HA - Illusion or realization

So lets say this new hyper-phobia of making the system HA catches you. You go, hire a few professionals to make the system HA, how do you test if your system is a true HA or not. Well , lets get it straight first time, IBM TIM is made up of java classes, has a LDAP server , a DB2 , a directory server and TDI in its most simplest of installations. You would be adding up with TAM combo adapter , which means webseal, policy server, authorization server as well. When you talk about HA , you want to have a backup of most of these components.
Few of these are critical , like mission critical, which if fail will stop the entire functioning of the system. Identification of these is purely dependent on the business logic, and functioning of the system. If your system runs the recon once daily / weekly, and then most of the transactions happen over ITIM server in itself , you might want to replicate your LDAP / Directory Server and DB2 ( HADR) , while TDI can be taken care of later. One has to understand, the team can go and have all the components. If you have a  huge number of requests coming from Webseal , and need to authorize using ITIM, then you will need to make the TDI HA. Similarly , multiple Webseals might be needed for heavy traffic streamlining , but the policy and authorization server can be up only one at a time. If you don't have daily changing ACLs , then this piece does not need to be HA. But if you have a TAI++ configuration set up, you can't afford for this piece to go down either. Regardless of the thought, lets say you have a HA setup with two LDAP (master -master) , two directory server, two DB2 ( HADR) , and two TDI servers as well. How would be start testing. What is the most basic test one can perform.
The first and most basic test is ,if you can , turn off the primary servers, one component at time , and keep on running transactions. By turning off one of the servers the hard way , you know if the system is truly HA. Once this step is complete, then starts the alternate shutting down of services , and restarting them while hitting the tests, and watching the logs .
One of the most important things while doing the HA is to look after the logs, they help you determine if the request is routed to the correct side. The LDAP should essentially be master -master , and more the entries, more should be the number of LDAP servers. Regular backup of LDAP servers is an essential tool, which will help to troubleshoot any unforeseen activity.
Getting the system to HA is not impossible in the books, but one should understand the fact, ITIM is essentially an EAR file deployed on application server, which will have memory leaks. Any code ,custom added will add to the complexity, and the irregular code would make it worse. Additionally DB2 sitting as the backbone should be properly configured, and steps as mentioned in Performance tuning guide be strictly followed.
I will try to push out the basic HA steps as well , but to understand HA is something which can be achieved, and sustained, but it comes with nice hardware costs , and understanding that it might be HA, it still can fail. There are too many pieces which can cause it stop functioning.

HA

One of the key features that have spun up in recent time is the concept of high availability. The desire to have a system which will never go down. There are bigger risks and greater costs associated with it. One of the major consideration people miss out is the infrastructure. An infrastructure built up with very high availability should be aware of certain things in the organization :

1.       Highly skilled admins  ( Linux / Windows / Solaris / AIX )

2. High SLA for uptime of the servers
3. High SLA for problem resolution
4. High Disk Space for any coredumps that might be created for any app error
5. High performance and a back up system for applying fix packs

One of the major reasons sometimes HA is not pursued by organizations and is not a success is because of technologies sitting beneath the stack. Lets say if I want to have ITIM (Tivoli identity manager ) as HA , other than making all components of it to be HA, like LDAP , TDS , DB2 , I should be focused on WAS or Weblogic on which the application is deployed. A broken WAS will result in breach of SLA or HA. Then Tivoli Identity Manager is full of  Java classes, which has memory leaks. The trouble increased when there is custom code in Workflows or person account using java statements and printing out outputs to system console. A not well tuned application code can be one of the biggest challenges in HA.

Once these challenges are faced, we have to make sure that each component in the application is performance tuned to perform the work it requires to do. The term tuning essentially means “best setting for the system” and not best setting in general. A 32 bit machine should not have a JVM of 4096kB , regardless.

Once all these steps are performed , then there is a need to understand how the things will shape up in real world. Here comes the biggest problem , the data. Here we have three challenges , data integrity , data warehouse , and data store. The speed at which data can be accessed , modified and use should not be at the cost of data security or HA , and otherwise.  

Let us see in coming days how HA , Data security and Data Accessing should be tackled.

Server List in Webseal

Login to Webseal machin :
pdadmin> login
Enter user name:
Enter password :
-----
The first thing i recommend you to list the servers available in your webseal 
pdadmin sec_master> server list

You will get a list of servers ... find the entry that looks like :
default-webseald-server01 

Person Form Customization in ITIM

In ITIM , it is very easy to customize various forms like person add.
Steps:
Login to itim console
Navigate to Configure System -> design forms
You may have to accept running the script, as this is java. If you dont let the script run, or let the browser stop it , then you might not be able to customize the person page.

Now go to Person , double click on it.
You will see person again , if you have made another custom person class, you will be able to see it there as well. Once you double click person, you will see the tabs on the right. Each tab has different attributes. Each tab in here appears as a separate tab in create person.
To create a new tab, go to Form Menu --> TAB menu ->  add Tab.

You will then need to rename the tab by tab menu -> rename tab

Once the person form is created, simply double click the attribute you want from the attribute list on the right. Any attribute you dont want to show up in the user create menu , can be selected and deleted using delete key. this will send the attribute back in the attribute list. You WILL NOT BE ABLE TO DELETE ANY ATTRIBUTE, so dont worry and play around.

You can give default value to the selected attribute by selecting Properties in right hand corner of the window.

Once done , save form and exit.

All set for Pulse 2012

I have finally got my Pulse 2012 pass with me , and with the hotel booked, looking forward to interact with whole lot of people I know. Try to understand where the technology is flying and where the people are working ...
Will keep a log of Pulse updated .

User Modify in TAM LDAP using pdadmin

To create the user using pdadmin :

user create deepakg83 uid=deepakg83,cn=users,o=myorg,c=us deepakg83 wsadmin wsadmin PasswordForwsadmin


Substitute myorg with valid LDAP entry in your ldap
This will create deepakg83 for TAI++ configuration . 

We can directly set the validity of a user to true using pdadmin . It is achieved with ease once you log into pdadmin and run the following command :
pdadmin sec_master > user modify deepakg83 account-valid yes

Creating WebSeal Junctions from Command line

Ever wondered how easy it is to make webseal junctions from mere command line, it is possibly easier than making it from WAS TAM integrated console.
Login to Webseal machin :
pdadmin> login
Enter user name:
Enter password :
-----
The first thing i recommend you to list the servers available in your webseal
pdadmin sec_master> server list

You will get a list of servers ... find the entry that looks like :
default-webseald-server01

This is possibly your webseal name , this is used at many instances and should be kept safe .

Now lets make the webseal junction :

server task default-webseald-server01 create -t ssl -b supply -c iv_creds -h wasPortalServer01 -p 20004 /junctionname01

Where wasPortalServer01 is the backend server which will be authenticated by webseal and junctionname01 is the junction that will be created.
If you now have to load balance the two servers on same junction name , DO NOT run the following command:
server task default-webseald-server01 create -t ssl -b supply -c iv_creds -h wasPortalServer02 -p 20004 /junctionname01
This will be ERROR ...

Use this command instead :
server task default-webseald-server01 add  -h wasPortalServer02  -p 20004 /junctionname01


This will create a junction which will be TAI++ enabled