3.2 Certificate Based Authentication support for Identity Manager Exchange Service

3.2.1 Creating Client Certificate for IDM Exchange Service

  1. Create the client key using the below command.

    openssl genrsa -out client.key.pem 2048

  2. Create the CSR executing the below command.

    openssl req -new -key client.key.pem -out client.csr

    Once the user executes the above command, it is mandatory to input “Common Name” as parameter. The value for the Common Name can be obtained from the Server running Identity Manager Exchange Service by running whoami command in the command prompt as shown below:

    Figure 3-3

    Use the whoami value to enter into the Certificate CSR “Common Name” parameter as shown below:

    Figure 3-4

    Once done, import this CSR in eDirectory under NETIQ Certificate Server -> Issue Certificate and then click NEXT until you get an option to choose base64 format and download the base64 certificate.

Generating the Client pfx file

After downloading the Client Certificate in base64 format, execute the below command to generate the Client Certificate in pfx format.

openssl pkcs12 -export -out client.pfx -inkey client.key.pem -in client.b64

NOTE:Once you execute the above command, you will be prompted to provide the password. This password is required during the driver configuration.

Create a directory in IDM and add the above generated Client Certificate in the IDM directory. Use this directory path in the iManager as given below -

Driver Parameters - > Subscriber Settings -> Exchange and Powershell Service -> Exchange Authentication Type (Certificate Based Authentication) -> Keytore Path

3.2.2 Verifying and Starting the Identity Manager Exchange Service

After finishing the installation of Identity Manager Exchange Service, verify that the service is properly installed.

NOTE:Ensure that SSL is configured for the Identity Manager Exchange Service before starting the service. This is a mandatory step before running the service. For more information, see Securing Communication with Identity Manager Exchange Service.

  1. From the Start menu, type regedit.

  2. On the Registry Editor page, locate the service at HKEY_LOCAL_MACHINE > Software > Novell > ExchServer and verify that the Port and CertificateFriendlyName have the correct values.

    The CertificateFriendlyName must be the same as Certificate Alias that you specified in Step 1 of the Securing Communication with Identity Manager Exchange Service.

  3. Navigate to the services that are running on your server and start the IDMExchangeOnline service.

3.2.3 Verifying the Provisioning of Exchange Mailbox

To verify the provisioned mailboxes for users, follow the procedure provided in the Microsoft Exchange Admin Center.