Wednesday, July 16, 2014

ITIM Workflow Mail notification Issue after 5.0 to 5.1 upgrade

I was looking into our newly updated ITIM environment. And it was not sending an email as part of new account creation workflow. I debugged it with IBM engineer and found some tips which can be handy for anyone. 


1. Check first the mail server is working on the ITIM machine.
          $>telnet localhost 25 ( this can be value from enRoleMail.prop, mail.from property )
             once connected type the commands below in sequence, please note that the backspace key 

             won't work, so if you make mistakes you have to drop the connection and reconnect   
             HELO admin.xyz.com
             MAIL FROM:<
no-reply@admin.xyz.com>
             RCPT TO:<abc
@xyz.ac.uk>
             DATA

               write something here, this will be the body of your message

               .          <- dot on an empty line will terminate and send your email


             you should receive the email immediately
. This makes sure mail server functioning okay


2.  In ITIM 5.1, check on WAS Console, Environment -> Shared Library -> ITIM_LIB
     As there is no mail.jar in the ITIM_HOME/lib directory, entry for ${ITIM_HOME}/lib/mail.jar should be removed.

3. 
Locate  $/opt/IBM/Tivoli/IdentityManager/data/enRoleMail.properties  and check that parameters have not been overwritten during the upgrade, in particular need you to double check
      mail.from="From Admin"<no-reply@admin.xyz.com>
mail.postoffice.aggregate.max.emails=1
mail.host=<FLDN_address_of_your_Mail_server>     <.- probably you have localhost here

mail.notification.disabled=false

   4. Check enRole.properties for enrole.workflow.notifyoption = 1
   5. Check on ITIM console, New Account Template and New Password Template should be disabled. Otherwise     this will send default ITIM mails instead the custom workflow mails. 

5 6. Now restart the servers 
   7.  Check Post Office test from ITIM console. ITIM console -> Configure System -> Post office. Make sure to check "Enable Store forwarding" and change the value of collection interval to 5.
   8.

   Check logs at /opt/IBM/Tivoli/common/CTGIM/logs/trace.log 
    if logs are not getting generated change the level of logs in /opt/IBM/Tivoli/IdentityManager/data/enRoleLogging.properties

    handler.file.trace.maxFiles=100
     ( ideally should be 10, but while debugging trace roles too quickly change it to 100)
    handler.file.maxFileSize=20480
    ( this is to not generate too many file with small size )
    logger.trace.com.ibm.itim.workflow.level=DEBUG_MAX
    logger.trace.com.ibm.itim.mail.level=DEBUG_MAX
 

 Hope this helps to resolve / debug your issue.

Friday, July 11, 2014

Shibboleth Links

To setup SSO using shibboleth...
-------------------------------------------------------------------------

http://www.testshib.org/index.html

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPInstall


https://shibboleth.usc.edu/docs/sp/install/#install

https://wiki.library.ucsf.edu/display/~234877@ucsf.edu/Running+Shibboleth+IDP+and+SP+Locally+in+Windows

http://www.itcs.umich.edu/itcsdocs/s4388/