Test 000-020: IBM Tivoli Access Manager for Enterprise Single Sign-On V8.0.1 Implementation

Section 1: Planning

1. Given access to the customer, their hardware, applications, and policies, collect and analyze the customers’ requirements so that a solution document is created.


With emphasis on performing the following tasks:

1. Arrange a kick-off meeting with stakeholders.
2. Interview the appropriate personnel.
3. Review the security infrastructure of the customer.
4. Identify and understand the customer's single sign-on requirements.
1. Determine key objectives for Enterprise Single Sign-On project.
2. Collect the list of applications to be included in project.
3. Analyze the customer's environment.
5. Identify the auditing requirements.
6. Create a solution document.


2. Given the topology of the client network (number of PCs, subnets, etc), the number of users, and the network link capacity, measure the network performance and analyze IBM Tivoli Access Manager for Enterprise Single Sign-On’s impact on the environment so that an estimate of the maximum network bandwidth consumed is available.


With emphasis on performing the following tasks:

1. Identify the most active period of time when users tend to log into IBM Tivoli Access Manager for Enterprise Single Sign-On.
2. Estimate the number of users involved.
3. Estimate the size of their wallets by taking into account the number of accounts stored, number of profiles, etc.
4. Estimate the average number of automatic fill of credentials that are done over the same period.
5. Identify the synchronization interval.
6. Use this information and generate an estimate of the maximum network bandwidth consumed.


3. Given the customer's environment, explain the solution architecture so that a solution document with minimum hardware and software requirements for the solution is created.


With emphasis on performing the following tasks:

1. Arrange a meeting with customers.
2. Explain the functionality of the IMS Server.
3. Explain the type of information stored and managed by the DB and where it has to be running.
4. Explain the use of LDAP.
5. Explain the purpose of Load Balancer.
6. Explain several administration tools that an administrator can use for different purposes (AccessAdmin, AccessAssistant, and AccessStudio).
7. Explain where the AccessAgent has to be installed and the purpose.
8. Explain the minimum hardware and software requirements for each component including supported clients.
9. Explain any consideration regarding network requirements for supported clients and supported servers.
10. Explain supported Web Browsers.
11. Explain supported Thin Clients.
12. Create a document with minimum hardware and software requirements for the solution.


4. Given access to the customer applications, collect and analyze the customer application requirements so that Application Profile checklist/document is created.


With emphasis on performing the following tasks:

1. Arrange a kick-off meeting with stakeholders.
2. Get a representative desktop and application list.
3. Review the customer applications in scope.
4. Identify and understand customer's specific application requirements.
1. Determine which applications are web, Windows, mainframe, Java, and others.
2. Determine which application password change workflow is required.
3. Determine password policies for each application.
4. Determine if any applications share credentials (i.e. common LDAP).
5. Identify any potentially “challenging” applications.
6. Identify mechanisms and personnel for password resets/expiry.
5. Obtain or create credentials on the applications for testing purposes.
6. Create an Application Profile checklist/document.


5. Given access to the customer’s test hardware, applications, test credentials, and IBM Tivoli Access Manager for Enterprise Single Sign-On installers, collate the data so that the components of the staging environment is determined and documented.


With emphasis on performing the following tasks:

1. Acquire test server, test workstations, and IBM Tivoli Access Manager for Enterprise Single Sign-On software.
2. Reach an agreement with the customer to use recommended staging environment.
3. Identify test applications that should be installed on the test workstations.
4. Identify test user accounts.
1. Verify which accounts to use for IBM Tivoli Access Manager for Enterprise Single Sign-On administrator account.
2. Verify which accounts to use for IBM Tivoli Access Manager for Enterprise Single Sign-On lookup account.
3. Verify which accounts to use for IBM Tivoli Access Manager for Enterprise Single Sign-On user accounts.
4. Verify which accounts to use for application profile creation/testing.
5. Determine hostname/URL to be used for staging IMS Server.
6. Identify the DB to be used and obtain valid DB credentials.
7. Identify the directory server to be used and obtain valid credentials.
8. Create a staging environment document.


6. Given access to the customer’s Single Sign-On Project Manager, their hardware, network administrator, and an estimate of the maximum network bandwidth consumed, determine High Availability and load balancing environment requirements so that a High Availability design document is created.


With emphasis on performing the following tasks:

1. Arrange a meeting with Single Sign-On Project Manager, Enterprise n/w Administrator, and Infrastructure personnel.
2. Collect information on existing network bandwidth and usage statistics and load infrastructure existing in the customer environment.
3. Collect information needed to estimate hardware sizing for HA.
1. Collect peak hour traffic estimates for one-time password (OTP) login and AA logins/second.
2. Determine peak installation and user sign-up rates.
3. Collect IMS database utilization and clustering requirements.
4. Collect Load Balancing architecture requirements.
4. Share the collected information with Tech Line.
5. Size hardware requirements for HA.
6. Architect High Availability solution for IBM Tivoli Access Manager for Enterprise Single Sign-On components.
7. Create a High Availability Design document.


7. Given access to the AA installer, the domain controller, client machine, and a network share accessible to all clients, create an AA Installation Group Policy Object of Active Directory (GPO) and deploy it to the client machines.


With emphasis on performing the following tasks:

1. Review the Active Directory infrastructure.
2. Copy the AA installer to some network share which is accessible to all clients.
3. Create a new GPO or identify an existing GPO to setup for AA Installation.
4. Configure changes to the GPO.
5. Add the client machine into the scope of this GPO.
6. Restart the client machine.




8. Given the business requirement document, determine a windows session management strategy so that a deployment recommendation for session management in the customer environment is created.


With emphasis on performing the following tasks:

1. Review the security infrastructure of the customer.
2. Identify and understand customer's session management requirements.
1. Determine key objectives for shared/roaming and personal workstation.
2. Collect the usage of fast user switching in the environment.
3. Collect the usage of kiosk environment.
4. Collect the second factor information.
3. Create the windows session management strategy document.


9. Given the authentication mechanisms, second factor options, and access to customer’s authentication requirement, determine a strong authentication strategy so that a strong authentication strategy is documented.


With emphasis on performing the following tasks:

1. Analyze customer’s authentication requirements.
2. Identify the areas of authentication setup.
1. Analyze any second factor authentication policy requirements.
2. Analyze the Mobile ActiveCode requirement.
3. Analyze any OTP requirement.
3. Identify the second factor(s) to use: passive Radio Frequency Identification (RFID), Active RFID, Fingerprint, and USB SmartCard.
4. Validate appropriate reader, if applicable.
1. Identify the readers that are compatible with the hardware.
2. Check the readers that are compatible with the operating systems supported by IBM Tivoli Access Manager for Enterprise Single Sign-On.
3. Eliminate the list further by comparing the readers with the ones supported by IBM Tivoli Access Manager for Enterprise Single Sign-On.
5. Document the strong authentication strategy.


10. Given customers’ requirements, determine need and identify resources for any integration with IBM Tivoli Access Manager for Enterprise Single Sign-On API, so as to define an integration strategy (if needed).


With emphasis on performing the following tasks:

1. Determine whether any customers’ requirements need integration with IBM Tivoli Access Manager for Enterprise Single Sign-On API.
2. Identify the IBM Tivoli Access Manager for Enterprise Single Sign-On API that can meet the requirement (e.g. IBM Tivoli Access Manager for Enterprise Single Sign-On Provisioning API).
3. Define strategy and provide implementer (possibly self) information/documentation needed to implement the integration.


11. Given the prerequisites for databases, prepare the database so that the database is ready for IMS Server installation.


With emphasis on performing the following tasks:

1. Identify customer database requirements.
2. Prepare the Database for the IMS Server installation.
3. Verify the network connection between the IMS Server and the Database Server if those are in different workstation or servers.
4. Obtain relevant access to create the DB instance to be used by IMS Server. .
5. Determine the path of the Database (where it is installed). .
6. Synchronize the system clocks if IMS database and IMS Server would be running on different machines.


12. Given requirements for upgrade, analyze the existing ESSO environment so that an appropriate upgrade strategy is created.


With emphasis on performing the following tasks:

1. Determine upgrade steps.
2. Identify existing infrastructure affected by upgrade steps.
3. Identify necessary stakeholders in upgrade.
4. Create update strategy document containing above information with a notification plan.

Section 2: Implement

1. Given access to the customer applications and test credentials, utilize the AccessStudio wizard so that working AccessProfiles are created for the customer's applications.


With emphasis on performing the following tasks:

1. Verify access to necessary applications.
2. Verify valid credentials for all applications.
3. Validate workflows required for each application (for example, change password, login, logout, and session timeout).
4. Verify if there is an existing profile.
5. Create AccessProfile using Assistant (wizard).
6. Test AccessProfile.


2. Given access to the customer applications and test credentials, utilize the AccessStudio advanced profiling so that working AccessProfiles are created for the customer's applications.


With emphasis on performing the following tasks:

1. Verify access to necessary applications.
2. Verify valid credentials for all applications.
3. Validate workflows required for each application (for example, change password, login, logout, and session timeout).
4. Verify there is not an existing profile.
5. Create AccessProfile using Advanced profiling.
6. Test AccessProfile.


3. Given a functional IMS Server, set up the IMS Server and implement Web Workplace on the IMS Server so that a functional Web workplace is available.


With emphasis on performing the following tasks:

1. Identify required Web workplace behavior and applications to be enabled.
2. Create Web AccessProfiles for identified web applications.
3. Set Web Workplace-related policies.
4. Embed Web Workplace links into customer Portal or VPN.

Section 3: Deployment

1. Given the IBM Tivoli Access Manager for Enterprise Single Sign-On Server installer, set up the server component so that the IMS Server is installed successfully.


With emphasis on performing the following tasks:

1. Verify the operating system prerequisite and free disk space.
2. Install and configure the Database and configure the enterprise directory.
3. Verify the IMS prerequisites.
4. Run the installer of the Server.
5. Configure the hostname details and database instance details during the installation.
6. Verify that the IMS Server is installed on the system.


2. Given a test workstation, customers’ requirement, and an existing IMS Server, install IBM Tivoli Access Manager for Enterprise Single Sign-On AccessAgent so that IBM Tivoli Access Manager for Enterprise Single Sign-On AccessAgent is installed on workstation with correct configurations.


With emphasis on performing the following tasks:

1. Ensure that the machine to be installed on will get the correct machine policy template as defined in template assignments on AccessAdmin.
2. Ensure that an AccessAgent installer package is available and has been customized for the deployment. (Possible customizations include banner graphic, registry edits, ini file options, and editing the installer msi to point to the location of configuration files).
3. Ensure that second factor hardware is connected, if needed.
4. Ensure that drivers for second factor hardware are installed, if needed.
5. On the workstation, run the msi to install IBM Tivoli Access Manager for Enterprise Single Sign-On AccessAgent. A restart is needed on completion. This step can be done manually or thru any software deployment tool.


3. Given the IBM Tivoli Access Manager for Enterprise Single Sign-On Studio installer, set up the AccessStudio component so that AccessStudio is installed on the customer system.


With emphasis on performing the following tasks:

1. Verify the operating system prerequisite and free disk space.
2. Install the AccessStudio.
3. Verify that the AccessStudio is installed on the system.

Section 4: Configuration

1. Given the requirements for IBM Tivoli Access Manager for Enterprise Single Sign-On IMS Server integration with a provisioning system, implement the Provisioning Bridge so that the user provisioning workflows are implemented successfully.


With emphasis on performing the following tasks:

1. Identify the minimum requirements for both of the provisioning system and IMS Server that can integrate with the IMS.
2. Create an IMS Bridge account at IMS for use by the Provisioning Bridge.
3. Configure a key store for the IMS Provisioning Bridge on the provisioning server.
4. Configure the IMS Provisioning Bridge (to point to right key-store and IMS, etc).
5. If the provisioning system does not provide out-of-the-box integration with IMS
1. If the system is based on J2EE or supports Java interfaces, integrate with the IMS Bridge Java APIs.
2. If the system is capable of making command line calls, integrate with the IMS Bridge command line interfaces (tools) into the system.
3. If the system is capable of making SOAP calls, integrate with the IMS SOAP interfaces.
6. If the provisioning system provides out-of-the-box integration with IMS, configure it accordingly.
7. Test the system for successful integration with the Provisioning Bridge.


2. Given the IBM Tivoli Access Manager for Enterprise Single Sign-On Solution, implement the provisioning agent so that the provisioning agent is implemented on the customer environment.


With emphasis on performing the following tasks:

1. Set up a new IMS Bridge using the IMS Configuration Utility.
2. Configure the correct certificates.
3. Configure the IBM Tivoli Access Manager for Enterprise Single Sign-On provisioning agent.
4. Test and install the provisioning agent.
5. Verify that the provisioning agent is implemented on the system.


3. Given an enterprise directory, implement the directory integration with IBM Tivoli Access Manager for Enterprise Single Sign-On so that IBM Tivoli Access Manager for Enterprise Single Sign-On is successfully integrated with enterprise directory structure.


With emphasis on performing the following tasks:

1. Identify the appropriate directory connector.
2. Configure the enterprise directory using IMS Configuration Utility.
3. For Microsoft Active Directory (AD) deployments, enable "AD password sync" where appropriate.
4. Test the enterprise directory.


4. Given a VPN solution, a remote browser, a second factor authenticator, access the configuration pages and configure so that a user can use the remote access solution with VPN.


With emphasis on performing the following tasks:

1. Configure the IMS using the Configuration Utility.
1. Open the IMS Configuration Utility webpage.
2. Configure Mobile ActiveCode (MAC)/one-time password (OTP) Settings.
3. Configure Message Connector settings.
4. Enable MAC/OTP for SSL VPN.
5. Configure Remote Authentication Dial-In User Service (RADIUS) interface.
2. Configure integration with the SSL VPN Appliance as indicated in IBM Tivoli Access Manager for Enterprise Single Sign-On Remote Access Integration Guide.


5. Given an understanding of the customers’ requirements, customize user policies so that the user policy templates are designed, and subsequently configured on the IMS Server.


With emphasis on performing the following tasks:

1. Create the User Policy templates based on customers’ requirements.
2. Identify the default user policy template.
3. Determine the user directory attribute to be used for assignment.
4. Configure the assignment attribute in the IMS Configuration Utility.
5. Implement the policies in AccessAdmin.
6. Customize individual user policies if needed.


6. Given access to the Solution Document and customers’ IBM Tivoli Access Manager for Enterprise Single Sign-On Environment, configure workstation usage workflows so that the desired workstation usage workflows are created.


With emphasis on performing the following tasks:

1. Configure Personal Workstation Usage Workflow.
1. Set up IAM Enterprise in a Personal Workstation.
2. Implement Personal Workstation lock, unlock, logon, and logoff scripts, if needed.
2. Configure Usage workflows for shared desktop.
1. Determine Usage workflows for shared desktop.
2. Implement shared desktop lock, unlock, logon, and logoff scripts, if needed.
3. Configure Usage workflows for private desktop.
1. Determine Usage workflows for private desktop.
2. Implement private desktop lock, unlock, logon, and logoff scripts, if needed.
4. Configure Usage workflows for roaming desktop.
1. Determine Usage workflows for roaming desktop.
2. Implement roaming desktop for Citrix/TS environment.


7. Given access to the Solution Document and customer’s IBM Tivoli Access Manager for Enterprise Single Sign-On Environment, define the machine policy templates and assignments so that the desired Machine Template Policy with assignments is created.


With emphasis on performing the following tasks:

1. Create new Machine Policy Templates based on customers’ requirements.
1. Configure Authentication Policy.
2. Configure Wallet Policy.
3. Configure Signup policy.
4. Configure Shared Workstation Policy and AccessAgent Policy.
5. Create the rules for assignment.
2. Select one of the new Machine Policy Template as the default policy to be used.
3. Change the template assignment of existing machines if reassignment is required.


8. Given a functional IMS Server and client requirements for the thin client, deploy the corresponding thin client solution so that the thin client is working.


With emphasis on performing the following tasks:

1. Determine the type of remote server (Terminal server or Citrix).
2. Install AccessAgent on the remote server and ensure it is configured as a shared

single session workstation.
3. Set the server’s AccessAgent policies.
4. Enable port redirection and mapping if using Radio-Frequency Identification (RFID).
5. Test out the configuration.


9. Given access to Citrix server and customer’s requirement on Citrix, integrate AccessAgent with Citrix so that automation is enabled for published applications.


With emphasis on performing the following tasks:

1. Analyze the user policy on the Citrix server.
2. Create Citrix machine policy template with the network provider policy set to enabled.
3. Assign the Citrix server to the Citrix machine policy template.
4. Install AccessAgent on Citrix server.
5. Verify that the AccessAgent icon is visible on the local machine system tray when user logs into Citrix published application.
6. Test the published application for Single Sign-on (or other automation) on Citrix.


10. Given access to customer’s audit requirement, configure and generate the audit logs so that the Audit log report is created.


With emphasis on performing the following tasks:

1. Define custom audit logs to be generated by the agents, if necessary.
2. Configure the audit log events listed on the server interface.
3. Select the search criteria for audit logs.
4. Define the specific duration for which the audit logs are required and generate the report.
5. Use published log database schema to generate reports using an external reporting tool, if necessary.
6. Print the Audit log report.


11. Given the customer's housekeeping requirements, configure the functionality on IBM Tivoli Access Manager for Enterprise Single Sign-On IMS so that the server installation is automatically maintained in a desired state in the future.


With emphasis on performing the following tasks:

1. Determine frequency of housekeeping.
2. Determine the items to be included in housekeeping, including log pruning, database backup, and server configuration backup.
3. Use IMS Configurator tool to set up housekeeping tasks in accordance with customers’ requirements.
4. Alternatively use customer-defined housekeeping tasks.


12. Given the customers’ requirements, determine the process to customize IBM Tivoli Access Manager for Enterprise Single Sign-On so that the requirements are met and the system can be implemented successfully.


With emphasis on performing the following tasks:

1. Configure the IBM Tivoli Access Manager for Enterprise Single Sign-On IMS Server.
1. After installation, modify the IMS configuration settings to address requirements such as enterprise directories to be integrated, AccessAdmin user interface customizations, housekeeping, etc.
2. Restart the service and run through the Setup Assistant on AccessAdmin to configure the default user policy template, machine policy templates and assignments, and system policies.
3. Review the system policies, machine policy templates (and assignments), and user policy templates (and assignments). Create new ones if needed.
4. Review and create the required saved Audit searches.
2. Customize the IBM Tivoli Access Manager for Enterprise Single Sign-On AccessAgent Package.
1. Review and make changes to the package based on Graphical Identification and Authentication, Logon Banner, IMS Server fully qualified domain name (FQDN), and requirements in the INI file.
2. Review and make changes to default registry settings in the deployment options registry file.
3. Add in any files or scripts to be distributed with the installer in the Config folder.
4. Review and make changes to the MSI installer file based on software distribution mechanism.
5. Install any third-party components required for second factor support prior to AccessAgent install.
3. Customize the IBM Tivoli Access Manager for Enterprise Single Sign-On AccessProfiles.
1. Review the application screens and Single Sign-On workflow requirements for each application and profile them accordingly.
4. Test the customizations and obtain the customer’s sign off.


13. Given a running IMS Server, run the IMS Configuration Utility so that the IMS Server is configured.


With emphasis on performing the following tasks:

1. Open IMS Configuration Utility.
2. Use the IMS Configuration Utility.
1. Set up new enterprise directories.
2. Provide IMS administrator.
3. Set up housekeeping.
4. Set up advance settings, etc.
3. Save changes and stop the IMS Server.
4. Restart the IMS Server.


14. Given the requirements for an application’s authentication to be augmented using IBM Tivoli Access Manager for Enterprise Single Sign-On OTP functionality, implement a solution so that the OTP authentication using third-party token requirements is addressed.


With emphasis on performing the following tasks:

1. Configure the IMS Server to enable OTP (time-based and/or Open AuTHentication (OATH)) for the authentication service to be strengthened.
2. Install OTP token support on the IMS.
3. Configure RADIUS authentication for the application (server) whose authentication service is to be strengthened.
4. Enable users sign up (registration) through AccessAdmin.
5. Set the ActiveCode enabled bindings for each token user.
6. Set the requisite User and System policy settings.
7. For OATH based OTP tokens, set the OATH look-ahead number and token reset window.
8. Configure the bypass option for OTP authentication.
9. Test the solution to ensure it to meet the customers’ requirements.


15. Given the requirements for an application’s authentication to be augmented using IBM Tivoli Access Manager for Enterprise Single Sign-On MAC functionality, implement a solution so that the MAC authentication requirements are addressed.


With emphasis on performing the following tasks:

1. Configure MAC settings on the IMS Server.
2. Configure an existing message connector on the IMS Server for the selected MAC delivery channel. (Or develop a new message connector)
3. Configure the IMS Server’s RADIUS Authentication interface if the application supports RADIUS authentication.
1. Configure the Application’s Authentication Server to perform RADIUS authentication with the IMS’s RADIUS server.
2. Configure the Application’s Server to direct the client to display the MAC challenge screen on first authentication step success.
3. Customize the Application’s client user interface to show appropriate messaging on the MAC challenge screen.
4. For non-RADIUS authentication supporting applications
1. Customize the application logon interface to include a request for MAC or provide a separate MAC request page.
2. Develop a SOAP Client with the ability to make authentication calls and MAC request calls to the IMS.
5. Configure a bypass option for MAC Authentication.
6. Test the solution to ensure it to meet the customers’ requirements.


16. Given end user availability, functional AccessAgent, and IMS components, utilize AccessAgent or AccessAssistant sign-up functionality so that users are successfully signed up with IBM Tivoli Access Manager for Enterprise Single Sign-On.


With emphasis on performing the following tasks:

1. Ensure user has second factor available if applicable (RFID badge etc).
2. Sign up using:
1. The AccessAgent sign up process
2. AccessAssistant
3. External provisioning system


17. Given access to the Solution Document, customer’s IBM Tivoli Access Manager for Enterprise Single Sign-On Environment, and system policies, define the self-service functionality so that the self-service functionality is defined.


With emphasis on performing the following tasks:

1. Define Secret Question list for End users to sign up during first time login based on customers’ requirements.
2. Enable Self Service functionality and set the corresponding policies required to authorize.
1. Enable self-service password reset.
2. Enable self-service second factor registration.
3. Enable self-service for authorization code generation.
3. Test and deploy the self-service functionality.
4. Include the self-service definitions in the user policy templates.


18. Given a functional IMS Server, configure user access to AccessAssistant so that AccessAssistant is working.


With emphasis on performing the following tasks:

1. Set AccessAssistant-related system policies.
2. Configure AccessAssistant-related policies in user policy templates.
3. Configure AccessAssistant-related policies for specific users.
4. Test access for users.


19. Given the organization security policy, configure the IMS system policy so that IMS system policy is configured successfully.


With emphasis on performing the following tasks:

1. Review the default system policy settings.
2. Modify the default system policy settings according to customers’ requirements through AccessAdmin.
3. Wait for the Sync period for the application of this system Polices.
4. Verify that the IMS Server Policy is configured successfully.




20. Given access to customer environment and business requirement, set policy priorities so that the policy priority is implemented.


With emphasis on performing the following tasks:

1. Analyze customer’s policy requirements.
2. Determine the scope of the policy (such as Machine, User, System policy).
3. Modify the policy priorities and execute the command-line tool.


21. Given the customers’ requirements regarding application screens and workflows (Application Design Document), modify an existing profile so that each application can be profiled successfully to meet the requirements.


With emphasis on performing the following tasks:

1. Determine the modifications required in order to make the existing profile work accordingly.
2. Determine details like Account Data Template, Authentication Service (and groups), to be used in the profile.
3. Complete the Application Design Template based on the options determined.
4. Test out the profile.


22. Given IMS Server installation, define the IMS Server administrator and set up the roles for administrators, helpdesk, and end user so that the users have been assigned roles.


With emphasis on performing the following tasks:

1. Provision the IMS Server administrator user.
2. Log on to the AccessAdmin as the Administrator.
3. Search for users.
4. Choose a user to change his role.
5. Open administrative policies.
6. Change the role user and updated.
7. Enable the automatic role assignment for large deployments if it is necessary.
1. Run the IMS Configuration utility.
2. Specify the AD attribute for automatic role assignment.
3. Restart the IMS Server.
8. Assign Helpdesk through user policy templates.


23. Given multiple configured databases and an installed IMS Server Solution, configure additional datasource so that an additional datasource is configured in the IMS Server.


With emphasis on performing the following tasks:

1. Map the input of datasource with appropriate databases information (IMS, Log or external).
2. Configure the external attributes in the datasource.
3. Update the configuration and restart the IMS Service.
4. Verify that the configuration of the datasource is complete.

Section 5: Administration

1. Given AccessStudio, administrative privileges on the IMS Server, access to applications and notification when applications are modified, the AccessProfiles should be reviewed and updated so that they are always up to date and working correctly.


With emphasis on performing the following tasks:

1. Evaluate applications which are to be updated or changed to validate if the AccessProfile remains functional.
2. Modify AccessProfile so that it is able to work with old version as well as the new version.
3. Test in a staging environment.
4. Deploy to production IMS Server once new profile is working correctly.




2. Given access to the Solution Document, the customer’s IBM Tivoli Access Manager for Enterprise Single Sign-On environment, and Disaster Recovery (DR) site, determine and establish a DR regime so that an effective failover to DR environment is achieved in the event of a failure in the production environment.


With emphasis on performing the following tasks:

1. Determine failover and recovery criteria for IBM Tivoli Access Manager for Enterprise Single Sign-On components.
2. Determine backup and restore strategy for IMS database.
3. Set up DR environment in a separate site or location.
4. Test DR environment for failover situations.


3. Given the IMS Server, manage audit logs and reports through the IMS Server so that audit logs and reports can be viewed by the Administrator.


With emphasis on performing the following tasks:

1. Search the audit logs based on the query.
2. Save the Query for the audit Logs.
3. Search the Reports on the IMS Server based on user information, token, User information, and Helpdesk activity.
4. Manage the Reports based on the page size.


4. Given that a new server host is prepared, the IMS database is on a separate host and the DNS and load balancer config is changed to accommodate new DNS name, move the IMS to another server host machine so that IMS is successfully migrated to a different server machine.


With emphasis on performing the following tasks:

1. Back up entire IMS folder from original server and copy to new server.
2. If DNS name is changed, re-generate IMS SSL cert using the new DNS name, and import to IMS's keystore on new server.
3. Set up IMS to run as a Windows service on the new server.
4. Start up IMS (within the IMS cluster environment, if applicable) and test.
5. If there are multiple IMS Servers, repeat above steps.


5. Given database access, migrate the IMS database to a different database server so that the IMS is operational with a new database server.


With emphasis on performing the following tasks:

1. Stop all IMS Servers.
2. Move IMS database from one database instance/server to another.
3. Create database account (with required privileges) for IMS to use and test access to the database using this account.
4. Reconfigure IMS configuration file on IMS to point to the new database server and to use the new DB account credentials.
5. Restart IMS and test.
6. If there are multiple IMS Servers, repeat the configuration change on each server (or copy over ims.xml), and restart.

Section 6: Performance Tuning and Problem Determination

1. Given existing IBM Tivoli Access Manager for Enterprise Single Sign-On installation, identify and implement measures for improving performance so that the server and client components perform at optimal levels.


With emphasis on performing the following tasks:

1. Identify and address opportunities for Improving Server performance, for example, configure Java memory parameters on the IMS web server or configure the LDAP lookup timeout on a directory connector.
2. Identify and address opportunities for Improving Agent performance, for example, performance may be tuned by removing unnecessary ApplicationProflies, lowering the log level, and excluding AccessAgent installation folder from certain runtime scans, adjust the synch interval between client and server, adjust communication timeouts, etc.
3. Identify and address opportunities for improving database performance, for example, log pruning, changing memory allocated to database, and create indexes.


2. Given an issue with the IBM Tivoli Access Manager for Enterprise Single Sign-On IMS Server functionality, troubleshoot the server utilizing tools provided so that the issue can be identified.


With emphasis on performing the following tasks:

1. Identify that the problem at hand is an IMS Server issue, and obtain the result-code provided in the IMS error logs (or on the Status page in AccessAdmin).
2. Identify the cause of the specific error code in the diagnostics pages.
3. If the result-code is related to integrate with the enterprise directory, utilize the enterprise directory troubleshooting capability provided by the diagnostics pages.
4. Identify the issue.


3. Given IBM Tivoli Access Manager for Enterprise Single Sign-On installation with lost connectivity to the IMS Server, troubleshoot IMS connectivity issues so that the connectivity problem can be identified.


With emphasis on performing the following tasks:

1. Determine if the client machine is on the network. .
2. Determine if certificates between the IMS and the Agent are set up correctly.
3. Determine if an intervening firewall between the client machine and IMS Server.
4. Determine if any network configuration issue, such as DNS problems.
5. Determine if an intervening application protector between the client machine and IMS Server.
6. Determine if some personal firewall or anti-spyware is blocking traffic from winlogon.exe.
7. Determine if the registry settings are corrupted or configured incorrectly, if AccessAgent is pointing to the wrong IMS Server.
8. Check to see if the IMS Server is up and running (ping test, visual inspection, etc).
9. Check to ensure the IMS Service is running (services.msc).
10. Try to “Set IMS Server Location” from a client workstation.
11. Identify the connectivity issue.


4. Given IBM Tivoli Access Manager for Enterprise Single Sign-On operation issues with users, computers or servers, recover from common user/computer situations so that the issue is resolved.


With emphasis on performing the following tasks:

1. Understand common issues affecting:
1. Users, for example, user forgets password, user forgets key.
2. Computers, for example, the user tries to log on to AccessAgent and unlock the computer but it is unsuccessful.
3. Servers, for example, IMS Server has crashed database has crashed.
2. Start the appropriate recovery workflow.
3. Resolve the issue.