Previous Topic: XPSExportNext Topic: Map the Active Directory inetOrgPerson Attribute

Policy Server Guides › Policy Server Administration Guide › Policy Server Tools › XPSExport › Arguments for smldapsetup

Arguments for smldapsetup

Arguments allow you to specify the information used by the modes to manage the LDAP policy store. If you do not specify arguments, smldapsetup uses the values configured in the Policy Server Management Console.

Note: smldapsetup does not allow spaces between an argument and its value. For example, the -h argument should be specified as follows:
smldapsetup ldmod -hldapserver.mycompany.com

The arguments you can specify in an smldapsetup call are listed below:

-hhost

Specifies the fully qualified name of the LDAP server; the relative name, if the machines are in the same domain (-hldapserver); or the IP address (-h123.12.12.12). If you do not specify a host, smldapsetup uses the previously configured value as the default.

Example: -hldapserver.mycompany.com

-pport_number

Specifies a non-standard LDAP port. The LDAP port must be specified if the LDAP server is using a non-standard port or if you are moving a server to a new server that uses a different port, such as moving from a server using SSL to one that is not. If a port is not specified, the previous configuration values are used. If no previous port configuration has been specified, smldapsetup uses the default ports 389, if SSL is not being used, or 636, if SSL is being used.

-duserdn

Specifies the LDAP user name of a user with the power to create new LDAP directory schema and entries. This is not necessarily the user name of the LDAP server administrator. If you do not specify a user name, smldapsetup uses the previously configured name as the default.

-wuserpw

Specifies the password for the user identified in the -d argument. If you do not specify a password, smldapsetup uses the previously configuration value.

Example: -wMyPassword123

-rroot

Specifies the distinguished name of the node in the LDAP tree where SiteMinder will search for the policy store schema. If you do not specify a root, smldapsetup uses the previously configured root.

Example: -ro=security.com

-e

When specified with smldapsetup ldgen, generates an LDIF file that can delete the SiteMinder schema. The generated file must be used with smldapsetup ldmod to remove the schema.

-mn

Skips automatic detection of LDAP servers and specify type of LDAP policy store where n is one of the following:

2

iPlanet v4 LDAP servers.

3

Active Directory LDAP servers.

4

Oracle Internet Directory.

5

iPlanet v5.

6

Sun Directory Servers.

9

Active Directory Application Mode (ADAM).

-fldif

Specifies the absolute or relative path to an LDIF file from the directory in which smldapsetup is being executed.

Example: -f../siteminder/db/smldap.ldif

Default: if you do not specify a path, smldapsetup uses the current directory as the default.

-ttool

Specifies the absolute or relative path, including filename and extension, of the ldapmodify command line utility. Ldapmodify is used to configure the server schema using the LDIF format commands. LDAP servers and SiteMinder provide a copy of ldapmodify. If the utility is not in the default location, use this argument to specify its location.

-ssl1_or_0

Specify -ssl1 to use an SSL-encrypted connection to the LDAP server, and -ssl0 to use a non-SSL connection. If you do not specify a value for -ssl, smldapsetup uses the previously configured value. If the LDAP connection has not been configured before, the initial default value is 0.

-ccert

This argument must be specified when using an SSL encrypted
(-ssl1) LDAP connection. Specifies the path of the directory where the SSL client certificate database file, which is usually called cert7.db for the Netscape Navigator Web browser, exists.

Example: If cert7.db exists in /app/siteminder/ssl, specify -c/app
/siteminder/ssl when running smldapsetup ldmod -f/app/siteminder/pstore.ldif -p81 -ssl1 -c/app/siteminder/ssl.

Note: For policy stores using an SSL-encrypted connection to Sun Java System LDAP, make sure the key3.db file exists in the same directory as cert7.db.

-k-k1

Enables you to use smldapsetup to set up or modify a key store if you are storing key information in a different LDAP directory. If you specify -k, smldapsetup checks to see if the Policy Server is pointing to the key store before performing any functions. If the Policy Server is not pointing to the key store, smldapsetup issues a warning. If you specify -k1, in conjunction with smldapsetup ldgen and the other arguments for a new policy store, smldapsetup creates a separate key store in the location you specify. If you do not specify -k or -k1, smldapsetup will modify the policy store.

-v

Enables verbose mode for troubleshooting. With -v, smldapsetup logs its command-line arguments and configuration entries as it performs each step in the LDAP migration.

-iuserDN

Specifies the distinguished name of an account that should be used by SiteMinder to make modifications to the policy store. This argument allows an administrator account to retain control of the SiteMinder schema while enabling another account that will be used for day-to-day modifications of SiteMinder data. When a change is made using the Administrative UI, the account specified by this argument is used. Be sure to enter the entire DN of an account when using this argument.

-q

Enables quiet mode for no questions to be asked.

-u

Creates a 6.x upgrade schema file (LDIF).

-x

Use the -x argument with ldmod to generate replication indexes for another 5.x Sun Java System Directory Server Enterprise Edition (formerly Sun ONE/iPlanet) LDAP directory server.

-ssuffix

This option allows you to specify a suffix other than the default parent suffix when configuring the 6.x Policy Server's schema in a Sun Java System Directory Server Enterprise Edition (formerly Sun ONE/iPlanet) LDAP directory server.

Example: assume the following:

ou=Apps,o=test.com is the Policy Store root.

o=test.com is the root suffix.

ou=netegrity,ou=Apps,o=test.com is the sub suffix.

If you do not use the -s parameter with smldapsetup, the Policy Server assigns ou=Apps,o=test.com as a parent suffix of ou=netegrity,ou=Apps,o=test.com. To change this and have the appropriate parent suffix set, run smldapsetup using the -s parameter while specifying o=test.com.

-?

Displays the help message.

Note: If the arguments contain spaces, you must enter double quotes around the entire argument. For example, if the name of the SiteMinder administrator is LDAP user, the argument for smldapsetup would be: -d”LDAP user".

smldapsetup and Sun Java System Directory Server Enterprise Edition

In a Sun Java System Directory Server Enterprise Edition (formerly Sun ONE/iPlanet) directory server, smldapsetup creates the ou=Netegrity, root sub suffix and PolicySvr4 database.

root

The directory root you specified in the Root DN field on the Data tab of the Policy Server Management Console. This variable has to be either an existing root suffix or sub suffix.

Example: If your root suffix is dc=netegrity,dc=com then running smldapsetup produces the following in the directory server:

Example: If you want to place the policy store under ou=apps,dc=netegrity,dc=com, then ou=apps,dc=netegrity,dc=com has to be either a root or sub suffix of the root suffix dc=netegrity,dc=com.

If it is a sub suffix, then running smldapsetup produces the following:

Note: For more information about root and sub suffixes, see the Sun Microsystems documentation.

Remove the SiteMinder Policy Store using smldapsetup

To remove the SiteMinder policy store data and schema from an LDAP directory, you must first delete the data, then remove the schema.

Important!

To remove the policy store using smldapsetup

  1. Navigate to the following location:
  2. Remove the policy store data by entering the following command: 
    smldapsetup remove -hLDAP_IP_Address -pLDAP_Port 
-d LDAP_Admin -wLDAP_Admin_Password -rLDAP_Base_DN
-v

    Example: smldapsetup remove -h192.169.125.32 -p552 -d"cn=directory manager" -wfirewall -rdc=ad,dc=test,dc=com -v

    Note: Removing the policy store data may take a few moments.

  3. Generate the LDIF file you will use to delete the schema by entering the following: 
    smldapsetup ldgen -e -fldif
    ldif

    Specifies the name of the LDIF file you are generating.

    Example: smldapsetup ldgen -e -fdelete.ldif

  4. Remove the SiteMinder schema by executing the following command: 
    smldapsetup ldmod -fldif
    ldif

    Specifies the name of the LDIF file you generated using smldapsetup ldgen
    -e.

    Example: smldapsetup ldmod -fdelete.ldif

Delete SiteMinder Data in ODBC Databases

SiteMinder provides SQL scripts that delete the SiteMinder schema from ODBC databases. The following list describes each SQL script:

sm_oracle_ps_delete.sql

Removes the SiteMinder policy store and data from an Oracle database.

sm_oracle_logs_delete.sql

If the database was created using sm_oracle_logs.sql, removes SiteMinder logs stored in an Oracle database

sm_oracle_ss_delete.sql

Removes the SiteMinder session store tables and data from an Oracle database.

sm_mssql_ps_delete.sql

Removes the SiteMinder policy store and data from an SQL database.

sm_mssql_logs_delete.sql

If the database was created using sm_mssql_logs.sql, removes SiteMinder logs stored in an SQL database

sm_mssql_ss_delete.sql

Removes the SiteMinder session store tables and data from a SQL database.

sm_db2_ps_delete.sql

Removes the SiteMinder policy store and data from a DB2 database.

sm_db2_logs_delete.sql

If the database was created using sm_db2_logs.sql, removes SiteMinder logs stored in a DB2 database

sm_db2_ss_delete.sql

Removes the SiteMinder session store tables and data from a DB2 database.

The ODBC database SQL scripts are in the following location:

Delete the database objects by running the appropriate SQL script using DB2, SQL Plus for Oracle, or SQL Server Query Analyzer.

Note: For more information about running SQL scripts, see your database documentation.

smpatchcheck

The smpatchcheck tool lets you determine whether you have the Solaris patches required for the Policy Server and Web Agent installed on your system. Smpatchcheck can be run on the Solaris versions listed on the SiteMinder Platform Matrix. To access this matrix, go to Technical Support and search for the SiteMinder Platform Support Matrix.

To use smpatchcheck

  1. Navigate to siteminder_home/bin
    siteminder_home

    Specifies the Policy Server installation path.

  2. Enter smpatchcheck.

    Smpatchcheck looks for each required/recommended patch and then displays its status.

    For example:

    Testing for Required Patches:
  Testing for Patch: 106327-09 ... NOT Installed
Testing for Recommended Patches:
  Testing for Patch: 106541-08 ... Installed
  Testing for Patch: 106980-00 ... Installed
SiteMinder Patch Check: Failed

Smpatchcheck returns one of the following messages:

Failed

One or more of the required patches is not installed.

Partially Failed

One or more of the recommended patches is not installed.

Success

All of the required and recommended patches are installed.

SiteMinder Test Tool

The SiteMinder Test Tool is a utility that simulates the interaction between Agents and Policy Servers. It tests the functionality of the Policy Server. During testing, the Test Tool acts as the Agent, making the same requests to the Policy Server as a real Agent. This allows you to test your SiteMinder configuration before deploying it.

Note: For further information about this tool, see the Policy Server Configuration Guide.

smreg

To change the super user password

  1. Be sure that the Policy Server is running and pointed at a configured policy store.
  2. Be sure that the smreg utility is located in policy_server_home\bin.
    policy_server_home

    Specifies the Policy Server installation path.

    Note: If the utility is not present, you can find it in the Policy Server installation media available on the Support site.

  3. Run the following command: 
    smreg -su password
    password

    Specifies the password for the SiteMinder super user account.

    Note: Be sure that there is a space between -su and the password.

    The utility changes the super user account password.

  4. Delete the smreg utility.

    Deleting the utility prevents anyone from changing the super user password.

More information:

Locate the Installation Media

XPSCounter

To comply with the terms of your SiteMinder license, you can count the number of users in your SiteMinder environment. The following process describes how to configure your directories and count the SiteMinder users stored within them:

  1. Make the following changes to each user directory you want to count:

    Note: For more information, see the SiteMinder Policy Server Configuration Guide.

  2. For Microsoft Active Directory user stores, map the inetOrgPerson attribute using the Administrative UI.
  3. Determine the number of users associated with SiteMinder policies.