IBM Security Privileged Identity Manager: Google Apps Adapter .

See the corresponding IBM Security Identity server Download Document forinstructions.Note:You can also obtain additional adapter information from IBM Support.Installation worksheetThe installation worksheet lists the information that is required to install andconfigure the adapter. Complete this worksheet before you start the installationprocedure for ease of reference. Make a copy of the worksheet for each adapterinstance you install.Table 2. Required information to install the adapterRequired information DescriptionValueAdministrator account An administrator account ID andID and passwordpassword on the managed resourcethat has administrative rights forrunning the Google Apps Adapter.Tivoli DirectoryIntegrator HomeDirectoryThe ITDI HOME directory containsthe jars/connectors subdirectory thatcontains adapter JAR files. Forexample, the jars/connectorssubdirectory contains the JAR file forthe UNIX adapter.If Tivoli DirectoryIntegrator is automaticallyinstalled with your IBMSecurity Privileged IdentityManager product, thedefault directory path forTivoli Directory Integratoris as follows:Windows:v for version 7.1:drive\ProgramFiles\IBM\TDI\V7.1UNIX:v for version 7.1:/opt/IBM/TDI/V7.1Adapters solutiondirectoryWhen you install the dispatcher, theinstaller prompts you to specify a filepath for the solution directory. Formore information about the solutiondirectory, see the DispatcherInstallation and Configuration Guide.The default solutiondirectory is at:Windows:v for version 7.1:drive\ProgramFiles\IBM\TDI\V7.1\timsolUNIX:v for version 7.1:/opt/IBM/TDI/V7.1/timsol8IBM Security Privileged Identity Manager: Google Apps Adapter Installation and Configuration Guide

Chapter 3. InstallingInstalling the adapter mainly involves importing the adapter profile and creatingan adapter service. Depending on the adapter, several other tasks can be involvedto completely install it.All IBM Tivoli Directory Integrator based adapters require the Dispatcher for theadapters to function correctly. If the Dispatcher is installed from a previousinstallation, do not reinstall it unless the Dispatcher is upgraded. See DispatcherInstallation Verification.Installing the dispatcherIf this is the first Tivoli Directory Integrator-based adapter installation, you mustinstall the RMI Dispatcher before you install the adapter. Install the RMIDispatcher on the same Tivoli Directory Integrator server where you want to installthe adapter.If you already installed the RMI Dispatcher for another adapter, you do not needto reinstall it.If you have not yet installed the RMI Dispatcher in the Tivoli Directory Integratorenvironment, download the Dispatcher installer from the IBM Passport Advantagewebsite. For more information about the installation, see the Dispatcher Installationand Configuration Guide.Installing the adapter binaries or connectorThe connector might or might not be available with the base Tivoli DirectoryIntegrator or Security Directory Integrator product. The connector is required toestablish communication between the adapter and the Dispatcher.Before you beginv The Dispatcher must be installed.Procedure1. Create a temporary directory on the workstation where you want to extract theadapter.2. Extract the contents of the compressed file in the temporary directory.3. Copy the GoogleAppsConnector.jar file to the ITDI HOME/jars/connectorsdirectory.4. Restart the adapter service.Installing 3rd party client librariesThe adapter requires access to the Google Directory API Java Client Library at runtime.9

Before you beginThe API library must be downloaded from the Google Developers rectory/v1/libraries).About this taskGoogle might provide client library files, which are newer than what isdocumented in the guide or in the release notes. While the newer library files canwork with the adapter, use these files with caution because they are not tested byIBM. If possible, use the same version as listed here or in the release notes.Procedure1. Go to the Google Developers ectory/v1/libraries) and search for the Google Directory API JavaClient Library package that is listed in the Google Apps Adapter Release Notes.2. Download the Google Directory API Java Client Library package to atemporary directory.3. Copy these files into ITDI HOME\jars\3rdparty\others directory. See the GoogleApps Adapter Release Notes for the path to these JAR files in the package.v commons-logging-1.1.1.jarv google-api-client-java6-1.25.0.jarv google-api-client-1.25.0.jarv google-api-services-admin-directory v1-rev104-1.25.0.jarv google-http-client-1.25.0.jarv google-http-client-jackson2-1.25.0.jarv google-oauth-client-1.25.0.jarv google-oauth-client-java6-1.25.0.jarv google-oauth-client-jetty-1.25.0.jarv httpclient-4.5.5.jarv httpcore-4.0.1.jarv jackson-core-2.9.6.jarv jetty-6.1.26.jarv jetty-util-6.1.26.jarv guava-25.1-jre.jar- This jar file can be found at: a/guavav gson-2.8.5.jar- This jar can be found at .gson/gson4. Go to the Google Developers brary/java/apis/groupssettings/v1) and search for the Google GroupsSettings API Java Client Library package.5. Download the Google Groups Settings API Java Client Library package to atemporary directory.6. Copy these files into ITDI HOME\jars\3rdparty\others directory. See the GoogleApps Adapter Release Notes for the path to these JAR files in the package.v .jar7. Copy the latest version of the commons-codec-1.11.jar file toITDI HOME\jars\3rdparty\IBM\axis2 directory. The jar file can be found /commons-codec.10IBM Security Privileged Identity Manager: Google Apps Adapter Installation and Configuration Guide

8. Restart the Dispatcher service. For information about starting and stopping theservice, see the Dispatcher Installation and Configuration Guide.Creating a Service Account in Google AppsTo create a service for the Google Apps adapter, you specify the Google Appsdomain details. To populate those fields, you must create a service account inGoogle Apps. The service account is not predefined before using the Google Appsadapter.Procedure1. Open the Google Cloud Console (https://console.developers.google.com).2. Select a project. If no project exists, then create one.3. Enable the API.a. On the navigation pane, select Overview if it is not already selected.b. In the displayed list of APIs, click Admin SDK and Groups Settings API .Enable these options if they are not already enabled.4. On the navigation pane, select Credentials.5. Optional: If you have not created any service account, create one.a. Click Manage service account. The list of service accounts are displayed.Note: Google might already have created accounts. Do not use thoseaccounts.b. Click Create service account.c. Enter the account name. The ID is automatically populated.d. Select the Furnish a new private key and Enable Google AppsDomain-wide Delegation check boxes.e. Select the p12 key type.6. Click Create. You are prompted to download the key.7. Take note of the Service account ID and application name.Delegating domain-wide authority to the service accountTo access user data in the Google Apps domain, grant domain-wide authority toyour service account.About this taskYou must have Administrator privileges on the Google Apps domain.Procedure1. Open the Google Apps domain administrative console (http://admin.google.com/).2. Select Security from the list of controls. If you cannot view it, select Morecontrols Security.Note: If you cannot see the controls, make sure you are signed in as anadministrator for the domain.3. Select Show more Advanced settings from the list of options.4. Select Manage API client access in the Authentication section.Chapter 3. Installing11

5. In Client name, enter the service account Client ID. You can find your serviceaccount client ID in the Service accounts section of the Developers Console'sPermissions page.6. In One or More API Scopes, enter the list of scopes required by the is.com/auth/apps.groups.settings7. Click Authorize.Configuring the SSL connection between the Dispatcher and theGoogle Apps serverTo enable communication between the adapter and the Google Apps server, youmust configure keystores for the Dispatcher.About this taskFor more information about SSL configuration, see the Dispatcher Installation andConfiguration Guide.Procedure1. Open a browser.2. Go to https://www.google.com/a/DOMAIN NAME/. The DOMAIN NAME is yourGoogle Apps Domain.3. View the certificate.v Click SSL lock.v If your browser reports that revocation information is not available, clickView Certificate.4. Click Certification Path5. Select the CA Root certificate.6. Export the certificate into a file that is encoded in the Base64 format.7. Take one of the following actions:v If the Dispatcher already has a configured keystore, use the keytool.exeprogram to import the IMS Server certificate.v If the keystore is not configured, create it by running the followingcommand from a command prompt. Type the command on a single line.keytool -import -alias googapps -file c:\GOOGLEAPPS.cer-keystore c:\truststore.jks -storepass passw0rd8. Download the Base-64 encoded X.509 (.CER) format of the CA certificate Root1 - Equifax Secure Certificate Authority. Go to the GeoTrust website andsearch for ca certificates.9. Import the certificate into the keystore that was created in step 7.keytool -import -alias equifax-file C:\Equifax Secure Certificate Authority.cer-keystore C:\truststore.jks -storepass passw0rd10. Edit ITDI HOME/timsol/solution.properties file to specify truststore andkeystore information. In the current release, only jks-type is supported:12IBM Security Privileged Identity Manager: Google Apps Adapter Installation and Configuration Guide

# Keystore file information for the server authentication.# It is used to verify the server’s public key.# examplejavax.net.ssl.trustStore truststore.jksjavax.net.ssl.trustStorePassword passw0rdjavax.net.ssl.trustStoreclass jksNote: If these key properties are not configured yet, you can set truststore tothe same value that contains the Google Apps certificate. Otherwise, you mustimport the IMS Server certificate to the truststore specified injavax.net.ssl.trustStore.11. After you modify the solution.properties file, restart the Dispatcher. Forinformation about SSL configuration, see the Dispatcher Installation andConfiguration Guide.Restarting the adapter serviceVarious installation and configuration tasks might require the adapter to berestarted to apply the changes. For example, you must restart the adapter if thereare changes in the adapter profile, connector, or assembly lines. To restart theadapter, restart the Dispatcher.The adapter does not exist as an independent service or a process. The adapter isadded to the Dispatcher instance, which runs all the adapters that are installed onthe same Security Directory Integrator instance.See the topic about starting, stopping, and restarting the Dispatcher service in theDispatcher Installation and Configuration Guide.Importing the adapter profileAn adapter profile defines the types of resources that the IBM Security Identityserver can manage. It is packaged with the IBM Security Identity Adapter. Use theadapter profile to create an adapter service on IBM Security Identity server andestablish communication with the adapter.Before you beginv The IBM Security Privileged Identity Manager is installed and running.v You have root or administrator authority on the IBM Security Privileged IdentityManager.v The file to be imported must be a Java archive (JAR) file. The Adapter Profile.jar file includes all the files that are required to define theadapter schema, account form, service/target form, and profile properties. Ifnecessary, you can extract the files from the JAR file, modify the files, andrepackage the JAR file with the updated files.The JAR file for IBM SecurityPrivileged Identity Manager is located in the top level folder of the installationpackage.About this taskService definition files are also called adapter profile files.If the adapter profile is not installed correctly, the adapter cannot functioncorrectly. You cannot create a service with the adapter profile or open an accounton the service. You must import the adapter profile again.Chapter 3. Installing13

Procedure1. Log on to the IBM Security Privileged Identity Manager by using an accountthat has the authority to perform administrative tasks.2. From the navigation tree, select Configure System Manage Service Types.The Manage Service Types page is displayed.3. On the Manage Service Types page, click Import. The Import Service Type pageis displayed.4. On the Import Service Type page, complete these steps:a. In the Service Definition File field, type the directory location of the Adapter Profile.jar file, or click Browse to locate the file. For example, ifyou are installing the IBM Security Identity Adapter for a Windows serverthat runs Active Directory, locate and import the ADProfileJAR file.b. Click OK to import the file.ResultsA message indicates that you successfully submitted a request to import a servicetype.What to do nextv The import occurs asynchronously, which means it might take some time for theservice type to load into the IBM Security Identity server from the propertiesfiles and to be available in other pages. On the Manage Service Types page, clickRefresh to see the new service type. If the service type status is Failed, checkthe log files to determine why the import failed.v If you receive a schema-related error, see the trace.log file for informationabout it. The trace.log file location is specified by the handler.file.fileDirproperty that is defined in the enRoleLogging.properties file. TheenRoleLogging.properties file is in the IBM Security Identity serverHOME\datadirectory. .Creating an adapter service/targetAfter you import the adapter profile on the IBM Security Identity server, create aservice/target so that IBM Security Identity server can communicate with themanaged resource.Before you beginComplete “Importing the adapter profile” on page 13.About this taskYou must create an administrative user account for the adapter on the managedresource. You can provide the account information such as administrator name andpassword when you create the adapter service. Ensure that the account hassufficient privileges to administer the users. For information about creating anadministrative account, see the documentation for the managed resource.To create or change a service, you must use the service form to provideinformation for the service. Service forms might vary depending on the adapter.The service name and description that you provide for each service are displayedon the console. Therefore, it is important to provide values that make sense to yourusers and administrators.14IBM Security Privileged Identity Manager: Google Apps Adapter Installation and Configuration Guide

Procedure1. From the navigation tree, click Manage Services.2. On the Services table, click Create. The Create a Service wizard is displayed.3. On the Select the Type of Service page, click Search to locate a business unit.The Business Unit page is displayed.4. On the Business Unit page, complete these steps:a. Type information about the business unit in the Search information field.b. Select a business type from the Search by list, and then click Search. A listof business units that matches the search criteria is displayed.If the table contains multiple pages, you can do the following tasks:v Click the arrow to go to the next page.v Type the number of the page that you want to view and click Go.c. In the Business Units table, select business unit in which you want to createthe service, and then click OK. The Select the Type of Service page isdisplayed, and the business unit that you specified is displayed in theBusiness unit field.5. On the Select the Type of Service page, select a service type, and then clickNext.6. On the Service Information page, specify the appropriate values for the serviceinstance. The content of the Service Information page depends on the type ofservice that you are creating.7. Click Finish.ResultsA message is displayed, indicating that you successfully created the serviceinstance for a specific service type.Service/Target form detailsComplete the service/target form fields.Adapter DetailsService NameSpecify a name that defines the adapter service on the IBMSecurity Identity server.Note: Do not use forward (/) or backward slashes (\) in theservice name.DescriptionSpecify a description that identifies the service for yourenvironment.Tivoli Directory Integrator locationSpecify the URL for the IBM Tivoli Directory Integrator instance.The valid syntax for the URL is rmi://ip-address:port/ITDIDispatcher, where ip-address is the IBM Tivoli DirectoryIntegrator host and port is the port number for the RMI Dispatcher.The default URL for the default SDI1 instance isrmi://localhost:1099/ITDIDispatcher.Chapter 3. Installing15

OwnerSpecify a user as a service owner. Click Search to find the user IDthat you want to specify as the owner of the service.Service prerequisiteSpecify a service that is prerequisite to this service. Click Search tospecify an existing service instance or function that the GoogleApps service instance requires.Google Apps Domain DetailsPrimary DomainName of the primary Google Apps domain.Secondary DomainsList of secondary Google Apps domains; separated by comma (",").Domain Admin EmailSpecify the login email address of the Google Apps Domainadministrator.Application NameApplication name of the adapter that is registered in Google Apps.Client EmailThe Service account ID of the adapter's service account in GoogleApps.Client Key PathLocation of the application's private key.Proxy Server hostSpecify

IBM Security Identity server The following servers ar e supported: v IBM Security Identity Manager server V ersion 6.0 v IBM Security Identity Manager server V ersion 7.0 v IBM Security Privileged Identity Manager V ersion 2.0 v IBM Security Identity Governance and Intelligence server V ersion 5.2.2 T ivoli Dir ectory Integrator adapters .