What are 'w' Commands?

Contributed By: Paul Claridge
Generally Tivoli supply compiled binaries. On UNIX they don't usually have a file extension. However, on NT they do. Just to complicate things Tivoli also supply Perl scripts which look like binaries but are not. winstlcf is a classic example. This can be very frustrating when you try and run one of these scripts on NT because is simply says something useless like "cannot find the file". Naturally if you call Perl with the script (possibly with prepended correct path) as a parameter everything bursts into life - well, you at least get a usage statement!

This can cause all sorts of fun and games in scripting because shell commands demand the full name of the file. So if you miss off the .EXE things tend to fail. However if you run the file in a Windows context the OS might properly say that's an EXE so I'll load the file anyway. Wouldn't it be nice if things were consistent!
 

WIDMAP Confusion

I've got a question regarding widmap. My TMR server is running NT. I want to setup a single Tivoli account that multiple NT users can use for Software Distribution and I'm a bit confused over the best way of doing this with widmap (assuming widmap is the way to go).

Does anyone have any information they'd be willing to share as I'm struggling with the Framework Reference Guide?

Contributed By: Paul Claridge, Pete Haswell, Cliff Hobbs [MVP SMS], Ken Wood
When things run on the Framework they need to have an "effective user" to use a UNIX expression. Tivoli refers to it as a Principal. The Principal is a userid that must exist on the platform you want to run the method on, otherwise the method cannot be run by the operating system.

Each Tivoli Administrator is created with two distinct sets of userids.

• The first is the effective user (or principal) and group and this determines what that Administrator will behave as when doing anything on any platform (interp).
   
• The second is a list of logins which the Framework uses to authenticate users through their Tivoli desktops, when they login to that Administrator desktop. The rule here is that the userid (sometimes qualified by domain name or hostname) must be able to be authenticated by the TMR Managed Node that is going to launch the Tivoli desktop server process.

So what is an ID map? It is simply a look up table that enables an alias to be used (by prefixing the table name with a "$" sign) as the principal. The one most people are familiar with because it designates the "superuser" on each platform is the "$root_user" idmap (use the "widmap list_entries root_user" command to list the entries).

This is an important idmap because a lot of the methods run with a principal of $root_user. When the method is invoked on NT the Framework does a lookup on the TMR and resolves the idmap to "Administrator" (by default on older versions) or "BuiltinNTAdministrator" on the current 3.7.1 Framework.

So idmaps are for individuals who may have different userids on different interps. Hence for an idmap "$bill", aix4-r1 might map to "bill_jones", whilst w32-ix86 might map to "jonesb3", etc.  See Setting up Single Tivoli Account Access across Platforms for more details on using the widmap command.

I don't think your problem will be solved by considering idmaps, which might be causing the problem.

One solution would be to create a privileged swdist user (in the NT domain or local SAM(s)); make this the principal of the Tivoli Administrator, and then add logins for all the users you want to do swdist. An idmap might be appropriate if you then want to define different privileged users on different platforms for the swdist function. In this case a "$swdist" idmap will give you the required flexibility. The subtlety is that you will need to change the Administrators principal from swdist to the idmap reference "$swdist".

You used to be able to forget NT groups but I think later versions require a valid group definition as well.

It's probably better to think of widmap as an ability to set the user you want something to run as.

Remember Tivoli is case sensitive and NT is not. Be sure the entry in the Logins dialog box matches exactly the way the user logs in to NT.