2.2 Installing OpenText Identity Console 1.8 and earlier

2.2.1 Installing Standalone OpenText Identity Console (Non-Docker)

You can install the OpenText Identity Console in one of the following ways:

NOTE:It is recommended to install OpenText Identity Console and OpenText eDirectory on the same machine, the machine must have at least one instance of OpenText eDirectory available.

Performing an Interactive Installation

This section covers how to install standalone OpenText Identity Console using the interactive installation method.

  1. Log in to the Software License and Download portal and navigate to the Software Downloads page.

  2. Select the following:

    • Product: OpenText eDirectory

    • Product Name: OpenText eDirectory per User Sub SW E-LTU

    • Version: 9.2

  3. Download and extract the latest OpenText Identity Console build.

  4. Navigate to the directory where you extracted the Identity Console build > IdentityConsole_<version>_Linux.

  5. Run the following command while logged in as root or root-equivalent user:

    ./identityconsole_install

  6. Read the Introduction, and then click ENTER.

  7. Enter 'y' to accept the License Agreement. This will install all the required RPMs on your system.

  8. Enter the Identity Console server’s hostname (FQDN)/IP address. For example, 10.10.33.100

    If you press Enter without specifying an IP address, your system's IP address/hostname will be used by default.

  9. Enter the port number for Identity Console to listen. The default value is 9000.

  10. (Conditional) Do one of the following depending on your requirement:

    • If you do not want to integrate OSP with Identity Console, choose “n” and continue with Step 11.

    • If you want to integrate OSP with Identity Console, choose “y” and provide inputs for the following steps:

      1. Enter the eDirectory/Identity Vault server’s Domain name/IP address with LDAPS port number.

        For example:

        192.168.1.1:636

      2. Enter the eDirectory/Identity Vault username.

        Example:

        cn=admin,ou=org_unit,o=org

      3. Enter the eDirectory/Identity Vault password.

      4. Enter the eDirectory/Identity Vault password again to confirm the password.

      5. Enter the OSP server domain name/IP address with SSO server SSL port number.

      6. Enter the OSP client ID and OSP client password.

      7. Enter the eDirectory/Identity Vault tree name.

  11. Specify which eDirectory-hosts to connect. You can provide either IP address or domain name. For example: localhost:636,xx.xx.xx.xx:636 or edir.domain.com:636

    If you want OpenText Identity Console to connect to OpenText multiple eDirectory trees, enter their IP addresses or domain names separated by commas.

    NOTE:If you want OpenText Identity Console to connect to multiple OpenText eDirectory trees, enter the IP addresses or domain names separated by commas.

  12. (Conditional) Do one of the following to import the CA certificate:

    • If you want to import the CA certificate from the server, input “y” and press Enter. Then, enter the eDirectory server domain name/IP address with LDAPS port number.

      For example: 10.10.10.10:636

    • If you do not want to import the CA certificate from the server, input “n” and press Enter. Then, provide the location of your CA certificate directory path manually.

    • If you enter “q”, the installation will be terminated.

  13. (Conditional) Do one of the following to generate a Server Certificate:

    • If you want to generate the Server Certificate, input “y” and press Enter. Provide inputs for the following steps:

      1. Enter the eDirectory server domain name or IP address with LDAPS port number.

      2. Enter the eDirectory user name. Example: cn=admin,o=novell.

      3. Enter the eDirectory user password.

      4. Re-enter the eDirectory user password.

      5. Enter the server certificate name.

        Example: servercert

      6. Enter the server certificate password.

        Example: password@123

      7. Re-enter the server certificate password.

        Example: password@123

    • If you already have a Server Certificate that you want to use, input “n” and press Enter. Provide inputs for the following steps:

      1. Specify the location of your Server Certificate directory path manually.

        For example, /home/cert/keys.pfx

      2. Enter the server certificate password.

      3. Re-enter the server certificate password.

NOTE:

  • You can find the following log files in the /var/opt/novell/eDirAPI/log directory:

    • edirapi.log - This file logs edirapi events and debugging issues.

    • edirapi_audit.log - This file logs edirapi audit events. The logs follow a CEF auditing format.

    • identityconsole_install.log - This file logs OpenText Identity Console events.

  • You can check the logs for OpenText Identity Console start and stop operations in the /var/log/messages file.

  • When you are generating the CA certificate and Server Certificate, make sure to run the OpenText Identity Console installer from the IdentityConsole_<version>_Linux directory in the extracted location.

  • If installation fails, it is not required to uninstall the existing OpenText Identity Console, instead the user can run the following command:

    /usr/bin/identityconsoleConfigure

Utilities to Generate Certificates

You have the option to obtain CA Certificates and Server Certificates for other trees using the following tools or utilities.

NOTE:The scripts for CA and Server certificate is available in opt/novell/eDirAPI/sbin path.

Generate CA Certificate

  1. Download and extract the latest OpenText Identity Console build.

  2. Navigate to the directory where you extracted the OpenText Identity Console build > IdentityConsole_<version>_Linux.

  3. Run the following command while logged in as root or root-equivalent user.

    ./get_cacert

  4. Enter the eDirectory IP address with LDAPS port number. For example: 10.10.10.10:636.

Trusted root certificate(s) copied successfully from server to /tmp/SSCert.pem.

Generate Server Certificate

  1. Download and extract the latest OpenText Identity Console build.

  2. Navigate to the directory where you extracted the OpenText Identity Console build > IdentityConsole_<version>_Linux.

  3. Run the following command while logged in as root or root-equivalent user.

    ./get_servercert <eDirectory IP address with LDAPS port number> <eDirectory/Identity Vault username> <userpassword> <server certificate name> <server certificate password> <path_of_CA _certificate with filename> <path of server certificate with filename>

    Example:

    ./get_servercert 10.10.10.10:636 cn=admin,ou=org_unit,o=org password keys password /var/opt/novell/eDirectory/data/SSCert.pem /home/user/keys.pfx

Performing a Silent Installation

Silent installation enables you to install OpenText Identity Console without any interactive input. To use this method, you must define your options for installing OpenText Identity Console in the silent_properties file and then run the installation process from the command line. To create the silent_properties file, you can use the create_silent_properties utility that comes with OpenText Identity Console version 1.7.2 and later. After you generate the properties file, the system uses the information from it to complete the installation silently.

Before starting the silent installation, ensure that you meet all the prerequisites.

To generate the silent properties file:

  1. Navigate to the IdentityConsole_<version>_Linux directory in the location where you have extracted the OpenText Identity Console build.

  2. Run the following command to use the create_silent_properties utility:

    ./create_silent_properties

  3. Enter the Identity Console server hostname or IP address. For example, 10.0.0.1.

  4. Enter the port number on which you want Identity Console to listen. For example, 9000.

  5. (Conditional) Do one of the following depending on your requirement:

    • If you do not want to integrate OSP with Identity Console, choose “n” and continue with Step 6.

    • If you want to integrate OSP with Identity Console, choose “y” and provide inputs for the following steps:

      1. Enter the eDirectory/Identity Vault server’s Domain name/IP address with LDAPS port number.

        For example:

        192.168.1.1:636

      2. Enter the eDirectory/Identity Vault username.

        Example:

        cn=admin,ou=org_unit,o=org

      3. Enter the eDirectory/Identity Vault password.

      4. Enter the eDirectory/Identity Vault password again to confirm the password.

      5. Enter the OSP server domain name/IP address with SSO server SSL port number.

      6. Enter the OSP client ID and OSP client password.

      7. Enter the eDirectory/Identity Vault tree name.

  6. Enter the eDirectory server host names or IP address to which you want Identity Console to establish a connection. For example, 10.10.10.10:636.

  7. Enter the eDirectory server host names or IP address to which you want Identity Console to establish a connection. For example, 10.10.10.10:636.

  8. Enter the directory path of the server certificate, including the filename. For example, /home/cert/keys.pfx.

  9. Enter the server certificate password.

  10. Re-enter the server certificate password.

    The silent_properties file is generated successfully in IdentityConsole_<version>_Linux location.

To perform a silent installation:

  1. After generating the silent_properties file, run the following command to run the installer in silent mode:

    ./identityconsole_install -s silent_properties

  2. Enter the eDirectory server Domain name/IP address with LDAPS port number. For example: 10.10.10.10:636

You can find installation-related logs in the Identity Console installation > identityconsole_install.log file.

Multi-tree with Standalone OpenText Identity Console

To connect OpenText Identity Console with multiple OpenText eDirectory trees, you must provide OpenText eDirectory IP and LDAPS port separated commas in the edirapi.conf file located at /etc/opt/novell/eDirAPI/conf/. Also, you must copy the CA certificates from all the OpenText eDirectory trees to the /etc/opt/novell/eDirAPI/cert/ directory.

For example, to connect OpenText Identity Console to three OpenText eDirectory trees, provide the IP address in the following format:

edir-hosts="10.0.0.1:636,10.0.0.2:636,10.0.0.3:636"

Then copy the CA certificates as follows:

cp /home/user/SSCert1.pem /etc/opt/novell/eDirAPI/cert/SSCert1.pem
cp /home/user/SSCert2.pem /etc/opt/novell/eDirAPI/cert/SSCert2.pem
cp /home/user/SSCert3.pem /etc/opt/novell/eDirAPI/cert/SSCert3.pem

Run one of the following command to restart OpenText Identity Console:

  • /usr/bin/identityconsole restart
  • systemctl restart netiq-identityconsole.service

Modifying Server Certificate in Standalone OpenText Identity Console

Perform the following steps to modify server certificate in Standalone OpenText Identity Console:

  1. Run NLPCERT to store the keys:

    su - nds -c "LD_LIBRARY_PATH=/opt/novell/lib64/:/opt/novell/eDirectory/lib64/:/opt/netiq/common/openssl/lib64/ /opt/novell/eDirAPI/sbin/nlpcert -i /Expiredcert/noexpire/new-keys.pfx -o /etc/opt/novell/eDirAPI/conf/ssl/private/cert.pem"

  2. Restart the OpenText Identity Console:

    systemctl restart netiq-identityconsole.service

Stopping and Restarting Standalone OpenText Identity Console

  • To stop, run one of the following command:

    /usr/bin/identityconsole stop

    or

    systemctl stop netiq-identityconsole.service

  • To restart, run one of the following command:

    /usr/bin/identityconsole restart

    or

    systemctl restart netiq-identityconsole.service

  • To start, run one of the following command:

    /usr/bin/identityconsole start

    or

    systemctl start netiq-identityconsole.service

2.2.2 Installing OpenText Identity Console Workstation on Windows

OpenText Identity Console (version 1.5 and later) can be launched on Windows as workstation, and requires the REST services running. Therefore, when it is launched, an eDirAPI process runs in the edirapi.exe cmd prompt. If you close edirapi.exe terminal, OpenText Identity Console will no longer function.

The following procedure describes how to run OpenText Identity Console on Windows.

  1. Log in to the Software License and Download portal and navigate to the Software Downloads page.

  2. Select the following:

    • Product: OpenText eDirectory

    • Product Name: eDirectory per User Sub SW E-LTU

    • Version: 9.2

  3. Download and extract the IdentityConsole_<version>_workstation_win_x86_64.zip.

  4. Navigate to the extracted folder, install NICI_w32 or NICI_wx64 depending on your system configuration.

  5. (Conditional) If you already have the keys.pfx and SSCert.pem files that you want to use, then copy the files manually into cert folder located in C:\IdentityConsole_<version>_workstation_win_x86_64\eDirAPI\cert.

    Then proceed to step 9.

  6. (Conditional) If you want to generate the CA certificate, navigate to the eDirAPI folder, run the get_cacert.exe binary in power shell, located in C:\IdentityConsole_<version>_workstation_win_x86_64\eDirAPI, and provide the following details:

    • eDirectory/Identity Vault server Domain name/IP address with LDAPS port number.

    • Trusted-root CA certificate path with certificate name.

    For example,

    get_cacert.exe 10.10.10.125:636 C:\IdentityConsole_<version>_workstation_win_x86_64\eDirAPI\cert\SSCert.pem

    A SSCert.pem file is generated.

  7. (Conditional) If you want to generate the Server Certificate, run get_servercert.exe binary through power shell along with the following details:

    • eDirectory/Identity Vault server Domain name/IP address with LDAPS port number.

    • eDirectory/Identity Vault user name.

    • eDirectory/Identity Vault password.

    • Server certificate name.

    • Server certificate password.

    • Trusted-root CA certificate path with certificate name.

    • Trusted-root server certificate path with certificate name(keys.pfx is hard coded).

    For example,

    get_servercert.exe 10.10.10.125:636 cn=admin,o=novell novell keys novell C:\IdentityConsole_<version>_workstation_win_x86_64\eDirAPI\cert\SSCert.pem C:\IdentityConsole_<version>_workstation_win_x86_64\eDirAPI\cert\keys.pfx

    A keys.pfx file is generated.

  8. Copy the files keys.pfx and SSCert.pem (that are generated in step: 6 and step: 7) manually into cert folder.

  9. Navigate to the extracted folder, double-click the configure.bat file and enter the server certificate (keys.pfx) password in the command prompt.

    NOTE:If the server certificate is changed, then re-run the configure.bat file with the password of the new certificate.

  10. Navigate to the extracted folder and double-click the run.bat file.

    The eDirAPI process terminal (edirapi.exe) starts running, and the Identity Console login page appears.

NOTE:

  • For subsequent logins to the OpenText Identity Console application, double click the run.bat. The login page will appear.

    If the eDirAPI process terminal (edirapi.exe) is already running, then run identityconsole.exe from the build extracted folder.

  • Users can find the following logs in: \IdentityConsole_<version>_workstation_win_x86_64\eDirAPI\log

    edirapi.log - This is used for logging different events in edirapi and debugging issues.

    edirapi_audit.log - This is used for logging audit events of edirapi. The logs follow CEF auditing format.

  • OSP based logins are not supported in workstation mode.

  • OpenText Identity Console Workstation is listening on port 9000. Do not modify the edirapi_win.conf file.

Utilities to Generate Certificates

You have the option to obtain CA Certificates and Server Certificates for other OpenText eDirectory Trees using the following utilities.

NOTE:The scripts for CA and Server certificate is available in opt/novell/eDirAPI/sbin path.

Generate CA Certificate

  1. Download and extract the latest OpenText Identity Console build.

  2. Navigate to the directory where you extracted the OpenText Identity Console build. Example: C:\IdentityConsole_<version>_workstation_win_x86_64\eDirAPI

  3. Run the following binary through command prompt.

    get_cacert.exe

  4. Provide the eDirectory IP address and LDAPS port number.

    Example: get_cacert.exe 10.10.10.125:636

    A SSCert.pem file is generated. Copy SSCert.pem manually into cert folder.

Generate Server Certificate

  1. Navigate to the folder where you have extracted the OpenText Identity Console build.

    Example: IdentityConsole_<version>_win

  2. Run get_servercert.exe help for more help options through command prompt.

    • eDirectory/Identity Vault server Domain name/IP address with LDAPS port number.

    • eDirectory/Identity Vault user name.

    • eDirectory/Identity Vault password.

    • Server certificate name.

    • Server certificate password.

    • Trusted-root certificate path with certificate name.

      To generate the Server Certificate, run the following command through command prompt:

      Example:

      get_servercert.exe 10.10.10.125:636 cn=admin,o=novell novell keys novell SSCert.pem

      A keys.pfx file is generated. Copy keys.pfx manually into cert folder.

Multi-tree with OpenText Identity Console as Workstation

OpenText Identity Console allows user to connect to multiple trees by obtaining individual CA certificate of the tree.

  1. Close the OpenText Identity Console workstation and eDirAPI terminal.

  2. Copy the CA certificates SSCert.pem into the location: IdentityConsole_<version>_workstation_win_x86_64\eDirAPI\cert.

    For example, if you want to connect to three eDirectory trees, copy the CA certificates as SSCert1.pem, SSCert2.pem and SSCert3.pem respectively.

  3. Navigate to the folder where the build is extracted and double click the run.bat file (Windows batch file).

Closing and Re-launching OpenText Identity Console Workstation

To close the application and the process:

  1. Close the OpenText Identity Console desktop windows application.

  2. Stop the eDirAPI process by closing the eDirAPI process terminal.

To relaunch OpenText Identity Console Workstation, navigate to the folder where the build is extracted and double click the run.bat file (Windows batch file).

NOTE:If the eDirAPI process terminal is already running, then run identityconsole.exe from the build extracted folder to relaunch OpenText Identity Console Workstation.

2.2.3 Installing OpenText Identity Console as Docker Container

Refer the section Installing OpenText Identity Console as Docker Container.

2.2.4 Installing OpenText Identity Console In Azure Kubernetes Services

Refer the section Installing OpenText Identity Console In Azure Kubernetes Services.