Learn with karthik !!!

Tivoli Identity Manager Architecture

noreply@blogger.com (karthik) — Mon, 19 Jul 2010 05:40:00 +0000

The Tivoli Identity Manager Server application runs on IBM WebSphere Application Server and communicates with adapters on remote systems.The Tivoli Identity Manager application runs on a single-server configuration with the WebSphere Application Server base product. However, Tivoli Identity Manager can also run in a larger cluster configuration that is composed of one or more WebSphere Application Servers and of a deployment manager that manages a cluster.

Tivoli Identity Manager stores transactional and historical data in a database server. For example, the Tivoli Identity Manager provisioning processes use a relational database to maintain their current state and their history. A type 4 Java Database Connectivity driver (JDBC™ driver) connects the Tivoli Identity Manager Server to a database. The DB2 and Microsoft SQL type 4 JDBC drivers are bundled with the Tivoli Identity Manager installation program. For an Oracle database, you must obtain this JDBC driver (ojdbc14.jar) from your Oracle Database Server installation.

Along with using a relational database, Tivoli Identity Manager stores the current state of the managed identities in an LDAP directory, including user account and organizational data. It is always recommended that Tivoli Identity Manager has its own database and LDAP server, due to the high volume of data exchange between these two components and Tivoli Identity Manager Server.

Finally, an HTTP server, such as IBM HTTP Server, and an IBM WebSphere Web server plug-in enable browser-based access to the Tivoli Identity Manager Server.

Click on the figure to zoom

The above fig illustrates that Tivoli Identity Manager supports the use of two type of adapters:

Agent-based adapters, which must reside on the managed resource to administer accounts. Communication between adapter and Tivoli Identity Manager Server is usually through DAML protocol. So, these adapters are often called DAML-based adapters.

Agentless adapters can reside on a remote server to administer accounts. For example, the UNIX/Linux adapter is an agentless adapter.

IBM Tivoli Directory Integrator is an optional installation component that is used for hosing of agentless, RMI-based (Remote Method Invocation) adapters. The tool is also used for complex HR feeds (a load of person data into Tivoli Identity Manager) from typical resources or from multiple resources. Tivoli Directory Integrator can be installed on a separate server (usually called Adapter server),or it can be co-located on the same server that runs WebSphere Application Server and Tivoli Identity Manager Server.

The RMI Dispatcher is a Tivoli Directory Integrator component that enables the Tivoli Identity Manager Server to communicate with a Tivoli Directory Integrator-based adapter using RMI. The RMI Dispatcher is the request handler inside Tivoli Directory Integrator for the Tivoli Directory Integrator-based adapters. The RMI Dispatcher is not installed with the base Tivoli Directory Integrator product and must be installed separately in order for the Tivoli Directory Integrator-based adapters to run.

Directory and Database

noreply@blogger.com (karthik) — Sat, 17 Jul 2010 07:42:00 +0000

Though both directory and database are considered as organized collection of data, they have subtle differences.

A directory is optimized for read operations. To query any data from a directory we use an application protocol called LDAP (Light weight directory access protocol). This protocol is used specifically for querying data as well as modifying said data. Examples for LDAP Directory: Active Directory, Tivoli Directory Server, Oracle Internet Directory

A database is optimized for write and change operations. Originally, databases were flat. This means that the information was stored in one long text file. Each entry in the file is separated by a special character, such as a vertical bar (|). Querying data from such flat files made our job cumbersome.

Then in 1970’s the 'Relational database' came into picture which uses tables to store information. Relational databases are created using a special computer language called structured query language (SQL). SQL is the foundation for all of the popular database applications available today. Examples for Relational Database: Oracle Database, DB2, Microsoft SQL Server

Therefore, any data that is read many more times than it is written or modified is a good candidate for storage in a directory.

Web server and Application server

noreply@blogger.com (karthik) — Mon, 05 Jul 2010 09:35:00 +0000

A Web server can execute only Web applications.The Web applications are usually stored on a server and delivered to users over the Internet. The Web server takes the HTTP request, then passes it to a server-side program (Servlets, JSPs, ASPs, CGI Scripts...) to handle the request. Once processed, the HTML response is sent back to your Web browser.

In short web server simply serves pages for viewing in web browser. Examples: Apache Web server, Google Web server

An application server is capable of executing Enterprise applications.It can act as a simple Web server or can run Enterprise business logic.For example, a J2EE application server exposes the business logic through a component API (Such as an Enterprise JavaBean component).Then a client application program (Say a GUI running on a PC, a Web server, or even other application server) can employ this exposed business logic however it wants.

It implies an application server can support HTTP,TCP/IP and many more protocols.In addition, application server also has extra features like security, transaction processing, resource pooling and messaging. Examples: Websphere, Jboss, Weblogic

Functional level definition of Identity management

noreply@blogger.com (karthik) — Fri, 26 Mar 2010 18:42:00 +0000

Identity – An Employee or Non-employee. Here Non-employee includes business partners, customers or contractors.

Management – Creating, Updating or Deleting function that manages the identity details and account details.

Difference between identity details and account details

Identity detail includes one's own common details say their first name, last name, address, Phone number etc.

Some of the user accounts at target resources are

Windows user account
Linux user account
Web mail account

User information form and Account form may or, may not have common attributes.

In the above example we have First name and Last name as common attributes. But it is not mandatory to have such common attributes in general.

An IDM suite will make our job easier to manage these accounts for any number of users in an organization.

you may also interested in A glance at identity manager suites

Authentication and Access Control

noreply@blogger.com (karthik) — Wed, 10 Mar 2010 10:14:00 +0000

"Authentication is any process by which you verify that someone is who they claim they are. Otherwise the process of identifying an individual usually based on a username and password is what we call as authentication."

"Access control is a much more general way of talking about controlling access to a resource. Access can be granted or denied based on a wide variety of criteria."

To understand it better let me explain these with an example.

I hope you all are familiar with 'Windows XP user accounts'.

Consider both Administrator and Guest accounts. And also consider you have set the password for Administrator account.

Say, you want to sign in as ‘Administrator’. That means you are going to claim yourself as 'Administrator'. For that you need to give the corresponding password for the administrator account. Then only the system will allow you to login. For simple understanding we can consider 'Authentication' as a process of ‘user credential verification'.

Now let us think about the difference between Administrator Account and Guest Account. Both are user accounts but the difference here is that Administrator has more privileges than Guest i.e. Administrator can do more things in the system than a guest can. For instance, Administrator can change date/time of the system but the guest cannot.These kind of controlling the access based on some criteria we call it as access control.

These criteria in IDM we normally control by defining 'Roles' and 'Policies'. This you will understand better when you start working on any IDM suite.

A glance at identity manager suites

noreply@blogger.com (karthik) — Tue, 09 Mar 2010 12:18:00 +0000

Identity manager suite helps to reduce the cost and redundant tasks in managing the identities.

Some of the popular identity manager suites are

Sun Identity manager
Oracle Identity manager
Novell Identity manager
Tivoli Identity manager (IBM Product)

Though the user interface for all these suite seems different the functioning and basic concepts remains one and the same.

What is Identity management(IDM) ?

noreply@blogger.com (karthik) — Tue, 09 Mar 2010 12:04:00 +0000

When you Google "Identity Management", mostly you will be end up with the definition that’s given below

“Identity management (ID management) is a broad administrative area that deals with identifying individuals in a system (such as a country, a network, or an enterprise) and controlling their access to resources within that system by associating user rights and restrictions with the established identity.”

As a novice it’s little difficult to understand the concept above. So let me try to explain this in a simpler way.

Identifying individuals in a system – Identifying a person in an organization. For example, in an organization each employee is uniquely identified using their employee number.

Controlling access to the resources – In an organization, employees are only allowed to visit the bay to which they have access. Imagine restricted bay access in a typical IT company.

You Should also Read...

Authentication and Access control

Functional level definition of Identity management

Simple way to display current Timestamp using Java

noreply@blogger.com (karthik) — Thu, 10 Dec 2009 13:30:00 +0000

String timeStamp()

{

java.util.Calendar calendar = java.util.Calendar.getInstance();

return (new java.text.SimpleDateFormat("yyyyMMddHHmm").format(calendar.getTime()));

}

Consider today's date is Dec 10, 2009 and the time is half passed five in the morning then the above code will return 200912100530 as output.

Refer SimpleDateForamt API for more display customization.

About

noreply@blogger.com (karthik) — Sat, 26 Sep 2009 11:38:00 +0000