![]() |
![]() |
Build the Examples before running them. Make sure the ITIM server is running. Also verify
that the values entered for the environment variables ITIM_USER and ITIM_PSWD in the setEnv.bat/setEnv.sh files have a valid ITIM user and password respectively.
Creating a new Person
The CreatePerson.java source file demonstrates how to create a new Person.
Execute the accompanying createPerson.sh or createPerson.bat file using the following command syntax:
Windows usage:
usage: createPerson -[argument] ? "[value]" -profile
Profile name of the new Person to create Example: createPerson -profile?"Person" -attribute?"cn=Jenny Brown" -attribute?"sn=Brown" |
The command line syntax is a list of name/value pairs in the format –[argument]
? “[value]”. The list of attributes should include all of the
required attributes for a Person. The default required attributes are sn
and cn.
Changing a Person’s Attributes
The ChangePerson.java source file demonstrates how to modify a Person’s attributes.
Execute the accompanying changePerson.sh or changePerson.bat file using the following command syntax:
Windows usage:
usage: changePerson -[argument] ? "[value]" -personfilter Ldap Filter to search for the
Person to change Example: changePerson -personfilter?"(cn=Jenny Brown)" -attribute?"cn=Jenny Green" |
The command line arguments are an LDAP search filter, followed by a list of name/value pairs in the form –[argument] ? “[value]”. The Search Filter argument is used to identify the person being modified. In most instances, the ‘cn’ attribute will be used to identify a person.
Deleting a Person
The DeletePerson.java source file demonstrates how to Delete a Person.
Execute the accompanying deletePerson.sh or deletePerson.bat file using the following command syntax:
Windows usage:
usage: deletePerson -[argument] ? "[value]" -personfilter Ldap Filter to search for the Person to delete Example: deletePerson -personfilter?"(cn=Jenny Brown)" |
The command line argument is a Search Filter used to identify the person being
deleted. In most instances, the ‘cn’ attribute will be used to identify a
person.
Note that when a person is deleted, all of his accounts will be deprovisioned.
Provisioning an Account
The ProvisionAccount.java source file demonstrates how to Provision an Account.
Execute the accompanying provisionAccount.sh or provisionAccount.bat file using the following command syntax and argument list:
Windows Usage:
usage: provisionAccount -[argument] ? "[value]" -profile
Object Profile Name for the Account to provision (e.g., NT40Account) Example:
provisionAccount -profile?NT40Account -serviceprofile?NT40Profile -uid?JSmith
|
Note that the list of attributes should include at least all the required
attributes to create the type of account.
Changing an Account
The ChangeAccount.java source file demonstrates how to change an account’s attributes.
Execute the accompanying changeAccount.sh or changeAccount.bat file using the following command syntax:
Windows usage:
usage: changeAccount -[argument] ? "[value]"
-profile
Object Profile Name for the Account to change (e.g., NT40Account) Example:
changeAccount -profile?NT40Account -accountfilter?"(eruid=JSmith)" |
The command line arguments are the profile name of the Account, an LDAP
search filter to lookup the account to be changed, and a list of attribute
name? value pairs defining the attributes to change.
Changing an Account Password
The ChangePassword.java source file demonstrates how to change an account’s password.
Execute the accompanying changePassword.sh or changePassword.bat file using the following command syntax:
usage: changePassword -[argument] ? "[value]" -profile
Object Profile Name for the Account to change password (e.g.,
ITIMAccount) Example: changePassword -profile?ITIMAccount -accountfilter?"(eruid=JSmith)" -password?"secret" |
The command line arguments are the profile name of the Account, an LDAP
search filter to lookup the account, and a password value.
Deprovisioning an Account
The DeprovisionAccount.java source file demonstrates how to deprovision an Account.
Execute the accompanying deprovisionAccount.sh or deprovisionAccount.bat file using the following command syntax:
usage: deprovisionAccount -[argument] ? "[value]" -profile
Object Profile Name for the Account to deprovision (e.g., NT40Account) Example: deprovisionAccount -profile?NT40Account -accountfilter?"(eruid=JSmith)" |
The command line arguments are the profile name of the Account, and an
LDAP search filter to to lookup the account to be removed (deprovisioned).
Synchronizing all of a Person’s Account Passwords
The SynchPasswords.java source file demonstrates how to set all of the passwords for a person’s accounts.
Execute the accompanying synchPassword.sh or synchPassword.bat file using the following command syntax:
usage: synchPassword -[argument] ? "[value]" -ownerfilter Ldap Filter to search for
a Person whose account passwords are to be synchronized Example: synchPassword -ownerfilter?"(cn=Joe Smith)" -password?"secret" |
The command line arguments are an LDAP search filter to lookup a Person,
and a new password for all accounts the Person owns. In most instances,
the ‘cn’ attribute will be used to identify a person.
Retrieving Assignments of a Person Account
The PersonAssignments.java source file demonstrates how to get all assignments for a person account.
Execute the accompanying personAssignments.sh or personAssignments.bat file using the following command syntax:
usage: personAssignments -[argument] ? "[value]" -accountfilter Ldap Filter to search for an account whose assignments are to be retrieved Example: personAssignments -accountfilter?"(eruid=JSmith)" |
The command line arguments are an LDAP search filter to lookup an Account.
In most instances, the ‘eruid’ attribute will be used to identify
an account.
Changing an Account Password by invoke the operation through Lifecycle
Management APIs
The ChangePasswordOperation.java source file demonstrates how to invoke change account’s password operation.
Execute the accompanying changePasswordOperation.sh or changePasswordOperation.bat file using the following command syntax:
usage: changePasswordOperation -[argument] ? "[value]" -profile
Object Profile Name for the Account to change password (e.g.,
ITIMAccount) Example: changePasswordOperation -profile?ITIMAccount -accountfilter?"(eruid=JSmith)" -password?"secret" -notifypassword?"true" |
A service can have multiple reconciliation units configured, but with different schedules.
A schedule uniquely identifies a reconciliation unit of a service.
The published class com.ibm.itim.apps.recon.ReconUnitData, represents a
reconciliation unit of a service at the API level.
The published class com.ibm.itim.apps.recon.ReconManager, provides all
functions required to perform reconciliation related operations, through API.
As a service points to a remote resource, the terms 'service' and
'resource' are used interchangeably in this documentation. Also the
term 'reconciliation' and 'recon' are used interchangeably.
Scheduling Reconciliation for a service
The AddReconUnit.java source file demonstrates how to add a new recon unit.
Execute the accompanying addReconUnit.sh or addReconUnit.bat file using the following command syntax and argument list:
Windows Usage:
usage: addReconUnit -[argument] ? "[value]"
-serviceprofile
Profile Name of the Service to add a recon (e.g., WinLocalProfile)
Arguments enclosed in [] are optional
Example: addReconUnit -serviceprofile?WinLocalProfile -servicefilter?"(erservicename=WinLocal)"
Example: addReconUnit -serviceprofile?WinLocalProfile -servicefilter?"(erservicename=WinLocal)"
|
Windows Usage:
usage: removeReconUnit -[argument] ? "[value]"
-serviceprofile
Profile Name of the Service (e.g., WinLocalProfile)
Example: removeReconUnit -serviceprofile?WinLocalProfile -servicefilter?"(erservicename=WinLocal)"
Example: removeReconUnit -serviceprofile?WinLocalProfile -servicefilter?"(erservicename=WinLocal)"
|
This example performs a dual job, of adding a new reconciliation unit and then
running reconciliation with this new unit. Details on how to run reconciliation using an
existing reconciliation unit, have been documented in the example source file.
Execute the accompanying runRecon.sh or runRecon.bat file using the following command syntax and argument list:
Windows Usage:
usage: runRecon -[argument] ? "[value]"
-serviceprofile
Profile Name of the Service to run recon (e.g., WinLocalProfile)
Arguments enclosed in [] are optional
Example: runRecon -serviceprofile?WinLocalProfile -servicefilter?"(erservicename=WinLocal)"
Example: runRecon -serviceprofile?WinLocalProfile -servicefilter?"(erservicename=WinLocal)"
|
Windows Usage:
usage: getAvailableReconAttributes -[argument] ? "[value]"
-serviceprofile
Profile Name of the Service (e.g., WinLocalProfile)
Example: getAvailableReconAttributes -serviceprofile?WinLocalProfile -servicefilter?"(erservicename=WinLocal)"
|
Windows Usage:
usage: isFilterSupported -[argument] ? "[value]"
-serviceprofile
Profile Name of the Service (e.g., WinLocalProfile)
Example: isFilterSupported -serviceprofile?WinLocalProfile -servicefilter?"(erservicename=WinLocal)"
|
Windows Usage:
usage: getReconUnits -[argument] ? "[value]"
-serviceprofile
Profile Name of the Service (e.g., WinLocalProfile)
Example: getReconUnits -serviceprofile?WinLocalProfile -servicefilter?"(erservicename=WinLocal)"
|
Windows Usage:
usage: setServiceReconParams -[argument] ? "[value]"
-serviceprofile
Profile Name of the Service (e.g., WinLocalProfile)
Arguments enclosed in [] are optional
Example: setServiceReconParams -serviceprofile?WinLocalProfile -servicefilter?"(erservicename=WinLocal)"
|