Ensure that you use binary mode to FTP the driver samples library, load library, and REXX exec library XMT files to the target system.
Ensure that you use a version of Identity Console compatible with your version of Identity Manager.
Examine the log file at /var/nds/schema.log.
Ensure that you specify the correct parameters (host name, Admin FDN in dotted format, and password).
Ensure that you have network connectivity to the Metadirectory server.
To set up certificates, the driver shim communicates with the Metadirectory server using the LDAP secure port (636).
Ensure that eDirectory™ is running LDAP with SSL enabled. For details about configuring eDirectory, see the NetIQ eDirectory Administration Guide.
Ensure that the connected system has network connectivity to the Metadirectory server.
You can use the driver REXX exec library member SETCERT to configure the certificate at any time.
If you cannot configure SSL using LDAP, you can install the certificate manually.
Click Certificate Management > Trusted Root Management options from the Identity Console landing page. The Trusted Root Container check box will be selected by default. Select the Trusted Root check box.
Select the appropriate trusted root certificate from the list and click the export icon.
In the next screen, do not select the check box for Export Private key.
Select Base64 format, then click OK.
Use FTP or another method to store the file on the connected system as /opt/novell/racfdrv/keys/ca.pem.
NOTE:The ca.pem file is an ASCII text file and must be transferred accordingly.
Examine the status log and DSTRACE output.
The driver must be specified as a Remote Loader driver. You can set this option in Identity Console.
You must activate both Identity Manager and the driver within 90 days. The IDM Administration page in Identity Console shows when Identity Manager requires activation. The Drivers page shows when the driver requires activation.
For details about activating NetIQ Identity Manager Products, see the Identity Manager 4.8 Installation Guide on the Identity Manager 4.8 Documentation Web site .
Ensure that the driver load library is APF-authorized.
You can use the DISPLAY PROG,APF operator command to display your APF-authorized libraries.
Ensure that the LDXSERV and SAFQUERY commands are listed as authorized TSO commands in your active IKJTSOxx member.
You can use the DISPLAY IKJTSO,AUTHCMD operator command to display authorized TSO commands.
For more information about troubleshooting Identity Manager engine errors, see the Identity Manager 4.8 Documentation Web site.
Examine the trace file.
Ensure that the connected system’s operating system and security system versions are supported. For a list of supported operating systems, see Connected System Requirements.
Apply all maintenance for your operating system and security system.
Ensure that the Remote Loader and Driver object passwords that you specified while setting up the driver on the Metadirectory server match the passwords stored with the driver shim.
To update these passwords on the connected system, use the SETPWDS REXX exec. The passwords are stored under /opt/novell/racfdrv/keys in encrypted files dpwdlf40 (Driver object password) and lpwdlf40 (Remote Loader password).
To update these passwords on the Metadirectory server, use Identity Console to update the driver configuration. For details, see Driver Configuration Page.
Ensure that the correct host name and port number of the connected system are specified in the Driver Configuration Remote Loader connection parameters. You can change the port number (default 8090) in the driver shim configuration file.
Ensure that the driver shim started task has been set up properly. For details, see Setting Up the Started Tasks.
Ensure that only one system in a complex that shares the security system database is running the driver shim started task.
Examine the status log, DSTRACE output, trace file, and REXX exec output file.
To be provisioned, users and groups must be in the appropriate base container. You can view and change the base containers in Identity Console on the Global Config Values page of the Drivers page. For more details, see Global Configuration Values Page.
To provision identities from the Identity Vault to the connected system, the driver Data Flow property must be set to Bidirectional or Identity Vault to Application. To change this value, re-import the driver rules file over your existing driver.
The user that the driver is security equivalent to must have rights to read information from the base container. For details about the rights required, see Table 2-2, Base Container Rights Required by the Driver Security-Equivalent User.
Examine the status log, DSTRACE output, and trace file.
Examine the User Base Container and Group Base Container GCV values. For more details, see Global Configuration Values Page.
To provision identities from the connected system to the Identity Vault, the driver Data Flow property must be set to Bidirectional or Application to Identity Vault. To change this value, re-import the driver rules file over your existing driver.
The user that the driver is security equivalent to must have rights to update the base container. For details about the rights required, see Table 2-2, Base Container Rights Required by the Driver Security-Equivalent User.
Ensure that the security system exit has been installed, that LLA has been refreshed, and that the exit has been activated. For details, see Installing the Driver Security System Exits.
Examine the status log, DSTRACE output, and REXX exec output file.
Several password management properties are available in Identity Console on the Global Config Values page of the Drivers module. Ensure that the connected system accepts passwords from the Identity Vault. To determine the right settings for your environment, view the help for the options, or see the NetIQ Identity Manager 4.8 Administration Guide on the Identity Manager 4.8 Documentation Web site.
Ensure that the user’s container has an assigned Universal Password policy and that the Synchronize Distribution Password When Setting Universal Password option is set for this policy.
Examine the status log, DSTRACE output, and the trace file.
Several password management properties are available in Identity Console on the Global Config Values page. Ensure that at least one of the following options is set:
The Identity Vault Accepts Passwords from the RACF Connected System
The Identity Vault Accepts Administrative Password Resets from the RACF Connected System
To determine the right settings for your environment, view the help for the options, or see the NetIQ Identity Manager 4.8 Administration Guide on the Identity Manager 4.8 Documentation Web site.
If the Require Password Policy Validation before Publishing Passwords GCV is set, the user’s password must satisfy the password rules in the password policy assigned to the user container.
Ensure that the change log started task is running on all systems that share the security system database.
Ensure that the security system exit has been installed, that LLA has been refreshed, and that the exit has been activated. For details, see Installing the Driver Security System Exits.
Examine the status log, DSTRACE output, trace file, and REXX exec output file.
Examine the driver Data Flow setting to verify the authoritative source for identities.
Identity Vault and connected system identities must be associated before events are synchronized. To view an identity’s associations, use the Object Inspector page in Identity Console and search for the object. You can migrate identities to establish associations. For details, see Migrating Identities.
Identity Vault move events can remove the identity from the base container monitored by the driver to a container that is not monitored by the driver. This makes the move appear to be a delete.
Moving a user or group is not supported by RACF.
Examine the change log started task messages.
Ensure that the change log started task is running on all systems that share the security system database.
Ensure that the change log started task has been set up properly. For details, see Setting Up the Started Tasks.
Ensure that you initialized the change log data set during installation. For details about initializing the change log data set, see Allocating and Initializing the Change Log Data Set.
You can use the LDXSERV TSO command to display information about the change log data set. Enter the following TSO command:
LDXSERV STATUS
To use the LDXSERV command, you must include the driver load library in your STEPLIB concatenation.