1.1.1 Publisher Channel

The Publisher shim provides identity change information to the Metadirectory engine as XDS event documents. The Metadirectory engine applies policies, takes the appropriate actions, and posts the events to the Identity Vault.

1.1.2 Subscriber Channel

The Subscriber channel receives XDS command documents from the Metadirectory engine, stores them as name-value variables in a user space, then calls the appropriate CL programs to handle the command.

The provided CL programs support adds, modifies, renames, and deletes for User and Group objects, and handle password synchronization. You can extend the CL programs to support other object types and events. The CL programs securely access the original command data by calling GETIDMVAR, which provides access to the user space.

1.1.3 Scriptable Framework

The interface between the the IBM i security system and the driver shim uses customizable CL programs. You can extend the programs that are provided with the driver to support other applications and databases.

Several helper commands are provided with the driver to enable communication with the driver shim and the change log. An extensible connected system schema file allows you to add your own objects and attributes to those already supported by the driver.

For more information about the CL programs and the scriptable framework, see Section 5.1, The Scriptable Framework.

1.1.4 Schema File

The configuration of class and attribute definitions for the connected IBM i system is specified using the schema file. You can modify and extend this file to include new objects and attributes. For details about configuring the schema file, see Section 5.2, The Connected System Schema File.

The schema for the connected system includes two classes: UserProfile and GroupProfile. UserProfile contains fields from both the *USRPRF object and the distribution directory. Exactly one distribution directory entry can be associated with each user profile.

1.1.5 Include/Exclude File

The include/exclude file allows local system policy to enforce which objects are included or excluded from provisioning, on both the Publisher channel and the Subscriber channel, independently. For details about using the include/exclude file, see Section 5.3, The Connected System Include/Exclude File.

1.1.6 Loopback State Files

The loopback state files are used to provide automatic loopback detection for external applications that do not have mechanisms to perform loopback detection. This loopback detection prevents subscribed events from being published back to the Identity Vault.

1.2.1 Data Flow

Filters and policies control the data flow of users and groups to and from the connected system and the Identity Vault. The Data Flow option, specified during driver import, determines how these filters and policies behave.

1.2.2 Filter and Schema Mapping

Attributes of i5/OS profiles that correspond to attributes of eDirectory™ User and Group objects are mapped by the default driver filter and the schema mapping policy. The IBM i driver provides a file (i5os.sch) that you can use to add auxiliary classes to eDirectory User and Group objects to support many more IBM i user and group attributes.

The Metadirectory engine uses filters to control which objects and attributes are shared. The default filter configuration for the IBM i driver allows objects and attributes to be shared as described in Table 1-2 and Table 1-3.

The eDirectory class User corresponds to the IBM i class UserProfile.

The eDirectory class Group corresponds to the IBM i class GroupProfile.

1.2.3 Policies

The Metadirectory engine uses policies to control the flow of information into and out of the Identity Vault. The following table describes the policy functions for the IBM i driver in the default configuration:

3.3.1 Connected System Requirements

One of the following operating systems:

For more information about supported platforms and operating environments, see the Identity Manager 4.7 Drivers Documentation Web site. From this index page, you can select a readme file associated with the platform(s) for which you need support.

3.3.2 Identity Vault Requirements

5.2.1 Schema File Syntax

Each line in the schema file represents an element and must begin with the element name: SCHEMA, CLASS, or ATTRIBUTE.

The first element of the schema file is the schema definition. The schema definition is followed by class definitions. Each class definition can contain attribute definitions.

Except for the values of class and attribute names, the contents of the schema file are case insensitive.

# This is a comment.

SCHEMA [HIERARCHICAL]

CLASS className [CONTAINER]

ATTRIBUTE attributeName [TypeAndProperties]

5.2.2 Example Schema File

######################################################################
#  IBM i Driver Schema File
#
# Syntax:
#   SCHEMA [HIERARCHICAL]
#
#     HIERARCHICAL defines whether the schema has a hierarchy.
#                  Default is false.
#
#   CLASS <class-name> [CONTAINER]
#
#     CONTAINER defines whether the class is a container class.
#               Default is false.
#
#   ATTRIBUTE <attribute-name> [CASESENSITIVE] [MULTIVALUED] [NAMING] 
#                              [READONLY] [REQUIRED] [STRING] [INTEGER] 
#                              [STATE] [DN]
#
#     CASESENSITIVE defines this attribute to be case sensitive.
#                   Default is false.
#
#     MULTIVALUED defines this attribute to be multivalue.
#                 Default is false.
#
#     NAMING defines this attribute as the class naming attribute.
#            Default is false.
#
#     READONLY defines this attribute to be read-only.
#              Default is false.
#
#     REQUIRED defines this attribute to be required for class
#              definition.
#              Default is false.
#
#     STRING defines this attribute to be of type string.
#            String is the default type.
#
#     INTEGER defines this attribute to be of type integer.
#            String is the default type.
#
#     STATE defines this attribute to be of type Boolean (TRUE or
#           FALSE)
#            String is the default type.
#
#     DN defines this attribute to be a distinguished name
#       (referential)
#            String is the default type.
#
######################################################################

SCHEMA

  CLASS UserProfile

    ATTRIBUTE USRPRF NAMING REQUIRED  # User Profile Name
    ATTRIBUTE PASSWORD                # 
    ATTRIBUTE PWDEXP                  # Password Expired *YES or *NO
    ATTRIBUTE STATUS                  # *ENABLED or #DISABLED
    ATTRIBUTE USRCLS                  # User Class
    ATTRIBUTE ASTLVL                  # Assistance Level
    ATTRIBUTE CURLIB                  # Current Library
    ATTRIBUTE INLPGM                  # Initial Program to Call
    ATTRIBUTE INLMNU                  # Initial Menu
    ATTRIBUTE LMTCPB                  # Limit Capabilities
    ATTRIBUTE TEXT                    # Text Description
    ATTRIBUTE SPCAUT                  # Special Authority
    ATTRIBUTE SPCENV                  # Special Environment
    ATTRIBUTE DSPSGNINF               # Display sign-on information
    ATTRIBUTE PWDEXPITV               # Password Expiration Interval
    ATTRIBUTE LMTDEVSSN               # Limit Device Sessions
    ATTRIBUTE KBDBUF                  # Keyboard Buffering
    ATTRIBUTE MAXSTG                  # Maximum Allowed Storage
    ATTRIBUTE PTYLMT                  # Highest Schedule Priority
    ATTRIBUTE JOBD                    # Job Description
    ATTRIBUTE GRPPRF                  # Group Profile
    ATTRIBUTE OWNER                   # Owner
    ATTRIBUTE GRPAUT                  # Group Authority
    ATTRIBUTE GRPAUTTYP               # Group Authority Type
    ATTRIBUTE SUPGRPPRF MULTIVALUED   # Supplemental Groups
    ATTRIBUTE ACGCDE                  # Accounting Code
    ATTRIBUTE MSGQ                    # Message Queue
    ATTRIBUTE DLVRY                   # Message Queue Delivery Method
    ATTRIBUTE SEV                     # Message Severity Code Filter
    ATTRIBUTE PRTDEV                  # Print Device
    ATTRIBUTE OUTQ                    # Output Queue
    ATTRIBUTE ATNPGM                  # Attention Program
    ATTRIBUTE SRTSEQ                  # Sort Sequence
    ATTRIBUTE LANGID                  # Language ID
    ATTRIBUTE CNTRYID                 # Country or Region ID
    ATTRIBUTE CCSID                   # Coded Character Set ID
    ATTRIBUTE CHRIDCTL                # Character Identifier Control
    ATTRIBUTE SETJOBATR               # Locale Job Attributes
    ATTRIBUTE LOCALE                  # Locale
    ATTRIBUTE USROPT                  # User Options
    ATTRIBUTE UID INTEGER             # User ID number
    ATTRIBUTE GID INTEGER             # Group ID number
    ATTRIBUTE HOMEDIR                 # Home Directory
    ATTRIBUTE GroupMembership MULTIVALUED # Virtual attr for GRPPRF &
                                          # SUPGRPPRF
# Distribution Directory Entry Attributes
    ATTRIBUTE USRID                   # User Identifier
    ATTRIBUTE USRD                    # User Description
    ATTRIBUTE USER                    # User Profile
    ATTRIBUTE SYSNAME                 # System Name
    ATTRIBUTE NETUSRID                # Network User ID
    ATTRIBUTE LSTNAM                  # Last Name
    ATTRIBUTE FSTNAM                  # First Name
    ATTRIBUTE MIDNAM                  # Middle Name
    ATTRIBUTE PREFNAM                 # Preferred Name
    ATTRIBUTE FULNAM                  # Full Name
    ATTRIBUTE DEPT                    # Department
    ATTRIBUTE TITLE                   # Job Title
    ATTRIBUTE CMPNY                   # Company
    ATTRIBUTE TELNBR1                 # Telephone Number 1
    ATTRIBUTE TELNBR2                 # Telephone Number 2
    ATTRIBUTE FAXTELNBR               # FAX Telephone Number
    ATTRIBUTE LOC                     # Location
    ATTRIBUTE BLDG                    # Building
    ATTRIBUTE OFC                     # Office
    ATTRIBUTE ADDR1                   # Address Line 1
    ATTRIBUTE ADDR2                   # Address Line 2
    ATTRIBUTE ADDR3                   # Address Line 3
    ATTRIBUTE ADDR4                   # Address Line 4
    ATTRIBUTE INDUSR                  # Indirect User
    ATTRIBUTE PRTPERS                 # Print Private Mail
    ATTRIBUTE PRTCOVER                # Print Cover Page
    ATTRIBUTE NFYMAIL                 # Mail Notification
    ATTRIBUTE NFYMSGS                 # Messages
    ATTRIBUTE TEXT                    # Text
    ATTRIBUTE CMDCHRID                # Command Character Identifier
    ATTRIBUTE COUNTRY                 # Country or Region ID
    ATTRIBUTE ADMD                    # Administration Domain
    ATTRIBUTE PRMD                    # Private Management Domain
    ATTRIBUTE SURNAM                  # Surname
    ATTRIBUTE GIVENNAM                # Given Name
    ATTRIBUTE INITIALS                # Initials
    ATTRIBUTE GENQUAL                 # Generational Qualifier
    ATTRIBUTE ORG                     # Organization
    ATTRIBUTE ORGUNIT MULTIVALUED     # Organizational Units
    ATTRIBUTE DMNDFNATR MULTIVALUED   # Domain-defined Attributes
    ATTRIBUTE USRDFNFLD MULTIVALUED   # User-defined Fields
    ATTRIBUTE MSFSRVLVL               # Mail Service Level
    ATTRIBUTE PREFADR                 # Preferred Address
    ATTRIBUTE CCMAILADR               # cc:Mail Address
    ATTRIBUTE CCMAILCMT               # cc:Mail Comment
    ATTRIBUTE ALWSYNC                 # Allow Synchronization
    ATTRIBUTE DLOOWN                  # DLO Owner

  CLASS GroupProfile

    ATTRIBUTE USRPRF NAMING REQUIRED  # User Profile Name
    ATTRIBUTE PWDEXP                  # Password Expired *YES or *NO
    ATTRIBUTE STATUS                  # *ENABLED or #DISABLED
    ATTRIBUTE USRCLS                  # User Class
    ATTRIBUTE ASTLVL                  # Assistance Level
    ATTRIBUTE CURLIB                  # Current Library
    ATTRIBUTE INLPGM                  # Initial Program to Call
    ATTRIBUTE INLMNU                  # Initial Menu
    ATTRIBUTE LMTCPB                  # Limit Capabilities
    ATTRIBUTE TEXT                    # Text Description
    ATTRIBUTE SPCAUT                  # Special Authority
    ATTRIBUTE SPCENV                  # Special Environment
    ATTRIBUTE DSPSGNINF               # Display sign-on information
    ATTRIBUTE PWDEXPITV               # Password Expiration Interval
    ATTRIBUTE LMTDEVSSN               # Limit Device Sessions
    ATTRIBUTE KBDBUF                  # Keyboard Buffering
    ATTRIBUTE MAXSTG                  # Maximum Allowed Storage
    ATTRIBUTE PTYLMT                  # Highest Schedule Priority
    ATTRIBUTE JOBD                    # Job Description
    ATTRIBUTE GRPPRF                  # Group Profile
    ATTRIBUTE OWNER                   # Owner
    ATTRIBUTE GRPAUT                  # Group Authority
    ATTRIBUTE GRPAUTTYP               # Gropu Authority Type
    ATTRIBUTE SUPGRPPRF MULTIVALUED   # Supplemental Groups
    ATTRIBUTE ACGCDE                  # Accounting Code
    ATTRIBUTE DOCPWD                  # Document Password
    ATTRIBUTE MSGQ                    # Message Queue
    ATTRIBUTE DLVRY                   # Delivery
    ATTRIBUTE SEV                     # Severity Code Filter
    ATTRIBUTE PRTDEV                  # Print Device
    ATTRIBUTE OUTQ                    # Output Queue
    ATTRIBUTE ATNPGM                  # Attention Program
    ATTRIBUTE SRTSEQ                  # Sort Sequence
    ATTRIBUTE LANGID                  # Language ID
    ATTRIBUTE CNTRYID                 # Country or Region ID
    ATTRIBUTE CCSID                   # Coded Character Set ID
    ATTRIBUTE CHRIDCTL                # Character Identifier Control
    ATTRIBUTE SETJOBATR               # Locale Job Attributes
    ATTRIBUTE LOCALE                  # Locale
    ATTRIBUTE USROPT                  # User Options
    ATTRIBUTE UID INTEGER             # User ID number
    ATTRIBUTE GID INTEGER             # Group ID number
    ATTRIBUTE HOMEDIR                 # Home Directory
    ATTRIBUTE EIMASSOC                # EIM Association
    ATTRIBUTE Members MULTIVALUED     # Virtual attribute that has
                                      # all members

5.3.1 Include/Exclude Processing

Identity Vault events for identities that match an exclude rule are discarded by the Subscriber shim. Local events for identities that match an exclude rule are not sent to the Metadirectory engine by the Publisher shim.

Included identities are treated normally by the Subscriber and Publisher shims.

Identities that do not match an include rule or an exclude rule in the file are included.

Identities are matched in the following priority:

Within each level of this matching priority, identities are matched against rules in the order that the rules appear in the file. The first rule that matches determines whether the identity is included or excluded.

5.3.2 Include/Exclude File Syntax

Except for class names, attribute names, and the values to match, the contents of the include/exclude file are case insensitive.

The include/exclude file can contain any number of include sections, exclude sections, and single-line rules.

Include sections and exclude sections can contain class matching rules, and class matching rules can contain attribute matching rules. Include sections and exclude sections can also contain association matching rules.

Include and exclude sections can be contained in subscriber and publisher sections to limit their scope to the specified channel.

Class and attribute names used in the include/exclude file must correspond to the names specified in the schema file. For details about the schema file, see Section 5.2, The Connected System Schema File.

# This is a comment.

SUBSCRIBER
  .
  .
  .
ENDSUBSCRIBER

PUBLISHER
  .
  .
  .
ENDPUBLISHER

INCLUDE
  .
  .
  .
ENDINCLUDE

EXCLUDE
  .
  .
  .
ENDEXCLUDE

CLASS className
  .
  .
  .
ENDCLASS

attributeName=expression

# Exclude the User object if its USRPRF is USER01 or USER02.
EXCLUDE
CLASS UserProfile
    USRPRF=USER01
ENDCLASS
CLASS UserProfile
    USRPRF=USER02
ENDCLASS
ENDEXCLUDE

EXCLUDE
  QSECOFR
ENDEXCLUDE

[SUBSCRIBER|PUBLISHER] INCLUDE|EXCLUDE [className] objectSelection

{associationMatch | attributeName=expression}

# Do not subscribe to events for the ADMIN user.
SUBSCRIBER EXCLUDE adminUserProfile

5.3.3 Example Include/Exclude Files

# Exclude users whose names start with TEMP
EXCLUDE
    CLASS UserProfile
        USRPRF=TEMP.*
    ENDCLASS
ENDEXCLUDE

# Exclude USERA and USERB
# Because attribute rules are ANDed, these must be in separate
# CLASS sections.
EXCLUDE
    CLASS UserProfile
        USRPRF=USERA
    ENDCLASS
    CLASS UserProfile
        USRPRF=USERB
    ENDCLASS
ENDEXCLUDE

# Exclude all users except those whose names start with IDM
# This works because channel-specific matching takes precedence
# over general matching.
EXCLUDE
    CLASS UserProfile
    ENDCLASS
ENDEXCLUDE
 
SUBSCRIBER INCLUDE UserProfile USRPRF=IDM.*
PUBLISHER INCLUDE UserProfile USRPRF=IDM.*

5.4.1 Modifying the Filter

If you want to map this attribute to an existing attribute in the i5/OS schema, modify the Schema Mapping policy for the driver.

For complete details about managing filters and Schema Mapping policies, see the Identity Manager 4.7 Documentation Web site.

5.4.2 Modifying the CL Programs for New Attributes

In the Subscriber channel, a specific CL program is called to take the appropriate action for each type of event. If the additional attribute is required for adds and modifies of users, modify ADDUSER and MODUSER to process the additional attribute.

To edit a CL program, use the following command:

EDTF FILE(LibName/QCLSRC) MBR(PgmName)

LibName is the name of the driver library and PgmName is the name of the CL program. The default driver library name is I5OSDRV.

CL programs must be compiled for use. To compile a CL program, use the following command:

CRTBNDCL PGM(LibName/PgmName) SRCFILE(LibName/QCLSRC)

LibName is the name of the driver library and PgmName is the name of the CL program. The default driver library name is I5OSDRV.

Publishing additional attributes requires that you act on changes made in the i5/OS source application.

6.1.1 Properties That Can Be Set Only during Driver Import

Properties that you can set only during driver import are used to generate policies and other configuration details.

6.1.2 Driver Configuration Page

hostname=192.168.17.41 port=8090 kmo="SSL CertificateIP"

6.1.3 Global Configuration Values Page

To view and edit Password Management GCVs, select Show for Show Password Management Policy.

To view and edit User and Group Placement GCVs, select Show for Show User and Group Placements.

users.myorg

groups.myorg

6.3.1 Migrating Identities from the Identity Vault to the Connected System

To view the results of the migration, click View the Driver Status Log. For details about the log, see Section A.1.5, The Status Log.

If a user has a Distribution Password, the Distribution Password is migrated to the connected system as the user’s password. Otherwise, no password is migrated. For information about Universal Passwords and Distribution Passwords, see the appropriate version of the Password Management Administration Guide at the NetIQ Documentation Web site.

6.3.2 Migrating Identities from the Connected System to the Identity Vault

To view the results of the migration, click View the Driver Status Log. For details about the log, see Section A.1.5, The Status Log.

Because local passwords cannot be retrieved from the IBM i security system, they cannot be submitted to the Metadirectory engine until they are changed. The Validate Password exit program captures password changes.

6.3.3 Synchronizing the Driver

To generate events for associated objects that have changed since the driver’s last processing, open the Identity Manager Driver Overview page for the driver in iManager, then click Synchronize.