37.2 Configuring Identity Governance for Integration

For proper integration, you must link Identity Governance to the Identity Manager Home page for the identity applications. You can also choose to use the same authentication server that the identity applications use to verify login attempts. This process includes the following activities:

37.2.1 Adding a Link to Identity Manager Home in the Identity Governance Menu

This section describes how to add a link in Identity Governance so users can easily switch to Identity Manager Home.

  1. Log in to Identity Governance with an account that has the Global Administrator authorization.

  2. Select Administration > General Settings.

  3. For Home Page URL, specify the URL for Identity Manager Home.

  4. Select Save.

  5. Sign out of Identity Governance.

  6. (Optional) To verify the integration, complete the following steps:

    1. Log in to Identity Governance. Verify that Identity Governance lists Home in the navigation pane.

    2. Select Home, and verify that it takes you to the Identity Manager Home page.

37.2.2 Using the Same Authentication Server as Identity Manager

This section describes how to configure Identity Governance to use the same authentication server as Identity Manager identity applications for verifying users who log in. This section assumes that, when you installed Identity Governance, you did not specify the Identity Manager authentication server. For example, you might have installed Identity Governance before adding Identity Manager to your environment.

NOTE:Identity Applications use https communication by default. You should create a wildcard certificate on one of the servers and copy the certificate on all the servers.

For example, the wildcard certificate *.example.com is created on OSP server.

  1. Add this certificate to the keystoreFile on all the servers.

  2. Restart Tomcat on all the servers.

Ensure that keystoreFile is updated in the server.xml.

 <Connector port="8543" protocol="org.apache.coyote.http11.Http11NioProtocol" maxThreads="150" SSLEnabled="true" scheme="https" secure="true" clientAuth="false" sslProtocol="TLSv1.2" keystoreFile="conf/tomcat.ks" keystorePass="novell" sslEnabledProtocols="TLSv1.2" />

  1. Stop Identity Governance (and Tomcat).

    For example:

    /etc/init.d/idmapps_tomcat_init stop

  2. In the Identity Governance Configuration Utility, select Authentication Server Details.

  3. Clear Same as IG Server.

  4. Specify the protocol, DNS host name or IP address, and port that represent the authentication server for Identity Manager identity applications.

    NOTE:To use TLS/SSL protocol for secure communications, select https.

  5. Select Save.

  6. Make a note of the settings for the authentication server.

    The values for these settings must match the settings that you specify for Identity Governance in the RBPM Configuration utility. For more information, see Configuring Identity Manager for Integration.

  7. Select Security Settings, and make a note of the settings in the General Service section.

    The values for these settings must match the settings that you specify for Identity Governance in the RBPM Configuration utility. For more information, see Configuring Identity Manager for Integration.

  8. Close the utility.

  9. (Optional) If you are using a secured connection, import the Identity Applications certificate into the Identity Governance trust store.

  10. Start Identity Governance. For example:

    /etc/init.d/idmapps_tomcat_init start

37.2.3 Registering Identity Applications Server

You should register Identity Applications server details on Identity Governance server that allows Identity Applications to access Identity Governance through Identity Manager Dashboard.

Perform the following steps to register Identity Applications server:

  1. Log in to Identity Governance server as an administrator.

  2. Stop the application server.

    /etc/init.d/idmapps_tomcat_init stop

  3. Launch the configuration update utility in the console mode.

    For example,

    /opt/netiq/idm/apps/idgov/bin/configutil.sh -password $db_password -console

  4. Specify the following commands to register the Identity Applications server.

    OSP Client ID

    ap com.netiq.iac2.clientID $OSP_CLIENT_OF_RBPM

    For example, ap com.netiq.iac2.clientID rbpm

    Client Password

    ap com.netiq.iac2.clientPass $CLIENT_PASSWORD_OF_RBPM

    For example, ap com.netiq.iac2.clientPass novell

    Identity Applications URL

    ap com.netiq.iac.CORSclient $URL_OF_RBPM_MACHINE

    For example, ap com.netiq.iac.CORSclient https://myhost:8543

    Identity Applications Redirect URL

    ap com.netiq.iac2.redirect.url $RBPM_OSP_CLIENT_REDIRECT_URL

    For example, ap com.netiq.iac2.redirect.url https://myhost:8543/idmdash/oauth

  5. Verify the values using following commands.

    dc com.netiq.iac2.clientID
dc com.netiq.iac2.clientPass
dc com.netiq.iac.CORSclient
dc com.netiq.iac2.redirect.url

These values are stored in th ism-configuration.properties file that is located at:

/opt/netiq/idm/apps/tomcat/conf/ism-configuration.properties

After registering the Identity Applications server on the Identity Governance server, you should update the Identity Governance URL in the Identity Manager Dashboard to see the Identity Governance tasks.

  1. Log in to Identity Manager Dashboard as an administrator.

  2. Select YourID > Settings > Customization.

  3. Select General from Navigation items and specify the Identity Governance URL.

For more information, see Changing Identity Applications Client Settings and Customizing the Views.