e-dokumen.com

35.36.37.38.39.40.41.42.43.44.45.46.47.Simple hierarchical entry . . . . . . . . 49Traditional, flat entry . . . . . . . . . 49Another simple hierarchical entry . . . . . 50Hierarchical Entry object example . . . . . 53The default IBM Security Directory IntegratorServer definition . . . . . . . . . . . 79The IBM Security Directory Integrator Projecttree . . . . . . . . . . . . . . . 79IBM Security Directory Integrator ProjectProperties window . . . . . . . . . . 81Properties view . . . . . . . . . . . 82Servers view in the Configuration Editor86Servers view; pop-up menu . . . . . . . 86Expression Editor: simple property. . . . . 88Expression Editor: Advanced (JavaScript)89Expression Editor: text with v.6-stylesubstitution . . . . . . . . . . . . 89AssemblyLine options menu . . . . . . . 93AssemblyLine Settings . . . . . . . . . 94AssemblyLine Log settings . . . . . . . 94AssemblyLine Hooks . . . . . . . . . 95AssemblyLine Operations . . . . . . . . 96AssemblyLine simulation settings . . . . . 97AssemblyLine simulation settings window,with script editor . . . . . . . . . . 98AssemblyLine Sandbox settings . . . . . . 98Specify Run Options dialog . . . . . . . 99Quick Editor for IF/ELSE/ELSE-IF Branch100Switch/Case Branch . . . . . . . . . 101Attribute Value loop . . . . . . . . . 101Conditional loop . . . . . . . . . . 102Connector loop . . . . . . . . . . . 102Connector Parameters in Connector Loop103Independent Attribute Map Component103User Documentation View . . . . . . . 104Sample AssemblyLine report . . . . . . 104Console log . . . . . . . . . . . . 105Configuration Editor File associationspreferences . . . . . . . . . . . . 106Attribute Mapping . . . . . . . . . . 107Attribute Mapping, with discoveredAttributes . . . . . . . . . . . . . 108Changing Attribute Map inheritance . . . . 108Attribute Mapping, with JavaScript editingwindow for individual Attribute . . . . . 109Add Attribute dialog . . . . . . . . . 109Attribute map: inheritance dialog . . . . . 110Attribute Map window . . . . . . . . 114Connection tab . . . . . . . . . . . 115Line Reader parser . . . . . . . . . . 116Link Criteria tab . . . . . . . . . . 117Expression Editor window, simple mode117Expression Editor window, Advanced(JavaScript) mode . . . . . . . . . . 118Pool tab: Connector Pool definition . . . . 122Pool tab: Connector in AssemblyLine122 Copyright IBM Corp. 2003, .97.98.99.100.Connector Editor: Configure InheritanceServer Document editor . . . . . . . .Schema Editor . . . . . . . . . . .Data Browser . . . . . . . . . . .Data Browser . . . . . . . . . . .Generic Data Browser . . . . . . . . .Stream Data Browser . . . . . . . . .JDBC Data Browser . . . . . . . . .JDBC Table details . . . . . . . . . ."Use as table" option . . . . . . . . .LDAP Data Browser . . . . . . . . .LDAP Data Browser entry . . . . . . .LDAP Data Browser schema item . . . . ."Use as search base" context menu choiceContext menu - Forms Editor choice . . . .Default Forms Editor screen for FileSystemConnector. . . . . . . . . . . . .Forms Editor, Events Script in LDAPConnector. . . . . . . . . . . . .Forms Editor - General section . . . . . .Forms Editor - Advanced section . . . . .Forms Editor - field definitions . . . . .Import Configuration wizard . . . . . .Linked file field . . . . . . . . . . ."Import from server" wizard . . . . . .New Connector in Resources folder wizardNew Component wizard . . . . . . . .New Component wizard, with filteringConnector Configuration panel . . . . .Parser Configuration panel . . . . . . .Parser selection dialog . . . . . . . ."Create AssemblyLine Report" commandChoose Config Report stylesheet dialogReports folder in the Project hierarchyThree options to start an AssemblyLineConsole log window . . . . . . . . .Data Stepper main window . . . . . . .Show/Hide button in the Data StepperShow/Hide components dialog . . . . .Debugger window . . . . . . . . . .Debugger at Before GetNext . . . . . .Error dialog: Stack Trace . . . . . . . .Debugger window: stepping through a scriptline-by-line. . . . . . . . . . . . .StepInto function . . . . . . . . . .Stepped-into function . . . . . . . . .Follow the function call . . . . . . . .Debug Server option . . . . . . . . .Run with Options window . . . . . . .Project Properties menu choice . . . . . .Project Properties . . . . . . . . . .CVS Share Project window . . . . . . .Problems View window . . . . . . . .Configuration Editor Preferences windowConfiguration system store settings . . . .Server document context meu . . . . . 4169171171vii

101.102.103.104.105.106.107.108.109.viiiAutoStart settings . . . . . . . .Solution Interface settings . . . . .Solution Interface settings: AssemblyLinesSolution Interface settings: PropertiesSolution Interface settings: DescriptionProperties editor window . . . . .Key Assignments window . . . . .Simulation Settings window . . . .EasyETL main window . . . . . .IBM Security Directory Integrator: Users Guide. 173. 173174175175. 176. 178. 184. 189110.111.112.113.114.115.116.117.EasyETL project context menu . . . . . .Initial EasyETL project window . . . . .LDAP Connector in Easy ETL . . . . . .Input/Output mapping . . . . . . . .Input/Output mapping, with TransformationsTransformation script . . . . . . . . .Completion dialog . . . . . . . . . .Synchronization AssemblyLine using Deltafunctionality . . . . . . . . . . . .190190191192192193194212

About this publicationThis publication contains the information that you require to develop solutions byusing components that are part of IBM Security Directory Integrator.IBM Security Directory Integrator components are designed for networkadministrators who are responsible for maintaining user directories and otherresources. It is assumed that you have practical experience with installation andusage of both IBM Security Directory Integrator and IBM Security Directory Server.The information is also intended for users who are responsible for thedevelopment, installation, and administration of solutions by usingIBM SecurityDirectory Integrator. The reader must familiar with the concepts and theadministration of the systems that the developed solution would connect to.Depending on the solution, these systems might include, but are not limited to,one or more of the following products, systems, and concepts:v IBM Security Directory Serverv IBM Security Identity Managerv IBM Java runtime environment (JRE) or Oracle Java runtime environmentv Microsoft Active Directoryv Windows and UNIX operating systemsv Security managementv Internet protocols, including HyperText Transfer Protocol (HTTP), HyperTextTransfer Protocol Secure (HTTPS) and Transmission Control Protocol/InternetProtocol (TCP/IP)v Lightweight Directory Access Protocol (LDAP) and directory servicesv A supported user registryv Authentication and authorization conceptsv SAP ABAP Application ServerAccess to publications and terminologyRead the descriptions of the IBM Security Directory Integrator Version 7.2 libraryand the related publications that you can access online.This section provides:v A list of publications in the “IBM Security Directory Integrator library.”v Links to “Online publications” on page x.v A link to the “IBM Terminology website” on page xi.IBM Security Directory Integrator libraryThe following documents are available in the IBM Security Directory Integratorlibrary:v IBM Security Directory Integrator Version 7.2 Federated Directory IntegratorAdministration GuideContains information about using the Federated Directory Server console todesign, implement, and administer data integration solutions. Also contains Copyright IBM Corp. 2003, 2013ix

information about using the System for Cross-Domain Identity Management(SCIM) protocol and interface for identity management.v IBM Security Directory Integrator Version 7.2 Getting Started GuideContains a brief tutorial and introduction to IBM Security Directory Integrator.Includes examples to create interaction and hands-on learning of IBM SecurityDirectory Integrator.v IBM Security Directory Integrator Version 7.2 Users GuideContains information about using IBM Security Directory Integrator. Containsinstructions for designing solutions using the Security Directory Integratordesigner tool (the Configuration Editor) or running the ready-made solutionsfrom the command line. Also provides information about interfaces, conceptsand AssemblyLine creation.v IBM Security Directory Integrator Version 7.2 Installation and Administrator GuideIncludes complete information about installing, migrating from a previousversion, configuring the logging functionality, and the security model underlyingthe Remote Server API of IBM Security Directory Integrator. Containsinformation on how to deploy and manage solutions.v IBM Security Directory Integrator Version 7.2 Reference GuideContains detailed information about the individual components of IBM SecurityDirectory Integrator: Connectors, Function Components, Parsers, Objects and soforth – the building blocks of the AssemblyLine.v IBM Security Directory Integrator Version 7.2 Problem Determination GuideProvides information about IBM Security Directory Integrator tools, resources,and techniques that can aid in the identification and resolution of problems.v IBM Security Directory Integrator Version 7.2 Message GuideProvides a list of all informational, warning and error messages associated withthe IBM Security Directory Integrator.v IBM Security Directory Integrator Version 7.2 Password Synchronization Plug-insGuideIncludes complete information for installing and configuring each of the fiveIBM Password Synchronization Plug-ins: Windows Password Synchronizer, SunDirectory Server Password Synchronizer, IBM Security Directory ServerPassword Synchronizer, Domino Password Synchronizer and PasswordSynchronizer for UNIX and Linux. Also provides configuration instructions forthe LDAP Password Store and JMS Password Store.v IBM Security Directory Integrator Version 7.2 Release NotesDescribes new features and late-breaking information about IBM SecurityDirectory Integrator that did not get included in the documentation.Online publicationsIBM posts product publications when the product is released and when thepublications are updated at the following locations:IBM Security Directory Integrator LibraryThe product documentation site opic/com.ibm.IBMDI.doc 7.2/welcome.htm) displays thewelcome page and navigation for this library.IBM Security Systems Documentation CentralIBM Security Systems Documentation Central provides an alphabetical listof all IBM Security Systems product libraries and links to the onlinedocumentation for specific versions of each product.xIBM Security Directory Integrator: Users Guide

IBM Publications CenterThe IBM Publications Center site ( ons/servlet/pbi.wss) offers customized search functionsto help you find all the IBM publications you need.Related informationInformation related to IBM Security Directory Integrator is available at thefollowing locations:v IBM Security Directory Integrator Version 7.2 uses the JNDI client from Oracle.For information about the JNDI client, see the Java Naming and DirectoryInterface Specification at /guides/jndi/index.html .v Information that might help to answer your questions related to IBM SecurityDirectory Integrator can be found at rview/software/security systems/tivoli directory integrator.IBM Terminology websiteThe IBM Terminology website consolidates terminology for product libraries in onelocation. You can access the Terminology website at ogy.AccessibilityAccessibility features help users with a physical disability, such as restrictedmobility or limited vision, to use software products successfully. With this product,you can use assistive technologies to hear and navigate the interface. You can alsouse the keyboard instead of the mouse to operate all features of the graphical userinterface.For additional information, see the Accessibility Appendix in IBM Security DirectoryIntegrator Version 7.2 Users Guide.Technical trainingFor technical training information, see the following IBM Education website port informationIBM Support provides assistance with code-related problems and routine, shortduration installation or usage questions. You can directly access the IBM SoftwareSupport site at BM Security Directory Integrator Version 7.2 Problem Determination Guide providesdetails about:v What information to collect before contacting IBM Support.v The various methods for contacting IBM Support.v How to use IBM Support Assistant.v Instructions and problem-determination resources to isolate and fix the problemyourself.About this publicationxi

Statement of Good Security PracticesIT system security involves protecting systems and information throughprevention, detection and response to improper access from within and outsideyour enterprise. Improper access can result in information being altered, destroyed,misappropriated or misused or can result in damage to or misuse of your systems,including for use in attacks on others. No IT system or product should beconsidered completely secure and no single product, service or security measurecan be completely effective in preventing improper use or access. IBM systems,products and services are designed to be part of a comprehensive securityapproach, which will necessarily involve additional operational procedures, andmay require other systems, products or services to be most effective. IBM DOESNOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES AREIMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THEMALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY.xiiIBM Security Directory Integrator: Users Guide

Chapter 1. Users Guide Copyright IBM Corp. 2003, 20131

2IBM Security Directory Integrator: Users Guide

Chapter 2. General ConceptsThis chapter introduces some of the basic concepts in IBM Security DirectoryIntegrator, along with those elements of the architecture that allow you to buildyour solutions, their characteristics and behaviors.The AssemblyLineAn AssemblyLine (AL) is a set of components strung together to move andtransform data; it describes the "route" along which the data will pass. The datathat is been handled through that journey is represented as an Entry object. TheAssemblyLine works with a single entry at a time on each cycle of theAssemblyLine. It is the unit of work in IBM Security Directory Integrator andtypically represents a flow of information from one or more data sources to one ormore targets.OverviewSome of the components that comprise the AssemblyLine retrieve data from one ormore connected systems—data obtained this way is said to "feed" the AL. Data to beprocessed is fed into the AL one Entry at a time, where these Entries carryAttributes with values coming from directory entries, database rows, e-mails, Lotus Notes documents, records or similar data objects. Each entry carries Attributes thathold the data values read from fields or columns in the source system. TheseAttributes are renamed, reformatted or computed as processing flows from onecomponent to the next in the AL. New information can be "joined" from othersources and all or parts of the transformed data can be written to target stores orsent to target systems as desired. This can be illustrated thus:In this diagram, picture the collection of large jigsaw puzzle pieces as theAssemblyLine, the leftmost blue dots and squares in the grey stream entering frombelow as raw data from an input stream, and the purple bits on the top right asdata output on an output stream. The darker orange element intersecting a jigsawpiece with the bucket in it denotes a Parser, turning raw data into structured data, Copyright IBM Corp. 2003, 20133

which then can start travelling down the AssemblyLine (as lighter-colored elementsin a bucket). The middle jigsaw piece pictures a Connector readingalready-structured data from for example a database.Data enters the AssemblyLine from connected systems using “Connectors” on page6 in some sort of input Mode, and is output later to one or more connected systemsusing Connectors in some output Mode.Data can either be read from record-oriented systems like a database or a messagequeue: in this case the various columns in the input are readily mapped intoAttributes in the resulting work Entry, which is depicted as a "bucket" in thepuzzle piece on the left. Or, data can be read from a data stream, like a text file ina filesystem, a network connection, and so forth. In this case, a Parser can beprefixed to the Connector, in order to make sense of the input stream, and cut itup into pieces after which it can be assigned to Attributes in the work Entry.Once the first Connector has done its work, the bucket of information (the "workEntry", called, appropriately, work) is passed along the AssemblyLine to the nextComponent—in the illustration, another Connector. Since the data from the firstConnector is available, it can now be used as key information to retrieve, orlookup data in the second connected system. Once the relevant data is found, itcan be merged into work, complementing the data that is still around from the firstConnector.Finally, the merged data is passed along the AssemblyLine to the third puzzlepiece or Connector this time in some output Mode, which takes care of outputtingthe data to the connected system. If the connected system is record-oriented thevarious Attributes in work are just mapped to columns in the record; if theconnected system is stream-oriented, a Parser can do the necessary formatting.Other components, like “Script Components” on page 23 and “Functions” on page23, can be inserted at will in the AssemblyLine to perform operations on the datain work.It is important to keep in mind that the AssemblyLine is designed and optimizedfor working with one item at a time. However, if you want to do multiple updatesor multiple deletes (for example, processing more than a single item at the time)then you must write AssemblyLine scripts to do this. If necessary, this kind ofprocessing can be implemented using JavaScript, Java libraries and standard IBMSecurity Directory Integrator functionality, such as pooling the data to a sorteddata store, for example with the JDBC Connector, and then reading it back andprocessing it with a second AssemblyLine.AssemblyLines are built, configured and tested using the IBM Security DirectoryIntegrator Config Editor (CE), see Chapter 4, “The Configuration Editor,” on page77 for more information. The AssemblyLine has a Data Flow tab in the ConfigEditor. This is where the list of components that make up this AL are kept.All components in an AL are automatically registered as script variables. So if youhave a Connector called ReadHRdump then you can access it and its methodsdirectly from script using the ReadHRdump variable. As a result, you will want toname your AL components as you would script variables: Use alphanumericcharacters only, do not start the name with a number, and do not use specialnational characters (for example, å, ä), separators (apart from underscore ' '), whitespace, and so forth.4IBM Security Directory Integrator: Users Guide

There is always an alternative method for accessing an AL component (forexample, the task.getConnector() function) but a conscious naming convention isalways advisable.Starting an AssemblyLine in IBM Security Directory Integrator is a fairly costlyoperation, as it involves

resources. It is assumed that you have practical experience with installation and usage of both IBM Security Directory Integrator and IBM Security Directory Server. The information is also intended for users who are responsible for the development, installation, and administration of solutions by usingIBM Security Directory Integrator.