peopletoolsadapter user guide - ibm · peopletoolsadapter user guide sc27-4406-02. note ... x ibm...

IBM Security Identity ManagerVersion 6.0

PeopleTools Adapter User Guide

SC27-4406-02

��

NoteBefore using this information and the product it supports, read the information in “Notices” on page 37.

Edition notice

Note: This edition applies to version 6.0 of IBM Security Identity Manager (product number 5724-C34) and to allsubsequent releases and modifications until otherwise indicated in new editions.

© Copyright IBM Corporation 2009, 2014.US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contractwith IBM Corp.

Contents

Figures . . . . . . . . . . . . . . . v

Tables . . . . . . . . . . . . . . . vii

Preface . . . . . . . . . . . . . . . ixAbout this publication . . . . . . . . . . . ixAccess to publications and terminology . . . . . ixAccessibility . . . . . . . . . . . . . . xTechnical training. . . . . . . . . . . . . xSupport information . . . . . . . . . . . . xStatement of Good Security Practices . . . . . . x

Chapter 1. Overview of the PeopleToolsAdapter . . . . . . . . . . . . . . . 1Features of the adapter . . . . . . . . . . . 1

Chapter 2. Checklist for configuring IBMSecurity Identity Manager to run theadapter . . . . . . . . . . . . . . . 3

Chapter 3. PeopleTools Adapter useraccount management tasks . . . . . . 5Preparing to use the PeopleTools Adapter . . . . 5User account reconciliation . . . . . . . . . 5User accounts . . . . . . . . . . . . . . 6

Attributes for adding user accounts. . . . . . 6Alternate user ID . . . . . . . . . . . . 7User supervisor . . . . . . . . . . . . 8Specification of email addresses . . . . . . . 8ID Type specification . . . . . . . . . . 8Permission . . . . . . . . . . . . . . 9Role names . . . . . . . . . . . . . . 9

User account modification . . . . . . . . . . 9User account suspension . . . . . . . . . . 10User account restoration . . . . . . . . . . 10User account deletion . . . . . . . . . . . 10

Chapter 4. Customizing thePeopleTools account form . . . . . . 11Modifying the CompIntfc.jar file . . . . . . . 12

Attributes in the adapter profile . . . . . . . 12Mapping attributes of Component Interfacessupported by IBM Security Identity Manager . . . 14

Assembly line icons . . . . . . . . . . 14Mapping attributes to the PeopleToolsAddALassembly line . . . . . . . . . . . . . 15Mapping attributes to the PeopleToolsModifyALassembly line . . . . . . . . . . . . . 16Mapping attributes to the PeopleToolsSearchALassembly line . . . . . . . . . . . . . 17

Mapping attributes of Component Interfaces notsupported by IBM Security Identity Manager . . . 18

Mapping attributes to the PeopleToolsAddALassembly line . . . . . . . . . . . . . 18Mapping attributes to the PeopleToolsModifyALassembly line . . . . . . . . . . . . . 19Mapping attributes to the PeopleToolsSearchALassembly line . . . . . . . . . . . . . 21

Chapter 5. Troubleshooting of thePeopleTools Adapter errors . . . . . . 23

Appendix A. PeopleTools Adapterattributes. . . . . . . . . . . . . . 27

Appendix B. Adapter customization forcollection attributes . . . . . . . . . 29

Appendix C. Support information . . . 31Searching knowledge bases . . . . . . . . . 31Obtaining a product fix . . . . . . . . . . 32Contacting IBM Support . . . . . . . . . . 32

Appendix D. Accessibility features forIBM Security Identity Manager . . . . 35

Notices . . . . . . . . . . . . . . 37

Index . . . . . . . . . . . . . . . 41

© Copyright IBM Corp. 2009, 2014 iii

||

iv IBM Security Identity Manager: PeopleTools Adapter User Guide

Figures

© Copyright IBM Corp. 2009, 2014 v

vi IBM Security Identity Manager: PeopleTools Adapter User Guide

Tables

1. Checklist for configuring IBM Security IdentityManager . . . . . . . . . . . . . . 3

2. Required attributes for adding user accounts 63. Assembly line icons . . . . . . . . . . 144. Specific error messages and recommended

actions . . . . . . . . . . . . . . 23

5. General error messages, warnings, andcorrective actions. . . . . . . . . . . 24

6. Attributes on the PeopleTools account form,their corresponding names on the IBM TivoliDirectory Server, and the PeopleSoft server . . 27

© Copyright IBM Corp. 2009, 2014 vii

viii IBM Security Identity Manager: PeopleTools Adapter User Guide

Preface

About this publication

The PeopleTools Adapter User Guide provides the basic information that you can useto complete PeopleSoft administrative tasks with the IBM® Security IdentityManager PeopleTools Adapter.

The PeopleTools Adapter enables connectivity between the IBM Security IdentityManager server and a managed resource. IBM Security Identity Manager waspreviously known as Tivoli® Identity Manager. The IBM Security Identity Managerserver is the server for your IBM Security Identity Manager product.

Access to publications and terminologyThis section provides:v A list of publications in the “IBM Security Identity Manager library.”v Links to “Online publications.”v A link to the “IBM Terminology website.”

IBM Security Identity Manager library

For a complete listing of the IBM Security Identity Manager and IBM SecurityIdentity Manager Adapter documentation, see the online library(http://www-01.ibm.com/support/knowledgecenter/SSRMWJ/welcome).

Online publications

IBM posts product publications when the product is released and when thepublications are updated at the following locations:

IBM Security Identity Manager libraryThe product documentation site (http://www-01.ibm.com/support/knowledgecenter/SSRMWJ/welcome) displays the welcome page andnavigation for the library.

IBM Security Systems Documentation CentralIBM Security Systems Documentation Central provides an alphabetical listof all IBM Security Systems product libraries and links to the onlinedocumentation for specific versions of each product.

IBM Publications CenterThe IBM Publications Center site ( http://www-05.ibm.com/e-business/linkweb/publications/servlet/pbi.wss) offers customized search functionsto help you find all the IBM publications you need.

IBM Terminology website

The IBM Terminology website consolidates terminology for product libraries in onelocation. You can access the Terminology website at http://www.ibm.com/software/globalization/terminology.

© Copyright IBM Corp. 2009, 2014 ix

http://www-01.ibm.com/support/knowledgecenter/SSRMWJ/welcome



https://www.ibm.com/developerworks/mydeveloperworks/wikis/home?lang=en#/wiki/IBM%20Security%20Systems%20Documentation%20Central/page/Welcome

http://www-05.ibm.com/e-business/linkweb/publications/servlet/pbi.wss

http://www-05.ibm.com/e-business/linkweb/publications/servlet/pbi.wss

http://www.ibm.com/software/globalization/terminology

http://www.ibm.com/software/globalization/terminology

AccessibilityAccessibility features help users with a physical disability, such as restrictedmobility or limited vision, to use software products successfully. With this product,you can use assistive technologies to hear and navigate the interface. You can alsouse the keyboard instead of the mouse to operate all features of the graphical userinterface.

Technical trainingFor technical training information, see the following IBM Education website athttp://www.ibm.com/software/tivoli/education.

Support informationIBM Support provides assistance with code-related problems and routine, shortduration installation or usage questions. You can directly access the IBM SoftwareSupport site at http://www.ibm.com/software/support/probsub.html.

Appendix C, “Support information,” on page 31 provides details about:v What information to collect before contacting IBM Support.v The various methods for contacting IBM Support.v How to use IBM Support Assistant.v Instructions and problem-determination resources to isolate and fix the problem

yourself.

Note: The Community and Support tab on the product information center canprovide additional support resources.

Statement of Good Security PracticesIT system security involves protecting systems and information throughprevention, detection and response to improper access from within and outsideyour enterprise. Improper access can result in information being altered, destroyed,misappropriated or misused or can result in damage to or misuse of your systems,including for use in attacks on others. No IT system or product should beconsidered completely secure and no single product, service or security measurecan be completely effective in preventing improper use or access. IBM systems,products and services are designed to be part of a comprehensive securityapproach, which will necessarily involve additional operational procedures, andmay require other systems, products or services to be most effective. IBM DOESNOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES AREIMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THEMALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY.

x IBM Security Identity Manager: PeopleTools Adapter User Guide

http://www.ibm.com/software/tivoli/education

http://www.ibm.com/software/support/probsub.html

Chapter 1. Overview of the PeopleTools Adapter

An adapter is a program that provides an interface between a managed resourceand the IBM Security Identity Manager server.

Adapters might reside on the managed resource. The IBM Security IdentityManager server manages access to the resource by using the security system.Adapters function as trusted virtual administrators on the target platform. Theadapter performs tasks, such as creating login IDs, suspending IDs, and otherfunctions that administrators run manually. The adapter runs as a service,independently of whether you are logged on to IBM Security Identity Manager.

The PeopleTools Adapter is an application that provides connectivity between IBMSecurity Identity Manager and the PeopleSoft server. The adapter runs as a service,independent of whether you are logged on to IBM Security Identity Manager. Youcan automate the following user account management tasks using the PeopleToolsAdapter and IBM Security Identity Manager:v Adding user accounts to the PeopleSoft serverv Creating multiple e-mail addresses for a user accountv Modifying attributes of PeopleSoft user accountsv Changing passwords of PeopleSoft user accountsv Suspending, restoring, and deleting PeopleSoft user accountsv Retrieving user accounts from the PeopleSoft server

Features of the adapterThe PeopleTools Adapter supports multiple functions.v Reconciliation of user accounts and other support data, such as languages,

currency code, roles, and permissions from the PeopleSoft server to the directoryserver of IBM Security Identity Manager.

v User account management tasks, such as add, modify (including passwordchange), suspend, restore, and delete to manage accounts on the PeopleSoftserver using IBM Security Identity Manager.

v Creation of multiple e-mail addresses for a user account.v Customization of the PeopleTools account form.

© Copyright IBM Corp. 2009, 2014 1

2 IBM Security Identity Manager: PeopleTools Adapter User Guide

Chapter 2. Checklist for configuring IBM Security IdentityManager to run the adapter

You can use a checklist when you configure IBM Security Identity Manager to runthe adapter.

The following table provides an overview of the process for configuring IBMSecurity Identity Manager.

Table 1. Checklist for configuring IBM Security Identity Manager

TaskFor information, see the section in thefollowing documentation:

Install the PeopleTools Adapter Installing the PeopleTools Adapter in thePeopleTools Adapter Installation andConfiguration Guide

Import the adapter profile into IBMSecurity Identity Manager

Importing the adapter profile into the IBMSecurity Identity Manager server in thePeopleTools Adapter Installation andConfiguration Guide

Create a service for the PeopleToolsAdapter

Creating the service in the DirectoryIntegrator-Based PeopleTools Adapter Installationand Configuration GuideNote: After you create a PeopleTools Adapterservice, the IBM Security Identity Managerserver creates a default provisioning policyfor the adapter service. You can customize aprovisioning policy for the PeopleToolsAdapter service according to yourorganization's requirements. For moreinformation, see the section aboutcustomizing a provisioning policy in the IBMSecurity Identity Manager productdocumentation.

Configure the PeopleTools Adapter Configuring the PeopleTools Adapter in thePeopleTools Adapter Installation andConfiguration Guide

Perform a reconciliation operation toretrieve user accounts and store them in theIBM Security Identity Manager server

Managing reconciliation schedules in the IBMSecurity Identity Manager productdocumentation

Adopt orphan accounts on IBM SecurityIdentity Manager

Assigning an orphan account to a user in theIBM Security Identity Manager productdocumentation


Chapter 3. PeopleTools Adapter user account managementtasks

IBM Security Identity Manager manages user accounts stored on the PeopleSoftserver using the PeopleTools Adapter.

You can perform operations, such as reconciliation, add, modify (includingpassword change), suspend, restore, and delete to manage your accounts.

You can manage:v Accounts for a specific personv Accounts for a service instancev Specific accounts using the search function of IBM Security Identity Manager

Preparing to use the PeopleTools AdapterYou must do several tasks before doing any operation with the adapter.

Procedure1. Ensure that you do the steps in Chapter 2, “Checklist for configuring IBM

Security Identity Manager to run the adapter,” on page 3.2. Run the RMI Dispatcher using one of the following methods. The RMI

Dispatcher in turn runs the PeopleTools Adapter.v Windows services in service mode

a. In the Windows control panel, double-click Administrative Tools.b. Double-click Services.c. Right-click the IBM Security Identity Manager Adapter service, and click

Start.v Windows command prompt in console mode

Go to the adapter installation directory and run the following command:ibmdisrv -s "Adapter solution directory" -c ITIM_RMI.xml –d

User account reconciliationThe reconciliation operation retrieves the user account information from thePeopleSoft server and stores it in the directory server of IBM Security IdentityManager.

You can schedule reconciliation to run at specific times and to return specificparameters. Running a reconciliation before its schedule time does not cancel thescheduled reconciliation. For more information about scheduling reconciliation andrunning a scheduled reconciliation, see the IBM Security Identity Manager productdocumentation.

You can also perform the following reconciliation tasks at any time from IBMSecurity Identity Manager:v Reconciling support datav Reconciling a single user account


|

|

|

||

||

|

|

|

||

|

|

|

|

Reconciling supporting data

Supporting data for a PeopleSoft user account includes the following information:v Language codesv Currency codesv Permission Listsv Role

For more information about each of these attributes, see the PeopleSoftdocumentation.

To reconcile only the supporting data, without reconciling the user accounts:1. Log on to IBM Security Identity Manager as an administrator.2. In the My Work pane, click Manage Services. The Manage Services page is

displayed.3. Select the type of service from the Service type list and click Search.4. Select the name of the service that you created for the PeopleTools Adapter.5. Click the View popup menu icon and select Reconcile Now from the pop-up

menu. The Reconcile Now page is displayed.6. Click Define query.7. Select the Reconcile supporting data only check box and click Submit.

User accountsYou can add user accounts at any time for either an existing person or a newperson in the organization.

This section describes the adapter attributes that define the accounts on theaccount form. For specific procedures, see the IBM Security Identity Managerproduct documentation.

Attributes for adding user accountsTo add user accounts to the PeopleSoft server, specify the required attributes onthe PeopleTools account form.

Table 2. Required attributes for adding user accounts

Attribute Description

User ID User ID of the account.

Symbolic ID Symbolic ID of the account. The symbolic ID is used to retrieve theaccess ID and the access password of a user. You must type thecorrect symbolic ID associated with a user. For more informationabout the symbolic ID, see the PeopleTools documentation.

When you specify the User ID and the Symbolic ID attributes on the PeopleToolsaccount form, the PeopleTools Adapter sets the following attributes on thePeopleSoft server:v User IDv Symbolic IDv ID Type


Note: If no ID Type is specified, the adapter automatically sets the value of the IDType attribute to None.

In addition to the required attributes, you can also specify the following optionalattributes on the PeopleTools account form:v Descriptionv Language Codev Multi Language Enabledv Enable Expert Entryv Navigator Homepagev Process Profilev Primaryv Row Securityv User Supervisorv Alternate User IDv Effective Datev To Datev Routing - Worklist Userv Routing - E-mail Userv E-mail Addressesv Currency Codev Roles

Alternate user IDIf a user is temporarily unavailable, you can assign the role of the unavailable userto an available Peoplesoft user. Specify the user ID of the alternate user as thevalue of the Alternate User ID attribute.

Note: The value of the User ID and the Alternate User ID attributes must bedifferent.

When you specify the Alternate User ID attribute, you must also specify thefollowing attributes on the PeopleTools account form:

Effective Date: DateThe start date from when the alternate user ID is effective. The defaultvalue of this attribute is Never. To specify a date, follow these steps:1. Clear the Never check box.2. Click the View Calendar icon and select the month, year, and date.3. Click OK.

Effective Date: TimeThe Effective Date attribute on IBM Security Identity Manager is of typedate which has independent controls for specifying the date and timevalues. You can enter the date and time values of this attribute by usingthe Effective Date: Date and Effective Date: Time controls on IBMSecurity Identity Manager. The Effective Date attribute maps to the FromDate attribute in the PeopleSoft pure internet architecture user interfacethat does not take the time value. Therefore, when you submit the add ormodify request, the adapter does not take the value specified for theEffective Date: Time control.

Chapter 3. PeopleTools Adapter user account management tasks 7

To Date: DateThe end date up to which the alternate user ID is effective. The defaultvalue of this attribute is Never. To specify a date, follow these steps:1. Clear the Never check box.2. Click the View Calendar icon and select the month, year, and date.3. Click OK.

To Date: TimeThe To Date attribute on IBM Security Identity Manager is of type datewhich has independent controls for specifying the date and time values.You can enter the date and time values of this attribute by using the ToDate: Date and To Date: Time controls on IBM Security Identity Manager.The To Date attribute maps to the To Date attribute in the PeopleSoft pureinternet architecture user interface that does not take the time value.Therefore, when you submit the add or modify request, the adapter doesnot take the value specified for the To Date: Time control.

User supervisorIf a user has a supervisor, specify the user ID of the supervisor as the value of theUser Supervisor attribute on the PeopleTools account form.

The PeopleTools Adapter maps the User Supervisor attribute to the SupervisingUser ID attribute on the PeopleSoft server.

Note: The value of the User ID and the User Supervisor attributes must bedifferent.

Specification of email addressesTo create multiple email addresses for a user account, specify the E-mail Addressesattribute on the PeopleTools account form.

The E-mail Addresses attribute is a collection of the following attributes:

E-mail TypeSpecify the type of email address, such as Blackberry, Business, Home,Other, or Work, as the value of this attribute.

E-mail AddressSpecify an email address for the user account as the value of this attribute.You can specify multiple email addresses for a user account. However, youcan specify only one email address per type.

Primary e-mailSelect this check box to assign the specified email address as a primaryemail address. You can assign only one email address as a primary emailaddress for a user account. By default, the adapter selects the first emailaddress as a primary email.

ID Type specificationTo create ID Types for a user, you must modify the adapter profile to specify theID Types attribute on the account form.

The ID Types attribute is a collection attribute that has the child attributesOPRALIASTYPE and ID Type. You specify the value for the ID Types with aname-value pair, separated by a $.attribute_name$attribute_value


For example, to add an Employee ID Type with the EmplID attribute the valueformat sent to the adapter is:EMP#Empl ID$1234

where EMP is the Employee ID and 1234 is employee ID you want to set.

If an ID Type has multiple attributes the name-value pairs are separated by a |.attribute_name$attribute_value|attribute_name2$attribute_value

For example, if you have a custom typed defined as Custom with two attributes,MyCustAttr1 and MyCustAttr2, the format is:Custom#MyCustAttr1$Myvalue1|MyCustAttr2$Myvalue2

where Myvalue1 and Myvalue2 are values you want to set.

After you import the modified profile, use the Design Forms function of IBMSecurity Identity Manager to add the attribute to the account form. Then you canuse the drop-down menu on the account form to assign ID Types such asEmployee, Vendor, or None to the user.

PermissionFor displaying purpose, the permission list displays permission code andpermission description in the format of “Permission code : Permissiondescription”. However, only the permission code value is sent to the adapter.

Role namesFor displaying purpose, the role list displays role name and role description in theformat of “Role Name : Role Description”. However, only the role name value issent to the adapter.

User account modificationYou can modify the value of attributes on the PeopleTools account form.v Symbolic IDv Descriptionv Email Addressesv Language Codev Multi Language Enabledv Currency Codev Enable Expert Entryv Navigator Homepagev Process Profilev Primaryv Row Securityv Rolesv User Supervisorv Alternate User IDv Effective Datev To Datev Routing - Worklist User

Chapter 3. PeopleTools Adapter user account management tasks 9

v Routing - Email Userv ID Types and Values

Note: The User Id attribute cannot be modified.

Password change of user accounts

You can change the password of any of the PeopleTools accounts that exist on IBMSecurity Identity Manager. For information about changing passwords, see the IBMSecurity Identity Manager product documentation.

User account suspensionWhen you suspend a user account, the status of the user account on IBM SecurityIdentity Manager becomes inactive, and the user account becomes unavailable foruse.

Suspending a user account does not remove the user account from IBM SecurityIdentity Manager. For more information about suspending user accounts, see theIBM Security Identity Manager product documentation.

When you suspend a user account from IBM Security Identity Manager, thePeopleTools Adapter sets the value of the Account Locked Out attribute on thePeopleSoft server to TRUE.

User account restorationWhen you restore a user account from IBM Security Identity Manager, thePeopleTools Adapter sets the value of the Account Locked Out attribute on thePeopleSoft server to FALSE.

User account deletionUse the deprovision feature of IBM Security Identity Manager to delete useraccounts.

For more information about deleting user accounts, see the IBM Security IdentityManager product documentation.


Chapter 4. Customizing the PeopleTools account form

You can add attributes of different Component Interfaces to the PeopleToolsaccount form. These Component Interfaces can be supported or not supported byIBM Security Identity Manager.

About this task

The Project file PT850_Component.zip for PeopleTools 8.50, 8.51, and 8.52, whichcontains Component Interfaces, is provided with the IBM Security IdentityManager PeopleTools Adapter software. These interfaces are in the ENROLE_AGENTsubdirectory. This subdirectory is imported into the PeopleTools ApplicationDesigner as a PeopleTools Project.

Procedure1. Modify the CompIntfc.jar file. For more information about modifying the

CompIntfc.jar file, see “Modifying the CompIntfc.jar file” on page 12.2. Log on to the workstation where the PeopleTools Adapter is installed.3. Copy the PeopleToolsProfile.jar file to the \temp directory.4. Extract the contents of the PeopleToolsProfile.jar file to the \temp directory

by running the following command:cd c:\tempjar -xvf PeopleToolsProfile.jar PeopleToolsProfile

This command creates the c:\temp\PeopleToolsProfile directory.5. Add the attribute to the PeopleTools Adapter profile. For more information

about adding an attribute to the adapter profile, see “Attributes in the adapterprofile” on page 12.

6. Map the attribute to the assembly lines.v To map an attribute of a Component Interface supported by IBM Security

Identity Manager, see “Mapping attributes of Component Interfacessupported by IBM Security Identity Manager” on page 14.

v To map an attribute of a Component Interface not supported by IBMSecurity Identity Manager, see “Mapping attributes of Component Interfacesnot supported by IBM Security Identity Manager” on page 18.

7. Go to the Tivoli Directory Integrator installation directory, and run thefollowing command to break the assembly lines:java –classpath ITDI_HOME\jars\ITLMToolkit.jar;ITDI_HOME\jars\miconfig.jar;ITDI_HOME\jars\miserver.jar;ITDI_HOME\jars\mmconfig.jar;ITDI_HOME\jars\diserverapi.jar;ITDI_HOME\jars\log4j-1.2.8.jar;ITDI_HOME\jars\itdiAgents-common.jar com.ibm.di.utils.IDIConfigHelper"c:\temp\PeopleToolsAdapterALs.xml""c:\temp"

In this command, ITDI_HOME is the name of the IBM Security IdentityManager installation directory and c:\temp\PeopleToolsAdapterALs.xml is thepath of the PeopleToolsAdapterALs.xml file.

8. Create a JAR file by using the files in the \temp directory by running thefollowing command:cd c:\tempjar -cvf PeopleToolsProfile.jar PeopleToolsProfile

9. Import the PeopleToolsProfile.jar file to the IBM Security Identity Managerserver. For more information about importing the PeopleToolsProfile.jar file,


see the PeopleTools Adapter Installation and Configuration Guide. In the sectionthat describes installing the PeopleTools Adapter, search for the topic aboutimporting the adapter profile into the IBM Security Identity Manager server.

10. Stop and start the IBM Security Identity Manager server.

Modifying the CompIntfc.jar fileTo add an attribute to a Component Interface, modify the CompIntfc.jar file.

Procedure1. Logon to PeopleSoft Application Designer.2. Open the ENROLE_AGENT Component Interface project.3. Open the Component Interface by double clicking the Component Interface, for

example, ENROLE_USERS.4. If the name of the attribute is not listed in the right pane of the Component

Interface window, then drag the attribute from the left pane to the right pane.5. Save the changes and generate the CompIntfc.jar file. For more information

about generating CompIntfc.jar file, see the PeopleTools Adapter Installation andConfiguration Guide and under the topic about configuring the PeopleToolsAdapter, search for the section that describes generating the CompIntfc.jar file.

Attributes in the adapter profileYou must update the profiles or specifications of new attributes.

Update the attributes in these files:

CustomLabels.propertiesThe CustomLabels.properties file contains a list of attributes that aresupported by IBM Security Identity Manager and their correspondinglabels.

For example, you want to add an attribute erpt84xuseridalias to the LogonInformation page of the PeopleTools account form. This attribute issupported by the ENROLE_USERS Component Interface of IBM SecurityIdentity Manager. The following example shows theCustomLabels.properties file with the specifications of theerpt84xuseridalias attribute:### erpt84xuseraccount Login Tab

erpt84xuseridalias=User ID Alias

In this example:

erpt84xuseraccount Login TabDefines the tab on which the erpt84xuseridalias attribute isdisplayed.

erpt84xuseridalias=User ID AliasDefines the label, User ID Alias, for the erpt84xuseridaliasattribute. IBM Security Identity Manager recognizes the newattribute by the name erpt84xuseridalias.

erpt84xuseraccount.xmlAll the information about the structure of the PeopleTools account form


exist in the erpt84xuseraccount.xml file. When you specify a structure foran attribute, you must specify the structure under the tab where you wantto display that attribute.

Following is an example of the erpt84xuseraccount.xml file that definesthe structure for the erpt84xuseridalias attribute:<tabbedForm><tab index="0" selected="true"><title>$erpt84xlogintab</title><formElement name="data.erpt84xuseridalias" label="$erpt84xuseridalias"><input name="data.erpt84xuseridalias" size="30" type="text"/></formElement></tab>

In this example, a text box element on the Logon Information page of thePeopleTools account form is mapped to the erpt84xuseridalias attribute.

schema.dsmlDefines an attribute. It contains the schema for attributes and object classesin the profile. Following is an example of the schema.dsml file that definesthe erpt84xuseridalias attribute and adds the erpt84xuseridalias attributeto the erpt84xuseraccount class:

<attribute-type single-value = "true"><name>erpt84xuseridalias</name><description>User ID Alias</description><object-identifier>1.3.6.1.4.1.6054.3.145.2.34</object-identifier><syntax>1.3.6.1.4.1.1466.115.121.1.15</syntax></attribute-type>

<class superior="top"><name>erpt84xuseraccount</name><description>PeopleTools Account</description><object-identifier>1.3.6.1.4.1.6054.3.145.1.1</object-identifier>

<attribute ref = "erpt84xuseridalias" required = "false"/></class>

In this example:

<attribute-type single-value = "true">Specifies the value of the attribute type as single.

<name>erpt84xuseridalias</name>Defines the name of the erpt84xuseridalias attribute.

<description>User ID Alias</description>Provides the description of the erpt84xuseridalias attribute.

<object-identifier>1.3.6.1.4.1.6054.3.145.2.34</object-identifier>Specifies the unique identifier for the erpt84xuseridalias attribute.

<syntax>1.3.6.1.4.1.1466.115.121.1.15</syntax>Refers to the syntax of the erpt84xuseridalias attribute type.

Chapter 4. Customizing the PeopleTools account form 13

<class superior="top"><name>erpt84xuseraccount</name><description>PeopleTools Account</description><object-identifier>1.3.6.1.4.1.6054.3.145.1.1</object-identifier><attributeref = "erpt84xuseridalias" required = "false"/></class>

Adds the erpt84xuseridalias attribute to the erpt84xuseraccountclass.

Note: Each attribute must have a unique identifier. In addition, the identifier mustbe unique in the directory server where the attribute is stored.

Mapping attributes of Component Interfaces supported by IBMSecurity Identity Manager

You can map the newly added attributes of Component Interfaces supported byIBM Security Identity Manager to the assembly lines.

Procedure1. Run the Tivoli Directory Integrator.2. Click File > Open.3. Select the PeopleToolsAdapterALs.xml file from the temporary folder where

the PeopleTools Adapter profile was extracted, and click Open.4. In the navigation pane, expand the AssemblyLines tree, and perform these

steps:v Select the PeopleToolsAddAL assembly line and map the attributes to the

PeopleToolsAddAL assembly line. For more information about mappingattributes to the PeopleToolsAddAL assembly line, see “Mapping attributesto the PeopleToolsAddAL assembly line” on page 15.

v Select the PeopleToolsModifyAL assembly line and map the attributes to thePeopleToolsModifyAL assembly line. For more information about mappingattributes to the PeopleToolsModifyAL assembly line, see “Mappingattributes to the PeopleToolsModifyAL assembly line” on page 16.

v Select the PeopleToolsSearchAL assembly line and map the attributes to thePeopleToolsSearchAL assembly line. For more information about mappingattributes to the PeopleToolsSearchAL assembly line, see “Mapping attributesto the PeopleToolsSearchAL assembly line” on page 17.

5. Save the changes to the assembly lines.

Assembly line iconsAssembly line icons of the Tivoli Directory Integrator are used while mappingattributes.

Table 3. Assembly line icons

Icon Name

Add a new Attribute to the Attribute map

Switch between List, Detail and Schema view

Connect to the data source


Table 3. Assembly line icons (continued)

Icon Name

Read the next entry

Add new Link Criteria

Mapping attributes to the PeopleToolsAddAL assembly lineYou can add a value to an attribute by mapping the attribute to thePeopleToolsAddAL assembly line.

About this task

To view the list of assembly line icons used while mapping attributes see Table 3on page 14.

For example, you can map the erpt84xuseridalias attribute of the ENROLE_USERSComponent Interface to the PeopleToolsAddAL assembly line.

Procedure1. Select the PeopleToolsAddAL assembly line. The PeopleToolsAddAL page

opens.2. Click the Call/Return tab. The Initial Work Entry page opens.

a. Click the Add a new Attribute to the Attribute map toolbar button.b. Type the name of the new attribute as erpt84xuseridalias, and click OK.

The erpt84xuseridalias attribute is listed in the Work Attribute list.3. Click the Data Flow tab. The Data Flow page opens.

a. In the left pane, expand the Flow folder and select conAddUser.b. On the Data Flow page, click the Config tab. The Config page opens.c. Type the PeopleSoft server, port, login, and Component Interface details.

4. Click the Output Map tab. The Output Map page opens.a. Click the Switch between List, Detail and Schema view toolbar button

until you see the Schema pane.b. Click the Connect to the data source toolbar button.c. Click the Read the next entry toolbar button. All the attributes supported

by the ENROLE_USERS Component Interface are displayed in the Schemapane.

d. Click the Switch between List, Detail and Schema view toolbar buttonuntil you see the Attribute Map details pane.

e. Select the erpt84xuseridalias check box to map the erpt84xuseridaliasattribute to the PeopleToolsAddAL assembly line.

Note:

v The erpt84xuseridalias attribute is a simple attribute; that is, asingle-valued attribute. To map a collection attribute; that is, a collectionof simple attributes, you must select the Advance Mapping Settingscheck box on the Output Map page, and write scripts to map thecollection attribute to the PeopleToolsAddAL assembly line.

v The Tivoli Directory Integrator version 7.0 fix pack 6 and higher does notallow Java objects such as, com.ibm.di.entry.Entry,


com.ibm.di.entry.Attribute, and so on in advanced attribute mapping inthe Ouput Map page. You must move these mappings to the BeforeExecute connector hook. For example, see the mapping of attributeserpt84xemailadd and erpt84xrole in Before Execute connector hook andthe attributes PSUSEREMAIL and PSROLEUSER_VW in the Output Mappage of connector conAdduser in the PeopleToolsAddAL assembly line.

5. Save the changes to the PeopleToolsAddAL assembly line.

Mapping attributes to the PeopleToolsModifyAL assembly lineYou can make an attribute modifiable by mapping the attribute to thePeopleToolsModifyAL assembly line.

About this task


For example, you can map the erpt84xuseridalias attribute of the ENROLE_USERSComponent Interface to the PeopleToolsModifyAL assembly line.

Procedure1. Select the PeopleToolsModifyAL assembly line. The PeopleToolsModifyAL

page opens.2. Click the Call/Return tab. The Initial Work Entry page opens.



a. In the left pane, expand the Flow folder and select conModifyUser.b. On the Data Flow page, click the Config tab. The Config page opens.c. Type the PeopleSoft server, port, login, and Component Interface details.





e. Select the erpt84xuseridalias check box to map the erpt84xuseridaliasattribute to the PeopleToolsModifyAL assembly line.

Note:

v The erpt84xuseridalias attribute is a simple attribute; that is, asingle-valued attribute. To map a collection attribute; that is, a collectionof simple attributes, you must select the Advance Mapping Settingscheck box on the Output Map page, and write scripts to map thecollection attribute to the PeopleToolsModifyAL assembly line.

v The Tivoli Directory Integrator version 7.0 fix pack 6 and higher does notallow Java objects such as, com.ibm.di.entry.Entry,


com.ibm.di.entry.Attribute, and so on in advanced attribute mapping inthe Ouput Map page. You must move these mappings to the BeforeModify connector hook. For example, see the mapping of attributeserpt84xemailadd and erpt84xrole in Before Modify connector hook andthe attributes PSUSEREMAIL and PSROLEUSER_VW in the Output Mappage of connector conModifyuser in the PeopleToolsModifyAL assemblyline.

5. Save the changes to the PeopleToolsModifyAL assembly line.

Mapping attributes to the PeopleToolsSearchAL assembly lineYou can make the value of an attribute reconcilable by mapping the attribute to thePeopleToolsSearchAL assembly line.

About this task


For example, you can map the erpt84xuseridalias attribute of the ENROLE_USERSComponent Interface to the PeopleToolsSearchAL assembly line.

Procedure1. Select the PeopleToolsSearchAL assembly line. The PeopleToolsSearchAL page

opens.2. Click the Call/Return tab. The Initial Work Entry page opens.



a. In the left pane, expand the Feeds folder and select conGetUsers.b. On the Data Flow page, click the Config tab. The Config page opens.c. Type the PeopleSoft server, port, login, and Component Interface details.

4. Click the Input Map tab. The Input Map page opens.a. Click the Switch between List, Detail and Schema view toolbar button




e. Select the erpt84xuseridalias check box to map the erpt84xuseridaliasattribute to the PeopleToolsSearchAL assembly line.

Note:

v The erpt84xuseridalias attribute is a simple attribute; that is, asingle-valued attribute. To map a collection attribute; that is, a collectionof simple attributes, you must select the Advance Mapping Settingscheck box on the Input Map page, and write scripts to map the collectionattribute to the PeopleToolsSearchAL assembly line.


v The Tivoli Directory Integrator version 7.0 fix pack 6 and higher does notallow Java objects such as com.ibm.di.entry.Entry,com.ibm.di.entry.Attribute, and so on in advanced attribute mapping inthe Input Map page. You must move these mappings to the AfterGetNext connector hook. For example, see the in the Input Map of theconnector conGetUsers PeopleToolsSearchAL to map collection attributesto work attributes without using objects of type com.ibm.di.entry.Entryand com.ibm.di.entry.Attribute.

5. Save the changes to the PeopleToolsSearchAL assembly line.

Mapping attributes of Component Interfaces not supported by IBMSecurity Identity Manager

You can add attributes of the Component Interfaces not supported by IBM SecurityIdentity Manager. However, the value of the create key and the find key of theComponent Interfaces must be OPRID.

Procedure1. Run the Tivoli Directory Integrator.2. Click File > Open.3. Select the PeopleToolsAdapterALs.xml file from the temporary folder where

the PeopleTools Adapter profile was extracted, and click Open.4. In the navigation pane, expand the AssemblyLines tree, and perform these

steps:v Select the PeopleToolsAddAL assembly line and map the attributes to the

PeopleToolsAddAL assembly line. For more information about mappingattributes to the PeopleToolsAddAL assembly line, see “Mapping attributesto the PeopleToolsAddAL assembly line.”

v Select the PeopleToolsModifyAL assembly line and map the attributes to thePeopleToolsModifyAL assembly line. For more information about mappingattributes to the PeopleToolsModifyAL assembly line, see “Mappingattributes to the PeopleToolsModifyAL assembly line” on page 19.

v Select the PeopleToolsSearchAL assembly line and map the attributes to thePeopleToolsSearchAL assembly line. For more information about mappingattributes to the PeopleToolsSearchAL assembly line, see “Mapping attributesto the PeopleToolsSearchAL assembly line” on page 21.

Mapping attributes to the PeopleToolsAddAL assembly lineYou can add a value to an attribute by mapping the attribute to thePeopleToolsAddAL assembly line.

About this task

To view the list of assembly line icons used while mapping attributes, see Table 3on page 14.

Procedure1. Select the PeopleToolsAddAL assembly line. The Data Flow page opens.2. On the Data Flow page, right-click the Flow folder, and click Add connector

component. The Select Connector window opens.a. Select ibmdi.PeopleSoftConnector.


b. In the Name field, type a name for the add connector component, forexample, add_users.

c. From the Mode list, select AddOnly.d. Click OK.

Note: On the Data Flow page, ensure that the value of the State list is Enabled.3. Click the Call/Return tab. The Initial Work Entry page opens.

a. Click the Add a new Attribute to the Attribute map toolbar button.b. Type a name for the new attribute and click OK. The new attribute is listed

in the Work Attribute list.4. Click the Data Flow tab. The Data Flow page opens.

a. In the left pane, expand the Flow folder and select the new connectorcomponent, add_users.

b. On the Data Flow page, click the Config tab. The Config page opens.c. Type the PeopleSoft server, port, login, and Component Interface details.


until you see the Schema pane.b. Drag the attribute to the Connector Attribute pane. The attribute is listed in

the Connector Attribute pane.c. Click the Connect to the data source toolbar button.d. Click the Read the next entry toolbar button. All the attributes supported

by the Component Interface are displayed in the Schema pane.e. Click the Switch between List, Detail and Schema view toolbar button

until you see the Attribute Map details pane.f. Select the checkbox corresponding to the newly added attribute.

Note:

v To map a collection attribute; that is, a collection of simple attributes, youmust select the Advance Mapping Settings check box on the Output Mappage, and write scripts to map the collection attribute to thePeopleToolsAddAL assembly line.

v The Tivoli Directory Integrator version 7.0 fix pack 6 and higher does notallow Java objects such as com.ibm.di.entry.Entry,com.ibm.di.entry.Attribute, and so on in advanced attribute mapping inthe Ouput Map page. You must move these mappings to the BeforeExecute connector hook. For example, see the mapping of attributeserpt84xemailadd and erpt84xrole in Before Execute connector hook andthe attributes PSUSEREMAIL and PSROLEUSER_VW in the Output Mappage of connector conAdduser in the PeopleToolsAddAL assembly line.

6. Save changes to the PeopleToolsAddAL assembly line.7. Define the newly added connector component in the service.def file. The

service.def file is available in the \temp directory where the adapter profilewas extracted.

Mapping attributes to the PeopleToolsModifyAL assembly lineYou can make an attribute modifiable by mapping the attribute to thePeopleToolsModifyAL assembly line.


About this task

To view the list of assembly line icons used while mapping attributes, see Table 3on page 14.

Procedure1. Select the PeopleToolsModifyAL assembly line. The Data Flow page opens.2. Right-click the Flow folder, and click Add connector component. The Select

Connector window opens.a. Select ibmdi.PeopleSoftConnector.b. In the Name field, type a name for the add connector component, for

example, mod_users.c. From the Mode list, select Delta.d. Click OK.

Note: On the Data Flow page, ensure that the value of the State list is Enabled.3. Click the Call/Return tab. The Initial Work Entry page opens.

a. Click the Add a new Attribute to the Attribute map toolbar button.b. Type a name for the new attribute and click OK. The new attribute is listed

in the Work Attribute list.4. Click the Data Flow tab. The Data Flow page opens.

a. In the left pane, expand the Flow folder and select the new connectorcomponent, mod_users.



until you see the Schema pane.b. Drag the attribute to the Connector Attribute pane. The attribute is listed in

the Connector Attribute pane.c. Click the Connect to the data source toolbar button.d. Click the Read the next entry toolbar button. All the attributes supported



Note:

v To map a collection attribute; that is, a collection of simple attributes, youmust select the Advance Mapping Settings check box on the Output Mappage, and write scripts to map the collection attribute to thePeopleToolsModifyAL assembly line.

v The Tivoli Directory Integrator version 7.0 fix pack 6 and higher does notallow Java objects such as com.ibm.di.entry.Entry,com.ibm.di.entry.Attribute, and so on in advanced attribute mapping inthe Ouput Map page. You must move these mappings to the BeforeModify connector hook. For example, see the mapping of attributeserpt84xemailadd and erpt84xrole in Before Modify connector hook and theattributes PSUSEREMAIL and PSROLEUSER_VW in the Output Map pageof connector conModifyuser in the PeopleToolsModifyAL assembly line.


6. Click the Link Criteria tab.a. Click the Add new Link Criteria toolbar button.b. From the Connector Attribute list, select OPRID.c. From the Operator list, select equals.d. From the Value list, select $erUid.e. Click OK.

7. From the Flow folder, select conModifyUser, and click the Hooks tab.a. Expand the Data Flow folder and select Delta Successful. The Delta

Successful pane opens to the right.b. Type // before the line work.removeAllAttributes();.

8. Save the changes to the PeopleToolsModifyAL assembly line.9. Define the newly added connector component in the service.def file. The


Mapping attributes to the PeopleToolsSearchAL assembly lineYou can make the value of an attribute reconcilable by mapping the attribute to thePeopleToolsSearchAL assembly line.

About this task


Procedure1. Select the PeopleToolsSearchAL assembly line. The Data Flow page opens.2. Right-click the Flow folder, and click Add connector component. The Select

Connector window opens.a. Select ibmdi.PeopleSoftConnector.b. In the Name field, type a name for the add connector component, for

example, recon_users.c. From the Mode list, select Lookup.d. Click OK.

3. From the State list, select Passive.4. Click the Call/Return tab. The Initial Work Entry page opens.

a. Click the Add a new Attribute to the Attribute map toolbar button.b. Type a name for the new attribute, and click OK. The new attribute is

listed in the Work Attribute list.5. Click the Data Flow tab. The Data Flow page opens.

a. In the left pane, expand the Flow folder and select the new connectorcomponent, recon_users.


6. Click the Input Map tab. The Input Map page opens.a. Click the Switch between List, Detail and Schema view toolbar button

until you see the Schema pane.b. Drag the attribute to the Connector Attribute pane. The attribute is listed

in the Connector Attribute pane.


c. Click the Connect to the data source toolbar button.d. Click the Read the next entry toolbar button. All the attributes supported



Note:

v To map a collection attribute; that is, a collection of simple attributes,you must select the Advance Mapping Settings check box on the InputMap page, and write scripts to map the collection attribute to thePeopleToolsSearchAL assembly line.

v The Tivoli Directory Integrator version 7.0 fix pack 6 and higher does notallow Java objects such as com.ibm.di.entry.Entry,com.ibm.di.entry.Attribute, and so on in advanced attribute mapping inthe Input Map page. You must move these mappings to the AfterGetNext connector hook. For example, see the in the Input Map of theconnector conGetUsers PeopleToolsSearchAL to map collection attributesto work attributes without using objects of type com.ibm.di.entry.Entryand com.ibm.di.entry.Attribute.

7. Click the Link Criteria tab.a. Click the Add new Link Criteria toolbar button.b. From the Connector Attribute list, select OPRID.c. From the Operator list, select equals.d. From the Value list, select $erUid.e. Click OK.

8. Click the Hooks tab.a. Expand the DataFlow folder and select GetNext Successful.b. Type the following code in the GetNext Successful pane:

gpsConn1 = task.getConnector("connectorName");gpsConnCfg1 = gpsConn1.getConfiguration();gConnConfig1 = gpsConnCfg1.getConnectionConfig();gpsConn1.lookup(work);var abc = work.getString("attributeName");work.setAttribute("attributeName",abc);fLogMessage("INFO","FINAL DUMPING");main.dumpEntry(work);

where connectorName is the name of the connector component, andattributeName is the name of the new attribute.

9. Save the changes to the PeopleToolsSearchAL assembly line.10. Define the newly added connector component in the service.def file. The



Chapter 5. Troubleshooting of the PeopleTools Adapter errors

Use this information to identify error messages that occur while running thePeopleTools Adapter and actions that you can take to resolve the errors.

Whenever an operation fails, the corresponding error messages are logged in theibmdi.log file. This file is located in the adapter solution\logs directory.

You can display the logs in the user interface by running the Remote MethodInvocation (RMI) Dispatcher from the command prompt. You can configurelogging information for the adapter. For more information, see the PeopleToolsAdapter Installation and Configuration Guide and search for the sections aboutdisplaying logs in the user interface and configuring logging for the adapter.

The following tables list the error messages and warnings that might occur whileperforming the PeopleTools Adapter user tasks and the corrective actions to resolvethose errors.

Table 4. Specific error messages and recommended actions

Error code Error messages Corrective actions

CTGIMT001E The following error occurred.

Error: Unable to connect to PeopleSoftApplication server.

Verify that:

v The PeopleSoft server is running.

v The credentials specified on the adapter serviceform are correct.

v The PeopleSoft administrator user name andpassword specified on the adapter service formare correct.

v The psft.jar and psjoa.jar files exist in theITDI_HOME\jars\3rdparty\others directory.

InitializeError:java.lang.ClassNotFoundException:com.microsoft.jdbc.sqlserver.SQLServerDriver

This error might occur when the adapter fails tofind the JDBC_driver.jar file. This file is requiredto establish a connection with the database.

Ensure that the JDBC_driver.jar file exists in theITDI_HOME\jars\3rdparty\others directory.

For more information about the JDBC_driver.jarfile, see the Directory Integrator-Based PeopleToolsAdapter Installation and Configuration Guide andsearch for the section about PeopleSoftresource-specific jar files.

CTGIMT003E The account already exists. The user account exists on the PeopleSoft server.This error might occur when you attempt to adda user to the PeopleSoft server, and IBM SecurityIdentity Manager is not synchronized with thePeopleSoft server. To fix this problem, schedule areconciliation between IBM Security IdentityManager and the PeopleSoft server. See theonline help documentation for information aboutscheduling a reconciliation.


Table 4. Specific error messages and recommended actions (continued)

Error code Error messages Corrective actions

CTGIMT009E The account username cannot be modifiedbecause it does not exist.

This error might occur when you attempt to:

v Modify a user from IBM Security IdentityManager and the user does not exist on thePeopleSoft server.

v Change the password of a user account fromIBM Security Identity Manager and the userdoes not exist on the PeopleSoft server.

The reason could be either the user was notcreated on the PeopleSoft server or the user wasdeleted directly from the PeopleSoft server.

Create the user on the PeopleSoft server andschedule a reconciliation. See the IBM SecurityIdentity Manager production documentation forinformation about scheduling a reconciliation.

CTGIMT015E An error occurred while deleting the usernameaccount because the account does not exist.

This error might occur when you attempt to:

v Delete a user from IBM Security IdentityManager and the user does not exist on thePeopleSoft server.

v Change the password of a user account fromIBM Security Identity Manager and the userdoes not exist on the PeopleSoft server.

The reason could be either the user was notcreated on the PeopleSoft server or the user wasdeleted directly from the PeopleSoft server.

Create the user on the PeopleSoft server andschedule a reconciliation. See the IBM SecurityIdentity Manager production documentation forinformation about scheduling a reconciliation.

CTGIMT600E An error occurred while establishingcommunication with the Tivoli DirectoryIntegrator server.

Verify that:

v The Tivoli Directory Integrator-based adapterservice is running.

v The URL specified for the Tivoli DirectoryIntegrator on the adapter service form iscorrect.

Table 5. General error messages, warnings, and corrective actions

Error messages Corrective actions

LoadConnectors:java.lang.NoClassDefFoundError:psft/pt8/joa/JOAException

This error might occur when the adapter fails to find thepsjoa.jar file.

Ensure that the psjoa.jar file exists in theITDI_HOME\jars\3rdparty\others directory.

For more information about the psjoa.jar file, see theDirectory Integrator-Based PeopleTools Adapter Installationand Configuration Guide and search for the section aboutPeopleSoft resource-specific jar files.


Table 5. General error messages, warnings, and corrective actions (continued)

Error messages Corrective actions

InitConnectors:java.lang.Exception: Unable toGetComponent Interface ABC_XYZ

This error might occur when the adapter fails to find thePeopleSoft Component Interface classes.

Verify that:

v The CompIntfc.jar file that contains theENROLE_AGENT Component Interface project classesexists in the ITDI_HOME\jars\3rdparty\othersdirectory.

v The CompIntfc.jar file contains classes for therequired ENROLE_AGENT Component Interfaceproject.

For more information about the CompIntfc.jar file, seethe Directory Integrator-Based PeopleTools AdapterInstallation and Configuration Guide and search for thesection about PeopleSoft resource-specific jar files.

v A system error occurred while adding an account. Theaccount was not added.

v A system error occurred while modifying an account.The account was not changed.

v A system error occurred while deleting an account.The account was not deleted.

v The search failed due to a system error.

Ensure that:

v The CompIntfc.jar and psjoa.jar files are copied tothe ITDI_HOME\jars directory on the workstationwhere the adapter is installed.

v The ENROLE_AGENT Component Interface project isdeployed on the PeopleSoft server.

v The network connection between IBM Security IdentityManager and Tivoli Directory Integrator, or TivoliDirectory Integrator and the PeopleSoft server is notslow.

v The account was added but some attributes failed.

v The account was modified but some attributes failed.

v The account was deleted successfully, but additionalsteps failed.

The account was created, modified, or deleted, but someof the attributes specified in the request were not set.

See the list of attributes that failed and the correspondingerror message for the error description. Correct the errorsassociated with each attribute and perform the operationagain.

v Search filter error

v Invalid search filter

The filter specified in the search request is not correct.Specify the correct filter and perform the searchoperation again.

Adapter profile is not displayed in the user interfaceafter installing the profile.

Stop and restart the IBM Security Identity Managerserver or wait until the cache times out (up to 10minutes) for IBM Security Identity Manager to refreshthe list of attribute names.

v A PeopleSoft error occurred while saving theattributes.

v Please specify all Attribute Values for all ID Types ofPSOPRALIAS attribute.

Verify that all attribute names for all ID Types andValues are specified correctly.

Chapter 5. Troubleshooting of the PeopleTools Adapter errors 25

Appendix A. PeopleTools Adapter attributes

The following table lists the attributes that are displayed on the PeopleToolsaccount form, and their corresponding names on the IBM Tivoli Directory Serverand the name by which the attribute is referred on the PeopleSoft.

Table 6. Attributes on the PeopleTools account form, their corresponding names on the IBM Tivoli Directory Server,and the PeopleSoft server

Attribute name on the PeopleToolsaccount form

Attribute name on the IBM TivoliDirectory Server

Attribute name on the PeopleSoftserver

Alternate User ID erpt84xaltid ROLEUSER_ALT

Currency Code erpt84xcurrcode CURRENCY_CD

Description erpt84xdescription OPRDEFNDESC

Effective Date : Date erpt84xstartdate EFFDT_FROM

Effective Date : Time

E-mail Addresses erpt84xemailadd PSUSEREMAIL

Enable Expert Entry erpt84xexpertentry EXPENT

ID Types and Values erpt84xopraliastype ID Type

Language Code erpt84xlangcode LANGUAGE_CD

Multi Language Enabled erpt84xmultilang MULTILANG

Navigator Homepage erpt84xhomepagepl DEFAULTNAVHP

Password erPassword OPERPSWD

Primary erpt84xprimarypl OPRCLASS

Process Profile erpt84xprofilepl PRCSPRFLCLS

Roles erpt84xrole PSROLEUSER_VW

Routing - E-mail User erpt84xemailuser EMAIL_USER_SW

Routing - Worklist User erpt84xworklistuser WORKLIST_USER_SW

Row Security erpt84xrowpl ROWSECCLASS

Symbolic ID erpt84xsymbid SYMBOLICID

To Date : Date erpt84xenddate EFFDT_TO

To Date : Time

User ID erUid OPRID

User Supervisor erpt84xusersupr ROLEUSER_SUPR


Appendix B. Adapter customization for collection attributes

PeopleSoft has a constraint of setting the values of a collection attribute in aspecific sequence. Tivoli Directory Integrator does not necessarily pass the valueson to the connector in the sequence they are received.

To support such attributes you must modify the assembly lines, adapter profile,and the connector. You might also need to create a PeopleSoft component interface.

A collection attribute is an attribute that has child attributes. These child attributesmight also be collection attributes. For example, the PSOPRALIAS attribute.PSOPRALIAS

- OPRALIASTYPE- PSOPRALIASFIELD

-PSOPRALIASNAME-PSOPRALIASVALUE-PSOPRALIASDESCR

OPRALIASTYPE and PSOPRALIASFIELD are child attributes of PSOPRALIAS.PSOPRALIASFIELD is a collection attribute with the child attributes PSOPRALIASNAME,PSOPRALIASVALUE, and PSOPRALIASDESCR.

To meet the PeopleSoft sequence constraint, add an attribute in the assembly lineto define the sequence in which the values of the collection are set. For thePSOPRALIAS attribute, add the following code to define the sequence:var attributeSequence = new ArrayList();attributeSequence.add("OPRALIASTYPE");attributeSequence.add("PSOPRALIASFIELD");fullOprAliasEntry.setAttribute("sequence",attributeSequence);

This sequence attribute instructs the connector to first set the OPRALIASTYPEattribute in the collection. Typically PeopleSoft populates the collection with therequired attributes and values.

If you are setting a custom type that needs multiple attributes, you need to instructthe connector to update the values for the attribute on the resource. For example,you want to set OPRALIASTYPE to Custom with two attributes, MyCustAttr1 andMyCustAttr2, the structure is:PSOPRALIAS

- OPRALIASTYPE Custom- PSOPRALIASFIELD [1]

-PSOPRALIASNAME MyCustAttr1-PSOPRALIASVALUE-PSOPRALIASDESCR

- PSOPRALIASFIELD [2]-PSOPRALIASNAME MyCustAttr2-PSOPRALIASVALUE-PSOPRALIASDESCR

If the connector adds the values on the resource, MyCustAttr2 generates an errorthat the value is already set. You must add the getItemByAttribute attribute to theadapter assembly line.psOprAliasedFieldEntry.setAttribute("getItemByAttribute","ATTRNAME")

For this example ATTRNAME is PSOPRALIASNAME.


The connector parses the getItemByAttribute attribute and gets the valueATTRNAME associated with it. The connector does not set the value for this fieldwhich is already set on the resource.

For information about customizing attributes, see Chapter 4, “Customizing thePeopleTools account form,” on page 11.

After customizing the attributes and the profile, you must import the profile toIBM Security Identity Manager. For information about importing the adapterprofile, see PeopleTools Adapter Installation and Configuration Guide. You can use theDesign forms function of IBM Security Identity Manager to modify the accountform to include the customized attributes.


Appendix C. Support information

You have several options to obtain support for IBM products.v “Searching knowledge bases”v “Obtaining a product fix” on page 32v “Contacting IBM Support” on page 32

Searching knowledge basesYou can often find solutions to problems by searching IBM knowledge bases. Youcan optimize your results by using available resources, support tools, and searchmethods.

About this task

You can find useful information by searching the product documentation for IBMSecurity Identity Manager. However, sometimes you must look beyond the productdocumentation to answer your questions or resolve problems.

Procedure

To search knowledge bases for information that you need, use one or more of thefollowing approaches:1. Search for content by using the IBM Support Assistant (ISA).

ISA is a no-charge software serviceability workbench that helps you answerquestions and resolve problems with IBM software products. You can findinstructions for downloading and installing ISA on the ISA website.

2. Find the content that you need by using the IBM Support Portal.The IBM Support Portal is a unified, centralized view of all technical supporttools and information for all IBM systems, software, and services. The IBMSupport Portal lets you access the IBM electronic support portfolio from oneplace. You can tailor the pages to focus on the information and resources thatyou need for problem prevention and faster problem resolution. Familiarizeyourself with the IBM Support Portal by viewing the demo videos(https://www.ibm.com/blogs/SPNA/entry/the_ibm_support_portal_videos)about this tool. These videos introduce you to the IBM Support Portal, exploretroubleshooting and other resources, and demonstrate how you can tailor thepage by moving, adding, and deleting portlets.

3. Search for content about IBM Security Identity Manager by using one of thefollowing additional technical resources:v IBM Security Identity Manager version 6.0 technotes and APARs (problem

reports).v IBM Security Identity Manager Support website.v IBM Redbooks®.v IBM support communities (forums and newsgroups).

4. Search for content by using the IBM masthead search. You can use the IBMmasthead search by typing your search string into the Search field at the top ofany ibm.com® page.

5. Search for content by using any external search engine, such as Google, Yahoo,or Bing. If you use an external search engine, your results are more likely to


http://www.ibm.com/software/support/isa/

http://www.ibm.com/support/entry/portal/overview/software/tivoli/tivoli_identity_manager

https://www.ibm.com/blogs/SPNA/entry/the_ibm_support_portal_videos

http://www.ibm.com/support/search.wss?rs=644&apar=include&tc=SSTFWV&dc=DB520+D800+D900+DA900+DA800+DB550+D100&dtm&atrn=SWVersion&atrv=5.1

http://www.ibm.com/support/search.wss?rs=644&apar=include&tc=SSTFWV&dc=DB520+D800+D900+DA900+DA800+DB550+D100&dtm&atrn=SWVersion&atrv=5.1

http://www.ibm.com/software/sysmgmt/products/support/IBMTivoliIdentityManager.html

http://publib-b.boulder.ibm.com/Redbooks.nsf/portals/Tivoli

http://www.ibm.com/software/sysmgmt/products/support/Tivoli_Communities.html

include information that is outside the ibm.com domain. However, sometimesyou can find useful problem-solving information about IBM products innewsgroups, forums, and blogs that are not on ibm.com.

Tip: Include “IBM” and the name of the product in your search if you arelooking for information about an IBM product.

Obtaining a product fixA product fix might be available to resolve your problem.

About this task

You can get fixes by following these steps:

Procedure1. Obtain the tools that are required to get the fix. You can obtain product fixes

from the Fix Central Site. See http://www.ibm.com/support/fixcentral/.2. Determine which fix you need.3. Download the fix. Open the download document and follow the link in the

“Download package” section.4. Apply the fix. Follow the instructions in the “Installation Instructions” section

of the download document.

Contacting IBM SupportIBM Support assists you with product defects, answers FAQs, and helps usersresolve problems with the product.

Before you begin

After trying to find your answer or solution by using other self-help options suchas technotes, you can contact IBM Support. Before contacting IBM Support, yourcompany or organization must have an active IBM software subscription andsupport contract, and you must be authorized to submit problems to IBM. Forinformation about the types of available support, see the Support portfolio topic inthe “Software Support Handbook”.

Procedure

To contact IBM Support about a problem:1. Define the problem, gather background information, and determine the severity

of the problem. For more information, see the Getting IBM support topic in theSoftware Support Handbook.

2. Gather diagnostic information.3. Submit the problem to IBM Support in one of the following ways:

v Using IBM Support Assistant (ISA):Any data that has been collected can be attached to the service request.Using ISA in this way can expedite the analysis and reduce the time toresolution.a. Download and install the ISA tool from the ISA website. See

http://www.ibm.com/software/support/isa/.b. Open ISA.


http://www.ibm.com/support/fixcentral/

http://www14.software.ibm.com/webapp/set2/sas/f/handbook/offerings.html

http://www14.software.ibm.com/webapp/set2/sas/f/handbook/getsupport.html

http://www.ibm.com/software/support/isa/

c. Click Collection and Send Data.d. Click the Service Requests tab.e. Click Open a New Service Request.

v Online through the IBM Support Portal: You can open, update, and view allof your service requests from the Service Request portlet on the ServiceRequest page.

v By telephone for critical, system down, or severity 1 issues: For the telephonenumber to call in your region, see the Directory of worldwide contacts webpage.

Results

If the problem that you submit is for a software defect or for missing or inaccuratedocumentation, IBM Support creates an Authorized Program Analysis Report(APAR). The APAR describes the problem in detail. Whenever possible, IBMSupport provides a workaround that you can implement until the APAR isresolved and a fix is delivered. IBM publishes resolved APARs on the IBM Supportwebsite daily, so that other users who experience the same problem can benefitfrom the same resolution.

Appendix C. Support information 33

http://www.ibm.com/software/support/

http://www.ibm.com/planetwide/

Appendix D. Accessibility features for IBM Security IdentityManager

Accessibility features help users who have a disability, such as restricted mobilityor limited vision, to use information technology products successfully.

Accessibility features

The following list includes the major accessibility features in IBM Security IdentityManager.v Support for the Freedom Scientific JAWS screen reader applicationv Keyboard-only operationv Interfaces that are commonly used by screen readersv Keys that are discernible by touch but do not activate just by touching themv Industry-standard devices for ports and connectorsv The attachment of alternative input and output devices

The IBM Security Identity Manager library, and its related publications, areaccessible.

Keyboard navigation

This product uses standard Microsoft Windows navigation keys.

Related accessibility information

The following keyboard navigation and accessibility features are available in theform designer:v You can use the tab keys and arrow keys to move between the user interface

controls.v You can use the Home, End, Page Up, and Page Down keys for more

navigation.v You can launch any applet, such as the form designer applet, in a separate

window to enable the Alt+Tab keystroke to toggle between that applet and theweb interface, and also to use more screen workspace. To launch the window,click Launch as a separate window.

v You can change the appearance of applets such as the form designer by usingthemes, which provide high contrast color schemes that help users with visionimpairments to differentiate between controls.

IBM and accessibility

See the IBM Human Ability and Accessibility Center For more information aboutthe commitment that IBM has to accessibility.


http://www.ibm.com/able

Notices

This information was developed for products and services offered in the U.S.A.

IBM may not offer the products, services, or features discussed in this document inother countries. Consult your local IBM representative for information on theproducts and services currently available in your area. Any reference to an IBMproduct, program, or service is not intended to state or imply that only that IBMproduct, program, or service may be used. Any functionally equivalent product,program, or service that does not infringe any IBM intellectual property right maybe used instead. However, it is the user's responsibility to evaluate and verify theoperation of any non-IBM product, program, or service.

IBM may have patents or pending patent applications covering subject matterdescribed in this document. The furnishing of this document does not give youany license to these patents. You can send license inquiries, in writing, to:

IBM Director of LicensingIBM CorporationNorth Castle DriveArmonk, NY 10504-1785 U.S.A.

For license inquiries regarding double-byte (DBCS) information, contact the IBMIntellectual Property Department in your country or send inquiries, in writing, to:

Intellectual Property LicensingLegal and Intellectual Property LawIBM Japan, Ltd.19-21, Nihonbashi-Hakozakicho, Chuo-kuTokyo 103-8510, Japan

The following paragraph does not apply to the United Kingdom or any othercountry where such provisions are inconsistent with local law :

INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THISPUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHEREXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIEDWARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESSFOR A PARTICULAR PURPOSE.

Some states do not allow disclaimer of express or implied warranties in certaintransactions, therefore, this statement might not apply to you.

This information could include technical inaccuracies or typographical errors.Changes are periodically made to the information herein; these changes will beincorporated in new editions of the publication. IBM may make improvementsand/or changes in the product(s) and/or the program(s) described in thispublication at any time without notice.

Any references in this information to non-IBM Web sites are provided forconvenience only and do not in any manner serve as an endorsement of those Websites. The materials at those Web sites are not part of the materials for this IBMproduct and use of those Web sites is at your own risk.


IBM may use or distribute any of the information you supply in any way itbelieves appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the purposeof enabling: (i) the exchange of information between independently createdprograms and other programs (including this one) and (ii) the mutual use of theinformation which has been exchanged, should contact:

IBM Corporation2Z4A/10111400 Burnet RoadAustin, TX 78758 U.S.A.

Such information may be available, subject to appropriate terms and conditions,including in some cases payment of a fee.

The licensed program described in this document and all licensed materialavailable for it are provided by IBM under terms of the IBM Customer Agreement,IBM International Program License Agreement or any equivalent agreementbetween us.

Any performance data contained herein was determined in a controlledenvironment. Therefore, the results obtained in other operating environments mayvary significantly. Some measurements may have been made on development-levelsystems and there is no guarantee that these measurements will be the same ongenerally available systems. Furthermore, some measurement may have beenestimated through extrapolation. Actual results may vary. Users of this documentshould verify the applicable data for their specific environment.

Information concerning non-IBM products was obtained from the suppliers ofthose products, their published announcements or other publicly available sources.IBM has not tested those products and cannot confirm the accuracy ofperformance, compatibility or any other claims related to non-IBM products.Questions on the capabilities of non-IBM products should be addressed to thesuppliers of those products.

All statements regarding IBM's future direction or intent are subject to change orwithdrawal without notice, and represent goals and objectives only.

This information contains examples of data and reports used in daily businessoperations. To illustrate them as completely as possible, the examples include thenames of individuals, companies, brands, and products. All of these names arefictitious and any similarity to the names and addresses used by an actual businessenterprise is entirely coincidental.

COPYRIGHT LICENSE:

This information contains sample application programs in source language, whichillustrate programming techniques on various operating platforms. You may copy,modify, and distribute these sample programs in any form without payment toIBM, for the purposes of developing, using, marketing or distributing applicationprograms conforming to the application programming interface for the operatingplatform for which the sample programs are written. These examples have notbeen thoroughly tested under all conditions. IBM, therefore, cannot guarantee orimply reliability, serviceability, or function of these programs. You may copy,modify, and distribute these sample programs in any form without payment to


IBM for the purposes of developing, using, marketing, or distributing applicationprograms conforming to IBM's application programming interfaces.

Each copy or any portion of these sample programs or any derivative work, mustinclude a copyright notice as follows:

If you are viewing this information softcopy, the photographs and colorillustrations might not appear.

© (your company name) (year). Portions of this code are derived from IBM Corp.Sample Programs. © Copyright IBM Corp. _enter the year or years_. All rightsreserved.

If you are viewing this information in softcopy form, the photographs and colorillustrations might not be displayed.

Trademarks

IBM, the IBM logo, and ibm.com are trademarks or registered trademarks ofInternational Business Machines Corp., registered in many jurisdictions worldwide.Other product and service names might be trademarks of IBM or other companies.A current list of IBM trademarks is available on the Web at "Copyright andtrademark information" at http://www.ibm.com/legal/copytrade.shtml.

Adobe, Acrobat, PostScript and all Adobe-based trademarks are either registeredtrademarks or trademarks of Adobe Systems Incorporated in the United States,other countries, or both.

IT Infrastructure Library is a registered trademark of the Central Computer andTelecommunications Agency which is now part of the Office of GovernmentCommerce.

Intel, Intel logo, Intel Inside, Intel Inside logo, Intel Centrino, Intel Centrino logo,Celeron, Intel Xeon, Intel SpeedStep, Itanium, and Pentium are trademarks orregistered trademarks of Intel Corporation or its subsidiaries in the United Statesand other countries.

Linux is a trademark of Linus Torvalds in the United States, other countries, orboth.

Microsoft, Windows, Windows NT, and the Windows logo are trademarks ofMicrosoft Corporation in the United States, other countries, or both.

ITIL is a registered trademark, and a registered community trademark of the Officeof Government Commerce, and is registered in the U.S. Patent and TrademarkOffice.

UNIX is a registered trademark of The Open Group in the United States and othercountries.

Cell Broadband Engine and Cell/B.E. are trademarks of Sony ComputerEntertainment, Inc., in the United States, other countries, or both and is used underlicense therefrom.

Notices 39

http://www.ibm.com/legal/copytrade.shtml

Java™ and all Java-based trademarks and logos are trademarks or registeredtrademarks of Oracle and/or its affiliates.

Privacy Policy Considerations

IBM Software products, including software as a service solutions, ("SoftwareOfferings") may use cookies or other technologies to collect product usageinformation, to help improve the end user experience, and to tailor interactionswith the end user or for other purposes. In many cases, no personally identifiableinformation is collected by the Software Offerings. Some of our Software Offeringscan help enable you to collect personally identifiable information. If this SoftwareOffering uses cookies to collect personally identifiable information, specificinformation about this offering’s use of cookies is set forth below.

This Software Offering does not use cookies or other technologies to collectpersonally identifiable information.

If the configurations deployed for this Software Offering provide you as customerthe ability to collect personally identifiable information from end users via cookiesand other technologies, you should seek your own legal advice about any lawsapplicable to such data collection, including any requirements for notice andconsent.

For more information about the use of various technologies, including cookies, forthese purposes, see IBM's Privacy Policy at http://www.ibm.com/privacy andIBM’s Online Privacy Statement at http://www.ibm.com/privacy/details/us/ensections entitled "Cookies, Web Beacons and Other Technologies and SoftwareProducts and Software-as-a Service".


http://www.ibm.com/privacy

http://www.ibm.com/privacy/details/us/en

Index

Aaccessibility x, 35account form

customization 11structure 12

adapterattributes 27features 1introduction 1overview 1troubleshooting errors 23user account management tasks 5

adding user accounts 6alternate user ID 7assembly lines

icons 14PeopleToolsAddAL assembly line 15,

18PeopleToolsModifyAL assembly

line 16, 20PeopleToolsSearchAL assembly

line 17, 21assigning

alternate user ID 7email addresses 8user supervisor 8

attributesadding user accounts 6customization 29ID Type 8

Cchecklist, configuring IBM Security

Identity Manager 3collection attributes, customization 29CompIntfc.jar file 11, 12customization

account forms 11collection attributes 29

CustomLabels.properties file 12

Ee-mail address attribute 8education xerpt84xuseraccount.xml file 12errors, troubleshooting 23

Ffiles

CompIntfc.jar file 11, 12CustomLabels.properties file 12erpt84xuseraccount.xml file 12schema.dsml file 12

IIBM

Software Support xSupport Assistant x

IBM Support Assistant 32ID type attribute 8ISA 32

Kknowledge bases 31

Mmapping attributes of Component

Interfacesnot supported 18supported 14

mapping attributes toPeopleToolsAddAL assembly line 15,

18PeopleToolsModifyAL assembly

line 16, 20PeopleToolsSearchAL assembly

line 17, 21

Nnotices 37

Oonline

publications ixterminology ix

operationsadding 6deletion 10modification 9restoration 10suspend 10

overview 1

PPeopleTools

account form 6adapter ix

PeopleToolsAddAL assembly line 15, 18PeopleToolsModifyAL assembly line 16,

20PeopleToolsSearchAL assembly line 17,

21permission

code 9description 9list 9

primary e-mail 8

problem-determination xpublication ixpublications

accessing online ixlist of ix

Rrole names 9

Sschema.dsml file 12support contact information 32

Tterminology ixtraining xtroubleshooting

adapter errors 23contacting support 32getting fixes 32searching knowledge bases 31support website x

Uuser account

adding 6deletion 10modification 9reconciliation 5restoration 10suspension 10

user supervisor 8


��

Printed in USA

SC27-4406-02

peopletoolsadapter user guide - ibm · peopletoolsadapter user guide sc27-4406-02. note ... x ibm...

Documents