This section defines the parameters that you need to specify to configure the OpenText Identity Manager installation. You can use the installation program to configure the components immediately after installing them or configure the components later by running the configure.sh script.
NOTE:
Identity Applications and Identity Reporting configured in typical configuration mode cannot connect to a database server installed on a different computer.
The installation process does not allow you to enable auditing for OpenText Identity Manager components. You must configure auditing for each component after completing the installation. For more information, see OpenText™ Identity Manager CE 24.4 (v4.10) - Configuring Auditing in Identity Manager.
Ensure that the Identity Applications, Identity Reporting, and databases are uniformly configured using either the Fully Qualified Domain Name (FQDN) or the IP address. Do not mix FQDN and IP addresses in your configuration. Using FQDN is recommended.
Table 5-1 describes the parameters required for configuring OpenText Identity Manager components in typical mode.
Table 5-1 Typical Configuration
|
Parameter |
Parameter in the Silent Properties File |
Typical Configuration |
|---|---|---|
|
OpenText Identity Manager Engine |
|
|
|
Common password |
IS_COMMON_PASSWORD |
Specifies whether you want to set a common password. |
|
Identity Vault Hostname/IP Address |
ID_VAULT_HOST |
Specifies the IP address of the server where Identity Vault is installed. |
|
Identity Vault Administrator name |
ID_VAULT_ADMIN_LDAP |
Specifies the relative distinguished name (RDN) of the administrator object in the tree that has full rights, at least to the context to which this server is added. |
|
Identity Applications |
|
|
|
Master KeyStore Password |
MASTER_KEYSTORE_PWD |
Specifies master keystore password for identity application. |
|
Common password |
IS_COMMON_PASSWORD |
Specifies whether you want to set a common password. Ensure that the password meets the considerations specified in the Using Non-Intuitive Passwords During Configuration section. |
|
Common One SSO Service password |
SSO_SERVICE_PWD |
Specifies the password for the authentication service for One SSO server. |
|
SSPR Configuration Password |
SSPR_CONFIG_PWD |
Specifies the password for the authentication service for SSPR. |
|
Identity Applications administrator name |
UA_ADMIN |
Specifies the name of the administrator account for the identity applications. |
|
Identity Application Administrator Password |
UA_PWD |
Specifies the administrator password for Identity application. |
|
Identity Applications and Workflow Engine database user password |
UA_WFE_DATABASE_USER_PWD |
Specifies the identity applications and workflow engine database user password. |
|
Identity Applications and Workflow Engine database Administrator password |
UA_WFE_DATABASE_ADMIN_PWD |
Specifies the identity applications and workflow engine database administrator password. |
|
NGINX port |
NGINX_HTTPS_PORT |
Specifies the NGINX port. |
|
Identity Reporting |
|
|
|
Master KeyStore Password |
MASTER_KEYSTORE_PWD |
Specifies master keystore password for identity reporting. |
|
Common password |
IS_COMMON_PASSWORD |
Specifies whether you want to set a common password. Ensure that the password meets the considerations specified in the Using Non-Intuitive Passwords During Configuration section. |
|
Identity Reporting database account password |
RPT_DATABASE_SHARE_PASSWORD |
Specifies the database account password for Identity Reporting. |
|
Identity Reporting Administrator name |
RPT_ADMIN |
Specifies the administrator name for Identity Reporting. The default value is cn=uaadmin,ou=sa,o=data. |
|
Identity Reporting Administrator Password |
RPT_PWD |
Specifies the password for the Administrator object. For example, password. |
|
OpenText Identity Console |
|
|
|
Trusted root certificate folder path |
ID_CONSOLE_CA_CERT_LOCATION |
Specifies the trusted root certificate (SSCert.pem) folder path. |
|
Server certificate path including the filename |
ID_CONSOLE_SERVER_CERT_LOCATION |
Specifies the server certificate path including the filename. |
Table 5-2 describes the parameters required for configuring OpenText Identity Manager components in custom mode.
Table 5-2 Custom Configuration
|
Parameter |
Parameter In the Silent Properties File |
Custom Configuration |
|---|---|---|
|
OpenText Identity Manager Engine |
|
|
|
Create a new Identity Vault |
TREE_CONFIG |
Specifies the Identity Vault to be installed. |
|
Add to an Identity Vault existing on local machine |
Specifies whether you want to connect to an existing Identity Vault on the same server where you are installing OpenText Identity Manager Engine. |
|
|
Add to an Identity Vault existing on remote machine |
Specifies whether you want to connect to an Identity Vault installed on a different server than OpenText Identity Manager Engine. |
|
|
Identity Vault Tree Name |
ID_VAULT_TREENAME |
Specifies a new tree for your Identity Vault. The tree name must meet the following requirements:
NOTE:If you are installing OpenText Identity Manager on OES, specify the existing tree name. |
|
Identity Vault Server Name |
ID_VAULT_SERVERNAME |
Specifies the Identity vault server name. |
|
Identity Vault Context DN |
ID_VAULT_SERVER_CONTEXT |
Specifies the context DN of the existing Identity Vault server. The default value is servers.system. |
|
Identity Vault Administrator Name |
ID_VAULT_ADMIN_LDAP |
Specifies the relative distinguished name (RDN) of the administrator object in the tree that has full rights, at least to the context to which this server is added. |
|
Identity Vault Administrator Password |
ID_VAULT_PASSWORD |
Specifies the password for the Administrator object. For example, password. |
|
RSA Key Size |
ID_VAULT_RSA_KEYSIZE |
Specify the key size for RSA certificates. Allowed values are 2048, 4096, and 8192 bits. The default value is 4096. |
|
EC Curve |
ID_VAULT_EC_CURVE |
Specify the elliptical curve (EC) limit for EC certificates. Allowed values are P256, P384, and P521. The default value is P384. |
|
Certificate Lifetime |
ID_VAULT_CA_LIFE |
Applies only if you have selected the Create a New Tree option. Specify the certificate life in years. |
|
NDS var folder location |
ID_VAULT_VARDIR |
Specifies the path of this Identity Vault instance on this server. The default path is /var/opt/novell/eDirectory. |
|
NDS data location |
ID_VAULT_DIB |
Specifies the path in the local system where you want to install the Directory Information Base (DIB) files.The DIB files are your Identity Vault database files. The default location is /var/opt/novell/eDirectory/data/dib. |
|
NCP Port |
ID_VAULT_NCP_PORT |
Specifies the NetWare Core Protocol (NCP) port that the Identity Vault uses to communicate with the OpenText Identity Manager components. The default value is 524. |
|
LDAP non SSL port |
ID_VAULT_LDAP_PORT |
Specifies the port on which the Identity Vault listens for LDAP requests in clear text. The default value is 389. |
|
LDAP SSL port |
ID_VAULT_LDAPS_PORT |
Specifies the port on which the Identity Vault listens for LDAP requests using Secure Sockets Layer (SSL) protocol. The default value is 636. |
|
Identity Vault HTTP Port |
ID_VAULT_HTTP_PORT |
Specifies the port on which the HTTP stack operates in clear text. The default value is 8028. |
|
Identity Vault HTTPS Port |
ID_VAULT_HTTPS_PORT |
Specifies the port on which the HTTP stack operates using TLS/SSL protocol. The default value is 8030. |
|
NDS configuration file with path |
ID_VAULT_CONF |
Specifies the location of the configuration file for Identity Vault. The default value is /etc/opt/novell/eDirectory/conf/nds.conf. |
|
Identity Vault driver set name |
ID_VAULT_DRIVER_SET |
Specifies the name for a new Identity Manager driver set object. |
|
Identity Vault driver set deploy context |
ID_VAULT_DEPLOY_CTX |
Specifies the LDAP DN of the container where you want to create the driver set object. |
|
Identity Applications |
||
|
Master KeyStore Password |
MASTER_KEYSTORE_PWD |
Specifies master keystore password for identity application. |
|
Common password |
IS_COMMON_PASSWORD |
Specifies whether you want to set a common password. Ensure that the password meets the considerations specified in the Using Non-Intuitive Passwords During Configuration section. |
|
Hostname (FQDN in lowercase) |
UA_SERVER_HOST |
Specifies the server’s Fully Qualified Domain Name (FQDN) or default IP address. NOTE:Ensure that FQDN is specified in lower case. The server hosting your component must also be configured to use FQDN in lower case. |
|
Identity Vault Hostname/IP Address |
ID_VAULT_HOST |
Specifies the IP address or hostname of the server where Identity Vault is installed. |
|
Identity Vault Administrator Name |
ID_VAULT_ADMIN_LDAP |
Specifies the relative distinguished name (RDN) of the administrator object in the tree that has full rights, at least to the context to which this server is added. |
|
Identity Vault Administrator Password |
ID_VAULT_PASSWORD |
Specifies the password for the Administrator object. For example, password. |
|
OSP custom login screen name |
OSP_CUSTOM_NAME |
Specifies the name that will be displayed on the OSP login screen. |
|
User search container DN |
USER_CONTAINER |
Specifies the default container for all user objects in the Identity Vault. |
|
Admin search container DN |
ADMIN_CONTAINER |
Specifies the distinguished name of the container in the Identity Vault that contains any administrator User objects that the authentication service (OSP) must authenticate. For example, o=data. |
|
Application server DNS/IP address |
TOMCAT_SERVLET_HOSTNAME |
Specifies the IP address or hostname of the Tomcat server. |
|
One SSO server SSL port |
SSO_SERVER_SSL_PORT |
Specifies the port that you want the single sign-on service to use. The default value is 8543. |
|
Identity Application One SSO Service password |
SSO_SERVICE_PWD |
Applies only if you have set the common password as No. Specifies the password for the single sign-on client used by identity applications. |
|
Identity Applications administrator name |
UA_ADMIN |
Specifies the name of the administrator account for the identity applications. |
|
SSPR Configuration password |
CONFIGURATION_PWD |
Applies only if you have set the common password as No. Specifies the password for password management used by identity applications. |
|
OAuth keystore password |
OSP_KEYSTORE_PWD |
Applies only if you have set the common password as No. Specifies the password that you want to create for loading the new keystore on the OAuth server. |
|
Database Platform |
UA_DB_PLATFORM_OPTION |
Specifies the databases required for Identity Applications. |
|
Configure PostgreSQL on current server |
INSTALL_PG_DB |
Specifies if you want to configure PostgreSQL database on the same server. |
|
Identity Applications database port |
UA_DB_PORT |
Specifies the database port for Identity Applications. |
|
Identity Applications database name |
UA_DATABASE_NAME |
Specifies the name of the database. The default value is idmuserappdb. |
|
Identity Applications database and Workflow Engine user name |
UA_WFE_DATABASE_USER |
Specifies the user name for the administrator of the database for the identity applications. |
|
Identity Applications and Workflow Engine database administrator password for user postgres |
UA_WFE_DATABASE_ADMIN_PWD |
Specifies the Identity Applications and Workflow Engine database administrator password for user postgres |
|
Use custom container as root container |
ENABLE_CUSTOM_CONTAINER_CREATION |
Specifies whether you want to use custom container as a root container. By default, the installer creates o=data and chooses it as a user container and assigns the password policies and required trustee rights. To create a custom container, choose Yes. |
|
Create the User Application and Roles and Resources Services drivers for Identity Applications |
UA_CREATE_DRIVERS |
Specifies whether you want to install the UA and RRSD drivers. If you select N, you must specify the name of the existing User Application driver. |
|
Name of the existing User Application driver |
UA_DRIVER_NAME |
Applies only if you have set the value for creation of UA and RRSD drivers to No. Specifies the existing User Application driver DN details. |
|
User Application Workflow Engine ID |
UA_WORKFLOW_ENGINE_ID |
Indicates Identity Applications workflow engine ID. |
|
Identity Applications and Workflow Engine database platform |
UA_WFE_DB_PLATFORM_OPTION |
Indicates the Identity Applications and Workflow Engine database platform. The supported values are Postgres, Oracle, and MsSQL. |
|
Identity Applications and Workflow Engine database port |
UA_WFE_DB_PORT |
Indicates the Identity Applications and Workflow Engine database port. |
|
Workflow Engine database name |
WFE_DATABASE_NAME |
Indicates the Workflow Engine database name. The default database name is igaworkflowdb. |
|
Identity Applications and Workflow Engine database password |
UA_WFE_DATABASE_PWD |
Indicates the Identity Applications and Workflow Engine database password. |
|
Identity Applications and Workflow Engine database JDBC driver jar file |
UA_WFE_DB_JDBC_DRIVER_JAR |
Specifies the JAR file for the database platform. |
|
Create schema |
UA_WFE_DB_CREATE_OPTION |
Indicates when you want to create the database schema for Identity Applications and Workflow Engine as part of the installation process. The available options are Now, Startup, and File. |
|
Create a new database or upgrade/migrate from an existing database for Workflow Engine |
WFE_DB_NEW_OR_EXIST |
Specifies whether you create tables in a new database or update/migrate from an existing database for Workflow Engine. Supported values are new and exist. |
|
Create a new database or upgrade/migrate from an existing database for Identity Applications |
UA_DB_NEW_OR_EXIST |
Specifies whether you want to create a new database or upgrade from an existing database. |
|
Root container |
ROOT_CONTAINER |
Specifies the root container. The default value is o=data. |
|
Group search root container DN |
GROUP_ROOT_CONTAINER |
Specifies the DN of the group search root container. |
|
Identity Applications Custom Certificate |
CUSTOM_UA_CERTIFICATE |
Indicates whether you want to use a custom certificate for Identity Applications |
|
Custom container LDIF file path |
|
Applies only if you have set the custom container as Yes. Specifies the path of the LDIF file for custom container. |
|
NGINX port |
NGINX_HTTPS_PORT |
Specifies the NGINX port. |
|
Identity Reporting |
|
|
|
Master KeyStore Password |
MASTER_KEYSTORE_PWD |
Specifies master keystore password for identity reporting. |
|
Common password |
IS_COMMON_PASSWORD |
Specifies whether you want to set a common password. Ensure that the password meets the considerations specified in the Using Non-Intuitive Passwords During Configuration section. |
|
Hostname (FQDN in lowercase) |
ID_VAULT_HOST |
Specifies the server’s Fully Qualified Domain Name or default IP address. NOTE:Ensure that FQDN is specified in lower case. The server hosting your component must also be configured to use FQDN in lower case. |
|
Identity Vault Hostname/IP Address |
ID_VAULT_HOST |
Specifies the IP address or hostname of the server where Identity Vault is installed. |
|
Identity Vault Administrator name |
ID_VAULT_ADMIN_LDAP |
Specifies the relative distinguished name (RDN) of the administrator object in the tree that has full rights, at least to the context to which this server is added. |
|
Identity Vault Administrator password |
ID_VAULT_PASSWORD |
Specifies the password for the Administrator object. For example, password. |
|
Application Server HTTPS port |
TOMCAT_HTTPS_PORT |
Specifies the HTTPS port that you want the Tomcat server to use for communication with client computers. The default value is 8543. |
|
Application server DNS/IP address |
TOMCAT_SERVLET_HOSTNAME |
Specifies the IP address or hostname of the Tomcat server. |
|
Select the database platform for Identity Reporting |
RPT_DATABASE_PLATFORM_OPTION |
Specifies the database that you want to use for Identity Reporting. |
|
Configure PostgreSQL on current server |
INSTALL_PG_DB_FOR_REPORTING |
Specifies if you want to configure PostgreSQL database on the same server. |
|
Identity Reporting database account password |
RPT_DATABASE_SHARE_PASSWORD |
Specifies the database account password for Identity Reporting. |
|
Create a new database or upgrade/migrate from an existing database |
RPT_DATABASE_NEW_OR_EXIST |
Specifies whether you want to create a new database or upgrade from an existing database. |
|
Identity Reporting Administrator name |
RPT_ADMIN |
Specifies the administrator name for Identity Reporting. The default value is cn=uaadmin,ou=sa,o=data. |
|
Identity Reporting Administrator password |
RPT_ADMIN_PWD |
Specifies the administrator password for Identity Reporting. |
|
Identity Reporting database name |
RPT_DATABASE_NAME |
Specifies the database name for Identity Reporting. The default value is idmrptdb. |
|
Identity Reporting database user |
RPT_DATABASE_USER |
Specifies the administration account that allows Identity Reporting to access and modify data in the databases. The default value is rptadmin. |
|
Identity Reporting database host |
RPT_DATABASE_HOST |
Specifies the DNS name or IP address of the server where the database has to be created. |
|
Identity Reporting database port |
RPT_DATABASE_PORT |
Specifies the port to connect to the database.The default port is 5432. |
|
Identity Application database JDBC jar file |
RPT_DATABASE_JDBC_DRIVER_JAR |
Specifies the JAR file for the database platform. |
|
Identity Reporting Tomcat keystore file with subject alternate name |
RPT_COMM_TOMCAT_KEYSTORE_FILE |
Specifies the location of the Tomcat keystore file. NOTE:The custom certificates are supported only with PKCS type. |
|
Create schema |
RPT_DATABASE_CREATE_OPTION |
Indicates when you want to create the database schema as part of the installation process. The available options are Now, Startup, and File. |
|
Create the MSGW and DCS drivers for Identity Reporting |
RPT_CREATE_DRIVERS |
Specifies whether you want to create the MSGW and DCS drivers. |
|
NGINX HTTPS port |
NGINX_HTTPS_PORT |
Specifies the port for NGINX. |
|
OpenText Identity Console |
|
|
|
Identity Console Server Name |
ID_CONSOLE_SERVER_HOST |
Specifies the server name for hosting OpenText Identity Console. |
|
Identity Console Server Port |
ID_CONSOLE_SERVER_SSL_PORT |
Specifies the port that OpenText Identity Console will be getting hosted. |
|
OSP for authorization with Identity Console |
ID_CONSOLE_USE_OSP |
Specifies your choice to use OSP for authorization with OpenText Identity Console (y/n). |
|
One SSO Service password |
SSO_SERVICE_PWD |
Applies only if you have opted OSP for authorization as Yes. Specifies the One SSO Service password. |
|
Trusted root certificate folder path |
ID_CONSOLE_CA_CERT_LOCATION |
Specifies the trusted root certificate(SSCert.pem) folder path. |
|
Server certificate path including the filename |
ID_CONSOLE_SERVER_CERT_LOCATION |
Specifies the server certificate path including the filename. |
|
Server certificate password |
ID_CONSOLE_SERVER_CERT_PASSWD |
Specifies the server certificate password. |
|
Identity Vault tree name |
ID_CONSOLE_TREENAME |
Enter the Identity Vault tree name the OpenText Identity Console hosted to. |
Use the sample-driverset.ldif file from IDM/LDIF/ directory of the OpenText Identity Manager installation kit to help you create a driver set. The file has the following contents:
dn: cn=driverset1,o=system changetype: add DirXML-LogLimit: 0 DirXML-ConfigValues:: PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48Y29u ZmlndXJhdGlvbi12YWx1ZXM+Cgk8ZGVmaW5pdGlvbnMvPgo8L2NvbmZpZ3VyYXRpb24tdmFsdWVzPg== objectClass: DirXML-DriverSet objectClass: Top objectClass: Partition objectClass: nsimPasswordPolicyAux
dn: cn=DirXML-PasswordPolicy,cn=Password Policies,cn=Security changetype: add nsimPwdRuleEnforcement: FALSE nspmSpecialAsLastCharacter: TRUE nspmSpecialAsFirstCharacter: TRUE nspmSpecialCharactersAllowed: TRUE nspmNumericAsLastCharacter: TRUE nspmNumericAsFirstCharacter: TRUE nspmNumericCharactersAllowed: TRUE description: This Password Policy is used by IDM Engine nspmMaximumLength: 64 nspmConfigurationOptions: 596 passwordUniqueRequired: FALSE passwordMinimumLength: 1 passwordAllowChange: TRUE objectClass: nspmPasswordPolicy objectClass: Top cn: DirXML-PasswordPolicy nsimAssignments: cn=driverset1,o=system
In a text editor, open the sample-driverset.ldif file and make the following changes. If you have provided the custom LDIF file path, then specify the custom path:
Point the driver set DN to the new driver set. For example, change dn: cn=driverset1,o=system to dn:cn=Driverset47,ou=drivers,o=acme.
Change the nsimAssignments attribute value to the DN of the new driver set. For example, change nsimAssignments: cn=driverset1,o=system to nsimAssignments: cn=Driverset47,ou=drivers,o=acme.
NOTE:Copying the content as is might insert some hidden special characters in the file. If you receive a ldif_record() = 17 error message when you add these attributes to the Identity Vault, insert an extra space between the two DNs.
If OpenText Identity Manager is already installed on a server in the OpenText eDirectory tree, the DirXML-PasswordPolicy object exists in the tree. You have the following choices:
Use the existing password policy
Change
dn: cn=DirXML-PasswordPolicy,cn=Password Policies,cn=Security changetype: modify add: nsimAssignments nsimAssignments: cn=driverset1,o=system
Use a different password policy
Use
dn: cn=DirXML-PasswordPolicy,cn=Password Policies,cn=Security changetype: add
In a text editor, open the sample-driverset.ldif file and make the following changes:
Point the driver set DN to the new driver set.
Change the nsimAssignments attribute value to the DN of the new driver set.
Change the DirXML-PasswordPolicy attribute to point to the existing DirXML-PasswordPolicy object or a different password policy.