Services Standard Build User Guide
Services Standard Build User Guide
This document is meant to be a user-friendly guide explaining how to set-up the services standard build, as well
as its applications.
© Copyright 2013 SailPoint Technologies, Inc., All Rights Reserved.
SailPoint Technologies, Inc. makes no warranty of any kind with regard to this manual, including, but not limited to, the implied
warranties of merchantability and fitness for a particular purpose. SailPoint Technologies shall not be liable for errors contained herein or
direct, indirect, special, incidental or consequential damages in connection with the furnishing, performance, or use of this material.
Restricted Rights Legend. All rights are reserved. No part of this document may be photocopied, reproduced, or translated to another
language without the prior written consent of SailPoint Technologies. The information contained in this document is subject to change
without notice.
Use, duplication or disclosure by the U.S. Government is subject to restrictions as set forth in subparagraph (c) (1) (ii) of the Rights in
Technical Data and Computer Software clause at DFARS 252.227-7013 for DOD agencies, and subparagraphs (c) (1) and (c) (2) of the
Commercial Computer Software Restricted Rights clause at FAR 52.227-19 for other agencies.
Regulatory/Export Compliance. The export and reexport of this software is controlled for export purposes by the U.S. Government. By
accepting this software and/or documentation, licensee agrees to comply with all U.S. and foreign export laws and regulations as they
relate to software and related documentation. Licensee will not export or reexport outside the United States software or documentation,
whether directly or indirectly, to any Prohibited Party and will not cause, approve or otherwise intentionally facilitate others in so doing.
A Prohibited Party includes: a party in a U.S. embargoed country or country the United States has named as a supporter of international
terrorism; a party involved in proliferation; a party identified by the U.S. Government as a Denied Party; a party named on the U.S.
Government's Entities List; a party prohibited from participation in export or reexport transactions by a U.S. Government General Order;
a party listed by the U.S. Government's Office of Foreign Assets Control as ineligible to participate in transactions subject to U.S.
jurisdiction; or any party that licensee knows or has reason to know has violated or plans to violate U.S. or foreign export laws or
regulations. Licensee shall ensure that each of its software users complies with U.S. and foreign export laws and regulations as they relate
to software and related documentation.
Trademark Notices. Copyright © 2012 SailPoint Technologies, Inc. All rights reserved. SailPoint, the SailPoint logo, SailPoint IdentityIQ,
and SailPoint Identity Analyzer are trademarks of SailPoint Technologies, Inc. and may not be used without the prior express written
permission of SailPoint Technologies, Inc. All other trademarks shown herein are owned by the respective companies or persons
indicated.
The Services Standard Build (SSB) is a process developed by the SailPoint Services team for use as a build process
for IdentityIQ deployments. This process was designed with the following goals in mind:
Automate effort of generating deployments for various environments such as development, testing,
UAT, and production.
Reduce time frame for new team members to become familiar with project structure and
customizations.
Reduce likelihood of errors due to improper deployment of patches, efixes, and configurations.
Accelerate the software development process with useful methods and tools that make configuring
IdentityIQ more efficient.
Enable the SailPoint support team to quickly replicate IdentityIQ environments.
Generally, it is best to set-up a build process once a project requires a move from the development environment
to the test environment. To do this, the set of scripts and directories that make up the SSB needs to be
downloaded and all configuration objects need to be exported from the development environment into the
build directory.
Process Overview
Before beginning, please ensure you have the following:
Download the Zip file with the latest version and unzip it into a file directory accessible to the development
environment. This will create the base build structure. The directory where you have un-zipped the services
standard build files to will be called the “SSB Install Directory” below. Note where you unzipped these files to,
we will reference this directory again later several times throughout the document.
To see the configuration objects your environment has by object type, navigate to the WEB-INF\bin folder within
your IdentityIQ installation directory from a command prompt. Enter the command “iiq console” once
inside this directory.
Enter the command, “list”, to see all of the object types or “Classes”. Enter “list objectType”, to see all of
the objects of that type in your environment.
If your environment has configuration object types not covered in the 35 object classes listed in the export
script, add more commands to the export script following the syntax of the other lines in the script,
i.e.,“export -clean exports/CurrentObjectClassNameExported.xml ObjectClassName”.
Navigate back to the WEB-INF\bin folder within your IdentityIQ installation directory from a command prompt.
Enter the command “iiq console” once inside this directory.
Once a closing tag appears “>”, enter the following command “source ExportScript.txt”. This will run the export
script and export all of your environment’s configuration objects into the exports folder you just created.
Place every class’ exported xml into its respective folder. For example, place the
“CurrentApplicationExported.xml” file from the “exports” folder, into the <SSB install
directory>\ServicesStdBuild\trunk\config\Application folder.
Object Split-up
It is recommended, but not required, to put each individual object into its own xml file. This makes it easier in
the future to track exactly which objects have been changed between releases. Do this by putting the object’s
entire definition in between the following header, opening, and closing tags:
4. Build Configuration
After all custom objects have been placed inside their proper class folders, move the entire <SSB install
directory> folder into your new environment.
Place your installation version’s IdentityIQ zip file into the <SSB install
directory>\ServicesStdBuild\trunk\base\ga folder. If you are running IdentityIQ 6.0, you
would put identityiq-6.0.zip here, for example. You can place as many different IdentityIQ zip files as you would
like here. The correct .zip will be selected based off the IIQVersion value set in the environment specific
If you are running a patched version of IdentityIQ, place the patch .jar file for your installation into the <SSB
install directory>\ServicesStdBuild\trunk\base\patch folder. You can place as many
different patch .jar files as you would like here. The appropriate patch .jar will be selected using the
IIQPatchLevel property set in the environment specific build.properties file. All patch .jar files can
be located here: https://community.sailpoint.com/documents/product-resources/productfiles
IIQPatchLevel (only required if using a patch level) - If you want to deploy a patch level specify what level with
pX syntax. Ex. p1 or p6. If you are not on a patch level then leave this entry blank.
IIQHome(required) - The home directory of the IdentityIQ web application in your sandbox/development
environment.
jdk.home (required) - The path on your system to the Java Development Kit (jdk) you want to use to compile
any custom Java code you may have developed as part of your IdentityIQ configuration. As with all system
paths, if there are spaces in your jdk path, put the entire path in double quotes.
runCustomScripts (leave as false if unsure) - (true/false) The build is not meant to be modified. You will notice
the core build files are set to be read only. The main build has two hook points after file layout and after war
creation where you can execute customized build scripts. This flag indicates if these customizations should be
executed.
application.server.start (required) - Since there are so many different application servers we leave it to you to
write a script that starts and stops the server, sets up JVM parameters etc. Many application servers already
ship with these but you can specify which ones you want to use here. These scripts are used in development
targets that cycle the application server for you.
db.userid (required) - Database user that has create and drop schema privileges . Ex. root on MySql. (Supply
these parameters only for the sandbox/development environment. Test and Production environment are
managed in a more secure fashion.)
db.password (required)- The password for the root db user. (Supply these parameters only for the
sandbox/development environment. Test and Production environment are managed in a more secure fashion.)
db.driver (required)- The class of the JDBC driver to use for SQL connections. This is the same type of value you
would put in your iiq.properties file following the directions in the IdentityIQ Installation Guide.
iiq.path (required)- The installation directory within the application server directory of the IdentityIQ
application. Usually /iiq or /identityiq
db.type (required) - (db2/mysql/oracle/sqlserver) one of these values used to pick which database scripts to
run.
override.safety.prompts (leave false if unsure) - Certain dangerous build targets like dropdb will prompt the
user for confirmation before executing. If you are using the build to make test cases you may want to turn off
these prompts.
manager.url - URL to the tomcat manager script interface. Prior to Tomcat Version 6 the url is usually /manager
but post Version 6 it is /manager/text.
manager.login - A user who has the manager-script role in the Tomcat manager application. For information on
how to set this up check out http://tomcat.apache.org/tomcat-7.0-doc/manager-
howto.html#Executing_Manager_Commands_With_Ant
usingLcm - If your implementation includes Lifecycle Manager, you can ensure that it is included in your project
build by enabling the “usingLcm” property in the build.xml file. This will insure that init-lcm.xml is called
immediately after init.xml (which is renamed to init-default-org.xml by the Services Standard Build.)
The “build.properties” file described above loads the defaults for the build with respect to the path to Java
binaries, IdentityIQ version and other details. In order to override those defaults on a per-server basis you can
specify another properties file with properties that just apply to one server. Each server or host used in
development and testing can override the settings in “build.properties” by using its own
“build.properties.hostname“ file. For example if your host is named “sailsandbox” then the properties file
unique to that server would be called “build.properties.sailsandbox”. The server’s properties file has the exact
same format and fields as the “build.properties” file described in the previous section and only has to specify the
fields that it wants to override with new values.
Each environment has different logins, IPs and passwords. The SSB will automatically look for tokenized strings
in your custom configuration xml and substitute the appropriate values per environment.
<target>.target.properties
This set of files contains name value pairs for token substitution during build time. You should have one file for
each environment in your deployment.
Example
sandbox.target.properties
test.target.properties
UAT.target.properties
prod.target.properties
Each file is just a list of key/value pairs. The build follows the convention that the keys follow the %%.*%%
pattern.
For example, you may have an Active Directory application configuration that looks like this:
To support multiple environments you would substitute passwords, ports, etc. with keys that will go in your
<target>.target.properties file.
#######################################################
# AD Connectors
#######################################################
%%AD_HOST%%=example.com
%%AD_PORT%%=3379
%%AD_PROXY_USER%%=productionADuser
%%AD_PROXY_PASSWORD%%=mySuperSecrectProductionPassword
<target>.iiq.properties
This file is the iiq.properties file you want to use for the target environment. For example, if your environments
are sandbox, test, UAT and prod, you would have four files each containing the iiq.properties that know how to
connect to the database server in that environment. This way you can support different properties for different
environments, such as having a direct connection in sandbox and test while having a JNDI named connection in
UAT and production.
Example
sandbox.iiq.properties
test.iiq.properties
UAT.iiq.properties
prod.iiq.properties
# Uncomment to send all SQL queries to std out. This provides a lot of
output
# and slows down execution, so use it wisely.
#sessionFactory.hibernateProperties.hibernate.show_sql=true
Folder Structure
base - Contains binaries distributed by SailPoint. You can download these from community.sailpoint.com
efix - Contains any efix archives sorted by directory name where the directory name follows the naming
convention <version><patchlevel>. If there is no patch level just the version number. Because efix solutions only
work with the specific product version they were designed for you must make a unique directory for each
version and patch level you want to build against. If the build does not find a efix directory for the version its
building for it will fail with the error indicating so. In the above example there is a efix directory for 5.1p5.
ga - Contains the SailPoint GA release binary. You can have as many GA release binaries as you want to build
against and the appropriate one will be selected using the values you set in build.properties.
Example: /base/ga/identityiq-6.1.zip
patch - Contains the SailPoint patch binaries. You can have as many patch binaries as you want to build against
and the appropriate patch will be selected using the values you set in build.properties.
Example:/base/patch/identityiq-6.1p1.jar
config - Contains all SailPoint XML configuration sorted by folders where each sub directory is named by the
type of top level SailPoint object it holds. In the provided example Application, Rule, TaskDefinition and
TaskSchedule directories are shown. In general as you customize more object types you should add a directory
to contain that object. While writing code, try to make the separation of object types as granular as possible
scripts - With the exception of the master build.xml file in the root directory, all other build files are contained in
this directory. Shipped and supported build files are read-only and follow the name convention build.*.xml. If
you customize the build process you must declare your customizations in build files that follow the naming
convention build.custom.*.xml. These files adhere to an interface which is discussed in detail in the Customizing
the build process section of this document.
servicestools - This folder may or may not be included in your version of the build archive. It contains the
source code and an ANT project to build the services-tools.jar which is placed in the lib directory of the build.
src - Contains all of your custom java. Note this java will be placed in a jar file which will be placed in the main
WEB-INF/lib directory. You should NOT "clone and own" SailPoint shipped classes in this area. Since they will be
placed in the classpath at the same level as the shipped classes you may get behavior you do not expect. If you
absolutely must modify a core class you will have to define a build.custom.*.xml file to handle layout of these
files as you are basically defining your own efix. By default the build will not play nice with this practice.
web - Contains content that will be directly overlaid on the IIQ folder structure. Examples include custom
graphics/branding, xhtml, jsp and custom message catalogs etc. An example may be including custom changes
to the Hibernate XML configuration files. Under web you will need to create the folder structure to where these
files are normally stored.
../web/WEB-INF/classes/sailpoint/object/hibernateExtended.hbm.xml
Where hibernateExtended may be any of the Hibernate XML configuration files usually found in the
object directory, such as IdentityExtended.hbm.xml or LinkExtended.hbm.xml
To create an initial Services Standard Build package in the standard J2EE Web Application Archive that can be
deployed to a web application server such as Tomcat, you can perform the following steps.
war:
[war] Building war:
/home/workspace/SSB/trunk/build/deploy/identityiq.war
[echo] A MD5 checksum was generated for this war file
and placed in the war file directory. Keep this checksum to
diagnose potential version issues
BUILD SUCCESSFUL
Deploy this file to the target web application server. You may need to consult your application serverss
deployment guide for details. In the case of Tomcat, you can simply copy this custom identityiq.war to a
folder under <Tomcat>/webapps
Navigate to this directory; cd <Tomcat>/webapps/identityiq
Expand and delete the war; jar xvf identityiq.war
You will need to create the IIQ database and tables, and if necessary consult the IdentityIQ Installation Guide for
details. Otherwise you are ready to use your customized IIQ application.
If you wish to update any custom objects and redeploy them to IdentityIQ you can perform the following steps.
Open a terminal or command prompt window,
createdb
Depends on the build.properties file having a database account setup that has schema creation and drop
privileges. This will setup the IIQ schema and apply any patch updates.
cycle
Depends on the application.server.start and stop properties being set. This will cycle your application server and
reload all web applications. If you are using Tomcat and you have the CATALINA_HOME environment variable
set this target will just reload the IIQ application and not the entire server.
dropdb
Drops the IIQ database.
dist
Copies the entire expanded war content to your application server webapps directory.
importcycle
Runs through the entire build process, validates and imports all custom xml, compiled java and static web
content and cycles the server. Useful while developing custom java.
importdynamic
Imports all content that does not require an application reload; Custom XML, static web content etc. Useful for
developing rules, workflow and branding.
export
Exports objects specified within objectsToExport.properties (this will now be generated – edit Rule-
OutputCustomObjectFile.xml in scripts if you need to add more objects to ignore or export – the variable name
of ignored object classes is listOfIgnoredClasses.) from your IIQHome repository to build/export so that you
don’t manually have to copy and paste xml from console-exported files to your build environment. Edit the
property file to include all types of objects you want to export, as well as the names of the objects for each type.