The Identity functionalities of this connector enable you as an Identity administrator to configure IBM RACF SecureWay as a connected system and then make Identity users part of the IBM RACF SecureWay system. This enables the user or Identity administrator to reset IBM RACF SecureWay account passwords. This also enables you to enable and disable user accounts.

The Provisioning functionalities of this connector enable exporting and importing user accounts on an IBM RACF SecureWay system.

 

Supported Features

Supported Features

 

Provisioning

 

Prerequisites

Ensure that these prerequisites are satisfied:

• IBM RACF SecureWay is installed, configured, and running.
• An administrator account that can be used to establish a connection and has authority to manage accounts on the connected system.

Creating the Connected System in the Admin UI

1. Log in to Identity Administration and click the Systems tab.
   
   
2. On the Connected System View page, click the Add button and select the IBM RACF SecureWay connected system from the Type drop-down list. The Connected System Details page displays the default values:
   
   
   

3. Enter the desired information:
   
   

   Definition

   Supported Connectors Displays whether the connected system is Identity only, Provisioning only, or both.

   Password Policy Displays the name of the password policy associated with the connected system.

   Connected System Group  Displays the name of the system group that includes this connected system. Note: If a password policy is associated with a connected system and then the connected system is placed in a group, the group’s password policy will override the connected system’s password policy. The password policy will be removed from the connected system.

   Type Select the connected system type.

   Locale Select the preferred language (default: English). Locale specific information such as Display Name and Description can be added only while modifying the connected system.

   Name The name for this connected system. Note: The name cannot be modified later.

   Display Name The display name of the new connected system.

   Description The description of the connected system.

   Associated With Select how the connector associated with this system will run: Server (default) - Runs locally on the Provisioning/Identity Server. Global Identity Gateway - Runs remotely on a Global Identity Gateway cluster member. Note: Only GIG clusters that have at least one registered and enabled member will display in this list. See the appendix Using the Global Identity Gateway with Connected Systems for additional information.

   Password Reset By Enables administrators to configure password management functions normally available to Users and OBO (On Behalf Of) Users: OBO User Only - Connected system and account association information is displayed only in Self-Service user management (for OBO Users). OBO Users can reset passwords for accounts on this connected system. Administrators can perform all user management functions for this connected system (e.g., enable/ disable, validate, associate user, and password reset). End users will not see their accounts on this connected system in Self-Service and Kiosk; therefore, they cannot reset passwords for accounts on this connected system. Users and OBO User - Connected system and account association information is displayed in Self-Service password reset, Self- Service - Kiosk, and Self-Service user management. Self-Service users, Kiosk users, and OBO Users can reset passwords for accounts on this connected system. Administrators can perform all user management functions for this connected system (e.g., enable/ disable, validate, associate user, and password reset). External - Connected system and account association information is not displayed in Self-Service password reset, Self-Service - Kiosk, and Self-Service user management. Self-Service users, Kiosk users, and OBO Users cannot reset passwords for accounts on this connected system. Note: When user management configuration enables OBO Users to perform password resets, this definition must be set to OBO User Only or Users and OBO User. For connectors that support Provisioning only, there is no password reset capability.

   Provisioning Option Select the provisioning option: Automated (default) - The connected system functions as a normal connected system; there are no restrictions. Administrative - The connected system cannot be used as an object in a workflow.

   Enable HPAM Support Select to make the connected system HPAM enabled (default: cleared). Note: This can only be set for systems that support Identity.

   Connection Information

   Host The IP address or host name of the server (e.g., 10.102.200.20 or localhost). Multiple hosts are supported by using a space-separated list of host names (e.g., abc.example.com example2.com:391 example3.com). The first server in the list that accepts the connection is used.

   Port The database port number.

   Service Account Name The name of the administrative user account used to connect to the server.

   Service Account Password The administrative user password.

   Use SSL Check this box if the connection is to be SSL-enabled.

   Use Search Information

   Base DN The rootDN of the Directory Information Tree (DIT).

   User Base DN The base DN where the users are located.

   User Object Classes Contains the object classes whose attributes must be shown when building the filter in the context list. Normally this list contains object classes that are required to create a new user account.

   User Department Attribute The attribute to use for the user’s department.

   Configuration Details

   Login ID Attribute The attribute that contains the login ID value.

   Password Attribute The attribute that contains the password value.

   System Owner Add or Remove users assigned as the owners of the system. Displays the Connected System Owner Search page for selecting users. The HPAM column indicates whether the system owner is authorized to use the HPAM feature. The Approvers column indicates whether the system owner is an approver in the approval process.

   Add PswdPolicy / Remove PswdPolicy Adds/removes a password policy to/from this connected system. If the connected system is associated with a Connected System Group, the buttons will be unavailable - all password policy assignments are defined at the group level (refer to Admin UI ► Systems ► Groups option).

4. Click the Test Connection button to test the Connection Information:

   • If successful, this messsage may display:

   Message: Connection from Identity to the connected system was established successfully.

   • If unsuccessful, this message may display:

   Error: Failed to establish connection from Identity to the connected system.

   
   Note: If the connection fails, additional messages may display providing more information regarding the failure, and additional information may be posted to the Provisioning and Identity logs.

5. Optional) To select owners of the system, click the System Owner Add button. The Connected System Owner Search page displays:
   
   
   
   1. Select the owners and then click the Select button. The system owner displays under the System Owner section:
      
      
      Note: More than one user can be assigned as an owner.
      
      
   2. To add additional system owners, click the Add button.
      
      
6. On the Connected System Details page, click the Add button to save the configured connected system. The Object Category Association page displays a list of categories that are already associated and/or can be selected to add additional associations to this connected system:
   
   
   
   1. Select one or more available object categories or provide search criteria and click the Search button to find specific categories to select. If there are no available categories to select, proceed to Step 7.
      
      
   2. Click the Add Association button to associate the selected object categories to the connected system.
      
      
7. Click the Back button to return to the Connected System View page. The new connected system displays in the list.

See the Copying, Modifying, and Deleting Connected Systems for additional information.

Creating the Connected System in the Studio

1. Log in to the Workflow and Connectivity Studio and click Connectivity ► Add Systems on the menu bar. The Add Connected Systems window displays.
   
   
   
2. Select the IBM RACF SecureWay connected system from the Type drop-down list. The default values display:
   
   
   

3. Enter the desired information:
   
   

   Definition

   Type Select the connected system type.

   Name The name for this connected system. Note: The name cannot be modified later.

   Display Name The display name of the new connected system.

   Description The description of the connected system.

   Supported Connectors Displays whether the connected system is Identity only, Provisioning only, or both. Only connectors that support Provisioning are available here.

   Associated With Select how the connector associated with this system will run: Server (default) - Runs locally on the Provisioning/Identity Server. Global Identity Gateway - Runs remotely on a Global Identity Gateway cluster member. Note: Only GIG clusters that have at least one registered and enabled member will display in this list. See the appendix Using the Global Identity Gateway with Connected Systems for additional information.

   Password Reset By Enables administrators to configure password management functions normally available to Users and OBO (On Behalf Of) Users: OBO User Only - Connected system and account association information is displayed only in Self-Service user management (for OBO Users). OBO Users can reset passwords for accounts on this connected system. Administrators can perform all user management functions for this connected system (e.g., enable/ disable, validate, associate user, and password reset). End users will not see their accounts on this connected system in Self-Service and Kiosk; therefore, they cannot reset passwords for accounts on this connected system. Users and OBO User - Connected system and account association information is displayed in Self-Service password reset, Self- Service - Kiosk, and Self-Service user management. Self-Service users, Kiosk users, and OBO Users can reset passwords for accounts on this connected system. Administrators can perform all user management functions for this connected system (e.g., enable/ disable, validate, associate user, and password reset). External - Connected system and account association information is not displayed in Self-Service password reset, Self-Service - Kiosk, and Self-Service user management. Self-Service users, Kiosk users, and OBO Users cannot reset passwords for accounts on this connected system. Note: When user management configuration enables OBO Users to perform password resets, this definition must be set to OBO User Only or Users and OBO User. For connectors that support Provisioning only, there is no password reset capability.

   Provisioning Option Select the provisioning option: Automated (default) - The connected system functions as a normal connected system; there are no restrictions. Administrative - The connected system cannot be used as an object in a workflow.

   Enable HPAM Support Select to make the connected system HPAM enabled (default: cleared). Note: This can only be set for systems that support Identity.

   Connection Information

   Host The IP address or host name of the server (e.g., 10.102.200.20 or localhost). Multiple hosts are supported by using a space-separated list of host names (e.g., abc.example.com example2.com:391 example3.com). The first server in the list that accepts the connection is used.

   Port The database port number.

   Service Account Name The name of the administrative user account used to connect to the server.

   Service Account Password The administrative user password.

   Use SSL Check this box if the connection is to be SSL-enabled.

   Use Search Information

   Base DN The rootDN of the Directory Information Tree (DIT).

   User Base DN The base DN where the users are located.

   User Object Classes Contains the object classes whose attributes must be shown when building the filter in the context list. Normally this list contains object classes that are required to create a new user account.

   User Department Attribute The attribute to use for the user’s department.

   Configuration Details

   Login ID Attribute The attribute that contains the login ID value.

   Password Attribute The attribute that contains the password value.

4. Click the Test Connection button to test the Connection Information:

   • If successful, this messsage may display:

   Message: Connection from Studio to the connected system was established successfully.

   • If unsuccessful, this message may display:

   Error: Failed to establish connection from Studio to the connected system.

   Note: If the connection fails, additional messages may display providing more information regarding the failure, and additional information may be posted to the Provisioning and Identity logs.

5. Click the Apply button to apply changes. The Category Association window displays.
   
   
   1. Select one or more object categories from the Available Categories list or enter a category name and click the Search button to find a specific category to select. If there are no available categories to select, proceed to Step 6.
      
      
   2. Click the Add button to associate the selected object categories to the connected system.
      
      
6. Click OK to accept selected categories.

See the Copying, Modifying, and Deleting Connected Systems for additional information.

Using the Connected System for Identity

Perform these procedures to configure the connector:

• Connector Details for Identity
• Identity Password Management

 

Identity Password Management

See the Identity Suite Administration Guide for details on password management. 

Using the Connected System for Provisioning

Perform these procedures to configure the connector:

• "Configuring for Export" 
• "Configuring for Import" 
• "Connector Details for Provisioning"

Note: If the number of records to be processed exceeds one thousand, we recommend configuring the workflow to use bulk mode, which lowers the memory consumption of the system by streaming data to files. Because data is streamed for every task, performance of the workflow execution will be decreased due to increased read-write operations. See the Workflow and Connectivity Studio document for details on how to configure bulk mode. 

Configuring for Export

Perform these procedures to configure the connector for data export:

• "Configuring the Export Connector" below
• "Configuring the Export Link" on page 80 

From the Workflow and Connectivity Studio, select the IBM RACF SecureWay UserExport workflow listed under the projects folder.

If a workflow does not already exist, create an export workflow. See the Workflow and Connectivity Studio document for details on creating export workflows.

Configuring the Export Connector

1. In the Design pane, double-click the export object (the first workflow object after the Start object). The Configure Data Source window displays:
   
   
   

2. From the Configure Plug-in tab, set these properties as required:

   Definition

   Associated Connected System Select the connected system from the list. The export operation will be done from this connected system.

   Name The name for this connected system. Note: The name cannot be modified later.

   Data Formats Select the type of data format to use: Profiles (this is the only data format supported at this time).

   DeltaExportMode Select the type of attribute to export if a change takes place (this works in conjunction with ExportMode when DeltaExport is selected): OnlyChangedAttributes - Performs a partial export of only the changed attributes from the last time the query was run. ChangedAndMandatoryAttributes (default) - Performs a partial export of both changed and mandatory attributes from the last time the query was run. Mandatory attributes are exported whether they have been changed or not. AllAttributes - Performs a full export of all attributes that contain a value.

   DynamicConnectedSystem Select the global variable to use as the dynamic connected sys- tem name. This works in conjunction with DynamicCon- nectedSystemOption when GlobalVariable is selected.

   DynamicConnectedSystemOption Select how to control Dynamic System Support (DSS): None - There will not be any Dynamic System Support. Transaction-SystemName - The value of the Transaction- SystemName attribute in data will be used as the dynamic connected system. The connected system name must be passed as the value of the attribute Transaction- SystemName; if it is missing in data, the operation will fail. GlobalVariable - Select a global variable to use as the dynamic connected system name from the property DynamicConnectedSystem.

   ExportDN Select the distinguished name in the LDAP directory where the connector will begin to locate entries. Entries in this container (default: dc=example,dc=com) will be exported based on the type of filter specified. When using this option, do not specify a value for ReadDN.

   ExportMode Select the type of data to export: FullExport - Exports all attributes. DeltaExport - Exports changed, mandatory, or all attributes, depending on the DeltaExportMode property setting.

   Filter Specify search criteria to determine the objects to be exported from the container specified in ExportDN. Use the Set Filter button that becomes active to create a filter. See "Set Filter" on page 78 for additional information.

   MaxConnections Select the maximum number of connections that can be created in the connection pool by the connector. As needed, the connection pool will grow only to this maximum limit (default: 10).

   MaxResults Select the maximum number of results to be returned (default: 300).

   PageIndex Select the index of the page to return. -1 returns all results (default).

   PageRefresh This is used only when PageIndex has been set to a value other than -1. It indicates whether or not to refresh the cache: TRUE - The search results cache is refreshed. FALSE (default) - The search results cache is retained.

   ReadDN Specify that only the attributes of a single entry are read. For example, to read attributes for a single user, enter the fully qualified distinguished name (DN) of the user entry (e.g., cn=Betty Lane,ou=Sales,dc=example,dc=com) as the ReadDN value. The ExportDN and Filter settings, if specified, are ignored if a ReadDN value is specified. Use the Select button to build the directory and select a specific DN value to read.

   ResultsPerPage Select the maximum number of results per page (default: 20).

   Scope Select the number of levels below the ExportDN to begin searching for possible entries to be exported: AllLevels (default) - Searches all entries and all levels below the DN entry specified by ExportDN. OnlyDN - Searches only the DN entry specified by ExportDN. OneLevel - Searches all entries one level below the DN entry specified by ExportDN.

   SortKey Specify the attribute name to use to sort results. If sorting is required on multiple attributes, list them in a comma delimited format (e.g., cn, sn). Sorting on DN is not supported.

   UseLdapServerPaging Select whether to use LDAP server paging (default: FALSE).

   Note: Hover the pointer over a property to view its description.

   Set Filter

   
   

3. Enter the required text in the Filter field or click the Set button to set the search filter. The Set Filter window displays:
   
   
   

   Description

   Attribute Select the attribute of the filter (e.g., objectClass, ou, sn). This represents the attribute name for searching the IBM RACF SecureWay directory.

   Comparison Select the operator value for this filter.

   Value Enter the required result value.

   AND Condition List Creates an AND statement comparing selected conditions. If there is more than one condition in this list box, all conditions must be true.

   OR Condition List Creates an OR statement comparing selected conditions. If there is more than one condition in this list box, one of the conditions must be true.

   Filter Syntax Displays the filter syntax used to retrieve entries from the LDAP directory and to build the export list.

   Edit Filter Manually Check this box to manually edit the filter in the Filter Syntax to build complex filters.

   1. Using logical AND/OR, generate the complex filter to narrow the search result. 

   2. Click OK when complete to return to the Configure Data Source window.

4. (Optional) Select the Attributes tab. Only standard attributes display:
   
   
   Modify schema attributes using these buttons:
   
   

   Add Adds additional attributes to the list. The Add New Attribute dialog displays.

   Export Exports the schema list to an XML file.

   Import Imports the schema list from an XML file.

   Refresh Schema Dynamically discovers the schema from the connected system. It also includes local as well as global attributes added in the Studio.

   Reset Schema Resets the schema definition to the default schema prepackaged with the IdM Suite, plus any global variable added.

5. (Optional) Select the Appearance tab to change how the Connected System object displays in the Design pane.

6. Click OK to save any changes and return to the Workflow and Connectivity Studio window.
   
   

   Configuring the Export Link

7. In the Design pane, double-click the export link between the export object (the first workflow object after the Start object) and the Data Mapper object. The Configure Link window displays:

   

   Description

   Source Attributes Select the attributes to export.

   Selected Attributes Displays default attributes and those attributes that have been selected from the Source Attributes. Notes: The check boxes are used only for delta export operations. These checked attributes will always be exported whether they were changed or not. Usually, the attributes that are selected as mandatory attributes help in identifying or verifying an entry when completing mapping functions.

   Advanced Settings Displays the Configure Attributes window for selecting any attributes that need to be encrypted.

8. From the Attribute Selection tab, select attributes to export.

9. (Optional) Select the Appearance tab to change how the link displays in the Design pane.

10. Click OK to save any changes and return to the Workflow and Connectivity Studio window.

11. (Optional) To create scripts for advanced functionality, right-click the export link and select the export task properties. See the section ‘Success Scripts and Failure Scripts’ in the Workflow and Connectivity Studio document for specific details.
    
    
12. Deploy the workflow by selecting Deploy ► New Deployment.
    See the Workflow and Connectivity Studio document for details of deployment options.
    
    
13. Manage and run the deployed workflow from the Admin UI ► Server tab. See the Identity Suite Administration Guide for details.

Configuring for Import

Perform these procedures to configure the connector for data import:

• "Configuring the Import Connector" 
• "Configuring the Import Link" 

 From the Workflow and Connectivity Studio, select the IBM RACF SecureWay UserAdd, UserModify, or UserDelete workflow listed under the projects folder.

If a workflow does not already exist, create an import workflow. See the Workflow and Connectivity Studio document for details on creating import workflows.

Configuring the Import Connector

1. In the Design pane, double-click the import object (the last workflow object). The Configure Data Source window displays:
   
   
   

2. From the Configure Plug-in tab, set these properties as required:
   
   

   Associated Connected System Select the connected system from the list. The import operation will be done to this connected system.

   Data Formats  Select the type of data format to use: Profiles (default) or ChangeLog.

   AddDiffWithTarget  If set to TRUE (default: FALSE), the target DN attributes are compared with the incoming modified attributes. Only the new attribute values are added. Other attributes are not updated. Note: If the target attribute is a multi-valued attribute, these must be set to TRUE: DiffWithTarget, AddDiffWithTarget, and RemoveDiffWithTarget.

   AddIfEntryNotExists  Select whether to create an entry if the entry does not already exist (default: FALSE).

   DiffWithTarget Select whether the attribute sets are compared: TRUE - The target DN attributes are compared with the incoming modified attributes. Only those attributes that have different values are modified. Unchanged attributes are discarded and not updated. If a new attribute is present, other than in the target DN attributes, it is added. FALSE (default) - The target DN attributes are not compared with the incoming modified attributes. All attributes are updated whether they have a changed value or not.

   DynamicConnectedSystem Select the global variable to use as the dynamic connected system name. This works in conjunction with DynamicConnectedSystemOption when GlobalVariable is selected.

   DynamicConnectedSystemOption Select how to control Dynamic System Support (DSS): None - There will not be any Dynamic System Support. Transaction-SystemName - The value of the Transaction-SystemName attribute in data will be used as the dynamic connected system. The connected system name must be passed as the value of the attribute Transaction-SystemName; if it is missing in data, the operation will fail. GlobalVariable - Select a global variable to use as the dynamic connected system name from the property DynamicConnectedSystem. See the Dynamic System Support appendix in the Workflow and Connectivity Studio document for additional information.

   Id * Enter the attribute that contains the value used to uniquely identify the user account user ID on the connected system.

   ImportDN The Distinguished Name (DN) in the LDAP directory where the connector will add entries during the import process if the dn attribute is not specified (default: ou=Imported Users,o=PQR,c=US). See Step 3. for details on using the Select button that becomes active for this property.

   loginId * Enter the attribute that contains the value used to uniquely identify the user account login ID on the connected system.

   MaxConnections Select the maximum number of connections that can be created in the connection pool by the connector. As needed, the connection pool will grow only to this maximum limit (default: 10).

   ModifyifEntryExists Select whether to perform a modify operation if an add operation fails (default: FALSE).

   RDN Select the attribute name to use when creating the Relative Distinguished Name (RDN) when adding entries to the local LDAP directory. When importing entries into the local LDAP directory, this specifies the attribute to use when creating the DN for the new imported entries (default: cn).

   RemoveDiffWithTarget Select whether to remove attributes from the target entry that do not exist in the modified data (default: FALSE).

   Notes: * Id and loginId are used by the Provisioning Policy and IdentityHub features to populate the ACCOUNT_ID and ACCOUNT_USERNAME columns of the FISC_USER_ACCOUNT table of the Product database. See the ‘Provisioning Policy’ and ‘Provisioning Using the IdentityHub’ chapters of the Identity Suite Administration Guide for details. Hover the pointer over a property to view its description.

3. (Optional) Select the Attributes tab. Only standard attributes display:
   
   Modify schema attributes with the buttons.
   
   
4. (Optional) Select the Appearance tab to change how the Connected System object displays in the Design pane.
   
   
5. Click OK to save any changes and return to the Workflow and Connectivity Studio window.
   
   

   Configuring the Import Link

6. In the Design pane, double-click the import link between the Data Mapper object and the import object (the last workflow object). The Configure Link window displays:

   

   Description

   Source Attributes Select the attributes to export.

   Check for attribute-level auditing If auditing is enabled and these attributes below are checked, Provisioning will log all events for auditing purposes.

   Selected Attributes Displays default attributes and those attributes that have been selected from the Source Attributes. Notes: The check boxes are used only for delta export operations. These checked attributes will always be exported whether they were changed or not. Usually, the attributes that are selected as mandatory attributes help in identifying or verifying an entry when completing mapping functions.

   Advanced Settings Displays the Configure Attributes window for selecting any attributes that need to be encrypted.

   Audit Key Select the attribute to associate with the Audit Key.

7. From the Attribute Selection tab, select attributes to import. You must add the User ID attribute to the Selected Attributes. You can select other attributes optionally.

8. Click OK to save any changes and return to the Workflow and Connectivity Studio window.

9. Deploy the workflow by selecting Deploy ► New Deployment.
   See the Workflow and Connectivity Studio document for details of deployment options.
   
   
10. Manage and run the deployed workflow from the Admin UI ► Server tab. See the Identity Suite Administration Guide for details.

Connector Details for Provisioning

Configuration import properties accountDN, Id, and loginId are used by the Provisioning Policy and IdentityHub features to populate the ACCOUNT_ID, ACCOUNT_DN, and ACCOUNT_USERNAME columns of the FISC_USER_ACCOUNT table of the Product database. See the ‘Provisioning Policy’ and ‘Provisioning Using the IdentityHub’ chapters of the Identity Suite Administration Guide for details.

This table shows the default attributes specified for these properties for the connected system:

 

Connector Attributes

The items in the Export, Create, Modify, and Delete columns have these meanings:

• Y = Yes (attribute is supported for this operation)
• N = No (attribute is not supported for this operation)
• R = Required (attribute is mandatory for this operation)