Configure a MySQL Policy Store
Contents
sm1252sp1
Contents
2
A MySQL policy store can also function as:
- A key store
- An audit logging databaseSession information is stored in a separate database. Do not use the policy store to store session information.
Using a single database simplifies administration tasks. The following sections provide instruction on how to configure a single database server.
Before You Begin
- Verify that MySQL uses the Latin1 or UTF8 character set. Use the UTF8 character set to support Unicode characters.
- Confirm that the MySQL database acting as the policy store is accessible from the Policy Server host system.
- Create the database instance for the data store, using the vendor–specific user interface.
- To create a database instance for Unicode characters, use the character set and collation for UTF8.
- To create a database instance for non-Unicode characters, use the character set and collation for Latin1.
Gather Database Information
sm1252sp1
Gather the following information before configuring the policy store or any other type of
CA Single Sign-On
data store:- Database host—Identify the name of the database host system.
- Database name—Identify the name of the database instance that is to function as the policy store or data store.
- Database port—Identify the port on which the database is listening.
- Administrator account—Identify the login ID of an administrator account with permission to manage objects in the database.
- Administrator password—Identify the password for the administrator account.
Create the
CA Single Sign-On
SchemaYou create the
CA Single Sign-On
schema so that the MySQL database can store the policy, key, and audit logging information.Follow these steps:
- Start the Query Browser and log in as the person who administers the Policy Server database.
- Select the database instance from the database list.
- Navigate to the following location:siteminder_home\db\tier2\MySQL.
- siteminder_homeSpecifies the Policy Server installation path.
- Openoneof the following files in a text editor:
- To store Unicode characters in the policy store, open sm_mysql_ps.sql.unicode.
- To store non-Unicode characters in the policy store, open sm_mysql_ps.sql.
- Locate the following lines in the sm_mysql_ps file:DROP FUNCTION IF EXISTS `databaseName`.`getdate` $$CREATE FUNCTION `databaseName`.`getdate` () RETURNS DATE
- Replace each instance of 'databaseName' with the name of the database functioning as the policy store.
- After you replace the databaseName instances, copy the contents of the entire file.
- Paste the file contents into a query and execute the query.The policy and key store schema are added to the database.
- Navigate to the following location:siteminder_home\xps\db\Tier2DirSupport\MySQL
- Openoneof the following files in a text editor and copy the contents of the entire file:
- To store Unicode characters in the policy store, open MySQL.sql.unicode.
- To store non-Unicode characters in the policy store, open MySQL.sql.
- Paste the schema from the appropriate MySQL file into a query and execute the query.The policy store schema is extended.
- To use the policy store as an audit logging database, repeat steps three and four but use the following logging schema file:sm_mysql_logs.sqlThe database can storeCA Single Sign-Ondata.Note:You are not required to configure the policy store to store moreCA Single Sign-Ondata. You can configure individual databases to function as a separate audit log database, key store, and session store.
Configure a MySQL Data Source for
CA Single Sign-On
sm1252sp1
You configure a data source to let the Policy Server communicate with the
CA Single Sign-On
data store. If you are using MySQL 5.1.x, ensure that you assign the TRIGGER permission to the user name that is used to create the DSN.
Create a MySQL Data Source on Windows
sm1252sp1
You create a MySQL data source for the MySQL wire protocol driver.
Follow these steps:
- Log in to the Policy Server host system.
- Do one of the following steps:
- If you are using a supported 32–bit Windows operating system, click Start and select Programs, Administrative Tools, ODBC Data Sources.
- If you are using a supported 64–bit Windows operating system:
- Navigate to theinstall_home\Windows\SysWOW64.
- Double–click odbcad32.exe.
- Click System DSN.
- Click Add.
- Scroll down and selectCA Single Sign-OnMySQL Wire Protocol and click Finish.
- Complete the following steps in the General tab:
- Enter a data source name in the Data Source Name field.Example:CA SiteMinder® MySQL Wire Data Source
- Enter the name of the MySQL database host system in the Host Name field.
- Enter the port on which the MySQL database is listening in the Port Number field.
- Enter the name of the MySQL database in the Database Name field.
- Click Test Connect.
- Click OK.The data source is created and appears in the System Data Sources list.
You can now point the Policy Server to the
CA Single Sign-On
data store.Create a MySQL Data Source on UNIX Systems
sm1252sp1
The
CA Single Sign-On
ODBC data sources are configured using a system_odbc.ini file, which you create by renaming mysqlwire.ini to system_odbc.ini. The mysqlwire.ini file is located in siteminder_home
/db.- siteminder_homeSpecifies the Policy Server installation path.
This system_odbc.ini file contains all of the names of the available ODBC data sources and the attributes that are associated with these data sources. This file must be customized to work for each site. Also, you can add other data sources to this file, such as defining other ODBC user directories for
CA Single Sign-On
.The first section of the system_odbc.ini file, [ODBC Data Sources], contains a list of all of the currently available data sources. The name before the “=” refers to a subsequent section of the file describing each individual data source. After the “=” is a comment field.
The value of the first line of data source entry is required when you configure the database as a policy store.
Each data source has a section in the system_odbc.ini file describing its attributes. The first attribute is the ODBC driver that is loaded when
CA Single Sign-On
uses this data source. The remaining attributes are specific to the driver.Adding a MySQL Server Data source includes:
- A new data source name in the [ODBC Data Sources] section of the file.
- A section that describes the data source using the same name as the data source.
Update the system_odbc.ini file when creating a new service name. You have entries for the MySQL driver under [
CA Single Sign-On
Data Source].Again, to configure a MySQL Server data source, you create the system_odbc.ini file by renaming mysqlwire.ini to system_odbc.ini.
Create the MySQL Wire Protocol Driver
sm1252sp1
sm1252sp1
You configure the wire protocol driver to specify the settings the Policy Server uses to connect to the database.
This procedure only applies if the Policy Server is installed on a UNIX system. If you have not already done so, copy one of the following files and rename it
system_odbc.ini
:- sqlserverwire.ini
- oraclewire.ini
- mysqlwire.ini
- postgresqlwire.ini
These files are located in
siteminder_home
/db.The system_odbc.ini file contains the following sections. The data source that you are configuring determine the section or sections that you edit:
- [SiteMinder Data Source]Specifies the settingsCA Single Sign-Onis to use to connect to the database functioning as the policy store.
- [SiteMinder Logs Data Source]Specifies the settingsCA Single Sign-Onis to use to connect to the database functioning as the audit log database.
- [SiteMinder Keys Data Source]Specifies the settingsCA Single Sign-Onis to connect to the database functioning as the key store.
- [SiteMinder Session Data Source]Specifies the settingsCA Single Sign-Onis to connect to the database functioning as the session store.
- [SmSampleUsers Data Source]Specifies the settingsCA Single Sign-Onis to connect to the database functioning as the sample user data store.
Follow these steps:
- Open the system_odbc.ini file.
- Enter the following line under [ODBC Data Sources]:SiteMinder Data Source=DataDirect 7.1 MySQL Wire Protocol
- Depending on the data source you are configuring, edit one or more of the data source sections with the following information. When editing data source information, do not use the pound sign (#). Entering a pound sign comments the information, which truncates the value. The truncated value can cause ODBC connections to fail.Driver=nete_ps_root/odbc/lib/NSmysql27.soDescription=DataDirect 7.1 MySQL Wire ProtocolDatabase=database_nameHostName=host_nameLogonID=root_userPassword=root_user_passwordPortNumber=mysql_port
- nete_ps_rootSpecifies the Policy Server installation path. Enter this value as an explicit path, rather than one with an environment variable.Example:/export/smuser/siteminder
- database_nameSpecifies the name of the MySQL database that is to function as the data store.
- host_nameSpecifies the name of the MySQL database host system.
- root_userSpecifies the login ID of the MySQL root user.
- root_user_passwordSpecifies the password for the MySQL root user.
- mysql_portSpecifies the port on which the MySQL database is listening.
- Save the file.The wire protocol driver is configured.
Point the Policy Server to the Database
sm1252sp1
You point the Policy Server to the database so the Policy Server can access the
CA Single Sign-On
data in the policy store.Follow these steps:
- Open the Policy Server Management Console and click the Data tab.
- Select the following value from the Storage list:ODBC
- Select the following value from the Database list:Policy Store
- Enter the name of the data source in the Data Source Information field.
- (Windows) The entry must match the name that you entered in the Data Source Name field when you created the data source.
- (UNIX) The entry must match the first line of the data source entry in the system_odbc.ini file. By default, the first line in the file is [CA Single Sign-OnData Sources]. If you modified the first entry, be sure to enter the correct value.
- Enter and confirm the user name and password of the database account that has full access rights to the database instance in the respective fields.
- Specify the maximum number of database connections that are allocated toCA Single Sign-On.We recommend retaining the 25 connection default for best performance.
- Click Apply to save the settings.
- Select the following value from the Database list:Key Store
- Select the following value from the Storage list:ODBC
- Select the following option:Use the Policy Store database
- Select the following value from the Database list:Audit Logs
- Select the following value from the Storage list:ODBC
- Select the following option:Use the Policy Store database
- Click Apply to save the settings.
- Click Test Connection to verify that the Policy Server can access the policy store.
- Click OK.The Policy Server is configured to use the database as a policy store, key store, and logging database.
Set the
CA Single Sign-On
Super User Passwordsm1252sp1
The default
CA Single Sign-On
administrator account is named siteminder
. The account has maximum permissions.Do not use the default super user for day-to-day operations. Use the default super user to:
- Access the Administrative UI for the first time.
- ManageCA Single Sign-Onutilities for the first time.
- Create another administrator with super user permissions.
Follow these steps:
- Copy the smreg utility tositeminder_home\bin.
- siteminder_homeSpecifies the Policy Server installation path.
The utility is at the top level of the Policy Server installation kit. - Run the following command:smreg -supassword
- passwordSpecifies the password for the default administrator.
- The password must contain at least six (6) characters and cannot exceed 24 characters.
- The password cannot include an ampersand (&) or an asterisk (*).
- If the password contains a space, enclose the passphrase with quotation marks.
If you are configuring an Oracle policy store, the password is case-sensitive. The password is not case-sensitive for all other policy stores. - Delete smreg fromsiteminder_home\bin. Deleting smreg prevents someone from changing the password without knowing the previous one.
The password for the default administrator account is set.
Import the Policy Store Data Definitions
sm1252sp1
Importing the policy store data definitions defines the types of objects that can be created and stored in the policy store.
Follow these steps:
- Open a command window and navigate tositeminder_home\xps\dd.
- siteminder_homeSpecifies the Policy Server installation path.
- Run the following command:XPSDDInstall SmMaster.xdd
- XPSDDInstallImports the required data definitions.
Import the Default Policy Store Objects
sm1252sp1
Importing the default policy store objects configures the policy store for use with the Administrative UI and the Policy Server.
Consider the following items:
- Be sure that you have write access tositeminder_home\bin. The import utility requires this permission to import the policy store objects.
- siteminder_homeSpecifies the Policy Server installation path.
- Before running aCA Single Sign-Onutility or executable on Windows Server 2008, open the command-line window with administrator permissions. Open the command-line window this way, even if your account has administrator privileges. For more information, see the release notes for yourCA Single Sign-Oncomponent.
Follow these steps:
- Open a command window and navigate tositeminder_home\db.
- Import one of the following files:
- To import smpolicy.xml, run the following command:XPSImport smpolicy.xml -npass
- To import smpolicy–secure.xml, run the following command:XPSImport smpolicy-secure.xml -npass
- npassSpecifies that no passphrase is required. The default policy store objects do not contain encrypted data.
- To import Option Pack functionality, run the following command:XPSImport ampolicy.xml -npass
- To import federation functionality, run the following command:XPSImport fedpolicy-12.5.xml -npass
Importing ampolicy.xml makes available legacy federation and Web Service Variables functionality that is separately licensed from
CA Single Sign-On
. If you intend on using the latter functionality, contact your CA account representative for licensing information.Enable the Advanced Authentication Server
sm1252sp1
Enable the Advanced Authentication Server as part of configuring your Policy Server.
Follow these steps:
- Start the Policy Server configuration wizard.
- Perform one of the following steps:On Windows:Leave all the check boxes in the first screen of the wizardclearedand click Next.On Linux:Type 5 and press Enter.
- Create the master encryption key for the Advanced Authentication Server.sm1252sp1If you are installing another (nth) Policy Server, use the same encryption key for the Advanced Authentication server that you used previously.
- Complete the rest of the Policy Server configuration wizard.The Advanced Authentication Server is enabled.
Restart the Policy Server
sm1252sp1
You restart the Policy Server for certain settings to take effect.
Follow these steps:
- Open the Policy Server Management Console.
- Click the Status tab, and click Stop in the Policy Server group box.The Policy Server stops as indicated by the red stoplight.
- Click Start.The Policy Server starts as indicated by the green stoplight.Note: On UNIX, execute the stop-ps and start-ps commands to restart Policy Server. To restart Policy Server and CA Risk Authentication, execute the stop-all and start-all commands.
Prepare for the Administrative UI Registration
sm1252sp1
You use the default super user account (siteminder) to log into the Administrative UI for the first time. The initial login requires that you to register the Administrative UI with a Policy Server, which creates a trusted relationship between both components.
You prepare for the registration by using the XPSRegClient utility to supply the super user account name and password. The Policy Server uses these credentials to verify that the registration request is valid and that the trusted relationship can be established.
Consider the following items:
- The time from which you supply the credentials to when the initial Administrative UI login occurs is limited to 24 hours. If you do not plan on installing the Administrative UI within one day, complete the following steps before installing the Administrative UI.
- (UNIX) Be sure that theCA Single Sign-Onenvironment variables are set before you use XPSRegClient. If the environment variables are not set, set them manually.
Follow these steps:
- Log in to the Policy Server host system.
- Run the following command:XPSRegClient siteminder[:passphrase] -adminui-setup -t timeout -r retries -c comment -cp -l log_path -e error_path -vT -vI -vW -vE -vF
- passphraseSpecifies the password for the default super user account (siteminder).If you do not specify the passphrase, XPSRegClient prompts you to enter and confirm one.
- -adminui–setupSpecifies that the Administrative UI is being registered with a Policy Server for the first–time.
- -t timeout(Optional) Specifies the allotted time from when you to install the Administrative UI to the time you log in and create a trusted relationship with a Policy Server. The Policy Server denies the registration request when the timeout value is exceeded.Unit of measurement:minutesDefault:240 (4 hours)Minimum:15Maximum:1440 (24 hours)
- -r retries(Optional) Specifies how many failed attempts are allowed when you are registering the Administrative UI. A failed attempt can result from submitting incorrect administrator credentials when logging in to the Administrative UI for the first time.Default:1Maximum:5
- -c comment(Optional) Inserts the specified comments into the registration log file for informational purposes.Surround comments with quotes.
- -cp(Optional) Specifies that registration log file can contain multiple lines of comments. The utility prompts for multiple lines of comments and inserts the specified comments into the registration log file for informational purposes.Surround comments with quotes.
- -l log path(Optional) Specifies where the registration log file must be exported.Default:siteminder_home\logsiteminder_homeSpecifies the Policy Server installation path.
- -e error_path(Optional) Sends exceptions to the specified path.Default:stderr
- -vT(Optional) Sets the verbosity level to TRACE.
- -vI(Optional) Sets the verbosity level to INFO.
- -vW(Optional) Sets the verbosity level to WARNING.
- -vE(Optional) Sets the verbosity level to ERROR.
- -vF(Optional) Sets the verbosity level to FATAL.
- Press Enter.XPSRegClient supplies the Policy Server with the administrator credentials. The Policy Server uses these credentials to verify the registration request when you log in to the Administrative UI for the first time.