Initializing and configuring the LDAP connector for IBM RACF
Pre-requisites
Platform Support
Operating Constraints
Pre-installation Information
How to initialize and configure the RACF LDAP connector
System Variables
Domain Filter Setting
User Mapping Information
Group Mapping Information
System Filtering on Users and Groups
Data Set Profile Mapping Information
Appendix: RACF User Attributes
Appendix: RACF Group Attributes
Appendix: RACF Data Set Profile Attributes
Appendix: Auxiliary Classes
Mandatory RACF Data Set Profile Attributes
Property Mapping Rules
Object Matching Rules
Sample Data Set Profile Mapping
TSO Command Execution
Auxiliary Classes
RACF Groups and RACF Universal Groups
RACF pass phrase support
Initializing and configuring the LDAP connector for IBM RACF
This document describes how to initialize and configure the RACF LDAP connector into an existing One Identity Manager system. This allows a One Identity Manager system to access, read, and update data stored in a RACF database on an IBM mainframe.
Detailed information about this topic
- Pre-requisites
- Platform Support
- Operating Constraints
- Pre-installation Information
- How to initialize and configure the RACF LDAP connector
- Domain Filter Setting
- System Variables
- User Mapping Information
- Group Mapping Information
- Data Set Profile Mapping Information
- TSO Command Execution
- Auxiliary Classes
- RACF Groups and RACF Universal Groups
- RACF pass phrase support
Pre-requisites
- The IBM mainframe must have the IBM Tivoli Directory Server for z/OS installed and configured.
- An LDAP service account must be created in your RACF database with the appropriate permissions to administer users and groups on this platform. To be able to administer everything in the RACF database, the user will need the RACF ‘special’ privilege.
- If more than 4096 records need to be retrieved from the RACF database in any one search (e.g. if there are more than 4096 users defined on the system) then the Quest RACF TDS Exit must be installed and configured.
- If data set profile data is to be synchronized, then the Quest RACF TDS Exit must be installed and configured.
|
|
NOTE: Before attempting to connect to the Tivoli Directory Server with the One Identity Manager connector, it is recommended to first check that the LDAP server is running correctly. This can be tested with any LDAP browser for example the LDP.exe tool from Microsoft. For more information, see your LDAP browser documentation. |
Platform Support
- The RACF LDAP connector has been verified for synchronization against the IBM mainframe running z/OS 1.8 (and RACF 1.8) or later.
Operating Constraints
- There is an eight character limit for user and group names on RACF.
- There is an eight character limit for passwords on RACF.
- If the Quest RACF TDS Exit has not been installed then there is a limit of 4096 records that can be read from the RACF system in any one search operation.
- If the Quest RACF TDS Exit has not been installed then the RACF dataset LDAP object will not be available to the connector.