WIXLIB

Prerequisites for running the adapterThe following table lists the requirements to run the BlackBerry Enterprise ServerAdapter.Table 2. BlackBerry Enterprise Server Adapter prerequisitesRequirementDescriptionTaskExport and Import the SSLCertificate.Export the SSL certificate from See “Exporting and importing the BlackBerrythe managed resource andEnterprise Server SSL certificate” on page 12.import it to the certificateauthority (CA) truststore of theTivoli Directory IntegratorJava Virtual Machine (JVM).Create a separate Tivoli DirectoryIntegrator environment for theBlackBerry Enterprise Serverconnector.Best practice is to run theBlackBerry Enterprise Serverconnector in its own TivoliDirectory Integratorenvironment.In the Tivoli Directory Integrator environment,delete the ITDI HOME/jars/3rdparty/IBM/axis2directory. Failure to remove this directorycauses the connector to fail.Software downloadsDownload the software through your account at the IBM Passport Advantage website.Go to IBM Passport Advantage.See the corresponding IBM Security Identity server Download Document forinstructions.Note:You can also obtain additional adapter information from IBM Support.Installation worksheetThe installation worksheet lists the information that is required to install andconfigure the adapter. Complete this worksheet before you start the installationprocedure for ease of reference. Make a copy of the worksheet for each adapterinstance you install.8IBM Security Privileged Identity Manager: BlackBerry Enterprise Server Adapter Installation and Configuration Guide

Table 3. Required information to install the adapterRequired information DescriptionTivoli DirectoryIntegrator HomeDirectoryThe ITDI HOME directory containsthe jars/connectors subdirectory thatcontains adapter JAR files. Forexample, the jars/connectorssubdirectory contains the JAR file forthe UNIX adapter.ValueIf Tivoli DirectoryIntegrator is automaticallyinstalled with your product,the default directory pathfor Tivoli DirectoryIntegrator is as follows:Windows:v for version 7.1:drive\ProgramFiles\IBM\TDI\V7.1UNIX:v for version 7.1:/opt/IBM/TDI/V7.1Adapters solutiondirectoryWhen you install the dispatcher, theinstaller prompts you to specify a filepath for the solution directory. Formore information about the solutiondirectory, see the DispatcherInstallation and Configuration Guide.The default solutiondirectory is at:Windows:v for version 7.1:drive\ProgramFiles\IBM\TDI\V7.1\timsolUNIX:v for version 7.1:/opt/IBM/TDI/V7.1/timsolChapter 2. Planning9

10IBM Security Privileged Identity Manager: BlackBerry Enterprise Server Adapter Installation and Configuration Guide

Chapter 3. InstallingInstalling the adapter mainly involves importing the adapter profile and creatingan adapter service. Depending on the adapter, several other tasks can be involvedto completely install it.All IBM Tivoli Directory Integrator based adapters require the Dispatcher for theadapters to function correctly. If the Dispatcher is installed from a previousinstallation, do not reinstall it unless the Dispatcher is upgraded. See Installing thedispatcher.Depending on your adapter, the Tivoli Directory Integrator connector mightalready be installed as part of the Tivoli Directory Integrator product and nofurther action is required. If the connector is not pre-installed, install it after theDispatcher.Installing the dispatcherIf this is the first Tivoli Directory Integrator-based adapter installation, you mustinstall the RMI Dispatcher before you install the adapter. Install the RMIDispatcher on the same Tivoli Directory Integrator server where you want to installthe adapter.If you already installed the RMI Dispatcher for another adapter, you do not needto reinstall it.If you have not yet installed the RMI Dispatcher in the Tivoli Directory Integratorenvironment, download the Dispatcher installer from the IBM Passport Advantagewebsite. For more information about the installation, see the Dispatcher Installationand Configuration Guide.Installing the adapter binaries or connectorThe connector might or might not be available with the base Tivoli DirectoryIntegrator or Security Directory Integrator product. The connector is required toestablish communication between the adapter and the Dispatcher.Before you beginv Verify that your site meets all the prerequisite requirements. See “Prerequisites”on page 6 and “Prerequisites for running the adapter” on page 8.Note: The ITDI HOME/jars/3rdparty/IBM/axis2 directory must be removed fromthe Tivoli Directory Integrator environment. You can either delete it or move itto a location outside of the Tivoli Directory Integrator environment. If theBlackBerry Enterprise Server Adapter is uninstalled, you might need to restorethis directory.v The Dispatcher must be installed.Procedure1. Create a temporary directory on the workstation where you want to extract theadapter.11

2. Extract the contents of the compressed file in the temporary directory. Theextracted files are typically:ibmdita.csslicenselicense/LA. more licenses.license/LI zh TW. doc files le.jar3. Copy the appropriate BESConnector.jar file for your system to theITDI HOME/jars/connectors directory.v For BlackBerry Enterprise Server for IBM Lotus Domino, copy theconnectors/domino/BESConnector.jarv For BlackBerry Enterprise Server for Microsoft Exchange, copy theconnectors/exchange/BESConnector.jar file4. Restart the adapter service.Verifying the version of Tivoli Directory IntegratorBefore you install the adapter, ensure that the Tivoli Directory Integrator is asupported version.Procedure1. Navigate to the build.properties file in the ITDI HOME\etc\ directory on aWindows operating system.2. Open the file in text editor, such as Notepad and check the value of the Versionproperty. For example, if fix pack 1 is installed on the base version of TivoliDirectory Integrator 7.1, then the value of Version property is 7.1.0.1.Exporting and importing the BlackBerry Enterprise Server SSLcertificateYou must download the certificate from the BlackBerry Administrative Server andimport it to the CA certificate keystore.Before you beginGo to the BlackBerry Getting Started website to ensure that you have the mostcurrent instructions for downloading the certificate. les/25822/Download a copy of the SSL cert of the BAS 1430255 11.jspAbout this taskPerform the following steps to download and import the BlackBerry EnterpriseServer SSL certificate.12IBM Security Privileged Identity Manager: BlackBerry Enterprise Server Adapter Installation and Configuration Guide

Procedurev To download the BlackBerry Enterprise Server root certificate:1. Create a temporary directory. For example, C:\temp\baa.2. In a browser, open the BlackBerry Administration Service. Go tohttps://servername/webconsole/app. Servername represents the fullyqualified domain name (FQDN) or the IP address of the server that hosts theBlackBerry Administration Service.3. Click File Properties.4. In the Properties window, click Certificates.5. Click Details.6. Click Copy to File.7. Follow the screen instructions to copy the certificate in DER encoded binaryformat to the temporary directory that you created.The certificate is copied to C:\temp\baa\bascert.cer.v To import the server root certificate:Note: You must provide your CA certificate keystore password to import theserver root certificate.1. Locate the server root certificate file that you exported from BlackBerryEnterprise Server and copy it to the target host.2. Import the certificate to the local CA certificate keystore.a. Change directories to ITDI HOME/jvm/jre/bin directory.b. Type: keytool -import -trustcacerts -file \temp\baa\bascert.cer-keystore ITDI HOME/timsol/serverapi/testadmin.jks -storepassadministrator -alias basNote: The default password for the testadmin.jks keystore isadministrator.The Java keytool displays a confirmation that the certificate is added to thekeystore.Verifying the adapter installationIf the adapter is installed correctly, you can verify that the components exist in thespecified directories.Table 4. Adapter componentAdapter componentBESConnector.jarDirectoryOn the Windows operating systemITDI HOME\jars\connectors\On the UNIX operating systemITDI HOME/jars/connectors/To upgrade the BlackBerry Enterprise Server connector, copy the newBESConnector.jar file over the existing one. Restart the Tivoli Directory Integratorserver.Chapter 3. Installing13

Verifying the BlackBerry Enterprise Server environmentThe adapter supports two versions of the connector. One for the Lotus Dominoenvironment and the other for the Microsoft Exchange environment. Use themanifest file to verify that the correct BESConnector.jar file is installed for yourenvironment.1. Issue the command:jar xvf BESConnector.jar META-INF/MANIFEST.MF2.Open the META-INF/MANIFEST.MF file with an editor.3. Verify that the Implementation is correct for your environment.Implementation-Title: IBM Security Identity Manager BlackBerry Enterprise Serverfor Lotus Domino Adapter ConnectororImplementation-Title: IBM Security Identity Manager BlackBerry Enterprise Serverfor Microsoft Exchange Adapter ConnectorRestarting the adapter serviceVarious installation and configuration tasks might require the adapter to berestarted to apply the changes. For example, you must restart the adapter if thereare changes in the adapter profile, connector, or assembly lines. To restart theadapter, restart the Dispatcher.The adapter does not exist as an independent service or a process. The adapter isadded to the Dispatcher instance, which runs all the adapters that are installed onthe same Security Directory Integrator instance.See the topic about starting, stopping, and restarting the Dispatcher service in theDispatcher Installation and Configuration Guide.Importing the adapter profileAn adapter profile defines the types of resources that the IBM Security Identityserver can manage. It is packaged with the IBM Security Identity Adapter. Use theadapter profile to create an adapter service on IBM Security Identity server andestablish communication with the adapter.Before you beginv The IBM Security Privileged Identity Manager is installed and running.v You have root or administrator authority on the IBM Security Privileged IdentityManager.v The file to be imported must be a Java archive (JAR) file. The Adapter Profile.jar file includes all the files that are required to define theadapter schema, account form, service/target form, and profile properties. Ifnecessary, you can extract the files from the JAR file, modify the files, andrepackage the JAR file with the updated files.The JAR file for IBM SecurityPrivileged Identity Manager is located in the top level folder of the installationpackage.About this taskService definition files are also called adapter profile files.14IBM Security Privileged Identity Manager: BlackBerry Enterprise Server Adapter Installation and Configuration Guide

If the adapter profile is not installed correctly, the adapter cannot functioncorrectly. You cannot create a service with the adapter profile or open an accounton the service. You must import the adapter profile again.Procedure1. Log on to the IBM Security Privileged Identity Manager by using an accountthat has the authority to perform administrative tasks.2. From the navigation tree, select Configure System Manage Service Types.The Manage Service Types page is displayed.3. On the Manage Service Types page, click Import. The Import Service Type pageis displayed.4. On the Import Service Type page, complete these steps:a. In the Service Definition File field, type the directory location of the Adapter Profile.jar file, or click Browse to locate the file. For example, ifyou are installing the IBM Security Identity Adapter for a Windows serverthat runs Active Directory, locate and import the ADProfileJAR file.b. Click OK to import the file.ResultsA message indicates that you successfully submitted a request to import a servicetype.What to do nextv The import occurs asynchronously, which means it might take some time for theservice type to load into the IBM Security Identity server from the propertiesfiles and to be available in other pages. On the Manage Service Types page, clickRefresh to see the new service type. If the service type status is Failed, checkthe log files to determine why the import failed.v If you receive a schema-related error, see the trace.log file for informationabout it. The trace.log file location is specified by the handler.file.fileDirproperty that is defined in the enRoleLogging.properties file. TheenRoleLogging.properties file is in the IBM Security Identity serverHOME\datadirectory. .Creating an adapter service/targetAfter you import the adapter profile on the IBM Security Identity server, create aservice/target so that IBM Security Identity server can communicate with themanaged resource.Before you beginComplete “Importing the adapter profile” on page 14.About this taskYou must create an administrative user account for the adapter on the managedresource. You can provide the account information such as administrator name andpassword when you create the adapter service. Ensure that the account hassufficient privileges to administer the users. For information about creating anadministrative account, see the documentation for the managed resource.Chapter 3. Installing15

To create or change a service, you must use the service form to provideinformation for the service. Service forms might vary depending on the adapter.The service name and description that you provide for each service are displayedon the console. Therefore, it is important to provide values that make sense to yourusers and administrators.Procedure1. From the navigation tree, click Manage Services.2. On the Services table, click Create. The Create a Service wizard is displayed.3. On the Select the Type of Service page, click Search to locate a business unit.The Business Unit page is displayed.4. On the Business Unit page, complete these steps:a. Type information about the business unit in the Search information field.b. Select a business type from the Search by list, and then click Search. A listof business units that matches the search criteria is displayed.If the table contains multiple pages, you can do the following tasks:v Click the arrow to go to the next page.v Type the number of the page that you want to view and click Go.c. In the Business Units table, select business unit in which you want to createthe service, and then click OK. The Select the Type of Service page isdisplayed, and the business unit that you specified is displayed in theBusiness unit field.5. On the Select the Type of Service page, select a service type, and then clickNext.6. On the Service Information page, specify the appropriate values for the serviceinstance. The content of the Service Information page depends on the type ofservice that you are creating.7. Click Finish.ResultsA message is displayed, indicating that you successfully created the serviceinstance for a specific service type.Service/Target form detailsComplete the service/target form fields.On the General Information tab:Service NameSpecify a name that defines the adapter service on the IBMSecurity Identity server.Note: Do not use forward (/) or backward slashes (\) in theservice name.DescriptionSpecify a description that identifies the service for yourenvironment.Tivoli Directory Integrator locationSpecify the URL for the IBM Tivoli Directory Integrator instance.The valid syntax for the URL is rmi://ip-address:port/16IBM Security Privileged Identity Manager: BlackBerry Enterprise Server Adapter Installation and Configuration Guide

ITDIDispatcher, where ip-address is the IBM Tivoli DirectoryIntegrator host and port is the port number for the RMI Dispatcher.The default URL for the default SDI1 instance isrmi://localhost:1099/ITDIDispatcher.Server Host NameSpecify the name of the host that is running the BlackBerryEnterprise Server.Administrator NameSpecify the administrator user that is used to log in to the resourceand perform user management operations. Make sure that theadministrator user has Security Administrator authority on theBlackBerry Enterprise Server.Note: If you use the Active Directory authenticator type, do notuse a domain-qualified administrator name. That is, do not use theDomainName\UserName format, just use UserName.PasswordSpecify the password for administrator user.Authentication DomainSpecify the authentication domain to use when the userauthenticates to the BlackBerry Enterprise Server. This field is notrequired for all authenticator types. Active Directory authenticationrequires an authentication domain, but BlackBerry AdministrationService authentication does not.Authenticator TypeSpecify the type of authentication to use to access the BlackBerryEnterprise Server. The following are examples of authenticatortypes.v Active Directoryv BlackBerry Administration Servicev Domino mailboxNote: This field is not case-sensitive.On the Dispatcher Attributes tab:AL FileSystem PathSpecify the file path from where the dispatcher loads the assemblylines. If you do not specify a file path, the dispatcher loads theassembly lines that are received from IBM Security Identity server.You can specify a file path such as the following to load theassembly lines from the profiles directory of the Windowsoperating system: c:\Program Files\IBM\TDI\V7.1\profiles or youcan specify the following file path to load the assembly lines fromthe profiles directory of the UNIX and Linux operating systems:/opt/IBM/TDI/V7.1/profiles. You must extract the assembly linefiles from the profile JAR file. Use a command such asjar xvf BESProfile.jarextracts the filesBESProfileBESProfile/BESAdd.xmlChapter 3. Installing17

ma.dsmlBESProfile/service.defYou must copy the assembly line files to the location that youspecify for the AL FileSystem Path.Max Connection CountSpecify the maximum number of assembly lines that the dispatchercan execute simultaneously for the service. If you enter 0 in theMax Connection Count field, the dispatcher does not limit then

viii IBM Security Privileged Identity Manager: BlackBerry Enterprise Server Adapter Installation and Configuration Guide. Chapter 1. Overview An adapter is an interface between a managed r esour ce and the IBM .