tivoli access manager enterprise single...
TRANSCRIPT
Tivoli® Access Manager for Enterprise Single Sign-On
DPRA Installation and Setup Guide
Version 6.0
SC32-1994-00
���
Tivoli® Access Manager for Enterprise Single Sign-On
DPRA Installation and Setup Guide
Version 6.0
SC32-1994-00
���
Note:
Before using this information and the product it supports, read the information in “Notices,” on page 17.
First Edition (September 2006)
This edition applies to version 6, release 0, modification 0 of IBM Tivoli Access Manager for Enterprise Single
Sign-On (product number 5724-N70) and to all subsequent releases and modifications until otherwise indicated in
new editions.
© Copyright International Business Machines Corporation 2006. All rights reserved.
US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contract
with IBM Corp.
Table of Contents
Installing TAM E-SSO: Desktop Password Reset Adapter Service ....................... 3 System platform requirements........................................................................... 3 Installation Steps ............................................................................................. 4 Step by step: Install TAM E-SSO: Desktop Password Reset Adapter......................... 6 Step-by-Step: Assign password reset permission to Reset Service........................... 8 Step-by-Step: Restrict Management Console Access ............................................. 8
Installing the TAM E-SSO: Desktop Password Reset Adapter Client.................... 9 Client system requirements ............................................................................... 9 Client installation settings ................................................................................. 9 Installing the client at the command line ............................................................10
Reference and Troubleshooting ........................................................................ 11 Installation and Configuration Notes ..................................................................11 Compatability Issues .......................................................................................12 TAM E-SSO: Desktop Password Reset Adapter Registry Settings ............................13 Additional Procedures ......................................................................................14
Inst
all
ati
on
& S
etu
p
3
Installing TAM E-SSO: Desktop Password Reset Adapter Service
System platform requirements
The following products must be installed on one or more physical servers running Windows 2000 or 2003 server, with Microsoft .NET Framework version 2.0 or later.
• One of the following for the TAM E-SSO: Desktop Password Reset Adapter repository:
TAM E-SSO: Desktop Password Reset Adapter can use one of the following as the repository for the password-reset challenge questions, and the enrolled users, and their responses.
− Microsoft Active Directory® or Active Directory Application Mode (ADAM). The Active Directory server or ADAM instance (that is, Active Directory running as a user service) can be on any server and in any domain, see the Note below. Also see Step by step: Install an ADAM instance on page 14 for more information.
− Microsoft SQL Server® 2000
− Oracle Database®. The .Net Framework Data Provider for Oracle enables data access to Oracle data sources through Oracle client connectivity software. The data provider supports Oracle client software version 10g and later. The .NET Framework Data Provider for Oracle requires that Oracle client software (version 10g or later) be installed on the system before you can use it to connect to an Oracle data source. The .NET Framework Data Provider for Oracle requires the installation of MDAC 2.6 or later. The necessary connection strings need to be formatted as follows: Oracle Provider: Provider=OraOLEDB.Oracle;Data Source=MyOracleDB;User
Id=myUsername;Password=myPassword
• For the TAM E-SSO: Desktop Password Reset Adapter Service Microsoft Internet Information Server (IIS), version 5.0 or later. TAM E-SSO: Desktop Password Reset Adapter uses the IIS Web server to provide a browser-based interface for user enrollment, password-reset challenge, and general setup and administrative tasks. The TAM E-SSO: Desktop Password Reset Adapter server application and IIS must reside on the same server.
Note: If IIS and Active Directory (or the ADAM-instance) are on different computers, then the Anonymous Logon for IIS Web Services (Step 2 below) must be
− a user account in the same domain as (or a trusted domain of) Active Directory or the ADAM instance, and
− provided with read/write access to Active Directory or the ADAM instance.
Installer Requirements To install TAM E-SSO: Desktop Password Reset Adapter, you will need to have Administrative privileges for the TAM E-SSO: Desktop Password Reset Adapter/IIS server.
You will need to provide the following information to configure ADAM:
localhost The host name of the server for Active Directory the ADAM instance
port the port number of Active Directory or he ADAM instance
name1[.name2.name3] The distinguished name of the AD/ADAM domain root.
Inst
all
ati
on
& S
etu
p
4
Installation Steps Follow these steps to install and configure the TAM E-SSO: Desktop Password Reset Adapter service. Refer to the detailed, step-by-step instructions for more information.
Step 1. Install the TAM E-SSO: Desktop Password Reset Adapter server program files
Run one of the TAM E-SSO: Desktop Password Reset Adapter Server installers: TAM E-SSO Desktop Password Reset Adapter Server.exe (or .msi).
See step by step instructions, page 6.
Step 2. Create or identify a user account for Anonymous logon
Create or identify a user account that will be the dedicated Anonymous User account through which TAM E-SSO: Desktop Password Reset Adapter users and administrators access TAM E-SSO: Desktop Password Reset Adapter Web Services. This Anonymous User account, referred to in this guide as SSPRweb, should be a member of the Administrators group.
Notes:
• Because the default Anonymous User account for a Web services, IWAM (for Windows 2000) or IUSER (Windows 2003), is not a member of the Administrator group, you must create or choose a domain user account that is an Administrator; this will allow the account to perform these tasks:
− Start, stop, and change services.
− Read from/write to Active Directory, ADAM-instance, SQL Server, or Oracle database.
− Write to the local-machine registry (HKLM).
• To create a new user account or assign Administrator rights to an existing account, use the Active Directory Users and Computers console (for an Active Directory domain) or the Computer Management console (for non-AD domains).
• The user account you create or choose is specified as the Anonymous User dialog of the Services tool when you complete Step 4 below.
Step 3. Create or identify a user account for the Password and Reset Service
Create or identify a Service Account; this is the domain account that the TAM E-SSO: Desktop Password Reset Adapter uses to log on as a service. The Reset Service user account, referred to in this guide as SSPRadmin, must have password-reset permission.
Notes:
• Because the default user account for a service, typically "LocalSystem," does not have password-change permission, you must create or select a domain user account that does have this permission. This can be an Administrator account (with full permissions) or a non-Administrator user account with this specific permission only. To grant this permission to a non-Administrator account, see Step-by-Step: Assign password reset permission to Reset Service on page 8
• To create a new user account or assign Administrator rights to an existing account, use the Active Directory Users and Computers console (for an Active Directory domain) or the Computer Management console (for non-AD domains).
• The user account you create or specify appears in the Log On As column of the Services tool when you complete Step 4 below.
Inst
all
ati
on
& S
etu
p
5 of 5
Step 4. Configure the Reset Service
Open Internet Explorer and enter this address:
http://serverhost/vgoselfservicereset/managementclient/webservice.aspx
The TAM E-SSO: Desktop Password Reset Adapter Management Console opens, displaying the
Web Service Account dialog page. (Within the Management Console, click the System tab
to display this dialog page).
Type the User Name and Password of the Anonymous Logon account you created or identified
in Step 2.
Type the password again to Confirm, then click Submit.
Click Storage.
Enter the requested connection information for Active Directory, ADAM, SQL Server, or Oracle
Database.
Select Initialize Storage for SSPR.
For Connect As, type the user name of an administrator of the directory server.
Type the administrator password and click Submit.
Click Reset Service.
Type the User Name and Password of the Reset Service user account you created or identified
in Step 3.
Type the password again to Confirm, then click Submit.
Step 5. Restrict Management Console access - optional
Set the access permission for the folder \Program Files\v-GO SSPR\Management Client to only those users who should have administrative rights to TAM E-SSO: Desktop Password Reset Adapter Management Console.
See step by step instructions, page 8.
Step 6. Deploy the TAM E-SSO: DESKTOP PASSWORD RESET ADAPTER client software
See step by step instructions, page 9.
Inst
all
ati
on
& S
etu
p
6
Step by step: Install TAM E-SSO: Desktop Password Reset Adapter
1. Double click the Setup icon TAM E-SSO Destop Password Reset Adapter Client.exe (or .msi):
2. Click [Next].
3. Select I accept the terms in the license agreement and click [Next].
4. Click [Next].
Inst
all
ati
on
& S
etu
p
7
5. Click [Next].
6. Click [Install]. When the installation is complete, click [Finish].
Inst
all
ati
on
& S
etu
p
8
Step-by-Step: Assign password reset permission to Reset Service
1. Open the Active Directory Users and Computers console snap-in.
2. Right-click Users in the left pane and select Delegate Control from the shortcut menu. The Delegation of Control Wizard appears. Click [Next].
3. The Users or Groups page appears. Click [Add] to display the Select Users or Groups dialog box.
4. Select SSPR Admin from the list box and click [Add], then click [OK] to close the Select Users dialog box. Click [Next].
5. For Active Directory Object Type, select Only the objects in the folder, then select User objects from the list. Click [Next].
6. For Permissions, select General, then select Reset Password from the list. Click [Next].
7. Click [Finish] to complete the Wizard.
Step-by-Step: Restrict Management Console Access
1. Open Windows Explorer and navigate to %TAM E-SSO: Desktop Password Reset Adapter home%\
2. Right-click the Management Client and select Properties from the shortcut menu.
3. In the Properties dialog, Click the Security tab.
4. Click [Advanced]
5. Click Inheritable rights for Users to clear the selection. A dialog appears.
6. Click Copy then click [OK]
7. In the Security tab, remove unauthorized users, then click [OK]
8. Click [Add].
9. Select Object Type [Users, Groups, or Built-in security principle]
10. Select From this Location [the server name] and click [OK]
11. Choose an Advanced search and select IIS_WPG (for Windows 2003) or IIS_WAM (for Windows 2000). Click [OK]
Note: All permissions except Full should be checked under the Allow column.
Inst
all
ati
on
& S
etu
p
9
Installing the TAM E-SSO: Desktop Password Reset Adapter Client
The TAM E-SSO: Desktop Password Reset Adapter Client Installer supplies the components needed to run TAM E-SSO: Desktop Password Reset Adapter through the Windows interface. It also sets the registry values that point the TAM E-SSO: Desktop Password Reset Adapter client to the enrollment and reset service and, optionally, offers or obliges workstation users to enroll in the password reset service. Installation can be performed with the Windows Install Wizard or at the command line. The installer package sspr_client.msi can also be customized with site-specific settings using any standard MSI package editor, such as InstallShield AdminStudio or Wise Package Studio.
Client system requirements
Windows 2000 or XP Professional, with Internet Explorer 6.0 SP1 or later.
Client installation settings
The settings Enroll URL, Reset URL, Check Enroll URL, and Status URL must be set during installation. These settings are URLs that point the TAM E-SSO: Desktop Password Reset Adapter client to the appropriate Web service resources for enrollment and password reset.
The optional settings, Automatic Enroll and Force Enrollment, control whether a workstation user is asked or required to enroll in the password reset service at their next logon. These optional values can be set using command-line installation or by modifying the installer package; they are not added by the Install Wizard on the client.
Setting
Check Enroll URL Type the URL of the Enrollment check service (checks if user is enrolled)
http://host/vgoselfservicereset/resetclient/checkenrollment.aspx
Check ForceEnroll URL Type the URL of the Enrollment check service (checks if user is enrolled)
http://host/vgoselfservicereset/resetclient/checkforceenrollment.aspx
Enroll URL Type the URL of the Enrollment service default page
http://host/vgoselfservicereset/enrollmentclient/enrolluser.aspx
Reset URL Type the URL of the reset service default page
http://host /vgoselfservicereset/resetclient/default.aspx
Status URL
Type the URL of the status check service (checks for TAM E-SSO: DESKTOP PASSWORD RESET ADAPTER service availability)
http://host /vgoselfservicereset/resetclient/checkstatus.aspx
Automatic Enroll Set to 1 to offer enrollment option to unenrolled user at next logon. Set to 0 (default) not to offer enrollment upon logon.
Force Enrollment Set to 1 to require unenrolled user to enroll at next logon. Set to 0 (default) not to require enrollment upon logon. If set to 1 this option overrides AutomaticEnroll.
Inst
all
ati
on
& S
etu
p
10
Installing the client at the command line
TAM E-SSO: Desktop Password Reset Adapter Client can be installed as a DOS command, using the following command syntax:
msiexec /i [/q] c:\sspr_client.msi programURLs [enrollOption]
/q Quiet mode: suppress all installer user interface messages. Refer to the description of other Windows Installer command line options for msiexec at http://msdn.microsoft.com.
Using the command line below, silent installs without a reboot of the PC can be achieved. It is assumed that the user’s Windows directory is "Windows" and the SSPR.msi is named "v-go self-service password reset via email.msi":
c:\windows\system32\msiexec.exe /i "C:\support\passlogix\v-go self-service password reset via email.msi" REBOOT=ReallySuppress /q
Note: The full path to the installer .msi must be typed out, as in the example above.
programURLs (required):
REG_CHECKENROLLURL=" http://host/vgoselfservicereset/resetclient/checkenrollment.aspx"
REG_ENROLLURL="http://host/vgoselfservicereset/enrollmentclient/enrolluser.aspx"
REG_RESETURL=" http://host /vgoselfservicereset/resetclient/default.aspx"
REG_CHECKSTATUSURL="http://host /vgoselfservicereset/resetclient/checkstatus.aspx"
where: host is the server name (or domain name/IP address) and path of the folder that holds the TAM E-SSO:
Desktop Password Reset Adapter service root folder.
enrollOption (select one)
REG_ AUTOMATICENROLL={1 | 0} 1 Set AutomaticEnroll on (to offer enrollment in the password reset service to user at the next system logon).
0 Set AutomaticEnroll off (default, no enrollment offered).
REG_ CHECKFORCEENROLLURL={1 | 0} 1 Set ForceEnrollment on (to require users to enroll in the password reset service at their next logon).
0 Set ForceEnrollment off (default, no enrollment required). If selected, this option overrides AutomaticEnroll.
Example: The following command (on a single line) installs the client and points it to the password reset service. It also requires end users at this workstation to enroll the next time they logon.
msiexec /i c:\sspr_client.msi REG_CHECKENROLLURL="http://sspr.passlogix.com/vgoselfservicereset/
resetclient/checkenrollment.aspx"REG_ENROLLURL="http://sspr.passlogix.com/vgoselfservicereset/
enrollmentclient/enrolluser.aspx"REG_RESETURL="http://sspr.passlogix.com/vgoselfservicereset/ resetclient/default.aspx"REG_STATUSURL="http://sspr.passlogix.com/vgoselfservicereset/resetclient/
checkstatus.aspx"REG_FORCEENROLLMENT=1
Inst
all
ati
on
& S
etu
p
11
Reference and Troubleshooting
Installation and Configuration Notes
Using AD/ADAM and IIS Web Services on different servers If IIS and Active Directory or the ADAM-instance are on different computers, then you must provide the IIS Web services with a user account that is in the same domain as (or a trusted domain of) AD/ADAM, and that is provided with read/write access to the directory.
Installing ASP.NET 2.0 with Windows 2000 SP4: "Access is Denied" error When you install ASP.NET 2.0 on a computer running on a Windows 2000 Server domain controller with Service Pack 4 (SP4) installed, the built-in IWAM user account (used by IIS Web services with ASP) is not granted "Impersonate User" rights for ASP.NET 2.0. A request for any ASP resources, including TAM E-SSO: Desktop Password Reset Adapter can produce an "Access is denied" error message. Microsoft has acknowledged that this is an issue in SP4 (Knowledge Base article 824308), and provides the following workaround to manually assign "Impersonate a client after authentication" to the IWAM account:
1. Click Start, point to Programs, point to Administrative Tools, and then click Domain Controller Security Policy.
2. Click Security Settings.
3. Click Local Policies, and then click User Rights Assignment.
4. In the right pane, double-click Impersonate a client after authentication.
5. In the Security Policy Setting window, click Define these policy settings.
6. Click Add, and then click Browse.
7. In the Select Users or Groups window, select the IWAM account name, click Add, and then click OK.
8. Click OK, and then click OK again.
9. To enforce an update of computer policy, type the following command: secedit /refreshpolicy machine_policy /enforce
10. At a command prompt, type iisreset.
Server Error in '/vGOSelfServiceReset/ManagementClient' Application When you install .NET 2.0 on a computer running a newly installed Operating System, the NETWORK SERVICE account must be granted Read/Write access or a server error will be encountered when accessing the TAM E-SSO: Desktop Password Reset Adapter 6.0 Management Console.
To do this, grant the NETWORK SERVICE account Read/Write access to the following folder:
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files
Note: This is not a TAM E-SSO: Desktop Password Reset Adapter specific issue. All ASP.NET applications will receive this error if the configuration is not correctly set.
Windows Installer Error 1720 Error 1720 occurs during TAM E-SSO: Desktop Password Reset Adapter client software installation when the logged-on user does not have sufficient rights to install software on the workstation. You must log on to workstation as a user with Administrator rights or contact support personnel.
Inst
all
ati
on
& S
etu
p
12
Group Security Policy: Password History setting should be increased TAM E-SSO: Desktop Password Reset Adapter makes use of the password history setting of the Windows 2000 Group Security Policy. You should allow for one additional prior password in addition to the Enforce password history setting. For example, if the setting is 3 (ensuring that a user’s last three prior passwords cannot be reused), TAM E-SSO: Desktop Password Reset Adapter uses one of these, so the actual setting is 2. A higher setting for Enforce password history is recommended for optimal security.
Internet Security settings (Windows 2003 users) The default settings for Windows 2003 Internet Security settings are more stringent than those for Windows 2000 and XP. You must add the TAM E-SSO: Desktop Password Reset Adapter Web service to the workstation's Trusted Sites Internet zone or the Local Intranet zone in order to use TAM E-SSO: Desktop Password Reset Adapter as a Windows 2003 client.
Internet Security settings (Windows Domain and Citrix MetaFrame® users) In order for Windows domain users and Citrix MetaFrame users to access TAM E-SSO: Desktop Password Reset Adapter, you must add the TAM E-SSO: Desktop Password Reset Adapter Web service to the workstation's Local Intranet zone.
Compatability Issues
Fast User Switching not available (Windows XP users only) Installing the TAM E-SSO: Desktop Password Reset Adapter client on Windows XP disables the Fast User Switching feature, which allows multiple users to be logged on to a computer at the same time and to switch among logons by pressing +L. This feature is unavailable because TAM E-SSO: Desktop Password Reset Adapter utilizes a custom GINA (Graphical Identification and Authentication) component that replaces the Microsoft default GINA dynalink library (Msgina.dll). To change logons on a Windows XP computer, a user must log off to allow the next user to logon. To do this, open Task Manager (CTRL+ALT+DELETE), and click Log off.
Inst
all
ati
on
& S
etu
p
13
TAM E-SSO: Desktop Password Reset Adapter Registry Settings
TAM E-SSO: Desktop Password Reset Adapter Server Registry Under HKLM\Software\Passlogix\SSPR
Key Value Name Data Type Data
Storage StorageOrder string (REG_SZ) AD or ADAM
Extensions
Under HKLM\Software\Passlogix\SSPR\Storage\Extensions\
Key Value Name Data Type Data
ADAM Root string (REG_SZ) ADAM partition root
Classname string (REG_SZ) adam
Under HKLM\Software\Passlogix\SSPR\Storage\ Extensions\ADAM\
Key Value Name Data Type Data
Servers Server1 string (REG_SZ) server:port (of the ADAM instance)
Under HKLM\Software\Passlogix\SSPR\Storage\Extensions\
AD Root string (REG_SZ) AD root
Classname string (REG_SZ) ad
Under HKLM\Software\Passlogix\SSPR\Storage\ Extensions\AD\
Key Value Name Data Type Data
Servers Server1 string (REG_SZ) server:port
TAM E-SSO: Desktop Password Reset Adapter Client Registry Under HKLM\Software\Passlogix\SSPR
Key Value Name Data Type Data [URLRoot] : http://[host]/vgoselfservicereset
WindowsInterface EnrollURL string (REG_SZ) URL of the Enrollment service default page: [URLroot]/enrollmentclient/enrolluser.aspx
ResetURL string (REG_SZ)
URL of the reset service default page: [URLroot]/resetclient/default.aspx
StatusURL string (REG_SZ)
URL of the checkstatus page (notifies reset client that reset service is available: [URLroot]/resetclient/checkstatus.aspx
CheckEnrollURL string (REG_SZ)
URL of Enrollment check service (checks if user is enrolled in service): [URLroot]/resetclient/checkenrollment.aspx
AutomaticEnroll dword (REG_DWORD)
Set to 1 to offer enrollment option to unenrolled user at next logon. Set to 0 (default) not to offer enrollment upon logon.
ForceEnrollment dword (REG_DWORD)
Set to 1 to require unenrolled user to enroll at next logon. Set to 0 (default) not to require enrollment upon logon. If set to 1 this option overrides AutomaticEnroll.
CheckForceEnrollment string (REG_SZ)
URL of Enrollment check service (sets number of times user can bypassForce Enrollment): [URLroot]/resetclient/checkforceenrollment.aspx
Inst
all
ati
on
& S
etu
p
14
WindowHeight
DWORD (REG_DWORD)
Adjusts TAM E-SSO: Desktop Password Reset Adapter’s browser window height.
WindowWidth
DWORD (REG_DWORD)
Adjusts TAM E-SSO: Desktop Password Reset Adapter’s browser window width.
Additional Procedures
Install an ADAM instance
1. Start “ADAMSetup.exe
2. Select “A unique instance” and click [Next]
3. Provide your Instance name and click [Next]
4. Specify port numbers of 10000 and 10001 (Ten thousand range, for easy recall) and click [Next]
Inst
all
ati
on
& S
etu
p
15
5. Specify the root DN (e.g., “DC=SSPR, DC=Passlogix,DC=Com”) and click [Next].
6. Specify an easy-to-find base location (e.g.; “%RootDrive%\ADAM\Instance”) and click [Next]
7. Specify the run privileges and click [Next]
8. Specify the Administrative Permissions and click [Next]
Inst
all
ati
on
& S
etu
p
16
9. Select “Do not import LDIF files for this instance of ADAM” and click [Next]
10. Click [Next] as requested to proceed.
11. Click [Finish].
Appendix. Notices
This information was developed for products and services offered in the U.S.A.
IBM may not offer the products, services, or features discussed in this document in
other countries. Consult your local IBM® representative for information on the
products and services currently available in your area. Any reference to an IBM
product, program, or service is not intended to state or imply that only that IBM
product, program, or service may be used. Any functionally equivalent product,
program, or service that does not infringe any IBM intellectual property right may
be used instead. However, it is the user’s responsibility to evaluate and verify the
operation of any non-IBM product, program, or service.
IBM may have patents or pending patent applications covering subject matter
described in this document. The furnishing of this document does not give you
any license to these patents. You can send license inquiries, in writing, to:
IBM Director of Licensing
IBM Corporation
North Castle Drive
Armonk, NY 10504-1785
U.S.A.
For license inquiries regarding double-byte (DBCS) information, contact the IBM
Intellectual Property Department in your country or send inquiries, in writing, to:
IBM World Trade Asia Corporation
Licensing
2-31 Roppongi 3-chome, Minato-ku
Tokyo 106-0032, Japan
The following paragraph does not apply to the United Kingdom or any other
country where such provisions are inconsistent with local law:
INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS
PUBLICATION “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER
EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS
FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or
implied warranties in certain transactions, therefore, this statement may not apply
to you.
This information could include technical inaccuracies or typographical errors.
Changes are periodically made to the information herein; these changes will be
incorporated in new editions of the publication. IBM may make improvements
and/or changes in the product(s) and/or the program(s) described in this
publication at any time without notice.
Any references in this information to non-IBM Web sites are provided for
convenience only and do not in any manner serve as an endorsement of those Web
sites. The materials at those Web sites are not part of the materials for this IBM
product and use of those Web sites is at your own risk.
IBM may use or distribute any of the information you supply in any way it
believes appropriate without incurring any obligation to you.
© Copyright IBM Corp. 2006 17
Licensees of this program who wish to have information about it for the purpose
of enabling: (i) the exchange of information between independently created
programs and other programs (including this one) and (ii) the mutual use of the
information which has been exchanged should contact:
IBM Corporation
2ZA4/101
11400 Burnet Road
Austin, TX 78758
U.S.A.
Such information may be available, subject to appropriate terms and conditions,
including in some cases, payment of a fee.
The licensed program described in this information and all licensed material
available for it are provided by IBM under terms of the IBM Customer Agreement,
IBM International Program License Agreement, or any equivalent agreement
between us.
Any performance data contained herein was determined in a controlled
environment. Therefore, the results obtained in other operating environments may
vary significantly. Some measurements may have been made on development-level
systems and there is no guarantee that these measurements will be the same on
generally available systems. Furthermore, some measurements may have been
estimated through extrapolation. Actual results may vary. Users of this document
should verify the applicable data for their specific environment.
Information concerning non-IBM products was obtained from the suppliers of
those products, their published announcements or other publicly available sources.
IBM has not tested those products and cannot confirm the accuracy of
performance, compatibility or any other claims related to non-IBM products.
Questions on the capabilities of non-IBM products should be addressed to the
suppliers of those products.
Trademarks
The following terms are trademarks or registered trademarks of International
Business Machines Corporation in the United States, other countries, or both:
AIX
DB2
developerWorks
eServer
IBM
iSeries
Lotus
Passport Advantage
pSeries
RACF
Rational
Redbooks
Tivoli
WebSphere
zSeries
Microsoft®, Windows®, Windows NT®, and the Windows logo are trademarks of
Microsoft Corporation in the United States, other countries, or both.
18 IBM Tivoli Access Manager for Enterprise Single Sign-On: DPRA Installation and Setup Guide
Intel®, Intel Inside® (logos), MMX and Pentium® are trademarks of Intel
Corporation in the United States, other countries, or both.
UNIX® is a registered trademark of The Open Group in the United States and
other countries.
Linux® is a trademark of Linus Torvalds in the U.S., other countries, or both.
Java™ and all Java-based trademarks are trademarks of Sun
Microsystems, Inc. in the United States, other countries, or
both.
Other company, product, and service names may be trademarks or service marks
of others.
Appendix. Notices 19
20 IBM Tivoli Access Manager for Enterprise Single Sign-On: DPRA Installation and Setup Guide
����
Printed in USA
SC32-1994-00