6.1 Procedure

  1. Navigate to the C:\NetIQ\Common\JRE\conf\security folder.

  2. Take a backup of the java.security file.

  3. Edit java.security file by executing the following steps:

    1. Search for the List of providers and their preference orders string, comment all the existing providers, and then add the following entries:

      security.provider.1=BCFIPS
security.provider.2=BCJSSE
security.provider.3=SunJSSE
security.provider.4=SUN
security.provider.5=SunJCE

    2. Search for the ssl.KeyManagerFactory.algorithm=SunX509 string, comment it, and then add:

      ssl.KeyManagerFactory.algorithm=PKIX

    3. Search for the jdk.tls.disabledAlgorithms string and add TLSv1, TLSv1.1 to the list.

      For example, jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, DES, MD5withRSA, DH keySize < 1024, \EC keySize < 224, 3DES_EDE_CBC, anon, NULL

    4. Search for the keystore.type string, comment it, and then add:

      keystore.type=bcfks

  4. Navigate to the C:\NetIQ\Common\JRE\lib\security folder.

  5. Take a backup of the cacerts file.

  6. To support security enhancement, convert the cacerts file to bcfks using the following command:

    keytool -importkeystore -srckeystore cacerts -srcstorepass changeit -srcstoretype JKS -destkeystore cacerts -deststorepass changeit -deststoretype BCFKS -providerclass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath $CLASSPATH

  7. Login to Identity Console.

  8. Go to IDM Administrator and click action menu of the driver set.

  9. Navigate to Driver Set Properties > Driver Set Configuration > Java Environment Parameters.

  10. In the JVM Options enter the following:

    -Djavax.net.ssl.trustStore=C:\NetIQ\Common\JRE\lib\security\cacerts -Djavax.net.ssl.trustStorePassword=changeit -Djavax.net.ssl.trustStoreType=BCFKS

  11. Click the Save button.

  12. Restart eDirectory.