[ITIM] Quiescing a provisioning policy

Disabling a provisioning policy in ITIM 4.5.1 will “do things”. There are times, however, when I simply need to have it stop what it’s doing without triggering some sort of mass re-evaluation.

To disable:
ldapmodify -D cn=root -w password -h host -p 389 -f disable_myprovisioning_pol.txt

Where disable_myprovisioning_pol.txt contains:
dn: erglobalid=ERGLOBALID,ou=policies,erglobalid=00000000000000000000,o=myco,c=us
changetype: modify
replace: erenabled
erenabled: false

To enable:
ldapmodify -D cn=root -w password -h host -p 389 -f enable_myprovisioning_pol.txt

Where enable_myprovisioning_pol.txt contains:
dn: erglobalid=ERGLOBALID,ou=policies,erglobalid=00000000000000000000,o=myco,c=us
changetype: modify
replace: erenabled
erenabled: true

If you’re making an update to the policy (using the ITIM interface) be careful to NOT:
– Remove any memberships from the policy
– Modify any users (using TAM, ITIM or a ldapmodify)

re: ITIM 4.5.1

[TDS, LDAP] Adding an organizational unit

ldapmodify -D cn=root -w password -h host -p 389 -a -f myous.txt

Where myous.txt contains the following:

dn: ou=users,o=myco,c=us
ou: users
objectclass: organizationalUnit

dn: ou=groups,o=myco,c=us
ou: groups
objectclass: organizationalUnit

[ITIM] JavaScript examples

Finding JavaScript examples is easy enough but for some reason finding examples that are relevant to TIM…not so much. A few are found in the following docs:

Extending IBM Tivoli Identity Manager 4.6 Using JavaScript (mirror)

Identity and Access Management Solutions Using WebSphere Portal V5.1, TIM V4.5.1, and TAM V5.1 (mirror)

A Sample Integration of IBM Tivoli Security Management Products (mirror)

re: ITIM 4.5.1/4.6

[ITIM] JavaScript snippet – ertam4groupmember – assigning more than one group

{var timRoles = "";
var tamGrps = new Array();

timRoles = subject.getProperty("role");

if (timRoles != null) {
        if (timRoles.length > 0) {
                for (i = 0; i < timRoles.length; i++) {
                        if (timRoles[i].name == "User Role 1") {
                                tamGrps[tamGrps.length] = "usergrp1";
                        }
                        else if (timRoles[i].name == "User Role 2") {
                                tamGrps[tamGrps.length] = "usergrp2";
                        }
                        else if (timRoles[i].name == "User Role 3") {
                                tamGrps[tamGrps.length] = "usergrp3";
                        }
                        else if (timRoles[i].name == "User Role 4") {
                                tamGrps[tamGrps.length] = "usergrp4";
                        }
                        else if (timRoles[i].name == "User Role 5") {
                                tamGrps[tamGrps.length] = "usergrp5";
                        }
                }
        }
}

return tamGrps;}

File with snippet (formatted)

re: ITIM 4.5.1

[eTrust] Perl script to extract users

Nothing fancy. Grab users and write them to file.

File with snippet

re: eTrust

[TAM] Running Web Portal Manager with WAS Security turned on

Once you enable WAS security on the WAS instance to which the TAM WPM was deployed you will see that you will be prompted for a username and password before even getting to the WPM homepage. That’s WAS security kicking in.

In order to disable it navigate to the WAS console then Applications -> Enterprise Applications -> TAMWPM -> Map security roles to users/groups. Uncheck everything under “All Authenticated?” and check everything under “Everyone?”. Save and restart. The next time you browse to the WPM you will get to the WPM homepage without WAS prompting you for anything.

Screenshot!

Oh yeah…probably not a bad idea to apply WAS & Java fixpacks…
WebSphere Application Server 5.0.2 Cumulative Fix 17
V5.0.2: SDK 1.3.1 Cumulative Fix

re: TAM 5.1

[TAM] Perl script to replicate the authorization database

Straight forward perl script that will use the pdadmin command line utility to retrieve a server listing and then execute a server replicate for each server.

If you’re running it on Windows grab yourself the Perl distribution from Activestate and unix utilities from Cygwin. You will of course also need to have the TAM Runtime component installed.

File with snippet

re: TAM 5.1

[TIM] JavaScript snippet – ertam4groupmember

{var timRoles = subject.getProperty(“role”);
var tamGrp = ” “;
var adminRl = false;
var userRl = false;

if (timRoles.length > 0) {
for (var i =0; i < timRoles.length; i++)

if (timRoles[i].name == “Application ABC Admin”)
adminRl = true;
if (timRoles[i].name == “Application ABC User”)
userRl = true;
}

if (adminRl)
tamGrp = “appabc_admins”;
else if (userRl)
tamGrp = “appabc_users”;
else
tamGrp = ” “;
}
else
tamGrp = ” “;

return tamGrp;}

File with snippet

re: TIM 4.5.1

[TAM] Removing ghost server entries – svrsslcfg

What’s a “ghost server”? I’m referring to the leftover reference to a WebSEAL server, authorization server, Web Portal Manager server, so on so forth, in the master authorization database after either a failed configuration/unconfiguration attempt or the removal of a physical server without having first executed pdconfig to cleanly remove whatever TAM server components happen to have lived there. To remove use the C-based version of svrsslcfg.

svrsslcfg -unconfig -f /tmp/null.conf -n <APP/SVRNAME>-webseald -h <HOST> -P <ADMIN_PWD> -A <ADMIN_ID>

If for example one had a WebSEAL server reference mysite.com-webseald-svrhost1 (output from a server list command):

svrsslcfg -unconfig -f /tmp/null.conf -n mysite.com-webseald -h svrhost1 -P passw0rd -A sec_master

You can provide the -f switch an empty file.

re: TAM 5.1

[TAM] Using the TAM Java Admin API – Part 3 Sample Code

Nothing fancy here, just enough to connect, get a list of servers and then disconnect:

TAMTestPDJrte.java

To compile:
JAVA_HOME=/usr/j2se
CLASSPATH=.:$JAVA_HOME/jre/lib/rt.jar:$JAVA_HOME/jre/lib/ext/PD.jar
$JAVA_HOME/bin/javac -classpath %CLASSPATH% TAMTestPDJrte.java

To run:
JAVA_HOME=/usr/j2se
CLASSPATH=.:$JAVA_HOME/jre/lib/rt.jar:$JAVA_HOME/jre/lib/ext/PD.jar
$JAVA_HOME/jre/bin/java -classpath $CLASSPATH TAMTestPDJrte <USERID> <PASSWORD> file:///usr/j2se/jre/PolicyDirector/PDPerm.properties

re: TAM 5.1