How to Configure OpenLDAP 2.4 or Later as a Policy Store
Contents
casso127
Contents
2
OpenLDAP can function as a policy store. A single directory server instance can function as a Policy Store and a Key store.
Using a single directory server simplifies administration tasks. The following sections provide instruction on how to configure a single directory server instance to store policy data and encryption keys. If your implementation requires, you can configure a separate key store.
Gather Directory Server Information
casso127
Configuring an LDAP directory server as a policy store or upgrading an existing policy store requires specific directory server information. Gather the following information before beginning.
- Host informationSpecifies the fully-qualified host name or the IP Address of the directory server.
- Port information(Optional) Specifies a non-standard port.Default values:636 (SSL) and 389 (non-SSL)
- Administrative DNSpecifies the LDAP user name of a user who has privileges to create, read, modify, and delete objects in the LDAP tree underneath the policy store root object.
- Administrative passwordSpecifies the password for the Administrative DN.
- Policy store root DNSpecifies the distinguished name of the node in the LDAP tree where policy store objects are to be defined.
- SSL client certificateSpecifies the pathname of the directory where the SSL client certificate database file resides.Limit:SSL only
Define the slapd Database Directives
Define the following slapd database directives in slapd configuration:
- databaseSpecifies a supported backend type.Example: bdb
- suffixSpecifies the database suffix.Example: dc=example,dc=com
- rootdnSpecifies the DN of the root.Example: cn=Manager,dc=example,dc=com
- rootpwSpecifies the password of the root.
- directorySpecifies the path of the database directory. Ensure that the database directory exists before you run slapd and it is accessible only to the slapd process.Example: /usr/local/var/openldap-data
Create the Database
The following process lists the steps for creating the directory server database for the policy store:
- Create the base tree structure.
- Add entries.
Create the Base Tree Structure
You can create a base tree structure to store policy store objects.
Specify the following entry under the root DN:
ou=Netegrity,ou=SiteMinder,ou=PolicySvr4,ou=XPS
The base tree structure is created.
Add Entries
Add entries to the directory server so that
CA Single Sign-On
has the necessary organization and organizational role information.Follow these steps:
- Create an LDIF file.Example: The following example contains an organization entry and an organizational role entry for the entries.ldif.# Netegrity, example.comdn: ou=Netegrity,dc= example,dc=comou: NetegrityobjectClass: organizationalUnitobjectClass: top# SiteMinder, Netegrity, example.comdn: ou=SiteMinder,ou=Netegrity,dc= example,dc=comou: SiteMinderobjectClass: organizationalUnitobjectClass: top# PolicySvr4, SiteMinder, CA, example.comdn: ou=PolicySvr4,ou=SiteMinder,ou=Netegrity,dc= example,dc=comou: PolicySvr4objectClass: organizationalUnitobjectClass: top# XPS, PolicySvr4, SiteMinder, Netegrity, example.comdn: ou=XPS,ou=PolicySvr4,ou=SiteMinder,ou=Netegrity,dc= example,dc=comou: XPSobjectClass: organizationalUnitobjectClass: top
- Use the following command to add the entries.ldapadd -f <file_name.ldif> -D "cn=Manager,dc=example,dc=com"-w<password>
Point the Policy Server to the Policy Store
casso127
You point the Policy Server to the policy store so the Policy Server can access the policy store.
Follow these steps:
- Open the Policy Server Management Console.casso127On Windows Server, if User Account Control (UAC) is enabled open the shortcut with Administrator permissions. Use Administrator permissions even if you are logged in to the system as an Administrator. For more information, see the release notes for yourCA Single Sign-Oncomponent.
- Click the Data tab.
- Select the following value from the Database list:Policy Store
- Select the following value from the Storage list:LDAP
- Configure the following settings in the LDAP Policy Store group box.
- LDAP IP Address
- Admin Username
- Password
- Confirm Password
- Root DN
You can click Help for a description of fields, controls, and their respective requirements. - Click Apply.
- Click Test LDAP Connection to verify that the Policy Server can access the policy store.
- Select the following value from the Database list:Key Store
- Select the following value from the Storage list:LDAP
- Select the following option:Use Policy Store database
- Click OK.
Create the Policy Store Schema
Create the Policy Store schema for the directory server to function as a Policy Store and store
CA Single Sign-On
objects.Before you proceed, complete the following steps:
- Create an LDAP instance.
- Define the Policy Store and key store information of the LDAP instance.
Follow these steps
:- Execute the following command on the machine where you installed Policy Server:smldapsetup ldgen -ffile_namefile_nameSpecifies the name of the LDIF file that is generated.An LDIF file with the specified name is created and contains theCA Single Sign-Onschema.
- Execute the following command:smldapsetup ldmod -ffile_namefile_nameSpecifies the name of the LDIF file that is generated.
- Execute the following command:smldapsetup ldmod -fsso_home\xps\db\Tier2DirSupport\OpenLDAP\openldap_XPS.ldifsso_homeSpecifies theCA Single Sign-Oninstallation path.
Define slapd Configuration
An OpenLDAP directory server requires additional configuration before you can use it as a policy store. The following process lists the configuration steps:
- Enable Policy Store indexing.
- Enable user authentication.
- Support Client-Side Sorting
- Restart the OpenLDAP server.
Note
: To define the configuration, use the ldapadd/ldapmodify commands or configure the slapd configuration database file.Enable Policy Store Indexing
Specify indexing in slapd configuration to use OpenLDAP as a policy store.
To enable indexing, add the following index to slapd configuration:
To enable indexing, add the following index to the slapd configuration:olcDbIndex: smAdminOID4 pres,eqolcDbIndex: smAuthDirOID4 pres,eqolcDbIndex: smAzDirOID4 pres,eqolcDbIndex: smcertmapOID4 pres,eqolcDbIndex: smIsRadius4 pres,eqolcDbIndex: smIsAffiliate4 pres,eqolcDbIndex: smParentRealmOID4 pres,eqolcDbIndex: smPasswordPolicyOID4 pres,eqolcDbIndex: smAgentGroupOID4 pres,eqolcDbIndex: smKeyManagementOID4 pres,eqolcDbIndex: smAgentOID4 pres,eqolcDbIndex: smAgentKeyOID4 pres,eqolcDbIndex: smRootConfigOID4 pres,eqolcDbIndex: smAGAgents4 pres,eqolcDbIndex: smDomainAdminOIDs4 pres,eqolcDbIndex: smDomainOID4 pres,eqolcDbIndex: smvariableoid5 pres,eqolcDbIndex: smNestedVariableOIDs5 pres,eqolcDbIndex: smvariabletypeoid5 pres,eqolcDbIndex: smActiveExprOID5 pres,eqolcDbIndex: smDomainUDs4 pres,eqolcDbIndex: smVariableOIDs5 pres,eqolcDbIndex: smusractiveexproid5 pres,eqolcDbIndex: smPropertyOID5 pres,eqolcDbIndex: smPropertySectionOID5 pres,eqolcDbIndex: smPropertyCollectionOID5 pres,eqolcDbIndex: smFilterClass4 pres,eqolcDbIndex: smTaggedStringOID5 pres,eqolcDbIndex: smNoMatch5 pres,eqolcDbIndex: smTrustedHostOID5 pres,eqolcDbIndex: smIs4xTrustedHost5 pres,eqolcDbIndex: smDomainMode5 pres,eq# olcDbIndex: smImsEnvironmentOIDs5 pres,eqolcDbIndex: smSecretRolloverEnabled6 pres,eqolcDbIndex: smSecretGenTime6 pres,eqolcDbIndex: smSecretUsedTime6 pres,eqolcDbIndex: smSharedSecretPolicyOID6 pres,eqolcDbIndex: smFilterPath4 pres,eqolcDbIndex: smPolicyLinkOID4 pres,eqolcDbIndex: smIPAddress4 pres,eqolcDbIndex: smRealmOID4 pres,eqolcDbIndex: smSelfRegOID4 pres,eqolcDbIndex: smAzUserDirOID4 pres,eqolcDbIndex: smResourceType4 pres,eqolcDbIndex: smResponseAttrOID4 pres,eqolcDbIndex: smResponseGroupOID4 pres,eqolcDbIndex: smResponseOID4 pres,eqolcDbIndex: smRGResponses4 pres,eqolcDbIndex: smRGRules4 pres,eqolcDbIndex: smRuleGroupOID4 pres,eqolcDbIndex: smRuleOID4 pres,eqolcDbIndex: smSchemeOID4 pres,eqolcDbIndex: smisTemplate4 pres,eqolcDbIndex: smisUsedbyAdmin4 pres,eqolcDbIndex: smSchemeType4 pres,eqolcDbIndex: smUserDirectoryOID4 pres,eqolcDbIndex: smODBCQueryOID4 pres,eqolcDbIndex: smUserPolicyOID4 pres,eqolcDbIndex: smAgentTypeAttrOID4 pres,eqolcDbIndex: smAgentTypeOID4 pres,eqolcDbIndex: smAgentTyperfcid4 pres,eqolcDbIndex: smAgentTypeType4 pres,eqolcDbIndex: smAgentCommandOID4 pres,eqolcDbIndex: smTimeStamp4 pres,eqolcDbIndex: smServerCommandOID4 pres,eqolcDbIndex: smAuthAzMapOID4 pres,eqolcDbIndex: xpsParameter pres,eqolcDbIndex: xpsValue pres,eqolcDbIndex: xpsNumber pres,eqolcDbIndex: xpsCategory pres,eqolcDbIndex: xpsGUID pres,eqolcDbIndex: xpsSortKey pres,eqolcDbIndex: xpsIndexedObject pres,eq
Enable User Authentication
Enabling user authentication ensures that you can protect resources with a supported authentication scheme.
To enable user authentication, add the following to slapd configuration:
olcAccess: to attrs=userpassword by self write by anonymous auth by * none
(Optional) Support Client-Side Sorting
To support client-side sorting, the OpenLDAP directory administrator must configure the following settings in slapd configuration:
- Enable reading of the Root DSE.This setting allows the XPS client to read the OpenLDAP directory's type and capabilities.
- Set the maximum number of entries that can be returned from a search operation >= 500.This setting accommodates XPS objects which are retrieved in increments of 500 by server-side paging.
- Allow a simple V2 bind.This setting allows smconsole to test the LDAP connection using a simple V2 bind.
Follow these steps:
- Add the following lines to slapd configuration:olcAccess: to * by users read by anonymous readORolcAccess: to dn.base="<Root_DN>" by users read
- Root_DNSpecifies the distinguished name of the node in the LDAP tree where policy store objects must be defined.
Note:For more information on how to specify the ACL, see Access Control. - Verify that the value specified by the sizelimit directive in slapd configuration is >= 500:olcSizeLimit: 500Note:The default sizelimit value is 500. For more information, see Configuring slapd.
- Add the following line to slapd configuration:olcAllows: bind_v2
slapd configuration is configured to support client-side sorting.
Restart the OpenLDAP Server
Restarting the OpenLDAP directory server loads the
CA Single Sign-On
schema. Policy Server requires that the CA Single Sign-On
schema is loaded before you can use the directory server as a policy store.Follow these steps:
- Execute the following command to stop the directory server:service slapd stop
- Execute the following command to start the directory server:service slapd start
Set the
CA Single Sign-On
Super User Passwordcasso127
The default administrator account is named
siteminder
. The account has maximum permissions.Do not use the default super user for day-to-day operations. Use the default super user to:
- Access the Administrative UI for the first time.
- ManageCA Single Sign-Onutilities for the first time.
- Create another administrator with super user permissions.
Follow these steps:
- Copy the smreg utility tositeminder_home\bin.
- siteminder_homeSpecifies the Policy Server installation path.
The utility is at the top level of the Policy Server installation kit. - Run the following command:smreg -supassword
- passwordSpecifies the password for the default administrator.
- The password must contain at least six (6) characters and cannot exceed 24 characters.
- The password cannot include an ampersand (&) or an asterisk (*).
- If the password contains a space, enclose the passphrase with quotation marks.
If you are configuring an Oracle policy store, the password is case–sensitive. The password is not case–sensitive for all other policy stores. - Delete smreg fromsiteminder_home\bin. Deleting smreg prevents someone from changing the password without knowing the previous one.
The password for the default administrator account is set.
Import the Policy Store Data Definitions
casso127
Importing the policy store data definitions defines the types of objects that can be created and stored in the policy store.
Follow these steps:
- Open a command window and navigate tositeminder_home\xps\dd.
- siteminder_homeSpecifies the Policy Server installation path.
- Run the following command:XPSDDInstall SmMaster.xdd
- XPSDDInstallImports the required data definitions.
Import the Default Policy Store Objects
casso127
Importing the default policy store objects configures the policy store for use with the Administrative UI and the Policy Server.
Consider the following items:
- Be sure that you have write access tositeminder_home\bin. The import utility requires this permission to import the policy store objects.
- siteminder_homeSpecifies the Policy Server installation path.
- If Windows User Account Control (UAC) is enabled, open the command-line window with administrator permissions. Open the command-line window this way, even if your account has administrator privileges. For more information, see the release notes for yourCA Single Sign-Oncomponent.
Follow these steps:
- Open a command window and navigate tositeminder_home\db.
- Import one of the following files:
- To import smpolicy.xml, run the following command:XPSImport smpolicy.xml -npass
- To import smpolicy–secure.xml, run the following command:XPSImport smpolicy-secure.xml -npass
- npassSpecifies that no passphrase is required. The default policy store objects do not contain encrypted data.
- To import Option Pack functionality, run the following command:XPSImport ampolicy.xml -npass
- To import federation functionality, run the following command:XPSImport fedpolicy-12.5.xml -npass
- To use OAuth or OpenID Connect, run the following command to import the default OAuth entities and default claims and scopes objects for OpenID Connect:XPSImport default-fedobjects-config.xml -npass-npassspecifies that no passphrase is required.
Importing ampolicy.xml makes available legacy federation and Web Service Variables functionality that is separately licensed from
CA Single Sign-On
. If you intend on using the latter functionality, contact your CA account representative for licensing information.Prepare for the Administrative UI Registration
casso127
You use the default super user account to log into the Administrative UI for the first time. The initial login requires that you to register the Administrative UI with a Policy Server, which creates a trusted relationship between both components.
You prepare for the registration by using the XPSRegClient utility to supply the super user account name and password. The Policy Server uses these credentials to verify that the registration request is valid and that the trusted relationship can be established.
Consider the following items:
- The time from which you supply the credentials to when the initial Administrative UI login occurs is limited to 24 hours. If you do not plan on installing the Administrative UI within one day, complete the following steps before installing the Administrative UI.
- (UNIX) Be sure that theCA Single Sign-Onenvironment variables are set before you use XPSRegClient. If the environment variables are not set, set them manually.
Follow these steps:
- Log in to the Policy Server host system.
- Run the following command:XPSRegClient super_user_account_name[:passphrase] -adminui-setup -ttimeout-rretries-ccomment-cp -llog_path-eerror_path-vT -vI -vW -vE -vF
- passphraseSpecifies the password for the default super user account.If you do not specify the passphrase, XPSRegClient prompts you to enter and confirm one.
- -adminui–setupSpecifies that the Administrative UI is being registered with a Policy Server for the first–time.
- -ttimeout(Optional) Specifies the allotted time from when you to install the Administrative UI to the time you log in and create a trusted relationship with a Policy Server. The Policy Server denies the registration request when the timeout value is exceeded.Unit of measurement:minutesDefault:240 (4 hours)Minimum:15Maximum:1440 (24 hours)
- -rretries(Optional) Specifies how many failed attempts are allowed when you are registering the Administrative UI. A failed attempt can result from submitting incorrect administrator credentials when logging in to the Administrative UI for the first time.Default:1Maximum:5
- -ccomment(Optional) Inserts the specified comments into the registration log file for informational purposes.Surround comments with quotes.
- -cp(Optional) Specifies that registration log file can contain multiple lines of comments. The utility prompts for multiple lines of comments and inserts the specified comments into the registration log file for informational purposes.Surround comments with quotes.
- -llog_path(Optional) Specifies where the registration log file must be exported.Default:siteminder_home\logsiteminder_homeSpecifies the Policy Server installation path.
- -eerror_path(Optional) Sends exceptions to the specified path.Default:stderr
- -vT(Optional) Sets the verbosity level to TRACE.
- -vI(Optional) Sets the verbosity level to INFO.
- -vW(Optional) Sets the verbosity level to WARNING.
- -vE(Optional) Sets the verbosity level to ERROR.
- -vF(Optional) Sets the verbosity level to FATAL.
- Press Enter.XPSRegClient supplies the Policy Server with the administrator credentials. The Policy Server uses these credentials to verify the registration request when you log in to the Administrative UI for the first time.