NOVELL FORUMS - IM: Engine-Drivers

Changing DirXML-EntitlementRef

varunece — Fri, 20 Nov 2009 16:42:22 GMT

Hi,
If I have a role with 2 entitlements, can I change namespace value of one entitlement(from 1 to 0) so as to invoke deprovisioning corresponding to this entitlement.

What problems can I face if I try modifying DirXML-EntitlementRef from within my driver(I cannot modify my role, and I assume that I'll not assign this role again)

Please HELP!

Installing Password Filter on a AD

elmagra — Fri, 20 Nov 2009 14:16:45 GMT

Hi

I got some Problem with the synchronisation of our Password from AD to eDir.

We got two DC Server Win2003 on one of them there is installed the IDM 3.0.1 an the XMLDrivers.

On the other AD Server it seems there is noting speciali installed.
So i got found that on all DC they must installed the Passwort Filter drivers.

But how i got them installed? Thanks for helping.

Driver Health Check - custom-state

alexmchugh — Fri, 20 Nov 2009 12:52:27 GMT

Using the driver health facility and sending mails via a template. Using the standard tokens as per documentation.

Also using pretty much the default driver health logic, which includes some custom states for some drivers like NoPub and NoSub which trigger if there is no activity on the publisher channel or subscriber channel for a period of time.

The problem I have is that when using the default token $HealthState$ and a NoPub or NoSub custom state is triggered, the email text that $HealthState$ resolves to is custom-state not the actual name of the custom state.

This is pretty much useless, as it is possible to have multiple custom state so there must be a way to distinguish which custom state has been triggered. Is there a way to actually return the name of the custom state?

IDM probs efter upgrading to SLES10SP3/OES2SP2

andben — Fri, 20 Nov 2009 09:47:02 GMT

Guys, upgraded to OES2 SP2 (SLES10 SP3) and suddenly my IDM stuff dont work. In iManager I see this error:

The version of the DIRXMLCommon plugin-in that is installed is not compatible with the Identity Manager Configuration plug-ins package.

Can someone advice, please?

cheers,
Anders

Modifying account in ID vault causes it to expire

6423241 — Thu, 19 Nov 2009 20:37:33 GMT

We've recently noticed a new issue with our IDM environment -- at least I think it's IDM that's causing this. When the properties of a user object are changed, whether by the user (password change) or an admin (password change, description field modified, etc) -- the user account expires. Console One shows an expiration of 12/31/1969, but an LDAP export shows it as 2/7/2106.
This doesn't happen every time, but it happens a lot.

Attached are two IDM L3 traces (prod-to-vault and vault-to-prod) showing a user TIMS01 who just had this happen.

Thoughts?

... I'm envisioning an evil genius somewhere saying "We replaced his IDM environment with a Whack-a-mole game! Let's see how long it takes him to go mad."

Attached Files

tims01 logs.zip (21.1 KB)

delimited text schema

joakim_ganse — Thu, 19 Nov 2009 13:37:30 GMT

Hi,

When running the delimited text driver we define the schema our selfs.
I have four attributes in my schema and expect a file with four values separated with commas.
If I get a file with more than that I expected the schema mapping to throw away the extra values and just process the first four.

If I want this:
value1,value2,value3,value4

but get this:
value1,value2,value3,value4,,value6

I get this in the document before the mapping rule:

value1

value1

value2

value3

value4

value6

The first four attributes gets mapped correctly but the value without an attribute name slips through and in the end I get an error that the object can not be created because it can not add the attribute "".

Fascinating.

eDir to eDir, tune connection

eddy — Thu, 19 Nov 2009 11:12:24 GMT

I have a eDir-to-eDir driver which connects through a firewall. The drivers connect properly, but very often the connection falls away and then I get a lot of "connection refused errors". When I let the driver run the errors resolve themselfs.

I have never seen this behaviour and I suspect the cause is the configuration of the firewall, or some kind of overload of the firewall. The firewall is managed by a third party. Are there some settings or connecton parameters to 'tune' the connection of the drivers in this situation?

Password synchronization at matching?

sjahan — Thu, 19 Nov 2009 08:53:15 GMT

Hi,

We would like to be able to sync passwords to a LDAP directory (iPlanet actually).
When the association between the user object in eDir and the iPlanet user object is done, there should be no trouble about password sync.

My question regards when the objects aren't associated:

if a common event happens on the eDir user, the driver should catch it and tries to match the user with iPlanet, but will it synchronize the password automatically (without the password to be changed)?

Thank you very much for support,

SJ.

Novell IDM Scripting Driver Configuration

aali31 — Thu, 19 Nov 2009 05:20:07 GMT

I want to create Home Directories for the users on the Microsoft server. Already I am populating the Home directory and profile path through AD driver. For this job I have setup a scripting driver using IDM 3.6.1 with no EFS, which is running alright. I am not sure how to configure policies to call VB script on the creation of the user in AD. Please help

Thanks

Ali

Remote Loader Installation

plbiju — Thu, 19 Nov 2009 03:39:10 GMT

We have IDM 3.5.1 and we want to install Remote loader on a Solaris 64-bit SPARC Server for Oracle Database.

Can we install Remote Loader 3.5.1(32-bit) on Solaris 64-bit?.

I could not find out from the docs about the clear difference between the Regular Remote loader and the Java Remote loader?.Is there any difference in features other than the startup script.

If there is no difference, then I think java remote loader is best as it can be installed without root privilege and the files related to remote loader will be only on a particular folder..

Please suggest a better approach...

PW synch from AD to eDir fails

redletter — Wed, 18 Nov 2009 22:46:57 GMT

Running RL to connect to a 3.51 AD driver on a member server, which then is connecting to a DC (the domain has 2003 and 2008 DC's).

When i power up the driver and create a new user in the IDV and have it migrate across it seems to work fine.

But, if my user already exists in AD and edir, and I just want to build an association, everything works but the pw synch.

Below is the trace of the error i get

AD
Novell, Inc.

Unwilling To Perform

00002077: SvcErr: DSID-0319039A, problem 5003 (WILL_NOT_PERFORM), data 0

Any help as to the nature of this error would be greatly appreciated

RedLetter

rdxm vs dirxml_jremote

kalyan0423 — Wed, 18 Nov 2009 13:48:52 GMT

Hi,

Can anyone tell the benifits of using remote loader installation on unix( Using the IDM installation binary) and java remote loader installation (java_remoteloader)

what are the functionalities differences betweent the remote loader isntallation and java remote loader installation.

Which is the best option to use and why?

Schema Mapping and Auxiliary Attributes

ChrisReeves — Wed, 18 Nov 2009 13:17:01 GMT

Whilst having some issues with schema mapping and auxiliary classes, I began to wonder how and when the Non-class-specific Attribute Mapping was (supposed to be) used. The official documentation says very little: "Sometimes an attribute mapping doesn't apply to a specific class. In this case you can define the attribute mapping in the Non-class-specific container". A quick search of the fora gave a couple of useful threads:
http://forums.novell.com/novell-prod...ttributes.html
and, to a lesser extent:
http://forums.novell.com/novell-prod...itation-2.html

The following is an example of what I have in my case. In the identity vault, I have the following schema:
User (class)
Surname (attr)
IDM Person (aux class)
IDM StaffID (attr)
IDM StudentID (attr)

which in our LDAP master looks something like:
inetOrgPerson (class)
sn (attr)
StAndExtendedPerson (aux class)
staffID (attr)
studentID (attr)

My expectation before reading these threads was that I would map these attributes as part of the User class. On the subscriber channel for the LDAP driver I would then add the StAndExtendedPerson objectClass if I saw either of these attributes being pushed out to LDAP (assuming it wasn't already there).

Having read the first thread I linked to, my interpretation of what was said was that I didn't need to add the StAndExtendedPerson objectClass manually. I map the student and staff ID attributes within the User class and make no mention of StAndExtendedPerson at all in the mapping policy. To quote Geoffrey Carman: "The engine handles aux classes and if it sees an attr that needs an aux class, it adds (all aux classes that include it, actually)." and David Gersic in that thread: "Just map the attribute (in IDM's schema mapping / filter) to the User (or Group) class as appropriate. The engine will figure it out from there for you."

When I tried adding an object containing staffID, however, the engine appears not to have figured it out at all and I get the error I would have expected:
13:08:15 505AB940 Drvrs: LDAP ST:LDAP: LDAP Add:
dn: uid=bob20,ou=People,ou=Test,dc=st-andrews,dc=ac,dc=uk
staffID: 017137
userpassword:
givenname: Charlie
uid: bob20
sn: Buchanan3
cn: Charlie Buchanan
objectclass: inetOrgPerson
objectclass: organizationalPerson
objectclass: person
objectclass: top
title: Dr

13:08:15 505AB940 Drvrs: LDAP ST:LDAP: LDAPInterface.doLDAPAdd() Error: LDAPException: Object Class Violation (65) Object Class Violation
LDAPException: Server Message: attribute 'staffID' not allowed

I guess my interpretation of what was said in these threads is incorrect. Could someone please clarify what is expected to happen here? Do I have to add the objectClass manually? In what situations will the engine figure it out for itself?

Thanks,
Chris

SOAP driver

fsjovatsen — Tue, 17 Nov 2009 22:06:53 GMT

Hi!

I just started working on a SOAP driver (I'm not very familiar with SOAP) and I'm stuck. I got several methods on the ws but I'm testing with one of them. The defs for SOAP 1.1 is:

Code:

POST /Service.asmx HTTP/1.1

Host: norron-test

Content-Type: text/xml; charset=utf-8

Content-Length: length

SOAPAction: "http://tempuri.org/AddOrUpdateUser"







  

    

      

        int

        string

        string

        string

        string

        string

        string

        string

        string

        string

        string

        boolean

        string

        string

        string

        string

        string

        string

        string

        int

        string

        string

        boolean

        string

        string

      

      string

      int

I made a transform to make the xml for this ws. When I tried to add a user everything seems ok (in my glasses), but it stop trying to post the xml. It stops for a while and then IDM tries to post the xml again:

Code:



  

    DirXML

    Novell, Inc.

  

  

    

      

        

          

            2

            karianne

            Dashboard

            Karianne

            Sjovatsen

            

            

            

            

            

            

            false

            Sjovatsen

            

            

            

            

            

            

            

            

            <br />
            <Wizard>false</Wizard><br />
            <WorkPhoneNumber/><br />
            <Salt/><br />
          </user><br />
          <password>Sjovatsen</password><br />
          <securityGroupId>3</securityGroupId><br />
        </AddOrUpdateUser><br />
        <operation-data parent-node-1="AddOrUpdateUserResponse"><br />
          <return-to-me cached-time="20091116195007.586Z" class-name="User" command="add" event-id="oesmetalab#20091116195007#1#1" qualified-src-dn="O=rfk-meta\OU=Personer\OU=Ansatt\CN=karianne" src-dn="\RFK-LAB-TRE\rfk-meta\Personer\Ansatt\karianne" src-entry-id="76256" timestamp="1258401007#23"/><br />
        </operation-data><br />
      </soap:Body><br />
    </soap:Envelope><br />
  </input><br />
</nds><br />
[11/23/09 12:07:44.246]:DASHBOARD ST:Dashboard: HTTPSubscriberTransport.send()<br />
[11/23/09 12:07:44.246]:DASHBOARD ST:Dashboard: Preparing HTTP POST connection to http://152.93.212.41:8081/Service.asmx<br />
[11/23/09 12:07:44.248]:DASHBOARD ST:Dashboard: Setting the following HTTP request properties: <br />
[11/23/09 12:07:44.249]:DASHBOARD ST:Dashboard:   Host: norron-test<br />
[11/23/09 12:07:44.249]:DASHBOARD ST:Dashboard:   SOAPAction: http://tempuri.org/AddOrUpdateUser<br />
[11/23/09 12:07:44.249]:DASHBOARD ST:Dashboard:   Content-Type: text/xml; charset=utf-8</code><hr />
</div>I've tried with the op data inside the the <AddOrUpdateUser/> but I guess this is not the problem.<br />
<br />
Is there anyone that can give me a hint on how to get this to work?<br />
<br />
Thanks!<br />
<br />
-- <br />
Frode</div>


</article>
<article>
<h1>AS400 midrange fan-out - events not processing until trawl</h1>
<p>brembold — Tue, 17 Nov 2009 20:29:39 GMT</p>
<div>Hey all,<br />
<br />
we are trying to get events processing automatically through the as400 midrange fan-out driver. Right now, events are not processing until we manually run a Trawl. How can we automate this?<br />
<br />
Thanks.</div>


</article>
</main></body></html>