You might have configured, or ready to configure the IBM Single Sign and some ISIM/PIM/ESSO products are transforming to the IBM Identity virtual appliance for the next generation plant forms. I've been on a steep learning curve for many years, and still many interests in this ESSO enterprise solution for the new or old customers,. I just thought of writing this blog for anyone who configure the ISIM/PIM/ESSO solution products to summarize all of tips and sticks since all infor are not in the one place. This blog will help all to have the check-list, and detail trouble-shooting here.

Most sticky part is integrated with many components.

• IBM security Directory Integrator known as SDI or TDI
• Either you configure the IBM Privilege Manager 2.x virtual appliance that's included the IMS server and IBM IMS Config utility  or IMS 8.2.2 based on WebSphere 8.5.5
• IBM Identity Manager 6.0 based on WebSphere 8.5.5 or IBM Security Identity Manager 7.0.
• all above required the IBM Directory Server and DB2 Server (Oracle)
• ISIM v7.0 Access Manager Enterprise Single Sign On (ESSO) adapter
• Dispatcher and its profile for the ESSO Adapter
• JRE Java for SDI/IDI must be installed separately for JRE due to JRE 6.0 are no longer supported, either JRE 7.0 or 8.0 need in order to work with the dispatcher properly.

First you might want to review this
The Adapter requirements
The Adapter readme usually good start to check the most recent the overview of what it is supported or not.
The IBM system requirements for a specific product might have some outdated infor so please refer the Adapter guide

We offer the number of configuration routes.

There are two main servers required,
IMS and ISIM stream

1. Virtual appliance might be the most easiest way to configure up for the IMS and ISIM side however, some existing or new deployments still prefer the WAS based, in the future, most likely, all go on VA(s), number of improvements, and easy to deploy, and many benefits. The virtual appliance for POWER-based systems offers increased deployment flexibility. Provides hardware, service, and basic virtualization management for your Power Systems servers.

2. IMS/ISIM WAS based applications (commonly older version ISIM 6.0 or IMS 8.2)

Then, you have the SDI/TDI 7.2 or 7.1.1 (just make sure to use the latest one, SDI 7.2 will be fully supported.)
SDI/TDI is basically a tool for real time synchronization of repositories of data, with a special focus on identity data, including directories, databases, and operating system repositories. How to install exe or bin

The SDI/TDI fixpack, make sure to refer the SDI/TDI Fixpack Readme, usually applyUpdates.bat -update <FP> or applyUpdates.bat -queryreg to check the version on. Refer the readme here, Please check the most recent one to see any updates also

TDI 7.1.1 is 32 bit or 64 bit base, so make sure JRE updates are replaced under the JRE folder when the JRE updated based on the bit version, otherwise, the Dispatcher would not work. The TDI 7.1.1 reference here

The Dispatcher is 7.1.37 or 6.0.39 is a bit sticky when you install the dispatcher.
Before installing the dispatcher, make sure to do this first
SDI 7.2 or TDI 7.1.1 install with the installer, very straight forward install
Then, install the JRE update

For JVM 7: 7.1.1-TDI-TDI-LA0040 (Applicable for 7.2) For JVM 8: 7.2.0-ISS-SDI-LA0019

Above LA fixes should be applied to work with the Dispatcher, so make sure to apply those.

The ISIM 6.0 or ISIM 7.0 very similar configuration on the service form
Just make sure the firewall disabled on 9443 where the IMS server is running.
The IMS SSL on default listener is 9443
The TDI/SDI dispatcher port, when you install the Dispatcher, usually configure 1099
The reference of the solution.properties under timsol, when you configure the dispatcher install, it will ask you where to create a new directory called timsol. All of related dispatcher install will be under timsol.
SDI/Dispatcher install can be few consideration.

• Set up the DEBUG in log4.properties file that will be installed with dispatcher, make sure to set to DEBUG underlog4j.rootCategory=INFO, Default so after configuration the dispatcher probably you will check the ibmdi.log for the connection test, as well as some operations infor.
• Set up the Solution.properties file for , SSL enabled/disable , CA file location, and the port listener for dispatcher, mainly those area that to be aware of.

Trouble-shooting for TDI/SDI
netstat -an | grep or findstr 1099
When you do the test connection from the ISIM service form, it will be helpful, how this cmd will be shown.

The IMS bridge has to be on SSL so you will import the cer file from the IMS server webconf site, and extract the cer, and import to the current

keytool.exe -import -alias esso -file esso.cer -keystore "C:\Program Files (x86)\ibm\TDI\V7.1.1\timsol\serverapi\testadmin.jks" -storepass administrator
Owner: CN=masa822ad.masa.local, OU=jtims822adCell01, OU=masa822adCellManager01, O=IBM, C=US
Issuer: CN=masa822ad.masa.local, OU=Root Certificate, OU=masa822adCell01, OU=masa822adCellManager01, O=IBM, C=US
Serial number: 1a1e13d2ea55
Valid from: 2/3/17 11:45 AM until: 2/2/22 11:45 AM
Certificate fingerprints:
MD5: 58:8A:66:0E:BC:96:85:BD:D4:03:AD:8C:83:84:A7:E5
SHA1: E0:BF:96:86:27:F2:1A:3A:BF:0D:56:5C:D9:9A:F9:05:13:A7:52:E7
SHA256: 9E:C2:35:82:5E:CC:84:44:C9:A9:5C:53:B8:C2:35:6D:4C:F8:14:C3:F0:4F:C3:2A:58:10:33:E4:5E:57:1C:C6
Signature algorithm name: SHA256withRSA
Version: 3
Trust this certificate? [no]: yes
Certificate was added to keystore

Either you can use your own jks file or already testadmin.jks is installed when you install the dispatcher, so you should use that for the default one / default password is administrator and import the alias like esso/ims then, to the cer file to that jks so when the IMS server requires SSL passed to the ISIM as the IMS bridge.

IBMDI.log  is located under the root directory of where the solution.properties is installed, in this case, /timsol/logs since the timsol folder has the solution.properties file, and that's considered as the root directory.

# This is the default logger, you will see that it logs to ibmdi.log log4j.appender.Default=org.apache.log4j.FileAppender log4j.appender.Default.file=logs/ibmdi.log

Most likely, valuable logging helps you a lot.

• SAMESSOCONNECTOR version Connector com.ibm.di.connector.samesso.SAMESSOConnector: 6.0.3.18. The connector is located under jar folders this is the main key connection tool between ISIM server and dispatcher to connect to the IMS server.
• Dispatcher version, usually starts with RMI....
• The Adapter version or adapter profile version, means the same, that's for the ISIM service form where you can customize the profile, and change the account profile infor, like attributes
• DEBUG or infor setting.
• IMS server infor where the connection sent to
• ISIM infor, and also the dispatcher where it is running from.
• The failure and errors are found in the logs, and the IBM support always look into this ibmdi.log to investigate any failure of the ESSO account operations.

RMI dispatcher -
If you have some issue with the dispatcher, you might have this often
How to uninstall manually
Usually, the <SDI_HOME>timsol/dispatcheruninstall folder, has the uninstall so open cmd with admin, then, run java -jar uninstaller.jar will uninstall the dispatcher
also you need to sc cmd to uninstall the dispatcher service.

Most likely, trick is that you might want to install SDI 7.2 and TDI 7.1.1 both in different directories, as well as you can install the JRE on different folders, and if you don't use the jre for older ones, you can just rename it, and install the JRE 7 or 8 and use that for testing.

This is very good approach when you test some of SDI 7.2 and TDI 7.1.1.

ISIM 6.0 installation guide
ISIM 7.0.1 installation guide
IMS 8.1/8.2 installation guide
ISPIM 2.x installation guide

PIM 2.x setting are similar for SDI side as well as dispatcher configuration, just difference are the PIM installation part of it are different from WAS base, so please refer that above the PIM 2.x installation guide.

The ISIM trouble-shooting for tracing and msg.log reference.

The ISIM/IMS server side consider below
ESSO profile import
ESSO extension workflow
ESSO subform jar
ESSO Connector
IMS Server bridge
I found above are simple configuration however, the ESSO connector might be careful which version to be used, and the bridge esso name is case sensitive, so when you place the esso name has to be the same case, the profile improt in ISIM under service type, you can check trace.log and if any errors you might be checking into. The workflow extension either using the createAccount or createAccountESSO method, you can configure in the manage operation, and account level for esso, and add/modify/ etc, and open it, and the workflow extension node can be adjusted .

The Dispatcher RMI either can be configured on SSL or none SSL can be enabled or disabled in the solution.properties file. Reference

Hope all helpful, and give me the comments and feedback will be appropriated. Thanks.










































------------------------------
Masa Imokawa
Software Engineer
IBM
------------------------------