Administer > Administer the NNM iSPI Performance for QA > Configure Access

Configure Access with Public Key Infrastructure Authentication

This topic includes the following sections:

You can configure NNMi to map the Public Key Infrastructure (PKI) certificates to NNMi user accounts. As a result, you can log on to the NNMi console without having to type in the NNMi user name and password on the Login page. However, you will be prompted to provide NNMi user name and password again when you try to launch the NNM iSPI Performance for QA Configuration form, unless you perform additional steps to reconcile the mapping with the iSPI.

When NNMi is configured to use the PKI authentication, it is mandatory for the iSPI to use the PKI authentication. Also, do not configure only the iSPI to use the PKI authentication when NNMi continues to use the credentials-based authentication.

When the NNM iSPI Performance for QA is configured in a High Availability (HA) environment, make sure that nms-auth-config.xml from the %NnmDataDir%\nmsas\qa\conf\ or /var/opt/OV/nmsas/qa/conf/ directory is replicated on to each cluster member, to use the PKI authentication.

Task 1: Configure NNMi

To configure NNMi to use the PKI authentication, follow the steps in Configure NNMi to Support Public Key Infrastructure User Authentication.

Task 2: Configure a Certificate Validation Method

When NNMi is configured to use the PKI authentication, unauthorized access using invalid certificates must be prevented. You must perform additional steps to configure NNMi to use a certificate validation method—Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP).

Task 3: Enable SSL

To enable NNMi-NNM iSPI Performance for QA communication, SSL should be enabled in the NNM iSPI Performance for QA.

Modify the following parameters in the extended.properties file from the %nnmdatadir%\shared\qa\conf or /var/opt/OV/shared/qa/conf to enable SSL:

com.hp.ov.nms.spi.qa.spi.isSecure=true
com.hp.ov.nms.spi.qa.Nnm.isSecure=true

For the SSL configuration changes to take effect, restart the NNM iSPI Performance for QA processes by running the following commands:.

  • ovstop -c qajboss
  • ovstart -c qajboss

Task 4: Enable and Disable SSLv3 Ciphers

To configure NNM iSPI Performance for QA to enable SSLv3 ciphers:

  1. Open the following file:

    For Windows: %NnmDataDir%\nmsas\qa\server.properties

    For Linux: $NnmDataDir/nmsas/qa/server.properties

  2. Uncomment the following line:

    #com.hp.ov.nms.ssl.PROTOCOLS = SSLv2Hello,SSLv3,TLSv1,TLSv1.1,TLSv1.2

    For example:

    com.hp.ov.nms.ssl.PROTOCOLS = SSLv2Hello,SSLv3,TLSv1,TLSv1.1,TLSv1.2

    You can remove any protocols contained in this line.

  3. Save the file.

To disable the SSLv3 ciphers after they have been enabled:

  1. Open the following file:

    For Windows: %NnmDataDir%\nmsas\qa\server.properties

    For Linux: $NnmDataDir/nmsas/qa/server.properties

  2. Reinsert the comment in the following line:

    com.hp.ov.nms.ssl.PROTOCOLS = SSLv2Hello,SSLv3,TLSv1,TLSv1.1,TLSv1.2

    For example:

    #com.hp.ov.nms.ssl.PROTOCOLS = SSLv2Hello,SSLv3,TLSv1,TLSv1.1,TLSv1.2

    You can remove any protocols contained in this line.

  3. Save the file.

Task 5: Configure the NNM iSPI Performance for QA

Configuring NNM iSPI Performance for QA to use the PKI authentication essentially requires updating the nms-auth-config.xml file in the NNM iSPI Performance for QA’s configuration data directory (%NnmDataDir%\nmsas\qa\conf on Windows; /var/opt/OV/nmsas/qa/conf on Linux) to reflect the changes done in the nms-auth-config.xml file on the NNMi management server.

To configure the NNM iSPI Performance for QA to use the PKI authentication:

  1. Make sure that Task 1, Task 2, and Task 3 are complete.
  2. Log on to the NNMi management server.

  3. Navigate to the following directory:

    On Windows

    %nnmdatadir%\nmsas\qa\conf

    On Linux

    /var/opt/OV/nmsas/qa/conf

  4. Open the nms-auth-config.xml file using a text editor.

  5. Modify the nms-auth-config.xml file to match the changes done on the nms-auth-config.xml file in the NNMi management server (%nnmdatadir%\nmsas\NNM\conf\ or /var/opt/OV/nmsas/NNM/conf/).

  6. Save and close the file.

  7. Run the following command:

    On Windows:

    %NnmInstallDir%\qa\bin\nmsqaauthconfigreload.ovpl

    On Linux:

    /opt/OV/qa/bin/nmsqaauthconfigreload.ovpl

    Do not enable the Single Sign-On feature when NNMi and the NNM iSPI Performance for QA are configured to use the Public Key Infrastructure (PKI) authentication.

Send Help Center feedback