My first placement rule!

All right I admit it's mostly borrowed from the example documentation. Thanks whomever wrote the docs, but basically my placement rule looks at the value of the location attribute for each user and based on that it assigns the user to a location in the ITIM org tree:

function getContainerName() {
var loc = entry.l.toString();
if (loc == 'E1B Education Campus')
return 'e1b education campus';
if (loc == 'Harkness Career Center')
return 'harkness career center';
if (loc == 'Kenton Career Center')
return 'kenton career center';
if (loc == 'Northtowns Academy')
return 'northtowns academy';
if (loc == 'Potter Road Career Center')
return 'potter road career center';
if (loc == 'Southtowns Academy')
return 'southtowns academy';
else {
return 'Other';
}
}
return 'l=' + getContainerName() + ',ou=erie1';

The only problem I had was trying to use wild cards. This code requires that there is an exact match to the value of entry.l so if someone had a typo somewhere I would end up placing them in Other. I was thinking that it might be nice to handle use say 'e1b*' instead of 'E1B Education Campus' that way it wouldn't have to be exact. That doesn't work however. Maybe there is function or method to the entry object that might let me do something like entry.l.contains or something to that effect where I might be able to get away with some wild card.

Anyhow, I'll play around with this more later. I have something working for now so I'm going to focus on getting some adapters installed and I'll re-visit placement stuff later.

Lotus Notes Adapter for ITIM - Some more guesswork

There is some pretty important information missing from the Lotus Notes Adapter for ITIM Here:

1.) Create some Domino databases for the Deny Access Log database and the Notes ID Address Book in particular. But no mention of what template should be used. So what will I use this for? Will I need any particular views in these databases? An IBM tech support rep told me blank databases should be fine. Well then, why didn't the document simply mention that?

2.) Create some Domino groups like, Suspend Group, Suspend HTTP Group, and Delete Group. Ya think they might mention why the three groups? I mean what's wrong with using one group? Is it that important to have these separate?

3.) Then the instructions tell you to install the Shadow Agent using setup.exe. This is wrong because the Shadow Agent is installed using setupShadowAgent.exe. Of course this fails unless you happen to have installed an old JRE that has probably reached end of life. Now if my latest and greatest JRE was fine for installing the adapter, what were they thinking when creating this shadow agent? BTW, the shadow agent did install once I downloaded and installed JRE 1.3.1_19.

I get the feeling that the instructions for this adapter was written by someone who has not done a lot with Domino either.

Using TDI to feed ITIM

The document included with ITIM 4.6 and TDI 6.1 on using an HR Feed to ITIM using the JNDI connector works pretty well. You should find this in the ITIM_HOME/extensions/examples/idi_integration directory as well as your TDI_HOME/examples/idi_integration directory. Make sure you go through the entire document. I figured I was done after being half way through it and the TDI assembly line never worked.

It's important to have the jndiSearchBase as part of the $dn for the users being imported into TIM. I really didn't get this as first, but essentially the users are being added to a virtual container in TIM, then TIM uses the placement rule to determine where in the tree to put the users. If there is no placement rule then they will be added to the root of your org tree. This virtual container is referred to as the Naming Context in the IDI Feed Service you create in ITIM.
You will set this exact value in the JNDI connector -> Search Base parameter. So you then need to get this added to the $dn for the users being imported. The document describes doing this in the feed:





So in my case UpdateITIM is my JNDI connector and jndiSearchBase is the parameter that contained dc=HRLoad. I suppose I could have just hard coded this as well, but it's probably going to get more complicated later anyhow since I may have to create multiple IDI Feed Services for the many identity sources we will be using. Depending on how we actually lay out the org tree and how complex placement rules would need to be we may find the need to use more that one JNDI connector and multiple corresponding IDI Feed Services.

Then again, I haven't started playing around with the ITIM reconciliation stuff yet.

Directory Design - What to do about duplicates

We are in the architecture phase of our Identity Management system and one of the haunting questions we have yet to get answers for is "What do we do about duplicate user names?"

Since we will be pulling user names from over 100 identity sources to populate a single ITIM there is a high probability there will be multiple people with the same name. First of all none of the source systems are synchronized in any way. So we will likely have duplicate names across different systems, but many of these systems also allow duplicate user names as long as the two users are not in the same OU. Since the OUs in the source system will not be anything like the OUs planned in the target system we have to devise some process for dealing with duplicate user names.

ITIM seems perfectly happy creating two identical users in the same OU since in each case the user DN will be unique. ITIM uses the erglobalid to uniquely identify the user in the DIT. The problem with this is that you have to have a way to tell the difference between two people with the same name. When defining static and dynamic roles choosing the correct user name is important.

I hope to learn more about this as we go through this design phase with our consultants (people we assume have done this before).

com.ibm.dsml2.jndi.DSML2NamingException: Server returned HTTP response code: 401 for URL:

OK so we got a step closer today with using TDI 6.1 to feed identities to ITIM. After applying FP0025 and IF0028 to ITIM I can now connect to ITIM using the JNDI connector in TDI. The only problem is when I try to run the assembly line it fails with the error message above. It seems like it has something to do with the URL, but I'm using what's suggested in the example documents. BTW, the only place I've found an actual example of setting up the connector to ITIM is in TDI_HOME\examples\idi_integration. There's an HTML document that shows how to do this, however it's assuming you are using TDI 6.0. I understand that it may be pure luck to get this to work in TDI 6.1, but IBM hasn't told me this can't be done so I'm going to try anyhow.

I did install TDI 6.0 on another machine I have sitting near by. If this trouble drags out too long I may just try doing this on the other machine.

ITIM 4.6 IF0028 Released

This should fix my problem with TDI 6.1. The good people at IBM Tech Support came through in a pinch on my problem with the JNDI connector. So tomorrow I'll get going on that. A few prerequisites are required. First ITIM 4.6 Fixpack FP0025 must be applied. Also TDI 6.1 FP0001 is required.

And so we go...

Cannot instantiate class: com.ibm.dsml2.jndi.DSML2InitialContextFactory

Now that I've had the time to play around with the ITIM organization tree it seemed like a good time to experiment with feeds. First I created the organizational units and locations needed to contain user accounts. I created some roles and services one being the IDI Feed service (DSMLv2). I have to say that the documentation with TDI and ITIM talks about the planning items that go into choosing a feed type and such but it's nearly impossible to find a document that shows you exactly how to do this step by step. I am taking some of the Tivoli on-line courses to get familiar with ITIM at http://www.cgselearning.com/tivoliskills and they have a nice lab on setting this up. Problem is it's using TDI 6.0. I'm using TDI 6.1. So as the lab tells you to create an event handler this is not possible in TDI 6.1. So I proceed to improvise.

The TDI 6.1 documentation does not have a section on how to connect to ITIM. You would think that someone would have included a section like this, but hence that is not the case. I found one place where I could find help and you wouldn't know it's there unless you remembered to check the TDI 6.1 install directory. In there is an /examples/idi_integration/ folder. I found examples of how to use the JNDI connector to connect to ITIM. but guess what. It doesn't work.

The ITIM DSMLv2Connector code (ITIM's dsml2 JNDI driver) was removed from TDI in the 6.1 release. Why ...is the big mystery. According to IBM they are working on a fix for this which should be available in the near future. So what the heck do I do in the meantime? I don't know how easy it is to run TDI 6.1 and TDI 6.0 on the same machine, but that sounds like a hassle I would like to avoid. I really don't desire setting up a whole separate machine for TDI 6.0 either but I'm not sure I will have a choice. It just irks me that this stuff does not work better than it does. It's bad enough that we need specific patches and fix packs for every single component in order for things to work. Nothing works out of the box and then you think going to the latest version of software is a no brainer and surprise!

Stay tuned.