1 About the Connector

1.3.1 Connector Components

The IBM RACF Advanced connector contains the following components:

• LDAP Gateway: The LDAP Gateway receives instructions from Oracle Identity Manager in the same way as any LDAP version 3 identity store. These LDAP commands are then converted into native mainframe commands for IBM RACF and sent to the Provisioning Agent. The response, which is also native to IBM RACF, is parsed into an LDAP-format response and returned to Oracle Identity Manager.

• Provisioning Agent (Pioneer): The Provisioning Agent is a mainframe component. It receives native mainframe IBM RACF provisioning commands from the LDAP Gateway. These requests are processed against the IBM RACF authentication repository. The response is parsed and returned to the LDAP Gateway.

  Note:

  At some places in this guide, the Provisioning Agent is referred to as the Provisioning Agent or Pioneer.

• Reconciliation Agent (Voyager): The Reconciliation Agent captures native mainframe events by using advanced exit technology. These events are then passed to Oracle Identity Manager through the LDAP Gateway. Exits are programs that are run after a system event in IBM RACF is processed. The Reconciliation Agent captures in real time events occurring from the TSO logins, the command prompt, batch jobs, and other native events. The Reconciliation Agent captures these events and transforms them into notification messages for Oracle Identity Manager through the LDAP Gateway.

  Note:

  At some places in this guide, the Reconciliation Agent is referred to as the Reconciliation Agent or Voyager.

• Message Transport Layer: The message transport layer enables the exchange of messages between the LDAP Gateway and the Reconciliation Agent and Provisioning Agent. You can use the TCP/IP messaging protocol for the message transport layer.

  TCP/IP with Advanced Encryption Standard (AES) encryption using 128-bit cryptographic keys. The connector supports a message transport layer by using the TCP/IP protocol, which is functionally similar to proprietary message transport layer protocols.

1.3.2 Connector Operations

This section provides an overview of the following processes:

• Section 1.3.2.1, "Full Reconciliation Process"

• Section 1.3.2.2, "Reconciliation Process"

• Section 1.3.2.3, "Provisioning Process"

1.3.2.2 Reconciliation Process

Real-time reconciliation is initiated by the 3 exits that work in conjunction with the Reconciliation Agent. Figure 1-1 shows the flow of data during reconciliation.

Figure 1-1 Reconciliation Process

Description of "Figure 1-1 Reconciliation Process"

The following is a summary of the reconciliation process:

1. Incremental reconciliation begins when a user profile is created, updated, or deleted on IBM RACF. This event might take place either directly on the mainframe or in response to a provisioning operation on Oracle Identity Manager.

2. ICHPWX01, ICHRIX02, and IRREVX01 are standard IBM RACF exits. These exits are used in conjunction with the Reconciliation Agent. One of these exits detects the event and sends a message containing user profile data to Subpool 231 (cache). This message contains the minimum amount of data, such as the user ID and password, needed to reconcile the event.

3. The Reconciliation Agent polls Subpool 231. When it finds the message in the subpool, it reads the message into its buffer. This frees up the subpool.

4. The Reconciliation Agent opens up a connection with the LDAP Gateway, and then sends the message to the gateway over TCP/IP.

   Note:

   Messages sent to the LDAP Gateway are encrypted using AES-128 encryption.

5. The LDAP Gateway decrypts the message. If it is a Create User or Change User Status event, then the LDAP Gateway checks the source of the event by comparing the user ID against the user IDs stored in the internal meta-store:

   • For a Create User event, if the user ID exists in the internal meta-store, then the message is not forwarded to Oracle Identity Manager.

   • For a Change User Status event, if the user status from the event is the same as the user status in the internal meta-store, then the message is not forwarded to Oracle Identity Manager.

   If the event does not meet either of these two conditions, then the LDAP Gateway determines that the source of the event is not Oracle Identity Manager. It then sends the message to Oracle Identity Manager.

   Note:

   As mentioned in Step 2, the message sent by the Reconciliation Agent contains only a minimum amount of data. The LDAP Gateway sends a request to the Provisioning Agent to fetch the remaining data from the user profile.

6. Oracle Identity Manager processes the message and creates or updates either the corresponding IBM RACF resource or the OIM User.

1.3.2.3 Provisioning Process

Figure 1-2 shows the flow of data during provisioning.

Figure 1-2 Provisioning Process

Description of "Figure 1-2 Provisioning Process"

The following is a summary of the provisioning process:

1. Provisioning data submitted from the Administrative and User Console is sent to the LDAP Gateway.

   Note:

   Oracle Identity Manager and the LDAP Gateway are installed on the same computer.

2. The LDAP Gateway converts the provisioning data into mainframe commands, encrypts the commands, and then sends them to the mainframe computer over TCP/IP.

3. The Provisioning Agent installed on the mainframe computer decrypts the commands and then runs them on the mainframe.

4. The Provisioning Agent sends the output of the commands back to the LDAP Gateway.

5. The outcome of the operation on the mainframe is displayed on the Oracle Identity Manager console. A more detailed message is recorded in the connector log file.

1.4.1 Target Resource and Trusted Source Reconciliation

You can use the connector to configure IBM RACF as either a target resource or trusted source of Oracle Identity Manager.

1.4.2 Full and Incremental Reconciliation

After you deploy the connector, you can perform full reconciliation to bring all existing user profile data from the target system to Oracle Identity Manager. After the first full reconciliation run, change-based or incremental reconciliation is automatically enabled and active. Incremental reconciliation is a real-time process. User profile changes on the target system are directly sent to Oracle Identity Manager.

You can perform a full reconciliation run at any time.

1.4.3 Encrypted Communication Between the Target System and Oracle Identity Manager

AES-128 encryption is used to encrypt data that is exchanged between the LDAP Gateway and the Reconciliation Agent and Provisioning Agent on the mainframe.

1.4.4 High Availability Feature of the Connector

The following are component-failure scenarios and the response of the connector to each scenario:

• Scenario 1: The Reconciliation Agent is running and the LDAP Gateway stops responding

  1. The Reconciliation Agent stops sending messages (event data) to the LDAP Gateway.

  2. Messages that are not sent are stored in the subpool cache.

  3. When the LDAP Gateway is brought back online, the Reconciliation Agent reads data from the subpool cache and then sends messages to the LDAP Gateway.

• Scenario 2: The LDAP Gateway is running and the Reconciliation Agent stops responding

  1. Event data is sent to the subpool cache.

  2. When the Reconciliation Agent is brought back online, it reads data from the subpool cache and then sends messages to the LDAP Gateway.

• Scenario 3: The LDAP Gateway is running and the mainframe stops responding

  1. Messages that are in the subpool cache are written to disk.

  2. When the mainframe is brought back online, event data written to disk is again stored in the subpool cache.

  3. The Reconciliation Agent reads data from the subpool cache and then sends messages to the LDAP Gateway.

• Scenario 4: The LDAP Gateway is running and the Provisioning Agent or mainframe stops responding

  The process task that sends provisioning data to the LDAP Gateway retries the task.

• Scenario 5: The subpool is stopped by an administrator

  If the subpool is stopped by an administrator, then it shuts down the Reconciliation Agent, thereby destroying any messages that are not transmitted. However, the messages in the AES-encrypted file are not affected and can be recovered.

1.5.1 Supported Functions for Target Resource and Trusted Source Reconciliation

The connector supports reconciliation of user data from the following events:

• Create user

• Modify user

• Change password

• Reset password

• Revoke user

• Resume user

• Delete user

1.5.2 Supported Functions for Provisioning

Table 1-2 lists the provisioning functions supported by the connector.

1.5.3 User Attributes for Target Resource Reconciliation and Provisioning

Table 1-3 lists attribute mappings between IBM RACF and Oracle Identity Manager for target resource reconciliation and provisioning.

1.5.4 Group Attributes for Target Resource Reconciliation and Provisioning

Table 1-4 lists group attribute mappings between IBM RACF and Oracle Identity Manager. The AddUserToGroup and RemoveUserFromGroup adapters are used for group provisioning operations.

1.5.5 Data Set Resource Profile Attributes for Target Resource Reconciliation and Provisioning

Table 1-5 lists data set resource profile attribute mappings between IBM RACF and Oracle Identity Manager. The AddUserToDataset, RemoveUserFromDataset, AddUserToResource, and RemoveUserFromResource adapters are used for data set resource profile provisioning operations.

1.5.6 User Attributes for Trusted Source Reconciliation

Table 1-6 lists attribute mappings between IBM RACF and Oracle Identity Manager for trusted source reconciliation.

1.5.7 Reconciliation Rule

During target resource reconciliation, Oracle Identity Manager tries to match each user profile fetched from IBM RACF with existing IBM RACF resources provisioned to OIM Users. This is known as process matching. A reconciliation rule is applied for process matching. If a process match is found, then changes made to the user profile on the target system are copied to the resource on Oracle Identity Manager. If no match is found, then Oracle Identity Manager tries to match the user profile against existing OIM Users. This is known as entity matching. The reconciliation rule is applied during this process. If an entity match is found, then an IBM RACF resource is provisioned to the OIM User. Data for the newly provisioned resource is copied from the user profile.

During trusted reconciliation, the same reconciliation rule is applied for entity matching. If an entity match is found, then an OIM User is created out of the data in the reconciliation event.

The following is the reconciliation rule for both target resource and trusted source reconciliation:

Rule name: IdfReconUserRule

Rule element: User Login Equals uid

In this rule element:

• User Login is the User ID field on the process form and the OIM User form.

• uid is the USER attribute on IBM RACF.

After you deploy the connector, you can view this reconciliation rule by performing the following steps:

1. On the Design Console, expand Development Tools and then double-click Reconciliation Rules.

2. Search for and open the IdfReconUserRule rule. Figure 1-3 shows this rule.

   Figure 1-3 Reconciliation Rule

   
   Description of "Figure 1-3 Reconciliation Rule"
   
   

1.5.8 Reconciliation Action Rules

Reconciliation action rules specify actions that must be taken depending on whether or not matching IBM RACF resources or OIM Users are found when the reconciliation rule is applied. Table 1-7 lists the reconciliation action rules for this connector.

After you deploy the connector, you can view the reconciliation action rules for target resource reconciliation by performing the following steps:

1. On the Design Console, expand Resource Management and double-click Resource Objects.

2. Search for and open the OIMRacfResourceObject resource object.

3. Click the Object Reconciliation tab, and then click the Reconciliation Action Rules tab. The Reconciliation Action Rules tab displays the action rules defined for this connector. Figure 1-4 shows the reconciliation action rules for target resource reconciliation.

   Figure 1-4 Reconciliation Action Rules

   
   Description of "Figure 1-4 Reconciliation Action Rules"