Release notes - IBM® Tivoli® Identity Manager SAP NetWeaver Adapter 5.1.16

 Add the following information to Chapter 4. Configuring the Adapter for SAP NetWeaver, section “Adapter attributes and object classes” of the install guide under “Supported account attributes”.

Tivoli Identity Manager Name	Attribute Name	Description	Data Type
Set Password as Productive	ersapnwprodpwdflag	This send only flag will change the Initial password to Productive password. Ref “Special Attribute” section for more details.	True or False

 

Add the following information to Chapter 4. Configuring the Adapter for SAP NetWeaver, section “Special Attributes” of the install guide after details of “CUA License Data”.

 

Set Password as Productive

 

The "Set Password as Productive" attribute is supported by both Add and Modify operation. Select this attribute to make the existing password Productive (Permanent) else the password would be Initial (Temporary). Since, this attribute is available in account form; to select between productive and initial password during Password change operation, a Modify operation need to be perform prior to Password change operation to change the above flag.

Note: This is a send only attribute; the value of the flag won’t be stored in ITIM/ISIM.

 

RFE: 29172 (16477) Additional provisioning attributes in SAP Adapters (Full Name)

 Add the following information to Chapter 4. Configuring the Adapter for SAP NetWeaver, section “Adapter attributes and object classes” of the install guide under “Supported account attributes”.

Tivoli Identity Manager Name	Attribute Name	Description	Data Type
Full Name	ersapnwfullname	Full Name. Ref “Special Attribute” section for more details.	String

 

Add the following information to Chapter 4. Configuring the Adapter for SAP NetWeaver, section “Special Attributes” of the install guide after details of “Set Password as Productive”.

 

Full Name

 

Pass the full name of the user to this attribute. Full name will get reflected in NW against FORMAT attribute (in SU01), for any value string passed except blank spaces. If blank space or no value will be passed then FORMAT attribute (in SU01) will have the value as combination of First name and Last Name available in NW account.

 

RFE: 41916 (24746) SAP NW adapter 6.0.14 supports Type B (Load balancing) connection:

1.     Add the following information to Chapter 3. SAP NetWeaver Adapter installation, section “Creating an SAP NetWeaver Adapter service” of the install guide under “Optional RFC Connection Parameters” service form attribute under “SAP CONNECTION DETAILS TAB”

SAP NW adapter 5.1.14 supports Type B (Load balancing) connection:

The mandatory attribute for Type B connection are client, user, passwd, lang, type, mshost, r3name and group.

In order to establish Type B (Load Balancing) connection; add the following value under “Optional RFC Connection Parameters?”

 

Type=B|mshost=<Message Server Name>|r3name=<SYSTEM ID>|group=<Name of SAP application server group>

 

For example,

Suppose message server name is SAPPR0 with systemID as PR0 and group SPACE, then add the following to “Optional RFC Connection Parameters?” attribute.

type=B|mshost=SAPPR0|r3name=PR0|group=SPACE

 

Note: As per the dispatcher behavior, dispatcher should be restarted for each change in ““Optional RFC Connection Parameters?” field.

Note: To establish Type B connection, enable RFC Load balancing in SAP system

 

2.     Change the following information in Chapter 3. Installing the Adapter for SAP NetWeaver, section "Creating an Adapter for SAP NetWeaver service" of the install guide, under “SAP CONNECTION DETAILS TAB”, the below mentioned attribute should be replaced with-

 

SAP Logon Language

 

The language ISO identifier needs to be used by the adapter. This is mandatory, if no value is supplied for Optional RFC Connection Parameters.

 

            Enabling JCO Trace

 

Add the following information to Chapter 3. SAP NetWeaver Adapter installation, section “Installation procedure” to the install guide under Installing the SAP Java Connector (JCo)

 

Steps to Enable JCo Trace:

 

            In order to enable JCo trace, follow these below steps.

1.    Navigate to the Tivoli Directory Integrator adapters solution directory

(ITDI_HOME\timsol).

2.     Open  ibmdiservice.props  file in an editor.

 

3.     Edit the following property

·              For Windows operating systems

jvmcmdoptions=-Djco.trace_level=10 -Djco.trace_path=E:\jco_trace\ -Djco.rfc=1

 

Where

-Djco.trace_level=N (where 0 = N = 10 with 10 = most detailed trace)

-Djco.trace_path=<PATH>

 

If a trace path is set the JCo traces will be written to one or multiple files named JCO<date>_<time>.<no>.trc in the specified PATH directory. Otherwise the JCo traces will be written to the standard output stream (default is an output to the console).

Note: Directory jco_trace should be available.

 

   -Djco.jrfc=1.

 

Please note that in this case all connections will be traced, hence this should be only the last resort.

 

·         For UNIX or Linux operating systems

-Djco.trace_level=10 -Djco.trace_path=/opt/jco_trace/ -Djco.rfc=1

 

      Where:

-Djco.trace_level=N

The trace level can either be 0 or 10, where 10 being the most detailed trace.

 

-Djco.trace_path=<PATH>

If a trace path is set, the JCo traces are written to one or multiple files that are named JCO<date>_<time>.<no>.trc in the specified PATH directory. Otherwise, the JCo traces are written to the standard output stream, where, by default is an output to the console.

 

      Note: The jco_trace directory must be available.

 

-Djco.jrfc=1

 

If set to 1, JCo trace is enabled for all connections. This configuration should be the last resort.

 

      For example:

"%TDI_JAVA_PROGRAM%" -Xdebug -Xnoagent -Djava.compiler=NONE -Djco.trace_level=10

-Djco.trace_path=/opt/jco_trace/ -Djco.rfc=1 -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5555 -classpath

"%TDI_HOME_DIR%\IDILoader.jar" %ENV_VARIABLES% com.ibm.di.loader.ServerLauncher %* set RC=%ERRORLEVEL%

 

 

4.     Save your changes.

5.     Restart the RMI dispatcher service.

      

IV44432: Changed the optional RFC parameter delimiter from space to "|" to support spaces in cert DN etc

 

Reference: Page number 18, Optional RFC Connection Parameters paragraph is replaced with-

 

Optional RFC Connection Parameters

 

This attribute allows for alternative SAP connectivity parameters to be specified. The value of this is a formatted string of name value pairs. Each pair must be separated by a single pipe "|" character. The name parts must be in lower case characters. The general format of the value of this attribute is as follows:

 

<name 1>=<value 1>  <name 2=value 2> ... <name N>=<value N>

 

For example the following string value would set the SAP Message Server to messageserver.com with System ID PR0 and Group SPACE:mshost=messageserver.com|r3name=PR0|group=SPACE

              

 

INT89710: User modify removed all ersapgroup values.

 

Reference: Page number 24, Under MODIFY ADVANCED MAPPING TAB,below mentioned paragraphs are replaced with-

 

Modify User Basic Lookup Request Stylesheet

 

This is a single-valued attribute. The value is the file name of an XSL transformation that will produce an RFC request. The RFC request will be executed by the adapter to determine if the account to be modified is present.If a value is supplied, the transformation will be executed regardless of the CUA status of target SAP system.
If CUA is used then following additional XSL mappings are required:

xsl/sbu_getdetail_precall.xsl xsl/sbu_locactgroups_read_precall.xsl

The value is the name of the XSL file deployed with the adapter relative to the RMI Dispatcher solution directory.
If no value is supplied, the adapter will execute the following XSL transformation and resulting RFC call:

xsl/sapnw_bapi_user_getdetail_precall.xsl

 

Modify User Basic Lookup Response Stylesheet

 

This is a single-valued attribute. The value is the file name of an XSL transformation that will process the SAP response from the RFC call executed based on the setting of Modify User Lookup Request Stylesheet above. If a value is supplied, the transformation will be executed regardless of the CUA status of target SAP system.
If CUA is used then following additional XSL mappings are required:

xsl/sbu_getdetail_postcall.xsl xsl/sbu_locactgroups_read_postcall.xsl

The value is the name of XSL file deployed with the adapter relative to the RMI Dispatcher solution directory. If no value is supplied, the adapter will execute the following XSL transformation and resulting RFC call:

xsl/sapnw_bapi_user_getdetail_postcall.xsl

 

 

SAP GRC installs guide corrections:

The following corrections to install guide apply to this release 

34287 (19692)- Need the capability to encrypt the passwords in SAPNotify.props file for SAP NetWeaver Adapter

Add the following information to Chapter 4. Installing and configuring SAP Governance, Risk and Compliance workflow extensions:

Section “Installing and configuring the notification component for SAP GRC AC 5.3” of the install guide between 7th and 8th step of “Install the workflow notification component for SAP GRC AC 5.3:”

&

Section “Installing and configuring the notification component for SAP GRC AC 10.0” of the install guide between 7th and 8th step of “Install the SAP GRC AC 10.0 workflow notification component:”.

Steps to encrypt the passwords in SAPNotify.props file:

The values of properties in SAPNotify.props files are in clear text format. To make it more secure, the passwords in this file can be encrypted.

Prepend “{protect}” to property name in the file, as below.

{protect}<Property Name>=<Property Value>

For example:

{protect}GRCPassword=Passw0rd

 

After running the notifier, the property value in the SAPNotifier.props file will change as below.

{protect}<Property Name>={encr}<Encrypted Property Value>

 

For example:

{protect}GRCPassword={encr}VsBnPSfYoqpSUidp1v36FkxlPvOSCGxfgvpD

 

To change the property value of a property, delete the encrypted string along with “{encr}” and write the new property value in clear text format after “=”.

 

INT 10333,756,000: New attribute “Disable SYS line” is added on service form

Add the following information to Chapter 3. Installing the Integration for SAP Governance, Risk and Compliance Access Control, section “Creating a SAP NetWeaver GRC service” of the install guide before the “GRC Version” service form attribute under “SAP GRC SERVICE ATTRIBUTES TAB”.

Disable SYS line

Select this check box if you don’t want the system line in assignment list at approval screen of GRC or vice versa.

 

Installation

HR Linking Extension ABAP Transports

 

               HR Linking is no longer supported. Because, SAP has stopped providing access for the view to related BAPI module.

Password Management Extension ABAP Transports

 

The extension has been designed propagate the password change from CUA master to CUA child systems. Being based on standard SAP functions, all constraints and limitations of the SAP
implementation and design are inherited by the adapter. Review the profile parameters for logon and password of your SAP ABAP server to ensure they match and support the password handling expectations of your IdM deployment requirements. Please refer to the following SAP notes for details: 862937, 1301479, 376856, 830493, 991968, 1287410, 1300104. In particular, review the SNC requirement in Note 1287410. In addition, refer to "Known Limitations" for limitations around productive passwords.

The only advanced mapping required for the password extension is for "Change Password Advanced Mapping".  The mapping
is required for CUA deployment only, not standalone ABAP server.  For CUA deployments, the following advanced mapping should
be configured on the adapter service for in your ITIM server:

Change Password Basic XSL Stylesheets (Multi-valued) : xsl/sapnw_bapi_user_change.xsl xsl/sapnw_tivsecty_distribute_pwd.xsl.

The transport files are contained within the transports/password directory of the adapter distribution.

 

The transport files must be deployed onto the target SAP ABAP systems as follows in the order specified:

·         On the CUA master system:

 

                      GC2K900033 {cofiles = K900033.GC2, data = R900033.GC2}

  

NB: Warnings related to ABAP Dictionary Activation can be ignored.

 

Account Locking Extension - ABAP Transports

 

The transport files must be deployed onto the target SAP ABAP systems as follows in the order specified:

 

·         On all standalone and CUA master and child member systems:

 

                       Unicode SAP Systems - TV1K900783 {cofiles = K900783.TV1, data = R900783.TV1}

 

                       Non-Unicode SAP Systems - TV2K900313 {cofiles = K900313.TV2, data = R900313.TV2}

 

NB: Warnings related to ABAP Dictionary Activation can be ignored.

  

Configuration Notes

RFE: 43484 (25795): Executing multiple BAPI modules with State-full connection

 

By default the JCo 3.x connection between SAP R3 and ISIM is not state-full. The state-ful connection is also required in case of transactional BAPI(s). To make the connection state-ful between BAPI(s) method execution, add the following tags to the XSL files as per your requirement.

 

To begin a state-full connection, add this tag to your XSL  -           <CONTEXT_BEGIN> & </CONTEXT_BEGIN> or <CONTEXT_BEGIN/>

To end a state-full connection, add this tag to your XSL     -           <CONTEXT_END> & </CONTEXT_END> or <CONTEXT_END/>                  

 

Note: It is not necessary to have both <CONTEXT_BEGIN/> and <CONTEXT_END/> in the same XSL. Nested <CONTEXT_BEGIN/> and <CONTEXT_END/> can also be implemented, provided the tags are nested correctly, else unexpected result may appear. State-full connection started by each <CONTEXT_BEGIN/> gets ended by its associated <CONTEXT_END/> tag. If any <CONTEXT_BEGIN/> tag do not have its associated <CONTEXT_END/> tag, then the state-full connection will get terminated at the end of JCo connection.

 

For example:

 

In sapnw_bapi_charact_create.xsl

 

<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform"       

    version="1.0"                                                      

    xmlns:xalan="http://xml.apache.org/xslt">

…..

…..

<BAPI_CHARACT_CREATE>

<CONTEXT_BEGIN/>

…..

…..

</BAPI_CHARACT_CREATE>

…..

…..

</xsl:stylesheet>

 

In sapnw_bapi_transaction_commit.xsl

 

<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform"       

    version="1.0"                                                      

    xmlns:xalan="http://xml.apache.org/xslt">

…..

…..

<BAPI_TRANSACTION_COMMIT>

…..

…..

<CONTEXT_END/>

</BAPI_TRANSACTION_COMMIT>

…..

…..

</xsl:stylesheet>

 

SAP GRC AC 10.0 Priority Customization

SAP GRC AC 10.0 allows priority codes and names to be customized. In the event that the priority codes in SAP GRC AC 10.0 are different from the defaults supported by the adapter (i.e. 006=HIGH, 007=LOW, 008=MEDIUM) or the list of priority names has been extended, then the ersapgrcpriority element on the IBM Tivoli Identity Manager Adapter for SAP NetWeaver account form must be edited to match the configured priorities. Refer to the Form customization section on the IBM Tivoli Identity Manager Information Center for further information.

 

Productive Password Support

 

SAP recently introduced the support for productive password change over the standard BAPI. In order to allow the adapter to set productive passwords, the following prerequisites must be satisfied:

 

·         SAP AS ABAP uses SAP Cryptographic Library as its security provider for SNC.

·         SAP AS ABAP has been configured to use Secure Network Communication (SNC) for RFC communications.

·         SAP user account used by the adapter to communicate with SAP AS ABAP has the authorization for object S_USER_GRP with activity 'PP'.

·         The adapter is configured to use SNC for its communication with SAP AS ABAP. Please refer to "Securing the Adapter to SAP AS ABAP Communication" section for more detail.

For more detail, please refer to SAP Note 1287410.

 

 

Securing the Adapter to SAP AS ABAP Communication

 

 

This section provides instructions for securing the communication between the adapter and SAP AS ABAP using Secure Network Communication (SNC).

 

The following instructions are based on the SAP documentation and have been verified against the following versions of SAP.

 

SAP Release     Software           Support Package
Version              Component

700                   SAP_BASIS      SAPKB70019

710                   SAP_BASIS      SAPKB71010

730                   SAP_BASIS      SAPKB73000

 

SAP reserves right to change the required configuration for subsequent versions and patches so it is recommended to review the corresponding SAP documentation for SNC, SAP Cryptographic Library and productive password support in conjunction with the instructions provided below.

 

 

Installing SAP Cryptographic Library:

 

1.     Download the SAP Cryptographic Library from the SAP Service Marketplace and extract it to a temporary directory.

2.     Copy the library and the command line tool to a local directory on the system hosting the adapter. For example,

 

Windows:

 

            C:\usr\sap\sapcrypto.dll

            C:\usr\sap\sapgenpse.exe

 

            Unix:

 

            /usr/sap/libsapcrypto.so

            /usr/sap/sapgenpse

 

3.     Copy the license ticket (ticket) to a subdirectory "sec". For example,

 

            Windows:

 

            C:\usr\sap\sec\ticket

 

            Unix:

 

            /usr/sap/sec/ticket

 

4.     For the user that runs the adapter, set the environment variable SECUDIR to this directory. For example,

 

            Windows:

 

            SECUDIR=C:\usr\sap\sec

 

            Unix:

 

            SECUDIR=/usr/sap/sec

 

            If the user is the SYSTEM user, set SECUDIR as a system variable.

 

5.     Restart the adapter (RMI dispatcher service) so the new environment variable is accessible by the adapter.

 

Creating a SNC Person Security Environment (PSE) for the adapter:

 

1.     Start a command line console and change to the directory containing sapgenpse tool.

2.     Create a PSE for the adapter by running the following command:

 

            sapgenpse get_pse [-p <PSE_name>] [-x <PIN>] [DN]

 

            where:

           

            -p <PSE_name>: Path and file name for the adapter's PSE

            -x <PIN>: PIN that protects the PSE

            DN: Distinguished Name for the adapter. The Distinguished Name is used to build the adapter's SNC name. The Distinguished Name consists of the following elements:

 

CN = <Common_Name>

OU = <Organizational_Unit>

O = <Organization>

C = <Country>

 

            For example,

           

            sapgenpse get_pse -p adapter.pse -x passw0rd "CN=adapter,OU=IdM,O=IBM,C=US"

 

3.     Use the following command to open the adapter's PSE and create credentials:

 

            sapgenpse seclogin [-p <PSE_name>] [-x <PIN>] [-O [<NT_Domain>\]<user_ID>]

 

            where:

 

            -p <PSE_name>: Path and file name for the adapter's PSE

            -x <PIN>: PIN that protects the PSE

            -O [<NT_Domain>]\<user_ID> User for which the credentials are created. (The user that runs the adapter service.). If omitted the current user.

           

            For example,

 

            sapgenpse seclogin -p adapter.pse -x passw0rd -O SYSTEM

 

Importing the adapter's public certificate into SAP AS ABAP's PSE:

 

1.     Export the adapter's public certificate by running the following command:

 

            sapgenpse export_own_cert -o <output_file> -p <PSE_name> [-x <PIN>]

           

            where:

 

            -o <output_file>: Path and file name for the exported certificate

            -p <PSE_name>: Path and file name for the adapter's PSE

            -x <PIN>: PIN that protects the PSE

 

            For example,

 

            sapgenpse export_own_cert -o adapter.crt -p adapter.pse -x passw0rd

 

 

2.     Start Trust Manager from SAP GUI  (transaction STRUST).

3.     Select SAP AS ABAP's SNC PSE under SNC SAPCryptolib folder with a double-click.

4.     Enter the PIN when prompted to do so.

5.     Choose Certificate -> Import from the menu.

6.     Enter the path and file name of the adapter's public certificate.

7.     Select the Base64 format, and choose Enter. The certificate appears in the Certificate section of Trust Manager’s screen.

8.     Click on Add to Certificate List button to add the certificate to the SAP AS ABAP’s SNC PSE.

9.     Save the data.

 

Note: For securing Multiple SAP systems with Single SNC certificate. Repeat step 2 to step 9 for each SAP systems. Use the same certificate from step 1 while uploading to different SAP systems

 

Importing SAP AS ABAP's public certificate into the adapter's PSE:

 

1.     In Trust Manager, select SAP AS ABAP's SNC PSE.

2.     Select the certificate shown in the Owner field with a double-click.

3.     Choose Certificate -> Export from the menu.

4.     Enter the path and file name (User different file name for different SAP systems) where you want to save the file, select the Base64 format and choose Enter.

5.     Copy the exported certificate to the system hosting the adapter.

6.     On the adapter system, run the following command to import the AS ABAP's public certificate into the adapter's PSE:

 

            sapgenpse maintain_pk [-a <cert_file>] -p <PSE_name> [-x <PIN>]

 

            where:

 

            -a <cert_file>: Path and file name of SAP AS ABAP's public certificate

            -p <PSE_name> Path and file name for the adapter's PSE

            -x <PIN> PIN that protects the PSE

 

            For example,

 

            sapgenpse maintain_pk -a sap.crt -p adapter.pse

              

7. Run following command to display all certificates details which were updated in .pse file.

              

               sapgenpse maintain_pk -l -p <PSE_name> [-x <PIN>]

              

            where:

 

            -p <PSE_name> Path and file name for the adapter's PSE

            -x <PIN> PIN that protects the PSE

 

            For example,

 

      sapgenpse maintain_pk -l -p adapter.pse

 

Note: For securing Multiple SAP systems with Single SNC certificate. Repeat step 1 to 6 for each SAP systems. Run step 6 for each crt files which were exported from different SAP systems to update the crt file entry to existing pse file

 

Allowing the adapter's user account to connect to SAP AS ABAP using SNC:

 

1.     Start Table Maintenance from SAP GUI (transaction SM30)

2.     Maintain the table USRACLEXT.

3.     Choose New Entries.

4.     Enter the following data in the corresponding fields:

 

            User: User that the adapter uses to connect to SAP AS ABAP.

            Sequence Number: Enter "000" unless the user has more than one SNC name.

            SNC Name: DN associated with the adapter's PSE, e.g. "p: CN=adapter,OU=IdM,O=IBM,C=US"

 

5.     Save the data.

 

Note: For securing Multiple SAP systems with Single SNC certificate. Repeat step 1 to 5 for each SAP systems. 

 

Setting Optional RFC Connection Parameters for the Adapter:

 

 

In order for the adapter to use SNC for communicating with SAP AS ABAP, the following parameters must be added to "Optional RFC Connection Parameters" field in the service form:

 

snc_mode=1 snc_partnername=<as_abap_snc_name> snc_qop=3 snc_myname=<adapter_snc_name> snc_lib=<path_to_snc_lib>

 

where

 

snc_mode: SNC activation indicator. 0 = SNC disabled, 1= SNC activated.

 

snc_partnername: SNC name of the communication partner (SAP AS ABAP)

 

snc_qop: Quality of protection level. 1 = Secure authentication only, 2 = Data integrity protection, 3 = Data privacy protection, 9 = Use the value from "snc/data_protection/max"

 

snc_myname: adapter's SNC name

 

snc_lib: Path and file name of the SAP Cryptographic Library

 

For example,

 

snc_mode=1 snc_partnername=p:CN=GC8,OU=IdM,O=IBM,C=US snc_qop=3 snc_myname=p:CN=adapter,OU=IdM,O=IBM,C=US snc_lib=C:/usr/sap/sapcrypto.dll

 

Note: For securing Multiple SAP systems with Single SNC certificate. Pass same path value in “snc_lib=” for in service forms of all the SAP systems

 

These parameters directly correspond to SAP JCO properties for SNC except they do not have "jco.client." prefix. The adapter automatically prepends the string " jco.client." prior to passing these parameters to SAP JCO.

 

 

For more information about the SNC parameters, see http://help.sap.com/saphelp_nw70/helpdata/en/d9/e8a740bbaa4d8f8bee6f7b173bd99f/frameset.htm in the SAP Help Portal.

 

Verification steps for SNC setup:

 

1.     Verify if, below files are present in respective folders of client system, which is having TDI running on it.

a.     \usr\sap

                                                  i.    sapcrypto.dll

                                                 ii.    sapgenpse.exe

                                                iii.    local certificate

                                                iv.    Server certificate

b.     \usr\sap\sec

                                                  i.    adapter.pse

                                                 ii.    cred_v2

                                                iii.    ticket

 

2.     Make sure that all the files used from SAP cryptolibrary packages are unused.

3.     The sapcrypto.dll must be a valid win32 file.

4.     Verify the correctness of certificate entry in  sapgenpse file using below command.

                

                 sapgenpse maintain_pk -l -p <PSE_name> [-x <PIN>]

 

5.     The entry to USRACLEXT (table) in SM30 (t-code)

a.     Must starts with “p:”.

b.     Must contains, the details of local certificate.

c.     Must not have any space after period “,”.

d.     Canonical name must be determined.

 

6.     Make sure that, while downloading the server certificate, server certificate name has been selected in STRUST (t-code).

7.     Each parameters in “Optional RFC parameter”

a.     Must be separated using pipe “|”.

b.     Must not have any space after period “,”.

 

 

SAP NW Recon operation performance improvement

 

In order to improve the performance for SAP NW recon operation, try the following JAVA settings

 

1. Look for jaxp.properties in JAVA_Home/lib directory.

Initially it was jaxp.properties.sample. Need to rename it as jaxp.properties and uncomment the following property in jaxp.properties file.

 

        javax.xml.transform.TransformerFactory=com.ibm.xtq.xslt.jaxp.compiler.TransformerFactoryImpl

        javax.xml.xpath.XPathFactory=org.apache.xpath.jaxp.XPathFactoryImpl

        javax.xml.parsers.SAXParserFactory=org.apache.xerces.jaxp.SAXParserFactoryImpl

        javax.xml.parsers.DocumentBuilderFactory=org.apache.xerces.jaxp.DocumentBuilderFactoryImpl

 

 

Check the performance of recon operation.

 

If it doesnot work, then try the second one.

 

2. Set the following system property

export IBM_JAVA_OPTIONS=-Djavax.xml.transform.TransformerFactory=

                             org.apache.xalan.processor.TransformerFactoryImpl

 

Check the performance of the recon operation.

 

For more details about the above settings, refer the following sites

 

http://xalan.apache.org/xalan-j/usagepatterns.html

http://www-03.ibm.com/systems/z/os/zos/tools/xml/perform/performjava.html

http://publib.boulder.ibm.com/infocenter/javasdk/v1r4m2/index.jsp?topic=%2Fcom.ibm.java.doc.user.aix64.142%2Fhtml%2Fsdkguide.aix64.htm

 

 Customizing or Extending Adapter Features

The Identity Manager adapters can be customized and/or extended. The type and method of this customization may vary from adapter to adapter.

Getting Started

Customizing and extending adapters requires a number of additional skills. The developer must be familiar with the following concepts and skills prior to beginning the modifications:

·         IBM Tivoli Identity Manager administration

·         Tivoli Directory Integrator management

·         Tivoli Directory Integrations assemblyline development

·         LDAP schema management

·         Working knowledge of Java scripting language

·         Working knowledge of LDAP object classes and attributes

·         Working knowledge of XML document structure

Note: If the customization requires a new Tivoli Directory Integrator connector, the developer must also be familiar with Tivoli Directory Integrator connector development and working knowledge of Java programming language.

IBM Tivoli Identity Manager Resources:

            Check the "Training" section of the IBM Tivoli Identity Manager Support web site for links to training, publications, and demos.

Tivoli Directory Integrator Resources:

            Check the "Training" section of the Tivoli Directory Integrator Support web site for links to training, publications, and demos.

Support for Customized Adapters

The integration to the Identity Manager server "the adapter framework" is supported. However, IBM does not support the customizations, scripts, or other modifications. If you experience a problem with a customized adapter, IBM Support may require the problem to be demonstrated on the GA version of the adapter before a PMR is opened.

 

Supported Configurations

Installation Platform

The IBM Tivoli Identity Manager Adapter was built and tested on the following product versions.

Adapter Installation Platform: 

·         Tivoli Directory Integrator 7.0 with Fix Pack 6 (only non-Aix platforms)

·         Tivoli Directory Integrator 7.1 with Fix Pack 5 or higher (non-Aix platforms)

·         IBM Tivoli Directory Integrator v7.1 with Fix Pack 5 or higher (Aix platforms) - supported with the following tech note update: http://www-01.ibm.com/support/docview.wss?uid=swg21578565

·         Tivoli Directory Integrator 7.1.1 with Fix Pack 2 or higher

Managed Resource:

The following SAP ABAP Basis versions running anywhere on the network are supported

·         SAP 700 (NetWeaver 2004s)

·         SAP 710

·         SAP 730 (see the "Limitations on support for SAP Productive Passwords" topic in the "Known Issues" section of this document for important functional restrictions)

·         SAP 740

The adapter supports SAP CUA environments. If CUA is configured the adapter must be deployed against the central CUA master system.

Refer to section "Multi Byte Character Support Limitations" above regarding unicode support limitations.

SAP PATCHES:

The following minimum patch levels, by SAP release version, are required

SAP Release         SoftwareComponent                          Support Package

700                               SAP_BASIS                                  SAPKB70026

701                               SAP_BASIS                                  SAPKB70111

702                               SAP_BASIS                                  SAPKB70210

710                               SAP_BASIS                                  SAPKB71014

730                               SAP_BASIS                                  SAPKB73007

731                               SAP_BASIS                                  SAPKB73102

 

Specifically, the SAP system must be patched with corrections from SAP notes 992375, 994415, 1101858, 1636845.

 IBM Tivoli Identity Manager:

·         Identity Manager v5.1

 

Notices

This information was developed for products and services offered in the U.S.A. IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-IBM product, program, or service.

IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not give you any license to these patents. You can send license inquiries, in writing, to:

IBM Director of Licensing

IBM Corporation

North Castle Drive

Armonk, NY  10504-1785  U.S.A.

For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to:

IBM World Trade Asia Corporation

Licensing

2-31 Roppongi 3-chome, Minato-ku

Tokyo 106-0032, Japan

The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you.

This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice.

Any references in this information to non-IBM Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk.

IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged should contact:

IBM Corporation

2ZA4/101

11400 Burnet Road

Austin, TX 78758  U.S.A.

Such information may be available, subject to appropriate terms and conditions, including in some cases, payment of a fee.

The licensed program described in this information and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement, or any equivalent agreement between us.

Any performance data contained herein was determined in a controlled environment. Therefore, the results obtained in other operating environments may vary significantly. Some measurements may have been made on development-level systems and there is no guarantee that these measurements will be the same on generally available systems. Furthermore, some measurements may have been estimated through extrapolation. Actual results may vary. Users of this document should verify the applicable data for their specific environment.

Information concerning non-IBM products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-IBM products. Questions on the capabilities of non-IBM products should be addressed to the suppliers of those products.

Trademarks

The following terms are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both: IBM, IBM logo, AIX, DB2, Domino, Lotus, Tivoli, Tivoli logo, Universal Database, WebSphere, i5/OS, RACF.

Adobe, Acrobat, Portable Document Format (PDF), and PostScript are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States, other countries, or both.

Cell Broadband Engine and Cell/B.E. are trademarks of Sony Computer Entertainment, Inc., in the United States, other countries, or both and is used under license therefrom.

Java and all Java-based trademarks are trademarks of Sun Microsystems, Inc. in the United States, other countries, or both.

Microsoft, Windows, Windows NT®, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both.

Intel®, Intel logo, Intel Inside®, Intel Inside logo, Intel Centrino™, Intel Centrino logo, Celeron®, Intel Xeon™, Intel SpeedStep®, Itanium®, and Pentium® are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries.

UNIX is a registered trademark of The Open Group in the United States and other countries.

Linux is a trademark of Linus Torvalds in the U.S., other countries, or both.

ITIL® is a registered trademark, and a registered community trademark of the Office of Government Commerce, and is registered in the U.S. Patent and Trademark Office.

IT Infrastructure Library® is a registered trademark of the Central Computer and Telecommunications Agency which is now part of the Office of Government Commerce.

Other company, product, and service names may be trademarks or service marks of others.