IBM Security Privileged Identity Manager: PeopleTools Adapter .

Software downloadsDownload the software through your account at the IBM Passport Advantage website.Go to IBM Passport Advantage.See the corresponding IBM Security Identity server Download Document forinstructions.Note:You can also obtain additional adapter information from IBM Support.Installation worksheetThe installation worksheet lists the information that is required to install andconfigure the adapter. Complete this worksheet before you start the installationprocedure for ease of reference. Make a copy of the worksheet for each adapterinstance you install.Table 2. Required information to install the adapterRequired information DescriptionTivoli DirectoryIntegrator HomeDirectoryValueThe ITDI HOME directory containsWindows:the jars/connectors subdirectory that v for version 7.1:contains files for the adapters. Fordrive\Programexample, the jars/connectorsFiles\IBM\TDI\V7.1subdirectory contains the files for theUNIX adapter.UNIX:v for version 7.1:/opt/IBM/TDI/V7.1Solution DirectorySee the Dispatcher Installation andConfiguration Guide.Windows:v for version 7.1:drive\ProgramFiles\IBM\TDI\V7.1\timsolUNIX:v for version 7.1:/opt/IBM/TDI/V7.1/timsol8IBM Security Privileged Identity Manager: PeopleTools Adapter Installation and Configuration Guide

Chapter 3. InstallingInstalling the adapter mainly involves importing the adapter profile and creatingan adapter service. Depending on the adapter, several other tasks can be involvedto completely install it.All IBM Tivoli Directory Integrator based adapters require the Dispatcher for theadapters to function correctly. If the Dispatcher is installed from a previousinstallation, do not reinstall it unless the Dispatcher is upgraded. See Installing thedispatcher.Depending on your adapter, the Tivoli Directory Integrator connector mightalready be installed as part of the Tivoli Directory Integrator product and nofurther action is required. If the connector is not pre-installed, install it after theDispatcher.Installing the dispatcherIf this is the first Tivoli Directory Integrator-based adapter installation, you mustinstall the RMI Dispatcher before you install the adapter. Install the RMIDispatcher on the same Tivoli Directory Integrator server where you want to installthe adapter.If you already installed the RMI Dispatcher for another adapter, you do not needto reinstall it.If you have not yet installed the RMI Dispatcher in the Tivoli Directory Integratorenvironment, download the Dispatcher installer from the IBM Passport Advantagewebsite. For more information about the installation, see the Dispatcher Installationand Configuration Guide.Installing the adapter binaries or connectorThe connector might or might not be available with the base Tivoli DirectoryIntegrator or Security Directory Integrator product. The connector is required toestablish communication between the adapter and the Dispatcher.Before you beginv The Dispatcher must be installed.Procedure1. Create a temporary directory on the workstation where you want to install theadapter.2. Extract the contents of the compressed file in the temporary directory.3. Copy the PeopleSoftConnector.jar file from the adapter package to theITDI HOME/jars/connectors directory.4. Restart the adapter service.9

What to do nextAfter you finish the installing the adapter software, modify the PRG USR Profilerecord. See “Modifying the PRG USR PROFILE record”Modifying the PRG USR PROFILE recordUse the PeopleSoft Application Designer to modify PRG USER PROFILE record.Procedure1. Log in to the PeopleTools Application Designer by using the PeopleToolsaccount of the adapter.2. From the File menu, click Open. The Open Definition dialog window isdisplayed.3. Select Record from the Definition drop-down listbox.4. Type PRG in the Name field and click Open. A list of matching records isdisplayed in the Definitions matching selection criteria pane.5. Select PRG USR PROFILE and click the Open. The record is opened in theApplication Designer.6. From within the Record Fields tabbed pane, right-click the OPRID table entryand click View PeopleCode from the right-click menu. The PeopleCodewindow opens.7. Select SaveEdit from the PeopleCode Event drop-down listbox. The followingPeopleCode is displayed in the PeopleCode edit pane.If %OperatorId PRG USR PROFILE.OPRID ThenIf %Panel Panel.PURGE USR PROFILE ThenWarning MsgGet(48, 122, "Select OK to confirm deletion of User Profile orselect Cancel.")End-If;ElseError MsgGet(48, 109, "Message not found.");End-If;8. Replace the existing PeopleCode with the following code.If %OperatorId PRG USR PROFILE.OPRID ThenIf %CompIntfcName "ENROLE DELETE" ThenIf %Panel Panel.PURGE USR PROFILE ThenWarning MsgGet(48, 122, "Select OK to confirm deletion of User Profile orselect Cancel.")End-If;End-IfElseError MsgGet(48, 109, "Message not found.");End-If;9. From the File menu, click Save to save the record.What to do nextLoad the PeopleTools Project for IBM Security Privileged Identity Manager. See“Loading the PeopleTools Project.”Loading the PeopleTools ProjectThe adapter software provides a compressed file that contains the PeopleToolsproject file. This file provides component interfaces that must be imported into thePeopleTools Application Designer.10IBM Security Privileged Identity Manager: PeopleTools Adapter Installation and Configuration Guide

About this taskThe PeopleTools Adapter software contains component interfaces in theENROLE AGENT subdirectory of these project files:v PT854 COMPONENT.zip for PeopleTools 8.54v PT850 COMPONENT.zip for PeopleTools 8.50, PeopleTools 8.51, and PeopleTools8.52, PeopleTools 8.53This ENROLE AGENT subdirectory is imported into the PeopleTools ApplicationDesigner as a PeopleTools Project.Loading the IBM Security Privileged Identity Manager PeopleTools project is atwo-part procedure.1. The project must be copied into the PeopleTools system. See “Loading thecomponent interfaces.”2. The project security must be set. The following two sections provide detailedprocedures on how to load the PeopleTools project for IBM Security PrivilegedIdentity Manager. See “Setting the component interface security.”Loading the component interfacesYou must import the ENROLE AGENT directory into the PeopleTools ApplicationDesigner as a PeopleTools Project.Procedure1. From the PT850 COMPONENT.zip file, extract ENROLE AGENT and its contentsinto a temporary directory on your file system.2. Log in to the PeopleTools Application Designer in two-tier mode by using thePeopleTools account of the adapter.a. Click Start Programs Peopletools8.5x Configuration Managerb. Select the appropriate database type (for example, if the PeopleSoft isconfigured with oracle, select ORACLE).c. Specify the server name, database name, and other details for the databasetype, if not already specified.d. Click OK.3. Copy the ENROLE AGENT project.a. Log on to the PeopleTools Application Designer.b. From the Tools menu, select Copy Project and then select From File fromthe submenu. The Copy Project from File dialog window is displayed.c. Browse to the directory where you extracted ENROLE AGENT.ENROLE AGENT is displayed in the Projects: list area.d. Ensure that ENROLE AGENT is highlighted and click Select. TheENROLE AGENT project is loaded. A second dialog window is displayed.e. Ensure that Component Interfaces is highlighted and click Copy. Thecomponent interfaces are loaded into PeopleTools.4. Exit the PeopleTools Application Designer.Setting the component interface securityYou must add components to the permissions list to set security for thePeopleTools project.Chapter 3. Installing11

Procedure1. Log in to the PeopleSoft web interface by using the PeopleTools account of theadapter.2. From the PeopleSoft menu tree, navigate to PeopleTools Security Permissions & Roles Permission Lists.3. Search for the ALLPAGES permission list link. The Permission List componentis displayed.4. Click the Component Interface tab and add the following ComponentInterfaces to the list:ENROLE CCODEENROLE DELETEENROLE LANGSENROLE PERMENROLE ROLESENROLE USERSENROLE OPRALIAS5. Set Full Access for each method of the component interfaces added in theprevious step.6. Save your changes.What to do nextObtain and generate the PeopleSoft resource-specific JAR files. See “PeopleSoftresource-specific JAR files.”PeopleSoft resource-specific JAR filesThe PeopleTools Adapter uses Java APIs to communicate and perform operationssuch as add, delete, modify, and search on the PeopleSoft resource.To use these functions, the PeopleTools Adapter requires the following JAR files:CompIntfc.jarThe Java API JAR file for the ENROLE AGENT Component Interfaceproject.psjoa.jarThis JAR file is created during the PeopleTools installation. The path to thepsjoa.jar file must be set to the ITDI CLASSPATH variable.psft.jarTo create a psft.jar file:1. Go to the workstation where PeopleTools is installed.2. Locate the PSKeyStore.class file that is present in the pshttp folder ofPeopleTools. It is in the web server installation directory. For example:Oracle WebLogic ServicePS HOME\webserv\web classes\psft\pt8\pshttpIBM WebSpherePS HOME\webserv\profile name\installedApps\app name\NodeCell\app p3. Copy the pshttp folder to a temporary folder that contains a psft\pt8folder structure. For example,C:\Temp\psft\pt8\pshttp4. Go to command prompt and locate the temporary folder that containsthe psft/pt8/pshttp folder structure. For example,12IBM Security Privileged Identity Manager: PeopleTools Adapter Installation and Configuration Guide

C:\Temp5. Create the psft.jar file by using the following command on commandprompt.jar -cvf psft.jar psftAfter the command is successfully completed, a psft.jar file is createdon the temp folder.6. On the workstation where IBM Tivoli Directory Integrator is installed,copy the psft.jar file to the folder ITDI HOME\jars\3rdParty\others.JDBC type 4 driver JAR fileThis JAR file is required to establish the connection with the database.Generating the CompIntfc.jar fileYou must create the CompIntfc.jar file from the Component interface JAVA files.The CompIntfc.jar file is the PeopleSoft Component Interface JAR file.About this taskThis file must be generated from the respective PeopleSoft resource and thencopied to the ITDI HOME\jars\3rdParty\others directory on the workstation wherethe adapter is installed.Procedure1. Log on to PeopleSoft Application Designer in two-tier mode.2. Open the ENROLE AGENT Component Interface project and open all thecomponent interfaces by double-clicking each component interface.3. From the menu, select Build PeopleSoft APIs.4. From the Build PeopleSoft API Bindings window, select the Java classes Buildcheck box and clear the COM Type Library and C Header Files Build checkboxes.5. In the Java Classes frame, select the Build check box and select the appropriateComponent Interfaces from the list. You must select the following options fromthe list and then click OK:v CompIntfc.CompIntfcPropertyInfov CompIntfc.CompIntfcPropertyInfoCollectionv PeopleSoft.* (Select all the Component Interfaces that begin with the prefixPeopleSoft)v CompIntfc.ENROLE USERS* (Select all the Component Interfaces that beginwith the prefix CompIntfc.ENROLE USERS)v CompIntfc.ENROLE ROLES* (Select all the Component Interfaces that beginwith the prefix CompIntfc.ENROLE ROLES)v CompIntfc.ENROLE PERM* (Select all the Component Interfaces that beginwith the prefix CompIntfc.ENROLE PERM)v CompIntfc.ENROLE LANGS* (Select all the Component Interfaces that beginwith the prefix CompIntfc.ENROLE LANGS)v CompIntfc.ENROLE DELETE* (Select all the Component Interfaces thatbegin with the prefix CompIntfc.ENROLE DELETE)v CompIntfc.ENROLE CCODE* (Select all the Component Interfaces that beginwith the prefix CompIntfc.ENROLE CCODE)v CompIntfc.ENROLE OPRALIAS* (Select all the Component Interfaces thatbegin with the prefix CompIntfc.ENROLE OPRALIAS)Chapter 3. Installing13

Note: If you must generate Component Interface Java files for the entire groupof Component Interfaces, click ALL.Specify the appropriate file path for the Java files; otherwise, the Java files aregenerated in the default location, PEOPLESOFT HOME\web\psjoa. The ComponentInterface Java files are generated in the PeopleSoft\Generated\CompIntfcdirectory that is created in the specified location. For example, if you specifiede:\enrole as the file path, then the Component Interface Java files aregenerated in the e:\enrole\PeopleSoft\Generated\CompIntfc directory.The following note applies to PeopleTools 8.54.When you generate the CompIntfc.jar, add the psjoa.jar file to theenvironment variable classpath. For example if c:\PT8.54\class\psjoa.jar isthe location, then add C:\PT8.54\class\ to the classpath environment variable.6. Compile the Java files.a. Open the command prompt and go the directory where the generated Javafiles are located. For example,cd e:\enroleb. Go to the PeopleSoft\Generated\CompIntfc\ directory.c. For PeopleTools 8.50, 8.51, 8.52, and 8.53, run the following command.javac -classpath d:\temp\psjoa.jar *.javawhere, d:\temp is a path to the psjoa.jar file.For PeopleTools 8.54, run the following command:javac -classpath people tools install folder INF\classes *.javaFor example:javac -classpath soft\ RTAL.war\WEB-INF\ classes *.javad. Optional: You can delete all the generated Java files except the .class filesfrom the existing directory.7. Package the compiled files as CompIntfc.jar file.a. Open the command prompt and go the directory where the generated Javafiles are located. For example,cd e:\enroleb. Run the following command:jar –cvf CompIntfc.jar *Note: Ensure that the Java compiler that is used for compiling the generatedJava files is compatible with bothv The Java provided with the PeopleSoft managed resourcev The Java provided with Tivoli Directory Integrator8. Copy the generated CompIntfc.jar file to the ITDI HOME\jars\3rdParty\othersdirectory.9. For PeopleTools 8.54, copy the com folder from ORTAL.war\WEB-INF\classes toITDI HOME\jars\3rdparty\others.psjoa.jar fileThis file is created in the PEOPLESOFT HOME\web\psjoa directory during thePeopleTools installation.14IBM Security Privileged Identity Manager: PeopleTools Adapter Installation and Configuration Guide

You must copy the psjoa.jar file from PEOPLESOFT HOME\web\psjoa to theITDI HOME\jars\3rdParty\others directory on the workstation where the adapter isinstalled.JDBC type 4 driver JAR fileBy default, the find method of a PeopleSoft Component Interface is limited to amaximum of 300 entries from PeopleSoft. If more than 300 entries need to beretrieved, the PeopleSoft Connector needs to invoke JDBC queries on thePeopleSoft database tables.The path to the JDBC driver.jar file for the database that is used by PeopleSoft,must be copied to the ITDI HOME\jars\3rdParty\others directory.The PeopleTools Adapter establishes the connection directly with the database if itfinds more than 300 records to be retrieved. The PeopleTools Adapter uses theJDBC Type 4 drivers to retrieve more than 300 records. To establish the connectionto the database you need to specify the appropriate driver class and a URL of thecorrect format.For example:PeopleSoft configured with the DB2 :JDBC Drivers:db2jcc.jardb2jcc javax.jardb2jcc license cu.jarDriver ation:50000/databasePeopleSoft configured with the Microsoft SQL Server 2005:JDBC Drivers:sqljdbc4.jarDriver RLjdbc:sqlserver://workstation name:port;instanceName instance;SelectMethod curson;DatabaseName databaseVerifying the adapter installationIf the adapter is installed correctly, the PeopleSoftConnector.jar file exists in thespecified directory.Windows operating systemdrive:\Program Files\IBM\TDI\V7.1\jars\connectors\UNIX operating system/opt/IBM/TDI/V7.1/jars/connectors/If this installation is to upgrade a connector, then send a request from IBM SecurityPrivileged Identity Manager. Verify that the version number in the ibmdi.logmatches the version of the connector that you installed. The ibmdi.log file is atITDI Home\adapter solution directory\logs.Chapter 3. Installing15

Restarting the adapter serviceVarious installation and configuration tasks might require the adapter to berestarted to apply the changes. For example, you must restart the adapter if thereare changes in the adapter profile, connector, or assembly lines. To restart theadapter, restart the Dispatcher.The adapter does not exist as an independent service or a process. The adapter isadded to the Dispatcher instance, which runs all the adapters that are installed onthe same Security Directory Integrator instance.See the topic about starting, stopping, and restarting the Dispatcher service in theDispatcher Installation and Configuration Guide.Importing the adapter profileAn adapter profile defines the types of resources that the IBM Security Identityserver can manage. It is packaged with the IBM Security Identity Adapter. Use theadapter profile to create an adapter service on IBM Security Identity server andestablish communication with the adapter.Before you beginv The IBM Security Privileged Identity Manager is installed and running.v You have root or administrator authority on the IBM Security Privileged IdentityManager.v The file to be imported must be a Java archive (JAR) file. The Adapter Profile.jar file includes all the files that are required to define theadapter schema, account form, service/target form, and profile properties. Ifnecessary, you can extract the files from the JAR file, modify the files, andrepackage the JAR file with the updated files.The JAR file for IBM SecurityPrivileged Identity Manager is located in the top level folder of the installationpackage.About t

IBM Security Identity server The following servers ar e supported: v IBM Security Identity Manager server V ersion 6.0 v IBM Security Identity Manager server V ersion 7.0 v IBM Security Privileged Identity Manager V ersion 2.0 v IBM Security Identity Governance and Intelligence server V ersion 5.2.2 PeopleSoft Enterprise V ersion 9.0 V ersion 9.1