivoli Directory Integrator 7.1: Administrator Guide.
Software downloadsDownload the software through your account at the IBM Passport Advantage®
website.
Go to IBM Passport Advantage.
See the corresponding IBM Security Identity server Download Document forinstructions.
Note:
You can also obtain additional adapter information from IBM Support.
Installation worksheetThe installation worksheet lists the information that is required to install andconfigure the adapter. Complete this worksheet before you start the installationprocedure for ease of reference. Make a copy of the worksheet for each adapterinstance you install.
Table 2 identifies the information that you need before installing the adapter.
Table 2. Required information to install the adapter
Required information Description Value
Tivoli DirectoryIntegrator HomeDirectory
The ITDI_HOME directory containsthe jars/connectors subdirectorythat contains adapter JAR files. Forexample, the jars/connectorssubdirectory contains the JAR filesfor the UNIX adapter.
Windows:
v for version 7.1:
drive\ProgramFiles\IBM\TDI\V7.1
UNIX:
v for version 7.1:
/opt/IBM/TDI/V7.1
Adapters solutiondirectory
For more information about theadapter solution directory, see theDispatcher Installation andConfiguration Guide.
Windows:
v for version 7.1:
drive\ProgramFiles\IBM\TDI\V7.1\timsol
UNIX:
v for version 7.1:
/opt/IBM/TDI/V7.1/timsol
8 IBM Security Privileged Identity Manager: Oracle eBS Adapter Installation and Configuration Guide
Chapter 3. Installing
Installing the adapter mainly involves importing the adapter profile and creatingan adapter service. Depending on the adapter, several other tasks can be involvedto completely install it.
All IBM Tivoli Directory Integrator based adapters require the Dispatcher for theadapters to function correctly. If the Dispatcher is installed from a previousinstallation, do not reinstall it unless the Dispatcher is upgraded. See Verification ofthe Dispatcher installation .
Depending on your adapter, the Tivoli Directory Integrator connector mightalready be installed as part of the Tivoli Directory Integrator product and nofurther action is required. If the connector is not pre-installed, install it after theDispatcher.
Installing the dispatcherIf this is the first Tivoli Directory Integrator-based adapter installation, you mustinstall the RMI Dispatcher before you install the adapter. Install the RMIDispatcher on the same Tivoli Directory Integrator server where you want to installthe adapter.
If you already installed the RMI Dispatcher for another adapter, you do not needto reinstall it.
If you have not yet installed the RMI Dispatcher in the Tivoli Directory Integratorenvironment, download the Dispatcher installer from the IBM Passport Advantagewebsite. For more information about the installation, see the Dispatcher Installationand Configuration Guide.
Installing the adapter binaries or connectorThe connector might or might not be available with the base Tivoli DirectoryIntegrator or Security Directory Integrator product. The connector is required toestablish communication between the adapter and the Dispatcher.
Before you beginv The Dispatcher must be installed.
About this task
The adapter uses the IBM Tivoli Directory Integrator JDBC connector. Thisconnector is already available with the base Tivoli Directory Integrator product. Assuch, you just need to install the Dispatcher. See the IBM Security DispatcherInstallation and Configuration Guide..
9
Restarting the adapter serviceVarious installation and configuration tasks might require the adapter to berestarted to apply the changes. For example, you must restart the adapter if thereare changes in the adapter profile, connector, or assembly lines. To restart theadapter, restart the Dispatcher.
The adapter does not exist as an independent service or a process. The adapter isadded to the Dispatcher instance, which runs all the adapters that are installed onthe same Security Directory Integrator instance.
See the topic about starting, stopping, and restarting the Dispatcher service in theDispatcher Installation and Configuration Guide.
Importing the adapter profileAn adapter profile defines the types of resources that the IBM Security Identityserver can manage. It is packaged with the IBM Security Identity Adapter. Use theadapter profile to create an adapter service on IBM Security Identity server andestablish communication with the adapter.
Before you beginv The IBM Security Privileged Identity Manager is installed and running.v You have root or administrator authority on the IBM Security Privileged Identity
Manager.v The file to be imported must be a Java archive (JAR) file. The
<Adapter>Profile.jar file includes all the files that are required to define theadapter schema, account form, service/target form, and profile properties. Ifnecessary, you can extract the files from the JAR file, modify the files, andrepackage the JAR file with the updated files.The JAR file for IBM SecurityPrivileged Identity Manager is located in the top level folder of the installationpackage.
About this task
Service definition files are also called adapter profile files.
If the adapter profile is not installed correctly, the adapter cannot functioncorrectly. You cannot create a service with the adapter profile or open an accounton the service. You must import the adapter profile again.
Procedure1. Log on to the IBM Security Privileged Identity Manager by using an account
that has the authority to perform administrative tasks.2. From the navigation tree, select Configure System > Manage Service Types.
The Manage Service Types page is displayed.3. On the Manage Service Types page, click Import. The Import Service Type page
is displayed.4. On the Import Service Type page, complete these steps:
a. In the Service Definition File field, type the directory location of the<Adapter>Profile.jar file, or click Browse to locate the file. For example, ifyou are installing the IBM Security Identity Adapter for a Windows serverthat runs Active Directory, locate and import the ADProfileJAR file.
b. Click OK to import the file.
10 IBM Security Privileged Identity Manager: Oracle eBS Adapter Installation and Configuration Guide
Results
A message indicates that you successfully submitted a request to import a servicetype.
What to do nextv The import occurs asynchronously, which means it might take some time for the
service type to load into the IBM Security Identity server from the propertiesfiles and to be available in other pages. On the Manage Service Types page, clickRefresh to see the new service type. If the service type status is Failed, checkthe log files to determine why the import failed.
v If you receive a schema-related error, see the trace.log file for informationabout it. The trace.log file location is specified by the handler.file.fileDirproperty that is defined in the enRoleLogging.properties file. TheenRoleLogging.properties file is in the IBM Security Identity serverHOME\datadirectory. .
Deploying the custom subformsThe Oracle eBS Adapter is supplied with custom subforms to specify the roles,responsibilities, and securing attributes associated with a user. The subforms arecontained in the OraEBSSubForms.zip file.
Before you begin
Extract the contents of the OraEBSSubForms.zip file to the subforms folder of theinstalled IBM Security Privileged Identity Manager web application.
For a self service console installationWAS_PROFILE_HOME/installedApps/nodeName/ITIM.ear/itim_self_service.war
For an administrative console installationWAS_PROFILE_HOME/installedApps/nodeName/ITIM.ear/itim_console.war
For Identity Service Center installation WAS_PROFILE_HOME/installedApps/nodeName/ITIM.ear/isim_isc_subform.war
About this task
In a clustered environment the subform must be deployed on each WebSphereapplication server. If WebSphere version 6.1 is being used, the jdkSourceLevel JSPengine configuration parameter must be set to 15 for each web application onwhich the subforms are deployed.
Procedure1. Open the WEB-INF/ibm-web-ext.xmi file from the configuration directory. For
example, WAS_PROFILE_HOME/config/cells/cellName/applications/ITIM.ear/deployments/ITIM/webModuleName. The webModuleName is theitim_self_service.war file or the itim_console.war file or both.
2. Add the following tag within the content of the webappext:webAppExtensiontag:<jspAttributes xmi:id="JSPAttribute_1" name="jdkSourceLevel" value="15"/>
Chapter 3. Installing 11
Note: The integer n in JSPAttribute_n has to be unique within the file.3. Save the file.4. Take one of the following actions:v Restart the IBM Security Privileged Identity Manager application from the
WebSphere Administrative Console.v Restart the service.
Creating an adapter service/targetAfter you import the adapter profile on the IBM Security Identity server, create aservice/target so that IBM Security Identity server can communicate with themanaged resource.
Before you begin
Complete “Importing the adapter profile” on page 10.
About this task
You must create an administrative user account for the adapter on the managedresource. You can provide the account information such as administrator name andpassword when you create the adapter service. Ensure that the account hassufficient privileges to administer the users. For information about creating anadministrative account, see the documentation for the managed resource.
To create or change a service, you must use the service form to provideinformation for the service. Service forms might vary depending on the adapter.The service name and description that you provide for each service are displayedon the console. Therefore, it is important to provide values that make sense to yourusers and administrators.
Procedure1. From the navigation tree, click Manage Services.2. On the Services table, click Create. The Create a Service wizard is displayed.3. On the Select the Type of Service page, click Search to locate a business unit.
The Business Unit page is displayed.4. On the Business Unit page, complete these steps:
a. Type information about the business unit in the Search information field.b. Select a business type from the Search by list, and then click Search. A list
of business units that matches the search criteria is displayed.If the table contains multiple pages, you can do the following tasks:v Click the arrow to go to the next page.v Type the number of the page that you want to view and click Go.
c. In the Business Units table, select business unit in which you want to createthe service, and then click OK. The Select the Type of Service page isdisplayed, and the business unit that you specified is displayed in theBusiness unit field.
5. On the Select the Type of Service page, select a service type, and then clickNext.
6. On the Service Information page, specify the appropriate values for the serviceinstance. The content of the Service Information page depends on the type ofservice that you are creating.
12 IBM Security Privileged Identity Manager: Oracle eBS Adapter Installation and Configuration Guide
7. Click Finish.
Results
A message is displayed, indicating that you successfully created the serviceinstance for a specific service type.
Service/Target form detailsComplete the service/target form fields.
The APPS account owns the Oracle eBS database and the adapter must run as theAPPS user unless you have followed special configuration steps. If you use APPS,you do not require configuration changes on the managed resource.
If your security standards do not permit the use of APPS as an administratoraccount for the Oracle eBS Adapter, you must create a new user and grant requiredpermissions as provided in the nonAPPS.sql file. The nonAPPS.sql file is suppliedwith the Oracle eBS Adapter compressed file. The adapter depends on wrapperstored procedures when an account other than APPS is used. Create the wrapperstored procedures specified in nonAPPS.sql file.
Note: If the following fields on the service form are changed for an existingservice, the adapter service on the Tivoli Directory Integrator server must berestarted.v Service Name
v Password
v Owner
v Service prerequisite
On the Oracle EBS Profile tab:
Service nameSpecify a name that defines the adapter service on the IBMSecurity Identity server.
Note: Do not use forward (/) or backward slashes (\) in theservice name.
Description Optional: Specify a description that identifies the service for yourenvironment.
Tivoli Directory Integrator location
Specify the URL for the IBM Tivoli Directory Integrator instance.The valid syntax for the URL is rmi://ip-address:port/ITDIDispatcher, where ip-address is the IBM Tivoli DirectoryIntegrator host and port is the port number for the RMI Dispatcher.
The default URL for the default SDI1 instance isrmi://localhost:1099/ITDIDispatcher.
Oracle EBS Service NameSpecify the service name of Oracle eBS database instance to whichthe adapter must connect.
Chapter 3. Installing 13
Oracle EBS Service HostSpecify the host workstation on which the Oracle eBS databaseinstance is running.
Oracle EBS Service PortSpecify the port on which the Oracle eBS database service islistening.
Use SSL communication with Oracle?Click the check box to force an SSL connection from the adapter tothe Oracle eBS database.
Oracle EBS Server Distinguished NameOptional. Specify the distinguished name that is contained in thecertificate of the Oracle eBS database. If SSL communication isenabled and this field is not blank, the connection succeeds only ifthe distinguished names match.
Administrator NameSpecify the name of the user who has access to the Oracle eBSdatabase and can perform administrative operations.
PasswordSpecify the password for the user.
Do not Reconcile Roles?Select this check box if you do not want the list of roles to beretrieved during a reconciliation operation.
Do not Reconcile Persons?Select this check box if you do not want the list of persons to beretrieved during a reconciliation operation.
Do not Reconcile Suppliers?Select this check box if you do not want the list of suppliers to beretrieved during a reconciliation operation.
Do not Reconcile Customers?Select this check box if you do not want the list of customers to beretrieved during a reconciliation operation.
Do not Reconcile Responsibilities?Select this check box if you do not want the list of responsibilitiesto be retrieved during a reconciliation operation.
Do not Reconcile Securing Attributes?Select this check box if you do not want the list of securingattributes to be retrieved during a reconciliation operation.
End Date the Responsibilities on Account SuspendSelect this check box if you want to end the responsibilities onaccount suspend.
OwnerOptional: Specify a user as a service owner.
Service PrerequisiteOptional: Specify a service that is prerequisite to this service.
On the Dispatcher Attributes tab:
Disable AL CachingSelect the check box to disable the assembly line caching in the
14 IBM Security Privileged Identity Manager: Oracle eBS Adapter Installation and Configuration Guide
dispatcher for the service. The assembly lines for the add, modify,delete, and test operations are not cached.
AL FileSystem PathSpecify the file path from where the dispatcher loads the assemblylines. If you do not specify a file path, the dispatcher loads theassembly lines that are received from IBM Security Identity server.For example, you can specify the following file path to load theassembly lines from the profiles directory of the Windowsoperating system: c:\Files\IBM\TDI\V7.1\profiles or you canspecify the following file path to load the assembly lines from theprofiles directory of the UNIX and Linux operating systems:system:/opt/IBM/TDI/V7.1/profiles
Max Connection CountSpecify the maximum number of assembly lines that the dispatchercan run simultaneously for the service. For example, enter 10 whenyou want the dispatcher to run maximum 10 assembly linessimultaneously for the service. If you enter 0 in the MaxConnection Count field, the dispatcher does not limit the numberof assembly lines that are run simultaneously for the service.
On the Status and information tabContains read only information about the adapter and managed resource.These fields are examples. The actual fields vary depending on the type ofadapter and how the service form is configured. The adapter must berunning to obtain the information. Click Test Connection to populate thefields.
Last status update: DateSpecifies the most recent date when the Status and information tabwas updated.
Last status update: TimeSpecifies the most recent time of the date when the Status andinformation tab was updated.
Managed resource status Specifies the status of the managed resource that the adapter isconnected to.
Adapter version Specifies the version of the adapter that the service uses toprovision request to the managed resource.
Profile version Specifies the version of the profile that is installed in the IBMSecurity Identity server.
TDI version Specifies the version of the Tivoli Directory Integrator on which theadapter is deployed.
Dispatcher version Specifies the version of the Dispatcher.
Installation platformSpecifies summary information about the operating system wherethe adapter is installed.
Adapter account Specifies the account that running the adapter binary file.
Chapter 3. Installing 15
Adapter up time: Date Specifies the date when the adapter started.
Adapter up time: Time Specifies the time of the date when the adapter started.
Adapter memory usage Specifies the memory usage for running the adapter.
If the connection fails, follow the instructions in the error message. Alsov Verify the adapter log to ensure that the test request was successfully
sent to the adapter.v Verify the adapter configuration information.v Verify service parameters for the adapter profile. For example, verify the
work station name or the IP address of the managed resource and theport.
Verifying that the adapter is working correctlyAfter you install and configure the adapter, verify that the installation andconfiguration are correct.
Procedure1. Test the connection for the service that you created on the IBM Security Identity
server.2. Run a full reconciliation from the IBM Security Identity server.3. Run all supported operations such as add, modify, and delete on one user
account.4. Verify the ibmdi.log file after each operation to ensure that no errors are
reported.5. Verify the trace.log file to ensure that no errors are reported when you run an
adapter operation.
16 IBM Security Privileged Identity Manager: Oracle eBS Adapter Installation and Configuration Guide
Chapter 4. Upgrading
Upgrading an IBM Tivoli Directory Integrator-based adapter involves tasks such asupgrading the dispatcher, the connector, and the adapter profile. Depending on theadapter, some of these tasks might not be applicable. Other tasks might also berequired to complete the upgrade.
To verify the required version of these adapter components, see the adapter releasenotes. For the installation steps, see Chapter 3, “Installing,” on page 9.
Upgrading the dispatcherBefore you upgrade the dispatcher, verify the version of the dispatcher.v If the dispatcher version mentioned in the release notes is later than the existing
version on your workstation, install the dispatcher.v If the dispatcher version mentioned in the release notes is the same or earlier
than the existing version, do not install the dispatcher.
Note: Stop the dispatcher service before the upgrading the dispatcher and start itagain after the upgrade is complete.
Upgrading the adapter profileRead the adapter Release Notes for any specific instructions before you import anew adapter profile.
Note: Restart the Dispatcher service after importing the profile. Restarting theDispatcher clears the assembly lines cache and ensures that the dispatcher runs theassembly lines from the updated adapter profile.
17
18 IBM Security Privileged Identity Manager: Oracle eBS Adapter Installation and Configuration Guide
Chapter 5. Configuring
After you install the adapter, configure it to function correctly. Configuration isbased on your requirements or preference.
See the IBM Security Dispatcher Installation and Configuration Guide for additionalconfiguration options such as:v JVM propertiesv Dispatcher filteringv Dispatcher propertiesv Dispatcher port numberv Logging configurationsv Secure Sockets Layer (SSL) communication
Enabling SSL communicationYou must configure a truststore to enable SSL communication between the OracleeBS Adapter and the Oracle eBS database. You can optionally configure a keystorefor the dispatcher.
If the Oracle eBS database is configured to require SSL client authentication, youmust configure a keystore.
To configure the truststore for the dispatcher, you must minimally import theCertification Authority (CA) certificate. This certificate is the one used to sign thecertificate for the Oracle eBS database.
Note:
v All the files in the following tasks are in the solutions directory. For example:TDI_HOME/timsol.
v The store password ThePwd12 in the code examples is a variable. Substitute yourpassword for ThePwd12.
Configuring Oracle eBS database tierUse the Oracle tools to configure both the truststore and the keystore on the OracleeBS database tier.
About this task
The Oracle Wallet Manager and the orapki command, are used in the followingsteps. The following task sets up a self-signed certification authority, truststore, andkeystore.
Procedure1. Create a self-signed certificate authority. Issue the following commands:
mkdir authority
orapki wallet create -wallet ./authority -pwd=ThePwd12
orapki wallet add -wallet ./authority -dn "CN=authority, C=US" -keysize 2048
19
-self_signed -validity 3650 -pwd=ThePwd12
orapki wallet export -wallet ./authority -dn "CN=authority, C=US"-cert CA.cer-pwd=ThePwd12
The CA.cer file is the trusted certificate that is used in the keytool command toimport a CA certificate into the truststore for the dispatcher.
2. Create stores for Oracle eBS database tier authentication Issue the followingcommands:mkdir server
orapki wallet create -wallet ./server -auto_login -pwd=ThePwd12
orapki wallet add -wallet ./server -trusted_cert -cert CA.cer -pwd=ThePwd12
orapki wallet add -wallet ./server -dn "CN=server, C=US" -keysize 2048-pwd=ThePwd12
orapki wallet export -wallet ./server -dn "CN=server, C=US" -request creq.cer-pwd=ThePwd12
orapki cert create -wallet ./authority -request creq.cer -cert signed.cer-validity 3650 -pwd=ThePwd12
orapki wallet add -wallet ./server -user_cert -cert signed.cer -pwd=ThePwd12
3. Configure the Oracle network. You must configure the listener.ora andsqlnet.ora files on the Oracle eBS database tier to enable SSL. These files aretypically edited with the Oracle Net Manager or with a text editor. These filesare in the ORACLE_HOME/network/admin/instance directory of the database tier.This example does not require adapter authentication. If you want to requireauthentication for the Oracle eBS Adapter, set SSL_CLIENT_AUTHENTICATION toTRUE.a. Edit the listener.ora file.b. Locate the following lines and substitute the appropriate values for
SERVER_WALLET_LOCATION and HOSTNAME.SSL_CLIENT_AUTHENTICATION = FALSEWALLET_LOCATION = (SOURCE = (METHOD = FILE)(METHOD_DATA =(DIRECTORY = SERVER_WALLET_LOCATION)))LISTENER = (DESCRIPTION_LIST = (DESCRIPTION =(ADDRESS = (PROTOCOL = TCPS)(HOST = HOSTNAME)(PORT = 2484))))
Note: Port 2484 is typically used for SSL communication (TCPS protocol).c. Edit the sqlnet.ora file.d. Locate the following lines and substitute the appropriate values for
highlighted values.SSL_CLIENT_AUTHENTICATION = FALSEWALLET_LOCATION = (SOURCE = (METHOD = FILE)(METHOD_DATA =(DIRECTORY = SERVER_WALLET_LOCATION)))
Configuring the Tivoli Directory Integrator for Oracle eBSdatabase tier authentication
You must import a CA certificate into the truststore.
20 IBM Security Privileged Identity Manager: Oracle eBS Adapter Installation and Configuration Guide
Procedure1. Import a CA certificate into the truststore. Issue the command:
keytool -import -v -alias OACA -file CA.cer -keystore truststore.jks-storetype JKS -storepass "ThePwd12"
2. In the solutions.properties file, set the following properties:javax.net.ssl.trustStore=truststore.jksjavax.net.ssl.trustStorePassword=ThePwd12javax.net.ssl.trustStoreType=jks
Note: If the javax.net.ssl.trustStore property is already set to a truststoreother than truststore.jks, import the CA certificate into that file instead.
3. Set the keystore properties. If a keystore is not required and no keystoreproperties are set in the solution.properties file, use the truststore propertiesvalues for the keystore properties:javax.net.ssl.keyStore=truststore.jksjavax.net.ssl.keyStorePassword=ThePwd12javax.net.ssl.keyStoreType=jks
Configuring Tivoli Directory Integrator for Oracle eBS Adapterauthentication
If the Oracle eBS database is configured for SSL client authentication, you mustconfigure a keystore.
Before you begin
You created a self-signed certificate authority in the Oracle eBS Adapter databasetier.
Procedure1. Create a JKS keystore. Issue the following commands:
keytool -genkey -alias OADB -dname "CN=client,C=US" -storetype JKS-keystore client.jks -keyalg RSA -storepass "ThePwd12"
keytool -certreq -alias OADB -file creq.cer -keystore client.jks-storepass "ThePwd12"
orapki cert create -wallet ./authority -request creq.cer -cert signed.cer-validity 3650 -pwd=ThePwd12
keytool -import -v -alias OACA -file CA.cer -keystore client.jks-storepass "ThePwd12"
keytool -import -v -alias OADB -file signed.cer -keystore client.jks-storepass "ThePwd12"
2. Set the following properties in the solutions.properties file:javax.net.ssl.keyStore=client.jksjavax.net.ssl.keyStorePassword=ThePwd12javax.net.ssl.keyStoreType=jks
Changes to the adapter service formTo enable SSL communication between the Oracle eBS Adapter and the Oracle eBSdatabase, you must supply information for the Oracle eBS adapter service form.
To access the service form, use the Manage Services utility on the IBM SecurityPrivileged Identity Manager console. Supply following information for the fieldson the service form.
Chapter 5. Configuring 21
Use SSL communication with Oracle?Click this check box.
Oracle EBS Service PortChange the value to the TCPS port. For example 2484.
Oracle EBS Server Distinguished NameOptional. When a value is entered for this field, the entry is verifiedagainst the Oracle eBS database server certificate.
Note:
v Start the listener and database services with the same user who created thewallet, so that they are both able to access the wallet.
v The wallet location is provided in both the sqlnet.ora and the listener.orafiles. Typically, both files contain the same wallet location. However, thelistener.ora file can use its own wallet.– The distinguished name of the certificate pointed by the wallet in the
sqlnet.ora file is the name to which the Oracle eBS Adapter must verify. Thisrequirement applies only if a distinguished name is supplied on the serviceform.
– Include a distinguished name in the service form as an extra measure ofsecurity. Doing so prevents another server from faking the identity.
v For information about how to configure SSL with the Oracle JDBC Thin driver,go to the Oracle website. Search for the Oracle technical white paper SSL withOracle JDBC Thin Driver.
JDBC driver location for SSLYou must download the JDBC Thin driver to support SSL.
Obtain the JDBC Thin driver from either:v The ORACLE_HOME/jdbc/lib directory of the database tierv The JDBC Driver Downloads page on the Oracle Technology Network (OTN)
website.
Depending on your JRE, select the appropriate driver. The driver for JRE 1.5 isojdbc5.jar. The driver for JRE 1.6 is ojdbc6.jar.
Copy the appropriate driver to the TDI_HOME/jars/3rdparty/others directory onthe Tivoli Directory Integrator server.
Remove previous versions of the JDBC Thin driver from the TDI_HOME/jars/3rdparty/others directory. For example:v ojdbc14.jarv classes12.zipv nls_charset12.zipv classes111.zipv nls_charset11.zip
Note: The .zip file in the list might alternatively be named as .jar files. Forexample classes12.jar.
22 IBM Security Privileged Identity Manager: Oracle eBS Adapter Installation and Configuration Guide
Customizing the adapter profileTo customize the adapter profile, you must modify the Oracle eBS Adapter JARfile.
About this task
You might customize the adapter profile to change the account form or the serviceform. You can also change the labels on the forms with the Form Designer orCustomLabels.properties. Each adapter has a CustomLabels.properties file forthat adapter.
The JAR file is included in the Oracle eBS Adapter compressed file that youdownloaded from the IBM website. The JAR file and the files contained in the JARfile vary depending on your operating system.
Note: You cannot modify the schema for this adapter. Attributes cannot be addedto or deleted from the schema.
The adapter JAR file includes the following files:v Service.defv Schema.dsmlv CustomLabels.propertiesv erOracleEBSAccount.xmlv erOracleEBSRMIService.xmlv OracleEBSManagerUserAL.xmlv OracleEBSSearchUserAL.xml
To edit the JAR file, perform these steps:
Procedure1. Log on to the workstation where the Oracle eBS Adapter is installed.2. On the Start menu, click Programs > Accessories > Command Prompt.3. Copy the JAR file into a temporary directory.4. Extract the contents of the JAR file into the temporary directory by running the
following command.The following example applies to the Oracle eBS Adapter profile. Type thename of the JAR file for your operating system.cd c:\temp#jar -xvf OraEBSProfile.jar
The jar command extracts the files into the directory.5. Edit the file that you want to change.6. After you edit the file, you must import the file into the IBM Security Identity
server for the changes to take effect. To import the file, perform these steps:a. Create a JAR file with the files in the \temp directory by running the
following commands:cd c:\temp#jar -cvf OraEBSProfile.jar OraEBSProfile
b. Import the JAR file into the IBM Security Privileged Identity Managerapplication server.
c. Stop and start the IBM Security Identity server
Chapter 5. Configuring 23
d. Restart the adapter service.
Editing adapter profiles on the UNIX or LINUX operating systemThe adapter profile .jar file might contain ASCII files that are created by using theMS-DOS ASCII format.
About this task
If you edit an MS-DOS ASCII file on the UNIX operating system, you might see acharacter ^M at the end of each line. These characters indicate new lines of text inMS-DOS. The characters can interfere with the running of the file on UNIX orLinux systems. You can use tools, such as dos2unix, to remove the ^M characters.You can also use text editors, such as the vi editor, to remove the charactersmanually.
Example
You can use the vi editor to remove the ^M characters. From the vi commandmode, run the following command and press Enter::%s/^M//g
When you use this command, enter ^M or Ctrl-M by pressing ^v^M or Ctrl V CtrlM sequentially. The ^v instructs the vi editor to use the next keystroke instead ofissuing it as a command.
Password management when restoring accountsHow each restore action interacts with its corresponding managed resourcedepends on either the managed resource, or the business processes that youimplement.
Certain resources reject a password when a request is made to restore an account.In this case, you can configure IBM Security Privileged Identity Manager to foregothe new password requirement. You can set the Oracle eBS Adapter to require anew password when the account is restored, if your company has a businessprocess in place that dictates that the account restoration process must beaccompanied by resetting the password.
In the service.def file, you can define whether a password is required as a newprotocol option. When you import the adapter profile, if an option is not specified,the adapter profile importer determines the correct restoration password behaviorfrom the schema.dsml file. Adapter profile components also enable remote servicesto find out if you discard a password that is entered by the user in a situationwhere multiple accounts on disparate resources are being restored. In thissituation, only some of the accounts being restored might require a password.Remote services will discard the password from the restore action for thosemanaged resources that do not require them.
Edit the service.def file to add the new protocol options, for example:<Property Name = "com.ibm.itim.remoteservices.ResourceProperties.
PASSWORD_NOT_REQUIRED_ON_RESTORE"<value>true</value></property><Property Name = "com.ibm.itim.remoteservices.ResourceProperties.
PASSWORD_NOT_ALLOWED_ON_RESTORE"<value>false</value></property>
24 IBM Security Privileged Identity Manager: Oracle eBS Adapter Installation and Configuration Guide
By adding the two options in the example above, you are ensuring that you willnot be prompted for a password when an account is restored.
Verifying that the adapter is working correctlyAfter you install and configure the adapter, verify that the installation andconfiguration are correct.
Procedure1. Test the connection for the service that you created on the IBM Security Identity
server.2. Run a full reconciliation from the IBM Security Identity server.3. Run all supported operations such as add, modify, and delete on one user
account.4. Verify the ibmdi.log file after each operation to ensure that no errors are
reported.5. Verify the trace.log file to ensure that no errors are reported when you run an
adapter operation.
Chapter 5. Configuring 25
26 IBM Security Privileged Identity Manager: Oracle eBS Adapter Installation and Configuration Guide
Chapter 6. Troubleshooting
Troubleshooting is a systematic approach to solving a problem. The goal oftroubleshooting is to determine why something does not work as expected andhow to resolve the problem. This topic provides information and techniques foridentifying and resolving problems that are related to the adapter, includingtroubleshooting errors that might occur during the adapter installation.
Techniques for troubleshooting problemsCertain common techniques can help with the task of troubleshooting. The firststep in the troubleshooting process is to describe the problem completely.
Problem descriptions help you and the IBM technical-support representative findthe cause of the problem. This step includes asking yourself basic questions:v What are the symptoms of the problem?v Where does the problem occur?v When does the problem occur?v Under which conditions does the problem occur?v Can the problem be reproduced?
The answers to these questions typically lead to a good description of the problem,which can then lead you to a problem resolution.
What are the symptoms of the problem?
When you start to describe a problem, the most obvious question is “What is theproblem?” This question might seem straightforward; however, you can break itdown into several more-focused questions that create a more descriptive picture ofthe problem. These questions can include:v Who, or what, is reporting the problem?v What are the error codes and messages?v How does the system fail? For example, is it a loop, hang, crash, performance
degradation, or incorrect result?
Where does the problem occur?
Determining where the problem originates is not always easy, but it is one of themost important steps in resolving a problem. Many layers of technology can existbetween the reporting and failing components. Networks, disks, and drivers areonly a few of the components to consider when you are investigating problems.
The following questions help you to focus on where the problem occurs to isolatethe problem layer:v Is the problem specific to one operating system, or is it common across multiple
operating systems?v Is the current environment and configuration supported?v Do all users have the problem?v (For multi-site installations.) Do all sites have the problem?
27
If one layer reports the problem, the problem does not necessarily originate in thatlayer. Part of identifying where a problem originates is understanding theenvironment in which it exists. Take some time to completely describe the problemenvironment, including the operating system and version, all correspondingsoftware and versions, and hardware information. Confirm that you are runningwithin an environment that is a supported configuration. Many problems can betraced back to incompatible levels of software that are not intended to run togetheror are not fully tested together.
When does the problem occur?
Develop a detailed timeline of events that lead up to a failure, especially for thosecases that are one-time occurrences. You can most easily develop a timeline byworking backward: Start at the time an error was reported (as precisely as possible,even down to the millisecond), and work backward through the available logs andinformation. Typically, you use the first suspicious event that you find in adiagnostic log.
To develop a detailed timeline of events, answer these questions:v Does the problem happen only at a certain time of day or night?v How often does the problem happen?v What sequence of events leads up to the time that the problem is reported?v Does the problem happen after an environment change, such as upgrading or
installing software or hardware?
Responding to these types of questions can give you a frame of reference in whichto investigate the problem.
Under which conditions does the problem occur?
Knowing which systems and applications are running at the time that a problemoccurs is an important part of troubleshooting. These questions about yourenvironment can help you to identify the root cause of the problem:v Does the problem always occur when the same task is being done?v Is a certain sequence of events required for the problem to occur?v Do any other applications fail at the same time?
Answering these types of questions can help you explain the environment inwhich the problem occurs and correlate any dependencies. Remember that justbecause multiple problems might occur around the same time, the problems arenot necessarily related.
Can the problem be reproduced?
From a troubleshooting standpoint, the ideal problem is one that can bereproduced. Typically, when a problem can be reproduced you have a larger set oftools or procedures at your disposal to help you investigate. Problems that you canreproduce are often easier to debug and solve.
However, problems that you can reproduce can have a disadvantage: If theproblem is of significant business impact, you do not want it to recur. If possible,re-create the problem in a test or development environment, which typically offersyou more flexibility and control during your investigation.v Can the problem be re-created on a test system?
28 IBM Security Privileged Identity Manager: Oracle eBS Adapter Installation and Configuration Guide
v Do multiple users or applications have the same type of problem?v Can the problem be re-created by running a single command, a set of
commands, or a particular application?
Error messages and problem solvingA warning or error message might be displayed in the user interface to provideinformation about the adapter or when an error occurs.
Table 3 contains warnings or errors that might be displayed on the user interface ifthe adapter is installed on your workstation.
Table 3. Warning and error messages
Message ID Warning or error message Corrective action
CTGIMT001E The following error occurred. Error:Either the Oracle eBS service name isincorrect or the service is not up.
Ensure that the Oracle database service name givenon IBM Security Privileged Identity Manager serviceform is running.
CTGIMT001E The following error occurred. Error:Either the Oracle eBS host or port isincorrect.
Verify that the host workstation name or the portfor the Oracle eBS database service is correctlyspecified.
CTGIMT002E The login credential is missing orincorrect.
Verify that you have provided correct logincredential on service form.
CTGIMT001E The following error occurred. Error: Nosuitable JDBC driver found.
Ensure that the correct version of the JDBC thindriver is copied onto the workstation where theadapter is installed and that the path is included inthe system CLASSPATH variable.
CTGIMT600E An error occurred while establishingcommunication with the Tivoli DirectoryIntegrator server.
IBM Security Privileged Identity Manager cannotestablish a connection with Tivoli DirectoryIntegrator. To fix this problem, ensure that:
v The Tivoli Directory Integrator is running.
v The URL specified on the service form for theTivoli Directory Integrator is correct.
Chapter 6. Troubleshooting 29
30 IBM Security Privileged Identity Manager: Oracle eBS Adapter Installation and Configuration Guide
Chapter 7. Uninstalling
To remove an adapter from the IBM Security Identity server for any reason, youmust remove all the components that were added during installation. Uninstallingan IBM Tivoli Directory Integrator based adapter mainly involves removing theconnector file, and the adapter profile from the IBM Security Identity server.Depending on the adapter, some of these tasks might not be applicable, or therecan be other tasks.
Uninstalling the dispatcherYou might need to remove the Oracle eBS Adapter.
About this task
The Oracle eBS Adapter installation installs the RMI Dispatcher only on the TivoliDirectory Integrator server. Therefore, you only need to uninstall from the RMIDispatcher. There is no uninstall for the Oracle eBS Adapter.
The JAR file needed to uninstall the RMI Dispatcher was created in theITDI_HOME\DispatcherUninstall directory when the RMI Dispatcher was installed.
Note: The RMI Dispatcher is required for all adapters based on Tivoli DirectoryIntegrator. If you uninstall the RMI Dispatcher, none of the other installed adaptersfunction.
Complete these steps:
Procedure1. Stop the adapter service.2. Run the DispatcherUninstall.jar file. To run the JAR file, double click on the
executable file or enter the following command at the command prompt:TDI_HOME/jvm/jre/bin/java –jar DispatcherUninstall.jar
Deleting the adapter profileRemove the adapter service/target type from the IBM Security Identity server.Before you delete the adapter profile, ensure that no objects exist on the IBMSecurity Identity server that reference the adapter profile.
Objects on the IBM Security Identity server that can reference the adapter profile:v Adapter service instancesv Policies referencing an adapter instance or the profilev Accounts
Note: The Dispatcher component must be installed on your system for adapters tofunction correctly in a Tivoli Directory Integrator environment. When you deletethe adapter profile, do not uninstall the Dispatcher.
For specific information about how to delete the adapter profile, see the IBMSecurity Privileged Identity Manager product documentation.
31
32 IBM Security Privileged Identity Manager: Oracle eBS Adapter Installation and Configuration Guide
Chapter 8. Reference
Reference information is organized to help you locate particular facts quickly, suchas adapter attributes, registry settings, and environment variables.
Adapter attributes and object classesAdapter attributes and object classes are required for customization, creatingprovisioning rules, and understanding what service/target attributes are supportedby the adapter. The IBM Security Identity server communicates with the adapterby using attributes, which are included in transmission packets that are sent over anetwork.
The combination of attributes, included in the packets, depends on the type ofaction that the IBM Security Identity server requests from the Oracle eBS Adapter.
Table 4 is a listing of the attributes that are used by the Oracle eBS Adapter. Thetable gives a brief description, constraints, and permissions. The permissions are:
Read The attribute is reconciled but not modified by the adapter.
Write The attribute is modified by the adapter but not reconciled.
Read and WriteThe attribute is reconciled and can be modified by the adapter.
Table 4. Attributes, descriptions, constraints, and permissions
Attribute Description Constraints Permissions
erAccountStatus Specifies the status of the account as enabledor disabled.
Read andWrite
erLastAccessDate The users last login date and time in OracleeBS.
Read
erOraEBSCust Customer. Read andWrite
erOraEBSDescription A short description for the user name. The description islimited to amaximum of 240characters.
Read andWrite
erOraEBSLeftPwdAccess Specifies the number of login accessesremaining (from the current day) until thepassword expires.
The maximum valueis 999999999999999.
Read andWrite
erOraEBSPerson Person. Read andWrite
erOraEBSPwdAccesses Specifies the number of login accesses allowedbefore the password expires.
The maximum valueis 999999999999999.
Read andWrite
erOraEBSPwdLifeSpanDays Specifies the number of days after which thepassword expires
The maximum valueis 999999999999999.
Read andWrite
33
Table 4. Attributes, descriptions, constraints, and permissions (continued)
Attribute Description Constraints Permissions
erOraEBSResp Specifies a directly granted responsibilityformatted as
Application_Nameh|hResponsibility_Name|Start_Date|End_Date
The h denotes a space character. Dates areformatted as “dd/mm/yyyy” (for example31/12/2001) or empty to omit. For exampleSales Foundation | Customer RelationshipMgmt|13/01/2001.
Read andWrite
erOraEBSSessionNumber Specifies the session ID Read
erOraEBSSupp Specifies a supplier. Read andWrite
erOraEBSUserEndDate Specifies the user's effective end date. Read andWrite
erOraEBSUserFax Specifies the user's fax number The fax number islimited to amaximum of 80characters.
Read andWrite
erOraEBSUserMail Specifies the user's email address. The email address islimited to amaximum of 240characters.
Read andWrite
erOraEBSUserStartDate Specifies the user's effective start date. Read andWrite
erPassword Specifies the password for the user name. The password islimited to amaximum of 45characters.
Write
erUid Specifies the user name. The user name islimited to amaximum of 100characters.
Read andWrite
erOraEBSSecAttr Specifies an associated securing attributeformatted asApplication_ID|Attribute_Code|Value. Do notuse blank spaces. For example,454|ONE_DAY_BOOK_TO_SHIP_PERCENT|2342. Ifthe Value is DATE, the format is dd-mm-yyyy(For example. 31-12-2001). If the Value isDATETIME, the format is dd-mm-yyyyhh24:mi:ss. (For example 31-12-200113:45:00).
Read andWrite
erOraEBSIndirectResp Specifies an inherited responsibility formattedlike erOraEBSResp.
Read
34 IBM Security Privileged Identity Manager: Oracle eBS Adapter Installation and Configuration Guide
Table 4. Attributes, descriptions, constraints, and permissions (continued)
Attribute Description Constraints Permissions
erOraEBSDirectRoles Specifies a directly granted role formatted as aJSON object with the fields
role (object)
startDate (string)
endDate (string)
reason (string)
The 'role' object is a JSON object with fieldsname (string), origSystem (string), andorigSystemId (string). The date fields(startDate and endDate) are represented asstrings with the format yyyymmddhh24mi'Z'.(For example 200112311345Z). For example,{"endDate":null,"reason":"Granted byXX","role":{"name":"UMX| SECURITY_ADMIN","origSystem":"UMX","origSystemId":"0"},"startDate":"201103150000Z"}.
Read andWrite
erOraEBSIndirectRole Specifies an inherited role formatted likeerOraEBSDirectRoles.
Read
Adapter attributes by operationsAdapter attributes by operations refer to adapter actions by their functionaltransaction group. They are required for customization, creating provisioning rules,and understanding what service/target attributes are supported by the adapter.
The lists include more information about required and optional attributes sent tothe Oracle eBS Adapter to complete that action.
System Login AddA System Login Add is a request to create a new user account with the specifiedattributes.
Table 5. Add request attributes for Oracle
Required attribute Optional attribute
erUid
erPassword
All other supported attributes
System Login ChangeA System Login Change is a request to change one or more attributes for thespecified users.
Table 6. Change request attributes for Oracle
Required attribute Optional attribute
erUidAll other supported attributes
Chapter 8. Reference 35
System Login DeleteThis operation is not supported.
System Login SuspendYou might need to suspend a system login.
A System Login Suspend is a request to disable a user account. The user is neitherremoved nor are their attributes modified.
Table 7. Suspend request attributes for Oracle
Required attribute Optional attribute
erUid
erAccountStatus
None
System Login RestoreYou might need to restore a system login.
A System Login Restore is a request to activate a user account that was previouslysuspended. After an account is restored, the user can access the system using thesame attributes as the ones before the Suspend function was called.
Table 8. Restore request attributes for Oracle
Required attribute Optional attribute
erUid
erAccountStatus
None
TestThe following table identifies attributes needed to test the connection.
Table 9. Test attributes
Required attribute Optional attribute
None None
ReconciliationYou might need to reconcile user account information.
The Reconciliation request synchronizes user account information between IBMSecurity Privileged Identity Manager and the adapter.
Table 10. Reconciliation request attributes for Oracle
Required attribute Optional attribute
None None
36 IBM Security Privileged Identity Manager: Oracle eBS Adapter Installation and Configuration Guide
Index
Aadapter
attributesby adapter action 35descriptions 33permissions 33
customizationsteps 23
features 1installation
dispatcher requirement 9steps 9troubleshooting errors 27verifying 16, 25warnings 27worksheet 8
overview 1profile
overview 1upgrading 17
SSL communication to thedatabase 19
supported configurations 2uninstall 31upgrading 17
adaptersremoving profiles 31
architecture 1attributes
adapter action, byreconciliation 36restoring 36suspending 36
by Oracle eBS Adapter actionadd 35change 35
by Oracle eBS Adapter action actiondelete 36
descriptions 33for the adapter 33
authentication for the adapter 21
Cchanges to the service form for SSL 21configuring
adapter authentication 21for tier authentication 21
connection 36creating
keystore 19self-signed certificate authority 19services 12truststore 19
custom subforms, deploying 11
Ddatabase
SSL communication to theadapter 19
truststore configuration 19deploying custom subforms 11directory integrator
connector 1unstalling the adapter 31
dispatcherinstallation 9upgrading 17
download, software 8
Eerror messages 29
Iinstallation
adapter 9first steps 19planning roadmaps 5uninstall 31verification
adapter 16, 25worksheet 8
JJDBC Thin driver
for SSL 22
Kkeystore for tier configuration 19
Mmessages
error 29warning 29
MS-DOS ASCII characters 24
Oobtaining the JDBC Thin driver 22operating system prerequisites 6overview 1
Pprofile
editing on UNIX or Linux 24
Rreconciliation 36removing
adapter profiles 31request attributes 36restore request 36restoring accounts
files, changing 24password requirements 24
RMI dispatcher 1roadmaps
planning 5
Sself-signed certificate authority for tier
configuration 19service
form changes for SSL 21restart 10start 10stop 10
service, creating 12software
download 8requirements 6website 8
SSLadapter authentication 21communication between adapter and
database 19information, service form 21JDBC Thin driver 22
subforms, custom 11supported
attributes 33configurations
adapter 2overview 2
suspend request attribute 36system login
restore 36suspend 36
Ttest attributes 36tier
authentication, configuring the TivoliDirectory Integrator 21
configuration 19troubleshooting
error messages 29identifying problems 27techniques for 27warning messages 29
troubleshooting and supporttroubleshooting techniques 27
truststore for tier configuration 19
37
Uuninstalling
adapter 31from the directory integrator 31
updatingadapter profile 23form labels 23
upgradeadapter 17dispatcher 17
upgradesadapter profiles 17
Vverification
dispatcher installation 9installation 16, 25operating
system prerequisites 6system requirements 6
softwareprerequisites 6requirements 6
vi command 24
Wwarning messages 29
38 IBM Security Privileged Identity Manager: Oracle eBS Adapter Installation and Configuration Guide
IBM®
Printed in USA