Install the Core Driver.
Create an extract file with the user names and attributes from their present location.
Agree upon a special Migration Mode Password.
You will use this password in Step 4 and Step 7. This password must conform to the password limitations of z/OS.
Prepare the extract file as appropriate for use with the utility you will use in Step 5.
If desired, remove users who already exist in eDirectory. Set the initial password of all of the users to the special Migration Mode Password determined in Step 3. Set the Login Disabled attribute of all of the user accounts to True. This places the users into the migration state.
Use a utility, such as UIMPORT or LDIF, to import the user accounts and attributes into eDirectory.
Use the Web interface to define a Platform object for the z/OS system.
Specify the Migration Mode Password configuration parameter with the special Migration Mode Password determined in Step 3, for each Core Driver.
For details about the Migration Mode Password configuration parameter, see Section A.2, Migration Mode Password Configuration Parameter.
Install Platform Services on the z/OS system, and activate the Platform Services Process.
The next time a user successfully authenticates to the z/OS system, the password is updated in the corresponding User object in eDirectory.
The password in eDirectory is only updated for users in the migration state. A user is in the migration state if the account is disabled and the password is set to the special Migration Mode Password. After the password in eDirectory has been updated, the user is no longer in the migration state.
After a suitable period of time, remove the Migration Mode Password configuration parameter from all of the Core Drivers.
Enable those users who are still in the migration state.
Deploy the Identity Manager Fan-Out driver to other platforms as appropriate.
IMPORTANT:If there are multiple z/OS images that share the same RACF database or synchronize passwords using RRSF, you must perform Step 6 and Step 8 for each image.
A RACF administrator can use the search command as shown in the following example to gauge the progress of the migration. Specify age as the number of days since migration began. This produces a list of users who have not logged on since the migration period began.
search class(user) age(45)
When an z/OS user in the migration state logs on, eDirectory imposes a three-second delay. If these logons occur at a significant rate in an address space that single-threads logon activity, backlogs can develop. In this case, you can use the Include/Exclude facility to limit the number of users involved in migration at any one time.