-
DistinguishedName (primary rule) vrtEntryDN
vrtEntryDN is a virtual property, set to the DN of the object in the connector. This forms a unique ID to distinguish individual dataset objects on the RACF system.
To convert this mapping into an object matching rule
-
Select the property mapping rule in the rule window.
-
Click
in the rule view toolbar.
A message appears.
-
Click Yes to convert the property mapping rule into an object matching rule and save a copy of the property mapping rule.
Sample value:
racfdataset=ABCDB.*.**,profileType=dataset,cn=mainframe1,o=mycompany,c=com
-
Initializing and configuring the LDAP connector for IBM RACF
Prerequisites
Platform support
Operating constraints
Pre-installation information
How to initialize and configure the RACF LDAP connector
System variables
Domain filter setting
User mapping information
Group mapping information
System filtering on users and groups
Data set profile mapping information
RACF user attributes
RACF group attributes
RACF data set profile attributes
Auxiliary classes
Mandatory RACF data set profile attributes
Property mapping rules
Object matching rules
Sample data set profile mapping
Run TSO command
Auxiliary classes
RACF groups and RACF universal groups
RACF pass phrase support
Object matching rules
Initializing and configuring the LDAP connector for IBM RACF > Data set profile mapping information > Object matching rules
Sample data set profile mapping
Initializing and configuring the LDAP connector for IBM RACF > Data set profile mapping information > Sample data set profile mapping
The following figure shows the data set profile mapping in operation.
Run TSO command
The RACF LDAP connector can be used to run any TSO command on the connected system if the Quest RACF TDS Exit has been installed and configured. This TSO command execution needs to be configured manually for the connector made available with One Identity Manager.
Create a custom defined process using the MFRComponent process component. Use the RACF LDAP connector server function to specify the execution server. The One Identity Manager Service is installed on this server with the RACF LDAP connector.
For more detailed information about configuring the server and creating processes, see the One Identity Manager Configuration Guide.
Auxiliary classes
The RACF user and group objects have a number of auxiliary classes available to add extra attributes. There are 13 of these auxiliary classes in total.
Auxiliary classes that can extend the RACF user object:
-
SAFTSOSegment
-
SAFDfpSegment
-
racfCicsSegment
-
racfLanguageSegment
-
racfOperparmSegment
-
racfWorkAttrSegment
-
racfUserOmvsSegment
-
racfUserOvmSegment
-
racfNetviewSegment
-
racfDCESegment
Auxiliary classes that can extend the RACF group object:
-
racfGroupOmvsSegment
-
racfGroupOvmSegment
-
SAFDfpSegment
The additional attributes that each of these makes available is listed in Auxiliary classes.
When the RACF user or group object is viewed in the Synchronization Editor, all of the attributes made available by all of the above auxiliary classes are listed by default and can be used in user or group mappings. To make use of additional attributes during a synchronization to RACF, the user or group object must contain the corresponding object class for each additional attribute or the attribute will be discarded. The object class attribute for a user is multi-valued and must contain the full list of all object classes needed for the user.
For example, the auxiliary class racfUserOvmSegment contains an attribute called racfOvmUid.
To successfully synchronize a value to this attribute for a user, the user object must contain the value racfUserOvmSegment in its object class attribute.