Search for	Example	Results
A single word	`cat`	Topics that contain the word "cat". You will also find its grammatical variations, such as "cats".
A phrase. You can specify that the search results contain a specific phrase.	`"cat food"` (quotation marks)	Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase.

Search for	Operator	Example
Two or more words in the same topic	`AND` `and` `+` (plus symbol) `&` (ampersand)	`cat AND dog` `"cat food"+milk` `"cat food"&"dog food"`
Either word in a topic	`OR` `or` `\|` (pipe)	`cat OR dog` `cat \| dog`
Topics that do not contain a specific word or phrase	`NOT` `not` `!` (exclamation point)	`NOT cat` `! dog`
Topics that contain one string and do not contain another	`^` (caret)	`cat ^ mouse`
A combination of search types	`( )` parentheses	`cat + (dog \| mouse)` `cat \| dog + (! mouse)`

Cloud Service Automation4.80.0002

Administer > Configuration > Identity Management Configuration

Appendix: Identity Management component Configuration

If you are using the Identity Management component, the identity service and its components require configuration. Because it is a Spring Framework application, most of its configuration is defined in the applicationContext.xml file, although key attributes are externalized to the applicationContext.properties file. Both files are in CSA_HOME/jboss-as/standalone/deployments/idm-service.war/WEB-INF/spring/.

You should make most common configuration changes to the applicationContext.properties file. To avoid service disruptions, only advanced users who understand the Spring Framework should change the applicationContext.xml file.

You must also configure the Java Relying Party Library.

Note You should always make a copy of a configuration file before editing it.

External Configuration

Selected settings are pulled from the applicationContext.properties file, which you can override by an external properties file set as a JVM argument: -Didm.properties="<external_properties_filename>". You can add this JVM argument to the JAVA_OPTS environment variable or by editing the standaloneconf.bat file on Windows or the standalone.conf file on Linux in CSA_HOME/jboss-as/bin/ to add it to JAVA_OPTS for the CSA JBoss container.

The table below describes the properties that are set in the properties file. These properties are required.

If you are integrating with Keystone, the idm.keystone* properties must match the Keystone network location, transport user credentials, and so on. All idm.csa* properties and all ConvergedLdapAuthConfig properties (which are listed in the ConvergedLdapAuthConfig section below) must match the CSA network location and transport user credentials.

Property Name	Description
`idm.ssl.requireValidCertificate`	Flag indicating whether valid certificates are required: `true` or `false`
`idm.csa.protocol`	The protocol used to access the CSA instance: `http` or `https`
`idm.csa.hostname`	The hostname or IP address of the CSA server
`idm.csa.port`	The port number used by the CSA server
`idm.csa.username`	The username for the CSA integration account
`idm.csa.password`	The password for the CSA integration account. For improved security, this value should be encrypted.
`idm.encryptedSigningKey`	The shared signing key for all token factory objects. For improved security, this value should be encrypted.
`idm.keystone.enabled`	Flag indicating whether secondary authentication through Keystone is enabled: `true` or `false`. Set to true when you want to generate secondary authentication tokens via keystone authentication from your registered OpenStack providers. Set to false when attempting to use CAC or Siteminder for authentication. If `idm.keystone.enabled` is set to true in these cases, the keystone authentication will not function correctly. The following `idm.keystone` properties need not be configured as these values will be ignored: idm.keystone.protocol = http idm.keystone.hostname = keystone idm.keystone.port = 5000 idm.keystone.servicePath = v3 idm.keystone.domainName = Default idm.keystone.transportUsername = consumer idm.keystone.transportPassword = encrypted idm.keystone.transportProject = CSA_CONSUMER

Configure Seeded Authentication

The top-level configuration file for seeded authentication in the Identity Management component is specified by the configFile property of the SeededAuthenticationProvider bean defined in the applicationContext.xml configuration file.

In the default configuration, this file is seededorgs.properties, but it can be changed. Each line in this file contains a key-value pair. The key is a CSA organization ID, and the value is the name of another properties file Identity Management component users for that organization.

Notes:

This seeded authentication configuration only applies to Identity Management component seeded users.
CSA does not support adding new seeded users to the Identity Management component configuration for any CSA organizations.
CSA does not support modifying the Identity Management component configuration to use existing seeded users with any new CSA organizations.

By default, the following organizations in the Identity Management component are configured to use the specified files.

Organization	User File
`CONSUMER`	`consumer-users.properties`

You can define additional Identity Management component organizations or change the user file associated with any organization. Each line in each user file contains a key-value pair. The key is the username, and the value is a comma-separated list of the password, granted authorities, and an optional flag indicating whether the account is enabled. For improved security, the entire value should be encrypted. Following is an example of a line from an Identity Management component user file that defines a user named consumer with the password cloud and granted the SERVICE_CONSUMER and ROLE_REST authorities.

consumer=cloud,SERVICE_CONSUMER,ROLE_REST,enabled

Configure the Java Relying Party Library

The Java Relying Party Library is a set of classes provided by the identity service that abstract and simplify invoking the service from Java applications, such as CSA. You modify the properties listed in this section in the CSA_HOME/jboss-as/standalone/deployments/csa.war/WEB-INF/applicationContext-security.xml file. The tokenFactory property value should be the same for all AuthenticationProvider beans (listed in the Internal Configuration section below) in the identity service and in the Java Relying Party library.

IdentityServiceConfig

Configures the connection to the identity service.

Class: com.hp.ccue.identity.rp.IdentityServiceConfig

Property Name	Description
`protocol`	The protocol (`http` or `https`) to use to connect to the identity service
`hostname`	The hostname or IP address of the server running the identity service
`port`	The port number where the identity service is running, typically `8444`
`servicePath`	The path on the server to the identity service, typically `idm-service`

IdentityAuthenticationProvider

Abstracts the invocation of the identity service to perform authentication.

Class: com.hp.ccue.identity.rp.IdentityAuthenticationProvider

Property Name	Description
`templateFactory`	Creates the `RestTemplate` object that facilitates performing REST calls
`configuration`	Network configuration of the identity service to connect to perform authentication: an `IdentityServiceConfig` object
`tokenFactory`	The token factory to validate returned tokens
`tenantHeaderName`	The name of the HTTP header where the tenant name is passed. The default is `HPE-Tenant-Name`

HeaderAuthenticationProvider

Performs authentication based on a token passed in an HTTP header.

Class: com.hp.ccue.identity.rp.HeaderAuthenticationProvider

Property Name	Description
`headerName`	The name of the HTTP header where the token is transferred
`tokenValidator`	The `TokenValidator` object to use to validate tokens

Internal Configuration

The applicationContext.xml file defines the configuration of the classes in the identity service. The tokenFactory property value should be the same for all AuthenticationProvider beans (listed in the sections below) in the identity service and in the Java Relying Party library.

Note Modify this file only if you cannot express the necessary configuration change in the applicationContext.properties file. The applicationContext.xml file must follow the syntax rules specified by the Spring Framework. In the following tables, the default values are used if no values are provided in the configuration file. You can configure items marked as externalized in the applicationContext.properties file.

JwtTokenFactory

Defines how tokens are created.

Class: com.hp.ccue.identity.domain.JwtTokenFactory

Property Name	Description
`lifetimeMinutes`	Required. The lifetime of the token, in minutes. The lifetime as installed is 30 minutes. Reducing this value will render tokens invalid faster and thus requires a more-frequent token refresh, which might reduce performance. Increasing this value allows tokens to last longer, which might allow someone who has intercepted a valid token to access the system for a period of time. Default value: (None) Externalized: No
`defaultTypeName`	Optional. Default type of JWT token to create: `PLAINTEXT`, `SIGNED`, or `ENCRYPTED` Default value: `PLAINTEXT` Externalized: No
`signingKey`	Required if `defaultTypeName` is set to `SIGNED`. This is a Base64-encoded byte array representing the key used to sign signed tokens. If `defaultTypeName` is set to `SIGNED`, this value must be the same for all components that validate tokens. For improved security, this item should be encrypted. Default value: (None) Externalized: `idm.encryptedSigningKey`
`refreshEnabled`	Optional. Boolean value indicating whether token refresh is enabled: `true` or `false`. The recommended value is `true`. Default value: `true` Externalized: No

ConvergedLdapAuthConfig

Defines the configuration for connecting to a CSA server to get LDAP configuration information. The idm.csa* external properties (which are listed in the External Configuration section above) and all ConvergedLdapAuthConfig properties must match the CSA network location and transport user credentials.

Class: com.hp.ccue.identity.ldap.ConvergedLdapAuthConfig

Property Name	Description
`providerProtocol`	Required if using ActiveDirectory or LDAP. `http` or `https`, depending on the protocol used by the CSA instance Default value: (None) Externalized: `idm.csa.protocol`
`providerHostname`	Required if using ActiveDirectory or LDAP. Hostname or IP address of the CSA server Default value: (None) Externalized: `idm.csa.hostname`
`providerPort`	Required if using ActiveDirectory or LDAP. Port number used by the CSA server Default value: (None) Externalized: `idm.csa.port`
`securityTransportUsername`	Required if using ActiveDirectory or LDAP. Username for the CSA integration account Default value: (None) Externalized: `idm.csa.username`
`securityTransportPassword`	Required if using ActiveDirectory or LDAP. Password for theCSA integration account Default value: (None) Externalized: `idm.csa.password`

ConvergedActiveDirectoryAuthenticationProvider and ConvergedLdapAuthenticationProvider

Performs authentication with Active Directory and LDAP authentication mechanisms.

Class: com.hp.ccue.identity.ldap.ConvergedActiveDirectoryAuthenticationProvider, com.hp.ccue.identity.ldap.ConvergedLdapAuthenticationProvider

Property Name Description

Property Name	Description
`config`	Required if using ActiveDirectory or LDAP. The `ConvergedLdapAuthConfig` that represents theCSA server to use to get the LDAP configuration for each organization Default value: (None) Externalized: No
`tokenFactory`	Required if using ActiveDirectory or LDAP. The token factory for creating identity tokens in response to successful authentications Default value: (None) Externalized: No

config

Required if using ActiveDirectory or LDAP. The ConvergedLdapAuthConfig that represents theCSA server to use to get the LDAP configuration for each organization

Default value: (None)

Externalized: No

tokenFactory

Required if using ActiveDirectory or LDAP. The token factory for creating identity tokens in response to successful authentications

Default value: (None)

Externalized: No

SeededAuthenticationProvider

Performs seeded authentication.

Class: com.hp.ccue.identity.seeded.SeededAuthenticationProvider

Property Name Description

Property Name	Description
`configFile`	Required if using seeded authentication. Typically `seededorgs.properties`, which is the file that defines the seeded organizations Default value: (None) Externalized: No
`tokenFactory`	Required if using seeded authentication. The token factory for creating identity tokens in response to successful authentications Default value: (None) Externalized: No

configFile

Required if using seeded authentication. Typically seededorgs.properties, which is the file that defines the seeded organizations

Default value: (None)

Externalized: No

tokenFactory

Required if using seeded authentication. The token factory for creating identity tokens in response to successful authentications

Default value: (None)

Externalized: No

IdentityAuthenticationProvider

Performs integration account authentication.

Class: com.hp.ccue.identity.seeded.IntegrationAuthenticationProvider

Property Name Description

Property Name	Description
`configFile`	Required. Typically `integrationusers.properties`, which is the file that defines the seeded organizations Default value: (None) Externalized: No
`tokenFactory`	Required. The token factory for creating identity tokens in response to successful authentications Default value: (None) Externalized: No

configFile

Required. Typically integrationusers.properties, which is the file that defines the seeded organizations

Default value: (None)

Externalized: No

tokenFactory

Required. The token factory for creating identity tokens in response to successful authentications

Default value: (None)

Externalized: No

MultiTenantAuthenticationProvider

Connects to mechanism-specific authentication providers.

Class: com.hp.ccue.identity.authn.MultiTenantAuthenticationProvider

Property Name Description

Property Name	Description
`providers`	Required. List of `AuthenticationProvider` objects that provide mechanism-specific authentication Default value: (None) Externalized: No
`secondaryEnabled`	Required if using Keystone. Flag that indicates whether the secondary authentication path (Keystone) is enabled Default value: `false` Externalized: `idm.keystone.enabled`
`secondaryProvider`	Required if using Keystone. Reference to Authentication provider bean to use for secondary authentication path. The Keystone authentication provider is the only one that supports this type of usage. Default value: (None) Externalized: No

providers

Required. List of AuthenticationProvider objects that provide mechanism-specific authentication

Default value: (None)

Externalized: No

secondaryEnabled

Required if using Keystone. Flag that indicates whether the secondary authentication path (Keystone) is enabled

Default value: false

Externalized: idm.keystone.enabled

secondaryProvider

Required if using Keystone. Reference to Authentication provider bean to use for secondary authentication path. The Keystone authentication provider is the only one that supports this type of usage.

Default value: (None)

Externalized: No

IdentityServiceImpl

The identity service implementation object.

Class: com.hp.ccue.identity.service.IdentityServiceImpl

Property Name	Description
`provider`	Required. Reference to the `AuthenticationProvider` bean to use to perform authentication. This is the `MultiTenantAuthenticationProvider` Default value: (None) Externalized: No
`tokenFactory`	Required. The token factory for creating identity tokens in response to successful authentications Default value: (None) Externalized: No
`queryService`	Required. The persistence service that provides all persistence operations. Default value: (None) Externalized: No
`trustFactory`	Required. The `TrustFactory` for validating all `Trust` objects. Default value: (None) Externalized: No

IdentityController

The controller object that provides the REST API for the identity service.

Class: com.hp.ccue.identity.service.IdentityController

Property Name Description

Property Name	Description
`identityService`	Required. The `IdentityService` object that implements the identity service. You must set the value of this to the `IdentityServiceImpl` instance. Default value: (None) Externalized: No

identityService

Required. The IdentityService object that implements the identity service. You must set the value of this to the IdentityServiceImpl instance.

Default value: (None)

Externalized: No

KeystoneAuthenticationProvider

Uses Keystone (if used) to perform authentication.

Class: com.hp.ccue.identity.keystone.KeystoneAuthenticationProvider

Property Name Description

Property Name	Description
`templateFactory`	Required. Creates the `RestTemplate` object that facilitates performing REST calls Default value: (None) Externalized: No
`tokenFactory`	Required. The token factory to validate returned tokens Default value: (None) Externalized: No

templateFactory

Required. Creates the RestTemplate object that facilitates performing REST calls

Default value: (None)

Externalized: No

tokenFactory

Required. The token factory to validate returned tokens

Default value: (None)

Externalized: No

KeystoneSecondaryAuthenticationProvider

Uses Keystone (if used) to perform authentication.

Class: com.hp.ccue.identity.keystone.KeystoneSecondaryAuthenticationProvider

Property Name	Description
`keystoneConfigurations`	Required. Associative array mapping configuration identifiers to `KeystoneConfig` objects defining network configurations to connect to one or more Keystone services. Default value: (None) Externalized: No
`configurationFile`	Required. Filename for properties file that contains Keystone configurations. Default value: (None) Externalized: No
`tokenFactory`	Required. The token factory to validate returned tokens. Default value: (None) Externalized: No
`templateFactory`	Required. Creates the `RestTemplate` object that facilitates performing REST calls. Default value: (None) Externalized: No

RestTemplateFactoryImpl

Configures how REST services are invoked.

Class: com.hp.ccue.identity.rest.RestTemplateFactoryImpl

Property Name Description

Property Name	Description
`fipsEnabled`	A flag that indicates whether the template factory should ignore settings that interfere with FIPS 140-2 compliance Default value: `false` Externalized: No
`wrapEnabled`	A flag that indicates whether the template factory should wrap JSON output in its specified root value or assume that incoming JSON is wrapped in the root value. This setting depends on the REST service being invoked. For template factories used to invoke CSA REST APIs, it should be set to `false`; for template factories used to invoke Keystone REST APIs, it should be set to `true`. Default value: `true` Externalized: No
`requireValidCertificate`	A flag that indicates whether the template factory should perform certificate validation and hostname verification (`true`) or ignore them (`false`). If this value is set to `true`, then the corresponding server host names for all beans that use that template factory must be given in a way that matches the certificate for that server (a fully-qualified domain name is generally required). Default value: `true` Externalized: `idm.ssl.requireValidCertificate`

fipsEnabled

A flag that indicates whether the template factory should ignore settings that interfere with FIPS 140-2 compliance

Default value: false

Externalized: No

wrapEnabled

A flag that indicates whether the template factory should wrap JSON output in its specified root value or assume that incoming JSON is wrapped in the root value. This setting depends on the REST service being invoked. For template factories used to invoke CSA REST APIs, it should be set to false; for template factories used to invoke Keystone REST APIs, it should be set to true.

Default value: true

Externalized: No

requireValidCertificate

A flag that indicates whether the template factory should perform certificate validation and hostname verification (true) or ignore them (false). If this value is set to true, then the corresponding server host names for all beans that use that template factory must be given in a way that matches the certificate for that server (a fully-qualified domain name is generally required).

Default value: true

Externalized: idm.ssl.requireValidCertificate

TrustFactory

Configures how the Identity Management component trusts are created and validated.

Class: com.hp.ccue.identity.domain.impersonation.TrustFactory

Property Name	Description
`lifetime`	Required. The lifetime of a trust. Default value: 90 (days) Externalized: No
`lifetimeMinutes`	Required. Alternate setter for trust lifetime, expressed in minutes (write only). Default value: (None) Externalized: No
`lifetimeHours`	Required. Alternate setter for trust lifetime, expressed in hours (write only). Default value: (None) Externalized: No
`lifetimeDays`	Required. Alternate setter for trust lifetime, expressed in days (write only). Default value: (None) Externalized: No

Token Store Cleanup Service

This background service is used to cleanup expired tokens in the Identity Management component token_store database table. The service runs twice a day ( 7 PM and 7 AM ) every day by default and cleans up tokens older than one hour from the time the service starts up.

The default settings should work for most workloads. However under heavy workloads such as OO callbacks to CSA in sequenced designs, the table may need to be cleaned up more often. When there are over 50K rows in the token_store database table in a single day, the overall performance of the database and eventually CSA and Marketplace Portal are greatly impacted. This is particularly true for the Microsoft SQLserver 2012 database.

If you see the token_store table growing beyond 50K rows in a single day, modify the following cron setting in the CSA_HOME/jboss-as/standalone/deployments/idm-service.war/WEB-INF/spring/applicationContext-services.xml file to run the service more often.

To modify the cron setting, complete the following steps:

Open the CSA_HOME/jboss-as/standalone/deployments/idm-service.war/WEB-INF/spring/applicationContext-services.xml file.
Look for the following line:

<task:scheduled ref="tokenStoreCleaner" method="cleanDbTokenStore" cron="0 0 7/12 * * *" />
Change the cron setting to have the service run every 2 hours after the start of CSA:

Change: cron="0 0 7/12 * * *

To: cron="0 0 */2 * * *"

Send Help Center feedback