6.1 Deploying Self Service Password Reset in Amazon Web Services

Self Service Password Reset supports deploying the WAR file in the Amazon Web Service (AWS} on a SUSE Linux Enterprise 15 SP4 Server that connects to Active Directory Domain Services which contains your users accounts you want to manage. Currently, this is the only scenario that has been tested and is supported for Self Service Password Reset. Use the following information to deploy Self Service Password Reset on AWS.

6.1.1 Prerequisites for Deploying Self Service Password Reset on AWS

You must meet the following prerequisite to deploy Self Service Password Reset on AWS:

You must have an AWS account. For more information, see Getting Started with Amazon Elastic Container Service.
You must have a basic understanding of Amazon Elastic Compute Cloud (EC2). For more information, see Amazon Elastic Compute Cloud Documentation.
You must have a basic understanding of the networking on AWS. For example, you must understand:
- Virtual Private Cloud (VPC)
- Subnets
- Network address translation (NAT)
- Security group
For more information, see Networking Products with AWS.
You must have a basic understanding deploying Microsoft Windows 2016 Server on AWS. For more information, see Getting Started with a Service.
You must have a basic understanding of Microsoft Active Directory running on AWS. For more information, see Microsoft Active Directory.

6.1.2 Supported Deployment Scenario for Self Service Password Reset on AWS

You can configure the Self Service Password Reset Amazon Web Services (AWS) environment in several ways. The following example NetIQ tested and supports.

Figure 6-1 Overview of the AWS Deployment

Specifically, you deploy an AWS Elastic Compute Cloud (EC2) SLES15 instances and a Windows 2016 EC2 instance in an AWS Virtual Private Cloud (VPC) connected with a common subnet. The SLES15 instance hosts Self Service Password Reset with an elastic IP assigned. The Windows 2016 instance hosts Active Directory that stores all of the user accounts that you want to manage.

Deploying the EC2 instance of SUSE Linux Enterprise Server and the Windows 2016 Server running Active Directory into an EC2 instance is beyond the scope of this documentation. For more information, see:

SUSE Linux Enterprise Server: SUSE Linux Enterprise Server on Amazon EC2 in the AWS documentation.
Microsoft Windows 2016 Server: Running a Recipe on a Windows Instance and Microsoft Active Directory in the AWS documentation.

In this scenario, this is the first deployment of Self Service Password Reset into AWS. This means you must create a new security group for Self Service Password Reset. A security group is a a virtual firewall that controls the traffic for one or more instances. AWS associates each security group with a list of firewall rules to secure associated EC2 instances. You must create a security group that contains the firewall rules for Self Service Password Reset.

6.1.3 Accessing the AWS EC2 SLES15 SP4 Instance Using SSH on Linux

You must access the RSA key pair file you downloaded when creating the SLES 15 SP4 instance. The key pair file name is similar to SSPR_keypair.pem.txt. Protect this file using a Linux command such as:

chmod 500 SSPR_keypair.pem.txt

To access the new instance using SSH, issue a Linux command such as:

ssh -i "SSPR_keypair.pem.txt" ec2-user@ec2-34-216-102-176.us-west-2.compute.amazonaws.com
or
ssh -i "SSPR_keypair.pem.txt" ec2-user@34.216.102.176

The -i "SSPR_keypair.pem.txt" parameter instructs SSH to apply the downloaded identity file from which the identity (private key) for public key authentication is read. The ec2-user@ parameter indicates the default user name used by SSH to connect to the instance.

6.1.4 Deploying the WAR File on the AWS EC2 SLES 15 SP4 Instance

After you have created the AWS EC2 SLES 15 SP4 instance, you must deploy the Self Service Password Reset WAR file. Deploying the WAR file on a SLES 15 SP4 Server on AWS the same as if you installed SLES 15 SP3 on a physical server.

Self Service Password Reset is a web application you must install Apache Tomcat and Java on the SLES 12 SP3 instance before deploying the WAR file.

Download the Self Service Password Reset War file. For more information, see Obtaining Self Service Password Reset.
You must complete the prerequisites of installing Apache Tomcat, Java, and set the correct environment variables before deploying the WAR file. For more information, see Prerequisites for Deploying the WAR File.
Deploy the WAR file into the Apache Tomcat instance running on the AWS EC2 SLES 15 SP 4 instance. For more information, see Deploying the WAR File on Linux.

After you have deployed the WAR file you must configure this instance of Self Service Password Reset to connect to the AWS EC2 Windows 2016 server instance running Active Directory. For more information, see Configuring Your Environment for Self Service Password Reset.