Tivoi Access Manager Development ToolKit Work .

1. Administration Java classes are packaged in the PD.jar file that is installed as part of the Tivoli Access Manager Java runtime environment component.

2. Applications using the Java runtime environment provided with Tivoli Access Manager automatically have access to these classes and methods. 

3. The administration API Java classes communicate directly with the Tivoli Access Manager policy server component. The API establishes an authenticated, Secure Sockets Layer (SSL) session with the Tivoli Access Manager policy server process. 

4. After the SSL session is established, the classes can send administration requests to the policy server.

5.Use the SvrSslCfg Java class to provide this functionality.

Other ways to manipulate administration objects 

1. pdadmin command line interface (CLI)

2. Administration C API

Administration API application development kit files

AM_BASE/nls/javadocs /pdjrte/index.html
index.html
(and
many others)
Javadoc HTML documentation for the Java classes and methods provided with the Tivoli Access Manager Java runtime component.
AM_BASE/example/ pdadminapi_demo/java

README.PDAdminDemo PDAdminDemo.java PDAdminDemo.class PDAdminDemo$ConsoleEraser.class
A demonstration program is provided which illustrates the use of the administration Java APIs. You can copy the demonstration program to any directory. The readme file explains how to run and recompile the demonstration program.
JAVA_HOME/lib/ext

PD.jar

The Java Archive (JAR) file containing the classes and methods associated with the administration APIs. Note: When you use the pdjrtecfg command line interface to configure the Tivoli Access Manager Java runtime component to a particular JRE, this archive file is copied to JAVA_HOME/lib/ext. Therefore, there is no need to modify the CLASSPATH in your environment to access the classes and methods defined in this archive file.

Notes: 1. 
The Tivoli Access Manager runtime environment component is not needed for developing or deploying an Tivoli Access Manager Java application. The prerequisite checking for the Tivoli Access Manager ADK component is in error and erroneously requires that the Tivoli Access Manager runtime component be installed, even if you are developing only Java applications and simply need the Javadoc information and the example files from the ADK component. To save disk space, you can copy the Javadoc HTML information, consisting of the entire AM_BASE/nls/javadocs directory tree, along with the sample Java program, in the AM_BASE/example directory tree, to another location on your development system and then uninstall the Tivoli Access Manager ADK and runtime components. 2. If you intend to use the Tivoli Access Manager runtime environment for an administration C API application, you also must install the IBM® Directory client if an LDAP or Lotus Domino server is being used as the user registry in the secure domain.

Configuring the Java runtime component to a particular Java runtime environment Configure the Tivoli Access Manager Java runtime component to use the proper JRE on the system by using the pdjrtecfg command.

The com.tivoli.pd.jcfg.SvrSslCfg Java class must be used to configure the administration Java APIs.

Security requirements When running a Java application in the context of a Java security manager, 
the application must have the proper Java permissions to use the administration Java APIs. If the application is not installed as a Java extension in the JAVA_HOME/lib/ext directory, an entry must be added to the JAVA_HOME/lib/security/java.policy file. 
For example, to grant Java applications located in the /sb/pdsb/export/classes directory, and all its subdirectories, the necessary Java permissions to use authorization Java classes and methods, add a statement similar to the following to the java.policy file: 
4 IBM Tivoli Access Manager for e-business:Administration
Java Classes Developer Reference Invoke administration Java classes and methods from a privileged block, doPrivileged(), to alleviate the need for the application’s callers to have this Java permission as well. The PD.jar file is signed, but verification of the signing of JAR files is not supported in this version of Tivoli Access Manager.

Enabling tracing on the policy server 
To enable tracing on the policy server, edit the /etc/pdmgrd_routing file, located in the installation directory for the Tivoli Access Manager policy server, and uncomment the last line. 
Shut down and restart the policy server daemon, pdmgrd. 

Enabling tracing on the authorization server :
To enable tracing on the authorization server, edit the /etc/pdacld_routing file, located in the installation directory for the Tivoli Access Manager authorization server, and uncomment the last line. 
Shut down and restart the authorization server daemon, pdacld. 

Enabling tracing in the Java runtime component 
Tracing for the Tivoli Access Manager Java runtime component is controlled by settings in the properties file created by the com.tivoli.pd.jcfg.SvrSslCfg command. To enable tracing, edit the properties file created and update the line associated with the desired application-server-name to set isLogging to true: baseGroup.PDJ<application-server-name>TraceLogger.isLogging=true Each Java application can be configured to use a different properties file, and the properties file can have any name and be located in any directory. The PDJLog.properties file, located in the PolicyDirector subdirectory of the associated JRE, is installed by the Tivoli Access Manager Java runtime environment component. This properties file is associated with, and can be used to enable tracing in, the pdjrtecfg command as well as the com.tivoli.pd.jcfg.SvrSslCfg command.

Administration objects

PDAdmin 
This class is used to initialize and shut down the operations associated with using the Tivoli Access Manager administration classes and methods. The methods in this class are applicable to all administration objects.

PDContext 
This class encapsulates the information needed to establish a communication session between the Java application and the Tivoli Access Manager policy server. Both user ID and password-based and certificate-based authentication are supported by this class. Multiple PDContext objects can be created and used within the same Java virtual machine (JVM).

PDPolicy 
This class represents the policy information that is associated with a 
particular Tivoli Access Manager user or, in the case of the global policy, that is associated with all users. The PDPolicy class is used to set and retrieve account policy information from the user registry on a global or per-user basis.

PDRgyGroupName 
This class represents the name of an Tivoli Access Manager group in the underlying user registry.

PDRgyName 
This class represents the name of an Tivoli Access Manager object in the underlying user registry. This object is either an Tivoli Access Manager user name or group name.

Common classes The following classes are used for both administration and authorization methods. 

PDAttrs This class represents a list of Tivoli Access Manager attributes. 

PDAttrValue This class represents the value of a Tivoli Access Manager attribute. 


PDAttrValues This class represents a collection of values for a particular attribute that is unordered and that does not allow duplicates. 

PDAttrValueList This class represents a collection of values for a particular attribute that is ordered and allows duplicates.

Initializing the administration API

PDMessages messages = new PDMessages(); PDAdmin.initialize("myApplicationName", messages);

Establishing a security context

The security context provides for the secure transfer of administrative requests and data between the Java application and the policy server.

configuration file URL The uniform resource locator (URL) to the configuration file created by the Java SvrSslCfg class. 

The URL must use the file:/// format.Note: 

Do not use the svrsslcfg command line interface to create a configuration file that is to be used by a Java application. 
To create the security context, create a PDContext object as shown in Figure 3. 

The contents of the configuration file created by the Java SvrSslCfg class is not externalized and is subject to change without notice in future releases of Tivoli Access Manager. 
Users should not use the information in the configuration file directly. 

Certificate-based authentication To establish a security context using certificate-based authentication, you need the following information: 

locale The locale that is to be used for returning message data to the application. 

configuration file URL The URL to the configuration file created by the Java SvrSslCfg class.

The URL must use the file:/// format.Note: Do not use the svrsslcfg command line interface to create a configuration file that is to be used by a Java application.

To create the security context, create a PDContext object as shown in Figure 4 on page 14. // Create locale for US English 

Locale myLocale = new Locale("ENGLISH", "US");

 /* Create a security context using our locale. 
Need to supply a user ID with administrative privileges in Access Manager (like sec_master) along with its password and a URL of the form file:/// to the configuration file created by the SvrSslCfg class. */ 

PDContext myContext = new PDContext(myLocale, adminName, adminPassword, domain, configFileURL);

Manipulating administration objects

Each Java class representing an administration object provides static methods to create, list, modify, and delete objects stored on the Tivoli Access Manager policy server.

String name = "Stephanie Luser";

String firstName = "Stephanie";

String lastName = "Luser";

String password = "herpassword";

String description = "Descriptive text for Stephanie Luser";

String rgyName = "cn=" + name + "," + rgySuffix;

PDRgyUserName pdRgyUserName = new PDRgyUserName(rgyName, firstName, lastName);

boolean ssoUser = false;

boolean pwdPolicy = true;

ArrayList groupList = new ArrayList();

groupList.add(groupAdministrativeAssistants);

messages.clear();

PDUser.createUser(mySecurityContext, name, pdRgyUserName, description, password.toCharArray(), groupList, ssoUser, pwdPolicy, messages);

Obtaining a local copy of an object To obtain a local copy of an administration object, use the constructor for the Java class representing the administration object. For example, to get a copy of the PDUser object representing a particular Tivoli Access Manager user, you would use the PDUser constructor. This is shown in Figure 6.

 /*------------------------------------------------------------------ * Create a user, using the PDUser.createUser() static method, and * assign the user to a specific group. This method sends a * request to the policy server to create the user. *------------------------------------------------------------------ */ //

 Set up all of the user’s attributes

String name = "Stephanie Luser";

String firstName = "Stephanie";

String lastName = "Luser";

String password = "herpassword";

String description = "Descriptive text for Stephanie Luser";

String rgyName = "cn=" + name + "," + rgySuffix;

PDRgyUserName pdRgyUserName = new PDRgyUserName(rgyName, firstName, lastName);

boolean ssoUser = false;

boolean pwdPolicy = true;

ArrayList groupList = new ArrayList();

groupList.add(groupAdministrativeAssistants);

messages.clear();

PDUser.createUser(mySecurityContext, name, pdRgyUserName, description, password.toCharArray(), groupList, ssoUser, pwdPolicy, messages);

Figure 5.

Creating a user /*------------------------------------------------------------------ * Obtain a user using the PDUser constructor. *------------------------------------------------------------------ */ // Set up all of the user’s attributes String name = "Zachary Wommbat"; String firstName = "Zachary"; String lastName = "Wommbat"; String rgyName = "cn=" + name + "," + rgySuffix; PDRgyUserName pdRgyUserName = new PDRgyUserName(rgyName, firstName, lastName); messages.clear() PDUser user = new PDUser(mySecurityContext, pdRgyUserName, messages);

Note:

After a local copy of an administration object is obtained, the object could be changed on the policy server by other users using the command line interface, the administration C API, or the Java classes and methods.

The instance method changes both the local copy of the administration object as well as the object stored on the policy server.

user.setAccountValid(mySecurityContext, false, // Disable the account messages);

The instance method changes both the local copy of the administration object as well as the object stored on the policy server.

To update the PDUser object on the policy server, use the static method:

PDUser.setAccountValid(mySecurityContext, name, false, // Disable the account messages);

This chapter contains the following topics:

1. Administering users” v “
2. Administering user information” 
3. Administering user account policies” 
4. Administering user password policies” 
5. Administering groups”
6. Administering group information”

Administering users

PDUser.createUser

PDUser.importUser

PDUser.deleteUser

PDUser.listUsers :Lists Tivoli Access Manager users.

The PDUser.importUser method imports an existing user definition from the user registry into Tivoli Access Manager and allows the user definition to be managed by Tivoli Access Manager.

Administering user information

When a user account has been created in the user registry, you can set and get different pieces of information about the user. You must create a security context between the calling application and the Tivoli Access Manager policy server before you can access the user registry. You can obtain the user registry information for a user object by specifying either the Tivoli Access Manager user name or the user registry name.

Below are the method through we can Administrate the Used

PDUser.createUser
PDUser.importUser - Use when user is altready there
PDUser.deleteUser
PDUser.listUser

Administereting User Information :

PDUser constructor

PDUser object.getDescription = Returns the user description.

PDUser object.getRgyName = Returns the user registry name for the user.

PDUser object.getId  = Returns the name of the object.

PDUser object.getFirstName = Returns the first-name attribute for the user.

PDUser object.getLastName = Returns the last-name attribute for the user.

PDUser object.getPolicy = Returns the password and account policy settings associated with the user.

PDUser object.getGroups = Lists the groups in which the user is a member.

PDUser object.isAccountValid = Returns the account-valid indicator for the user.

PDUser object.isPDUser = Returns a setting that indicates if this is an Tivoli Access Manager user.

PDUser object.isSSOUser = Returns a setting that indicates if the user has single signon capabilities.

PDUser.setDescription PDUser object.setDescription = Sets a user description.

PDUser.setAccountValid PDUser object.setAccountValid = Enables or disables a user account.

PDUser.setSSOUser PDUser object.setSSOUser= Enables or disables the single signon capabilities of a user.

PDUser object.isPasswordValid = Returns the enabled indicator for the user’s password.

PDUser.setPassword PDUser object.setPassword = Sets a user’s password.

PDUser.setPasswordValid PDUser object.setPasswordValid

Administering user account policies

PDUser.getUserRgy  = Return the registory Name of the user in which Tivoli Access Manager Registry is used by PDUser

PDPolicy obj.accDisableEnforcedTime
PDPolicy obj.accDisableEnforcedUnlimite

PDPolicy obj.accExpDateEnforced
PDPolicy obj.accExpDateUnlimited

PDPolicy obj.accAccExpDate 
PDPolicy obj.accAccDisableTimeInterval

PDPolicy obj.getMaxFailed
PDPolicy obj.setMaxFailed

PDPolicy obj.getAccessibleDay
PDPolicy obj.getAccessibleStartTime
PDPolicy obj.getAccessibleEndTime

PDPolicy obj.maxFailedloginEnforced
PDPolicy obj.setAccExpDate
PDPolicy obj.setActDisableTime

PDPolicy obj.MaxFailedLogin

PDPolicy obj.setTodAccess

PDPolicy obj.setTodAccessEnforced

I have workd on Administration of the
1. Administaton of User 

PDUser.createUser();
PDUser.importUser();
PDUser.deleteUser();
PDUser.listUser();

2. Administartion of User Inforamtion
                                          
PDUser.getDiscription();
PDUser.getRgyName();
PDUser.getID();
PDUser.getFirstName();
PDUser.getLastName();
PDUser.isAccValid();
                                
3. Administration of User Account Policy

PDUSer.getDescription();
PDPolicy obj.getMaxLenght();
PDPolicy obj.getMaxAplhaEnforced();
PDPolicy obj.getMax

4. Administartion of User Password Policy

PDPolicy obj.setMaxPwdLength();
PDPolicy obj.setMaxAlphaChar();
PDPolicy obj.setMaxExpiryDate();


5. Administartion of Group Policy

PDGroup.createGroup();
PDGroup.importGroup();
PDGroup.deleteGroup();
PDGroup.listGroup();

6. Administartion of Group Information

PDGroup obj.getDescription();
PDGroup obj.getRgyName();
PDGroup obj.getID();
PDGroup obj.isPDGroup();
PDGroup obj.addMember();
PDGroup obj.getMember();
PDGroup obj.removeMember();