7.2 Preparing One SSO Provider for Use

In some installation scenarios, you must take additional steps to prepare OSP for use with Identity Governance. For example, running OSP in an environment without Identity Manager or using Active Directory as your LDAP authentication server require some additional steps. Also, if you did not enable auditing during the installation process, you must run some additional steps.

7.2.1 Ensuring the Configuration Update Utility Can Run OSP

When you run OSP on a different Tomcat server than Identity Governance, and you do not have Identity Manager in your environment, you must ensure that the OSP Configuration Update utility has the appropriate values to run OSP. The OSP Configuration Update utility (configupdate.sh or configupdate.bat) contains the settings that allow OSP to function and it is a separate utility from the Configuration Update utility for Identity Governance. After installing Identity Governance, you must update several settings in both utilities. see SSO Clients Parameters in the NetIQ Identity Manager Setup Guide for Linux.

  1. Create a backup copy of the ism-configuration.properties file.

    • Linux: Default location in /opt/netiq/idm/apps/tomcat/conf

    • Windows: Default location in C:\opt\netiq\idm\apps\tomcat\conf

  2. In a text editor, open the configupdate.sh.properties or configupdate.bat.properties.to update values.

    • Linux: Default location in /opt/netiq/idm/apps/osp/bin

    • Windows: Default location in c:\netiq\idm\apps\osp\bin

    1. In the file, modify the properties to the following values:

      • Change is_prov to false

      • (Conditional) Change use_ssl to false, if your LDAP server is not set up for SSL communication

      • (Option) Change use_console to true, if you want to run the utility in console mode, otherwise change use_console to false for opening in the console in GUI mode

    2. Save and close the file.

  3. Update settings in the OSP Configuration Update utility.

    1. Launch the Configuration Update utility.

      • Linux: Default location in the /opt/netiq/idm/apps/osp/bin

        ./configupdate.sh edition=none

      • Windows: Default location in C:\netiq\idm\apps\osp\bin

        configupdate.bat edition=none

        NOTE:Adding edition=none on the command line avoids needing to modify this value within configupdate.sh.properties or the configupdate.bat.properties file. It also avoids certain unnecessary fields which the config update utility would otherwise require values for in order to save.

    2. Select SSO Clients.

    3. Under Reporting, specify values for the following parameters:

      NOTE:Regardless whether you use Identity Reporting, the utility requires values in these fields.

      • OAuth client ID

        For example, rpt.

      • OAuth client secret

      • URL link to landing page

        For example, http://123.456.78.90:8180/#/landing

      • URL link to Identity Governance

        For example, http://123.456.78.90:8080/#/nav

      • OSP Oauth redirect url

        For example, http://123.456.78.90:8180/IDMRPT/oauth.html

    4. Under DCS Driver, specify values for the following parameters:

      NOTE:Regardless whether you use Identity Reporting, the utility requires values in these fields.

      • OAuth client ID

        For example, dcsdriver.

      • OAuth client secret

    5. To save your changes, select OK.

    6. Update the settings for Identity Vault and Authentication, as needed.

7.2.2 Preparing OSP to Use an Active Directory LDAP Server

To use Active Directory for your LDAP authentication server, you need to update the settings using the OSP Configuration Update utility and in the Identity Governance configuration utility.

  1. Ensure that you have prepared the Configuration Update utility for OSP. For more information, see Ensuring the Configuration Update Utility Can Run OSP.

  2. Stop Tomcat, if it is running. For examples, see Stopping, Starting, and Restarting Tomcat.

  3. Update settings in the Configuration Update utility.

    1. Launch the Configuration Update utility.

      • Linux: Default location in the /opt/netiq/idm/apps/osp/bin

        ./configupdate.sh edition=none

      • Windows: Default location in C:\netiq\idm\apps\osp\bin

        configupdate.bat edition=none

        NOTE:Adding edition=none on the command line avoids needing to modify this value within configupdate.sh.properties or configupdate.bat.properties file. It also avoids certain unnecessary fields which the config update utility would otherwise require values for in order to save.

    2. Select Reporting > Identity Vault Settings > Identity Vault User Identity > Login Attribute.

    3. For Login Attribute, specify the attribute in Active Directory that you want to use for logging in to Identity Governance. For example, sAMAccountName.

      NOTE:This value is case-sensitive.

    4. To save your change, select OK.

  4. Update settings in the Identity Governance Configuration utility:

    1. Launch the Identity Governance Configuration utility.

      • Linux: Default location in /opt/netiq/idm/apps/idgov/bin

        ./configutil -password database_password

      • Windows: Default location in c:\netiq\idm\apps\idgov\bin

        configutil -password database_password

    2. Select Security Settings.

    3. For Auth Matching Rules, add the same attribute from Active Directory that you specified for Login Attribute in Step 3.c.

      Do not delete dn. For example, the setting should now list dn and sAMAccountName.

    4. Select Save.

  5. Continue with the post-installation tasks, as required.

7.2.3 Enabling Auditing for the OSP after the Installation

If during the OSP installation process you did not enable auditing, you can enable it at anytime. For more information, see Enabling Auditing for OSP after the Installation.