System Queue Connector

IBM Tivoli Directory Integrator

The System Queue provides a subsystem similar to Java Message Service (JMS) for IBM TDI. It is designed for storing and forwarding general messages and TDI Entry Objects, between TDI Servers and AssemblyLines.

The System Queue Connector is the mechanism for AssemblyLines to interface with the System Queue. To learn more about the System Queue and its configuration, refer to the System Queue section in the IBM TDI V7.1 Installation and Administrator Guide.

The System Queue Connector can be used with AssemblyLines in Iterator and AddOnly modes:

In Iterator mode, the Connector retrieves TDI Entry objects from a specified message queue.
In AddOnly mode, the Connector stores TDI Entry objects in the specified message queue.

If two JMS clients retrieve messages from the same JMS queue simultaneously, an error might occur. Avoid solutions which use several instances of the System Queue Connector retrieving messages from the same JMS queue simultaneously. However, an instance of the System Queue Connector writing to a queue and another instance of the Connector reading from that same queue at the same time is acceptable.

The System Queue Connector uses the Server API to access the System Queue. The Connector uses both the local and remote interfaces of the Server API, allowing the Connector to operate on a TDI System Queue running on a remote computer. The Connector's ability to operate on a remote computer, coupled with the System Queue's capability to connect to remote JMS servers, results in the ability to use some quite complex deployment scenarios. For example: a TDI server and a System Queue Connector deployed on machine A, working through the remote Server API with the TDI server and System Queue on machine B, which in turn interface with a JMS server deployed on machine C.

In TDI 7.1, the System Queue is enabled by default by the install process and the MQe Queue Manger is set up with two queues:

_default - serves as a general purposes queue
passwords - this queue is used by the JMS Password Store components for storage of password changes.

Configuration

The System Queue Connector uses the following parameters:

Connection Type

This parameter determines whether the System Queue Connector works with the System Queue of the local TDI server or with the System Queue of a remote TDI server. The available values for this parameter are local and remote. The value local specifies that the Connector will use the local Server API interfaces and will work with the System Queue of the local TDI server. This is the default. The value remote specifies that the Connector will use the remote Server API interfaces and will work with the System Queue of a remote TDI server. In that case, the RMI URL parameter is required, the Connector configuration (both the Connector parameters and the SSL configuration of the local TDI Server) must match the configuration of the remote TDI Server.

RMI URL

The Remote Method Invocation (RMI) URL used to connect to the remote TDI Server system. An example value (and default) for this parameter is:

rmi://127.0.0.1:1099/SessionFactory

This parameter is taken into account only if the connectionType parameter is set to remote.

Username

Used to authenticate to the remote TDI server using the user name and password authentication mechanism of the Server API. This parameter is taken into account only if the connectionType parameter is set to remote.

Password

Used to authenticate to the remote TDI server. This parameter is taken into account only if the connectionType parameter is set to remote.

Queue Name

Specifies the name of the JMS queue with which the Connector will work. In Iterator mode, the Connector retrieves Entry objects from this queue. In Add-Only mode, the Connector stores Entry objects in this queue.

Timeout

Specifies the amount of time in seconds the Connector will wait before returning a null Entry object. If a value of zero (0) is specified for this parameter, the Connector will immediately return if there are no available Entry objects in the queue. If a negative value is specified for this parameter then the Connector will wait indefinitely or until an Entry object becomes available in the queue. The default value is -1.

Detailed Log

This parameter turns on debug messages This parameter is globally defined for all TDI components

Security, Authentication and Authorization

Encryption

When the connection type is set to remote and the remote TDI server is configured to use Secure Sockets Layer (SSL), then the System Queue Connector uses SSL, provided that a trust store on the local TDI Server is configured properly. When SSL is used, the Connector uses a Server API SSL session, which runs RMI over SSL.

Of the standard JMS Drivers only the driver for MQ supports SSL out of the box. The MQe JMS Driver only works with a local Queue Manager - this is mandated by the MQe architecture. The JMS Script Driver is a generic driver which supports whatever the corresponding user-provided Javascript supports.

Authentication

Username and password authentication

The System Queue Connector can use the remote Server API username and password authentication. The Connector does not implement any authentication itself. The username and password supplied to the Server API are configured as Connector configuration parameters.

SSL certificate-based authentication

The System Queue Connector is capable of authenticating by using a client SSL certificate. This is only possible when the remote TDI Server API is configured to use SSL and to require clients to possess SSL client certificates. A trust store must be configured properly on the local TDI server.

If SSL is used and a user name and password have been supplied as Connector parameters then the Connector will use the supplied user name and password and not the SSL client certificate to authenticate to the remote TDI Server.

Authorization

The Server API authorization mechanism is applied to the Server API session the System Queue Connector establishes to the TDI Server. With the TDI 7.1 Server API once the System Queue Connector is authenticated it can use the TDI System Queue.