ITIM DB2

Connecting to itim db2 is easy , but most of us forget to profile db.

Login to itim db2 server as root

Then profile the db :

# . /home/db2admin/sqllib/db2profile
db2 connect to user itimuser using

Easy as it gets :)

if u want to run select commands, put db2 "Select * from abc where d = 'gupta'"

GLPCTL088E Unable to run the command on directory server instance ''

GLPCTL088E Unable to run the command on directory server instance '' If u got an error like this running ibmslapd -k command ,do check if there is -k or .k

The correct syntax is :  /location/ibmslapd -k

Tivoli General Rules

The way things have come up in recent past have changed.
modus operandi tends to include most if not all of the following:

•    It is reactive, not proactive.
•     Resources may be healthy while customer service levels are not acceptable.
•     Events describe problems, not corrective actions.
•     Events flow into the Operations room at an incredibly high rate, and “event storms” have performance impact on systems.

•    Fixes are typically manual and inefficient.
•     Problems cannot be prioritized because impacts are unknown.
•    Most problems cannot be detected; more than 50% of all problems are reported through the help desk.
•   Organizational boundaries breed incompatible tools, making end-to-end management and integration very difficult.
•    Lack of vision and strategic direction increases costs.

ReF: IBM Redbooks: Tivoli Monitoring

TAM For E-Business

Lets talk about Links and Junctions :
WebSEAL is a proxy that is located between the Internet and the internal back-end servers. In the following figure, the browser requests a Web page using the URL https:///Junction1/index.html. WebSEAL uses the junction name Junction1 to identify the back-end server and sends a request for http://ServerA/index.html.

The Problem :
Webpage contains links to other webpages, and resources which are accessed using the URLs. These Hyperlinks are send to back-end servers using webseal, but these URLs might not be validated as they dont contain the junctions.
Link Types:  There are 3 link types we come across ITIM/ ITAM : Relative, server relative and Absolute.

Relative links do not contain the name of the server or the name of the current directory. When the browser receives a relative link, the link appears to be located on the WebSEAL server. Relative links are correctly interpreted as links to other pages in the same directory on the same server.
For example, assume that this line appears in http://serverA/index.html: About this site
The browser retrieved this page from https://webseal/Junction1/index.html. This URL is correctly interpreted as pointing to https://webseal/Junction1/ about.html. This request would go back to WebSEAL and WebSEAL would know to request http://serverA/about.html.
•    Server-relative links do not contain the name of the server, but they do contain the name of the directory.
For example, assume that this line appears in http://serverA/index.html: Contact information
The browser retrieved this page from https://webseal/Junction1/index.html. This URL is interpreted as pointing to /contact.html on the same server. However, from the browser’s perspective the server is WebSEAL. If WebSEAL did not change the HTML, the browser would attempt to retrieve https://webseal/contact.html instead of the correct URL, which is https://webseal/Junction1/contact.html.
•    Absolute links contain the name of the server and the directory. For example, assume that this line appears in http://serverA/index.html:
Copyright Information
If WebSEAL did not change the HTML, the browser would attempt to connect directly to ServerA, bypassing WebSEAL. A correctly configured firewall would only allow connections to ServerA from WebSEAL.



ReF: Junctions and Links.pdf IBM White paper

Tivoli Directory Integrator - Access the Database

TDI or Tivoli directory integrator is used to send and receive data from a data source to ITIM and back. TDI is a much more powerful tool that can be used over IBM Tivoli applications and also over many other places.
Things to understand about TDI :
1. The way the data is transmitted across
2. The java packets in which data flows across.

I will try to talk about various connectors here :
Lets start with JDBC , possibly the most popular considering the fact its easy to connect to Databases. I have successful connections from MS-Access to MS-SQL server, Oracle 10g connection and now JD Edwards.
The basic rule for JDBC connector is it talks to the database with the correct credentials. Once you have correct JDBC , and passwords entered , you need to specify schema.
The tables you want to fetch the data from. If you have multiple tables , enter all the table names.

Once the DB2 connector is up and running : 

JDBC URL : jdbc:db2://localhost:port/dbSchema

JDBC Driver: com.ibm.db2.jcc.DB2Driver

Username: adminDB

Password: ****

Schema : dbInfo

Sometimes we have to access data from different db and feed it into other db. Like fetching data from MS Server 2005 or JD Edwards , or Oracle and feeding the data in ITIM LDAP / ITIM DB2 or any other platform. 

The most important advantage of using the JDBC connector is it takes care of the data change, the hooks helps us weed unwanted entries and play with the data while in transit. 

Suppose we have to take data from MS SERVER 2008 and put in DB2, there are many ways where we can check the data. 

I prefer to check for valid data in Feed hooks while the manipulation in Flow. 

Always remember to use : 

task.logmsg("****** CONN OBJECT before GETNEXT*******");

task.dumpEntry(conn); 

Using the above in hooks can help in determing the connection parameters. 

Interview Questions For ITIM

The interview for ITIM can have many open ends . We are not not interviewed only in ITIM (Tivoli Identity Management Suite), but also get grilled in other areas like WAS (websphere application services), TDI (tivoli Directory integrator), Linux / Unix/ AIX , Bash scripting , AD (active directory), Lotus notes, Adapter customization and many times even Tivoli Access management .
Few popular interview Questions will be :
1. how long have u been associated with TIM . Were u a part of team that installed TIM
Ans: Tell the exact time when u started. Its perfect if u have 4+ yrs of Tivoli experience.
2. Steps to install ITIM
Ans: need to understand the requirement , and what all Tivoli components are needed. With ITIM 5.0 and up, TDI are RMI based, installed with the installation, the middleware configuration is simplified and have a whole list of adapters compatible.
Steps:

1.        Install ITIM suite. Select a response file
2.        Install DB2 , default location Program Files\SQLLIB\bin
3.       Install TDS , tivoli directory server. Once Tivoli directory server is installed, you have to link it to DB2. This will ensure middleware is up and running. 
4. Install TDI , and the default location for install is: Program Files\ibm\tdi\version x.x
5. Install the adapters .

3. Does ITIM has its own database - Yes , ITIM has ITIM LDAP and ITIM DB2
4. What is trusted source. - The default store which will have correct credentials for recons to run
5. Where are memory leaks in ITIM. - Yes. ITIM is based out of Java, and the custom codes are responsible for memory leaks.
6. Which of the two is synchronous- ITIM / TDI
7. where will u look for logs in TDI and in ITIM .
Ans: CTGIM folder in ITIM install
8. When is the case when u dont have to restart WAS when u change something. What changes am i talking about
9. Your role in the team
10. What is DMZ - demilitralized zone for TAM , protects against invasion
11. What is cache size
12. Where is JVM Heap size located
13. If one of the installation steps goes wrong, where r the error logs
14. What is adapter
15. how do u schedule a task using TDI
16. Version of WAS / TDI / ITIM / DB2 /DB
17. What is lifecycle rule
18 What is FESI extension. Is it better than IBM JS. Have you worked on them
19. What command is used for configuring adapter
20. Can you develop a custom adapter. What file you need to modify for the same
21. how do u implement load balancing in ITIM.
22. What is identity management , how it is different from identity policy
23. Steps to implement a fresh new ITIM
24. How do u configure a policy on person record on particular org tree
25. Steps to export the changes to QA or production
26. LDAP searches , basic questions on them
27. Bash / C shell questions , as how to execute and run commands
28 what are hooks in TDI
29. at what different levels hooks can be established in TDI
30. What is role of Delta in TDI
31. What is link criteria.
32. What is ACI
33. Questions on self service console

more coming up ... feel free to answer in comments

Upgrade to ITIM 5.0

Migration Order:

§Backup existing ITIM 4.6 Environment

§Backup ITIM database

§Backup ITIM LDAP server

§Backup ITIM_HOME directory

§Run the ITIM 5.0 Installer

§Reapply ITIM customizations

§ITIM 5.0 Installation Guide Appendix A documents customizations which need to be reapplied

----------------------------

§Install ITIM 5.0 Adapters

§ITIM 4.6 ADK Adapters must be uninstalled before upgrading to ITIM 5.0 adapter

§ITIM 5.0 ADK Adapter installation can not “upgrade” existing ITIM 4.6 Adapters

§ITIM 5.0 will work with ITIM 4.6 ADK Adapters but new ITIM 5.0 features will not be available

§Access Entitlements and Supporting Data Only reconciliations

It is very important to uninstall ADK for ITIM 4.6 before ITIM 5.0 installation is started , as the adapters in ITIM 4.6 are not supported for ITIM 5.0