Remote CLI .. Windows PC set-up

TWS remote CLI for a personal PC advantages:

• You can skip using the TDWC which in is slow and hard to use for big / massive changes.
• No need to connect to any host.
• Configure and personalize the editor (which for local CLI is the OS default one).

Once the remote CLI software was deployed (it also can be copied from an already installed source, installation is not mandatory) perform the following tasks for a better view and easier access:

    1. Create a *.cmd (e.g. TWS_CLI_Start.cmd) file that is setting up the global variables before launching the composer, and use it to start the remote CLI (more details can be found HERE):

@echo off
set MAESTRO_OUTPUT_STYLE=LONG
set MAESTROLINES=0
set MAESTROCOLUMNS=520

"%CD%\bin\composer.exe"

   2. Adjust the localopts file, personalize tp make sure there wont be any confusions to which TWS environment are you connected / working on (all the lines can be removed except the below ones):

e.g. TWS1 env.

############## Attributes of this Workstation: ##############

composer prompt    =TWS1>

############## Attributes for CLI connection ##############

HOST   =   TWS1.company.com 

PROTOCOL    =   https
PORT        =   31116
TIMEOUT     =   3600
IS REMOTE CLI = yes

e.g. TWS2 env.

############## Attributes of this Workstation: ##############

composer prompt    =TWS2>

############## Attributes for CLI connection ##############

HOST   =   TWS2.company.com 

PROTOCOL    =   https
PORT        =   31116
TIMEOUT     =   3600
IS REMOTE CLI = yes

I personally have multiple versions of localopts files and i'm overwriting the localopts file based on the needs. (e.g. localopts_TWS1, localopts_TWS2 and based on which TWS env. i want to connect i'm copying its localopts_XXX file over localopts)

     3. Once the user password expired you need to re-add it (as per first use), the first step that needs to be performed is to remove the useropt file from the user profile home and this can be automated by creating a *.cmd, file using the below commands:

@echo off
del "%USERPROFILE%\.TWS\useropts"
"%CD%\TWS_CLI_Start.cmd"

     4. You can adjust the default Windows editor which will be used in editing composer modify commands:

     X. To take full advantage of the remote CLI I recommend to use Windows PowerShell rather the default command line.

TWS LTPA key update / exchange

Sometimes the LTPA (Lightweight Third-Party Authentication) key need to be updated for TWS / TDWC or exchanged between several TWS / TDWC servers in order to connect from any TDWC (tivoli Dynamic Workload Console) to any TWS / TDWC. Usually this exchange is done automatically (totally transparent for end user) but it some cases it doesn't work and manual exchange is needed.

To update or export / import LTPA key perform the following steps:

   
   1. Connect to TWS / TDWC WebSphere, administrative console:

Default path: https://:31124/ibm/console/logon.jsp?action=OK

   2. Log in using the administrative account and navigate to Security -- Global security -- Authentication -- LTPA

   3. To generate a new key press the Generate keys button from Key Generation menu or if you need to export / import the key in Cross-cell single sign-on menu add a Password / Confirm Password and a Fully qualified key file name and press Export Keys.

   4. To import the key, copy the exported key from step 3. on the target server, repeat steps 1 and 2 for the target and in Cross-cell single sign-on menu add a the  Password / Confirm Password from step 3. type the path and file name in Fully qualified key file name and press Import Keys.

   5. Save the changes are you are done (there is no need to restart the WebSphere).

TWS & TDWC MS AD integration

In this post I will describe how to set-up a MS AD (Microsoft Active Directory) users integration for TWS & TDWC directly using WebSphere (for Windows machine there is another way using the OS capabilities).

Prerequisites: A MS AD (Microsoft Active Directory) account (service account preferred) that will be used to connect to MS AD and read its repository.
For both TWS and TDWC the set-up is identical (if they both run on the same WebSphere it needs to be performed only once).

To set-up the TWS / TDWC and MS AD integration:
   

   1. Login to WebSphere admin page:

• Directly: https://:31124/ibm/console/secure/securelogon.do?action=force (this si the default link)
• From TDWC:

                    

   2. Go to Security -- Global Security, and under User account repository set Current realm definition as Standalone LDAP registry (to use a single repository, e.g. MS AD only) or Federated  repositories (to use multiple repositories, e.g. MS AD, Local Server Account).

!!!!! Important: If the account name is not unique across Federated  repositories the user WILL NOT be authenticated, be very very careful with this.  

 
   3. Then go to Configure ... -- Manage repositories (Under Related Items) and click Add

   4. On LDAP server under Directory type select Microsoft Windows Active Directory and fill in the data as:

• Repository identifier -- just a display name
• Primary host name -- your Microsoft Active Directory (MS AD) domain controller server name (DNS name) or fully qualified domain name (FQDN) or  IP address
• Port -- the server port that will be used to connect to MS AD in order to get users data (default: 389)
•  Bind distinguished name -- specify the distinguished name for the application name to use when binding to the MS AD repository 

e.g. CN=user_name,OU=IT,OU=TM,OU=RO,DC=europe,DC=ad,DC=company_name,DC=com

• Bind password -- specify the password for the application server to use when binding to the MS AD repository (in short: the password for user_name on the Bind distinguished name field)

Press OK and if you opted for Standalone LDAP registry go to the last step (8).

   

   5. Go to Global Security -- Federated  repositories -- Repositories in the realm: -- Add Base entry to Realm...

   6. On Repository reference select:

• Repository -- The one you created at step 4.
• Distinguished name of a base entry that uniquely identifies this set of entries in the realm -- specify the distinguished name of a base entry that uniquely identifies this set of entries in the realm

e.g. DC=ad,DC=company_name,DC=com

Press OK

   7. Press Apply and Save directly to the master configuration.

   8. Restart the WebSphere.

Now the users authentication is performed using MS AD (only MS AD or and MS AD). Also you may use MS AD groups or DL (distributions lists) to grant rights in TWS and / or TDWC.