28.1 Installing on a JBoss Application Server

To install the User Application with the installation wizard:

1. Log on as a root user to the computer where you want to install the User Application.

2. Stop the JBoss application server.

3. (Conditional) If you are installing the User Application on JBoss 5.1.2 Enterprise Application Platform (EAP), copy the jbosssx.jar file from the %jboss-root%/lib directory to the %jboss-root%/common/lib directory. Complete the installation steps in this section, and then continue to Deploying the User Application on JBoss 5.1.2 EAP.

4. In the JRE, enter one of the following commands to start the .jar file, by default in the products/RBPM/user_app_install folder within the .iso image file for Identity Manager. For example:

   Linux

   $ /opt/novell/jre/bin/java -jar IdmUserApp.jar

   or

   $ /opt/novell/idm/jre/bin/java -jar IdmUserApp.jar

   Windows

   C:\Novell\InstallFiles\> "C:\Program Files\Java\jdk1.6.0_31\bin\java.exe" -jar IdmUserApp.jar

5. In the Welcome page of the User Application installation program, specify the language that you want to use for installation, and then click OK.

6. In the License Agreement window, click I accept the terms of the License Agreement and then click Next.

7. In the Application Server Platform window, click JBoss and then click Next.

8. In the Install Folder window, specify the folder where you want to place the installation files and then click Next.

9. In the Database Platform window, specify the platform of the User Application database. For example, Oracle. Click Next.

10. In the Database Host and Port window, specify the hostname or IP address of the server hosting the User Application database.

11. For Port, specify the number of the listener port for the database.

    For a cluster, you must specify the same port for each member of the cluster.

12. Click Next.

13. In the Database Username and Password window, specify the name of the database according to the database platform. By default, the database name is idmuserappdb.

    • For a PostgreSQL, My SQL, or SQL Server database, specify the name.

    • For an Oracle database, specify the Security Identifier (SID) that you created with the database instance.

    • For a cluster, you must specify the same database name or SID for each member in the cluster.

14. Specify the name for the database user account to use with the User Application and the password associated with the user account.

    In a cluster environment, you must use the same user account and password for each member in the cluster.

15. Specify the JAR file for the database platform.

    The database vendor provides the driver JAR file, which represents the Thin Client JAR for the database server. For example, for PostgreSQL, specify postgresql-8.4-701.jdbc4.jar, by default in the novell\idm\Postgres folder. NetIQ does not support driver JAR files from third-party vendors.

16. Click Next.

17. (Optional) In the Database Administrator window, specify the name and password for the database administrator.

    This field automatically lists the same user account and password that you specified in Step 14. To use that account, do not make any changes.

18. Click Next.

19. In the Create Database Tables window, select one of the following options:

    Create Tables Now

    The installation program creates the database tables as part of the installation process.

    Create Tables at Application Startup

    The installation program leaves instructions to create the tables when the User Application starts for the first time.

    Write SQL to File

    Create a schema file at installation time for the database administrator to use later to create the tables. When selecting this option, you must also specify a name for the file in the Schema Output File window.

20. Click Next.

21. (Conditional) If you chose Create Tables Now or Write SQL to File in Step 19, specify whether the database is a new or empty database or it already exists from a previous installation. Click Next.

22. To verify that the User Application can connect to the specified database, click Test Database Connection and then click Next.

    This step enables the installer to connect to the database for creating tables directly or for creating the .sql file.

    NOTE:You can continue with installation if the database connection fails. However, after installation, you must manually create the tables and connect to the database. For more information, see “Recreating the Database after Installation” in the User Application Administration Guide.

23. In the Java Install window, specify the path to the JRE file used to launch the installation program and then click Next.

24. In the JBoss Configuration window, specify the path to the installation files for the JBoss server and then click Next.

25. In the IDM Configuration window, specify the configuration for the JBoss application server:

    default

    Specifies that this installation is on a single node that is not part of a cluster.

    If you select this option and decide later than you need a cluster, you must reinstall the User Application.

    all

    Specifies that this installation is on a node within a cluster.

26. For Application Context, specify a name that represents the application server configuration, the application WAR file, and the name in the URL context.

    The installation script creates a server configuration, then names the configuration according to the name that you created when installing the application server. For example, IDMProv.

    IMPORTANT: NetIQ recommends that you make a note of the specified Application Context. You will use this application name in the URL when you start the User Application from a browser.

27. (Optional) When installing the provisioning WAR file on a node in a cluster, you must also specify the Workflow Engine ID. The engine ID cannot exceed 32 characters. For more information about workflow engine IDs, see the section on configuring workflows for clustering in the User Application Administration Guide.

28. Click Next.

29. (Optional) To send log events to an auditing server, complete the following steps in the Select Audit Logging Type window:

    1. Click Yes and then click Next.

    2. In the Audit Logging window, specify the type(s) of logging that you want to enable:

       Novell Identity Audit or NetIQ Sentinel

       Enables logging through a Novell or NetIQ client for the User Application.

       OpenXDAS

       Enables the User Application to send events to your OpenXDAS logging server.

    3. Click Next.

    4. (Conditional) If you chose in Step 29 to send log events through a Novell client, in the Novell Identity Audit or Novel Sentinel window, specify the hostname or IP address for the client server and the path to the log cache.

       For more information about setting up loggin, see the User Application Administration Guide.

30. Click Next.

31. (Optional) To import an existing master key, complete the following steps in the Security - Master Key window:

    NOTE:

    • The User Application uses the master key to access encrypted data.

    • You must complete these steps after installing the first instance of the User Application in a cluster. Every instance of the User Application in a cluster must use the same master key. For more information, see Section 27.2.4, Using the Same Master Key for Each User Application in the Cluster.

    • Complete these steps if you are moving your installation from a staging system to a production system and want to keep access to the database you used with the staging system.

    • Complete these steps also if you are restoring your User Application and you want to access the encrypted data stored by your previous version of the User Application.

    • By default, the installation procedure writes the encrypted master key to the master-key.txt file in the installation directory.

    1. Click Yes and then click Next.

    2. In the Import Master Key window, copy and paste the master key from the master-key.txt file.

32. Click Next.

33. (Conditional) If, at this time, you do not want to specify the settings for the User Application to interact with RBPM, click No in the Configure IDM window.

    NOTE:After installing the User Application, you can modify most of the settings in the configureupdate.sh or configureupdate.bat files. For more information about specifying the values for the settings, see the tables in Section 30.2, Configuring the User Application. The tables also explain which settings are required, and whether you can edit them with the configuration update files.

34. (Conditional) To immediately configure the User Application to interact with RBPM, complete the following steps in the Configure IDM window:

    1. Click Yes and then click Next.

    2. In the Roles Based Provisioning Module Configuration window, click Show Advanced Options.

    3. Modify the settings as needed.

       NOTE:

       • For more information about specifying the values, see the tables in Section 30.2, Configuring the User Application. The tables also explain which settings are required, and whether you can edit them with the configuration update files.

       • In production environments, all administrator assignments are restricted by licensing. NetIQ collects monitoring data in the audit database to ensure that production environments comply. Also, NetIQ recommends that only one user be given the permissions of the Security Administrator.

    4. Click OK.

35. Click Next.

36. In the Pre-Installation Summary window, click Install.

37. (Optional) Review the installation log files. For results of the basic installation, see the Identity_Manager_User_Application_InstallLog.log file. For information about the User Application configuration performed in Step 33, see the Novell-Custom-Install.log file.

1. Install JBoss 5.1.2 EAP.

2. Before launching the User Application installation program, copy the jbosssx.jar file from the %jboss-root%/lib directory to the %jboss-root%/common/lib directory.

3. Install the User Application as described in Installing the User Application with the Installation Wizard.

4. Create a new messaging-jboss-beans.xml file with the following content:

   <?xml version="1.0" encoding="UTF-8"?>
   
   <!--
    ========================================================================
   
    Copyright (c) 2014 NetIQ Corporation. All Rights Reserved.
   
    THIS WORK IS SUBJECT TO U.S. AND INTERNATIONAL COPYRIGHT LAWS AND TREATIES
    NO PART OF THIS WORK MAY BE USED, PRACTICED, PERFORMED COPIED, DISTRIBUTED,
    REVISED, MODIFIED, TRANSLATED, ABRIDGED, CONDENSED, EXPANDED, COLLECTED,
    COMPILED, LINKED, RECAST, TRANSFORMED OR ADAPTED WITHOUT THE PRIOR WRITTEN
    CONSENT OF NOVELL, INC. ANY USE OR EXPLOITATION OF THIS WORK WITHOUT
    AUTHORIZATION COULD SUBJECT THE PERPETRATOR TO CRIMINAL AND CIVIL
    LIABILITY.
   
    ========================================================================
   -->
   
   <!--
       Messaging beans
       $Id: messaging-jboss-beans.xml 88672 2009-05-11 20:49:47Z anil.saldhana@jboss.com $
   -->
   <deployment xmlns="urn:jboss:bean-deployer:2.0">
   
      <!-- messaging application-policy definition -->
      <application-policy xmlns="urn:jboss:security-beans:1.0" name="messaging">
         <authentication>
            <login-module code="org.jboss.security.auth.spi.DatabaseServerLoginModule" flag="required">
               <module-option name="unauthenticatedIdentity">guest</module-option>
               <module-option name="dsJndiName">java:/IDMUADataSource</module-option>
               <module-option name="principalsQuery">SELECT PASSWD FROM JBM_USER WHERE USER_ID=?</module-option>
               <module-option name="rolesQuery">SELECT ROLE_ID, 'Roles' FROM JBM_ROLE WHERE USER_ID=?</module-option>
            </login-module>
         </authentication>
      </application-policy>
   
      <bean name="SecurityStore" class="org.jboss.jms.server.jbosssx.JBossASSecurityMetadataStore">
         <!-- default security configuration -->
         <property name="defaultSecurityConfig">
            <![CDATA[
               <security>
                  <role name="guest" read="true" write="true" create="true"/>
               </security>
            ]]>
         </property>
         <property name="suckerPassword">changeit</property>
         <property name="securityDomain">messaging</property>
         <property name="securityManagement"><inject bean="JNDIBasedSecurityManagement"/></property>
         <!-- @JMX annotation to export the management view of this bean -->
         <annotation>@org.jboss.aop.microcontainer.aspects.jmx.JMX(name="jboss.messaging:service=SecurityStore",exposedInterface=org.jboss.jms.server.jbosssx.JBossASSecurityMetadataStoreMBean.class)</annotation>
         <!-- Password Annotation to inject the password from the common password utility
          <annotation>@org.jboss.security.integration.password.Password(securityDomain="messaging",methodName="setSuckerPassword")</annotation>
          -->
      </bean>
   
      <bean name="MessagingDeploymentTemplateInfoFactory"
         class="org.jboss.managed.plugins.factory.DeploymentTemplateInfoFactory"/>
   
      <bean name="QueueTemplate" class="org.jboss.profileservice.management.templates.JmsDestinationTemplate">
         <property name="info"><inject bean="QueueTemplateInfo"/></property>
      </bean>
      <bean name="QueueTemplateInfo"
         class="org.jboss.profileservice.management.templates.JmsDestinationTemplateInfo">
         <constructor factoryMethod="createTemplateInfo">
            <factory bean="DSDeploymentTemplateInfoFactory"/>
            <parameter class="java.lang.Class">org.jboss.profileservice.management.templates.JmsDestinationTemplateInfo</parameter>
            <parameter class="java.lang.Class">org.jboss.jms.server.destination.QueueServiceMO</parameter>
            <parameter class="java.lang.String">QueueTemplate</parameter>
            <parameter class="java.lang.String">A template for JMS queue *-service.xml deployments</parameter>
         </constructor>
         <property name="destinationType">QueueTemplate</property>
      </bean>
   
      <bean name="TopicTemplate" class="org.jboss.profileservice.management.templates.JmsDestinationTemplate">
         <property name="info"><inject bean="TopicTemplateInfo"/></property>
      </bean>
      <bean name="TopicTemplateInfo"
         class="org.jboss.profileservice.management.templates.JmsDestinationTemplateInfo">
         <constructor factoryMethod="createTemplateInfo">
            <factory bean="DSDeploymentTemplateInfoFactory"/>
            <parameter class="java.lang.Class">org.jboss.profileservice.management.templates.JmsDestinationTemplateInfo</parameter>
            <parameter class="java.lang.Class">org.jboss.jms.server.destination.TopicServiceMO</parameter>
            <parameter class="java.lang.String">TopicTemplate</parameter>
            <parameter class="java.lang.String">A template for JMS topic *-service.xml deployments</parameter>
         </constructor>
         <property name="destinationType">TopicTemplate</property>
      </bean>
   
   </deployment>
   

5. Replace the existing messaging-jboss-beans.xml file in the IDMProv/deploy/messaging folder with the file that you created in Step 4.

6. Locate the persistence service configuration file for JBoss. For example, for PostgreSQL databases, the file is the postgresql-persistence-service.xml in the novell\idm\jboss\docs\examples\jms directory.

7. Replace the existing persistence service configuration file with the file in the database examples folder. For example for PostgreSQL, the %jboss-root%/docs/examples/jms/postgresql-persistence-service.xml file.

8. Add a copy of the new persistence service configuration file to the %jboss-root%/server/IDMProv/deploy/messaging/ directory.

9. Open the persistence service configuration file, and then complete the following steps:

   1. Replace the text DefaultDS with the text IDMUADataSource.

   2. Within the Clustered attribute, comment out the following lines:

      <attribute name="Clustered">false</attribute>
      
            <!-- All the remaining properties only have to be specified if the post
      office is clustered.
                 You can safely comment them out if your post office is non clustered
      -->
      
            <!-- The JGroups group name that the post office will use -->
      
            <!--attribute
      name="GroupName">${jboss.messaging.groupname:MessagingPostOffice}</attribute>-->
      
            <!-- Max time to wait for state to arrive when the post office joins the
      cluster -->
      
            <!--attribute name="StateTimeout">30000</attribute>-->
      
            <!-- Max time to wait for a synchronous call to node members using the
      MessageDispatcher -->
      
            <!--attribute name="CastTimeout">30000</attribute>-->
      
            <!-- Set this to true if you want failover of connections to occur when a
      node is shut down -->
      
            <!--<attribute name="FailoverOnNodeLeave">false</attribute>
      
            <depends
      optional-attribute-name="ChannelFactoryName">jboss.jgroups:service=ChannelFactory</depends>
            <attribute name="ControlChannelName">jbm-control</attribute>
            <attribute name="DataChannelName">jbm-data</attribute>
            <attribute
      name="ChannelPartitionName">${jboss.partition.name:DefaultPartition}-JMS</attribute>-->
         </mbean>
      

   3. Replace the following lines with the specified text:

      Replace this text	With this text
      POPULATE.TABLES.3 = INSERT INTO JBM_USER (USER_ID, PASSWD, CLIENTID) VALUES ('john', 'needle', 'DurableSubscriberExample')	POPULATE.TABLES.3 = INSERT INTO JBM_USER (USER_ID, PASSWD, CLIENTID) VALUES ('p_user', 'changeit', 'IDMNotificationDurableTopic')
      POPULATE.TABLES.8 = INSERT INTO JBM_ROLE (ROLE_ID, USER_ID) VALUES ('john','guest')	POPULATE.TABLES.8 = INSERT INTO JBM_ROLE (ROLE_ID, USER_ID) VALUES ('p_user','guest')
      POPULATE.TABLES.9 = INSERT INTO JBM_ROLE (ROLE_ID, USER_ID) VALUES ('subscriber','john')	POPULATE.TABLES.9 = INSERT INTO JBM_ROLE (ROLE_ID, USER_ID) VALUES ('subscriber','p_user')
      POPULATE.TABLES.10 = INSERT INTO JBM_ROLE (ROLE_ID, USER_ID) VALUES ('publisher','john')	POPULATE.TABLES.12 = INSERT INTO JBM_ROLE (ROLE_ID, USER_ID) VALUES ('durpublisher','p_user')

   4. Close and save the persistence service configuration file.

10. Start JBoss.

11. Add the JBoss administrator account to the stop-jboss.sh script by completing the following steps:

    1. Open the stop-jboss.sh script.

    2. At the end of the shutdown.sh command, append the user account and password of the JBoss administrator. Use the following syntax:

       shutdown.sh -s jnp://localhost:1199 -u %user_account% -p %password%
       

       For example:

       shutdown.sh -s jnp://localhost:1199 -u admin -p novell
       

    3. Close and save the script.

12. (Optional) To verify proper configuration, ensure that the server log contains the following information:

    INFO  [ServerPeer] JBoss Messaging 1.4.7.GA server [0] started
    
    INFO  [TopicService] Topic[/topic/IDMNotificationDurableTopic] started,
    fullSize=200000, pageSize=2000, downCacheSize=2000
    

    INFO  [RBPM] [com.novell.soa.notification.impl.jms.JMSConnectionMediator:init]
    Starting JMS notification system
    INFO  [STDOUT] INFO  [RBPM]
    [com.novell.soa.notification.impl.NotificationThread:run] Starting asynchronous notification system
    

To start the User Application on a JBoss Server:

1. Start your database. For more information, see your database documentation.

2. For the User Application to run reports, add the Djava.awt.headless=true flag to the startup script for the JBoss application server. For example:

   JAVA_OPTS="-Djava.awt.headless=true -Dfile.encoding=UTF-8 -Dsun.jnu.encoding=UTF-8 -server -Xms1024m -Xmx1024m -XX:MaxPermSize=512m

   NOTE:You do not need to perform this step if you are running on an X11 Windows system.

3. Start the JBoss application server where you installed the User Application.

4. At the command line, make the installation directory your working directory.

5. Execute the JBoss startup script.

6. To enable communication with the User Application driver, complete the following steps:

   1. Log on to iManager.

   2. Under Identity Manager in the Roles and Tasks display in the left navigation frame, select Identity Manager Overview.

   3. In the content view, specify the driver set that contains the User Application driver, then click Search.

   4. In the graphic showing the driver set with its associated drivers, click the red-and-white icon for the User Application driver.

   5. Select Start Driver.

      Upon start, the driver attempts a “handshake” with the User Application. If your application server is not running or if the WAR was not deployed successfully, the driver returns an error. Otherwise, the driver status changes to the yin-yang symbol, indicating that the driver is now started.

7. To start the Role and Resource Service driver, repeat the procedure in Step 6.

8. To launch and log on to the User Application, enter the following URL in your Web browser: http://hostname:port/ApplicationName

   hostname

   Represents the name of the application server. For example, myserver.domain.com

   port

   Represents the port number of the application server. For example, 8180.

   ApplicationName

   Represents the name that you specified during the installation for the application when you provided application server configuration information.

9. In the upper right corner of the User Application landing page, click Login.