Install > Install and configure the HPE Identity Manager service

Install and configure the HPE Identity Manager service

Service Manager (SM) leverages HPE Identity Manager (IdM) to support Single Sign-On (SSO) using SAML 2.0. To set up SAML SSO for Service Manager, you need to deploy the IdM service and create a trust relationship with a third-party identity provider (IdP). In the SAML SSO process, the IdM service acts as a service provider (SP) to the IdP.

  • For SM SAML SSO, you can use only the IdM service package released as a web archive (WAR) file, which is version 1.10.2. Currently, you must not use the IdM service bundled in Service Manager Service Portal, which is not supported for SAML SSO. For more information about how to set up SAML SSO for Service Manager, see SAML Single Sign-On.
  • Currently, only Microsoft ADFS 2.0 or 3.0 is supported as an identity provider (IdP) for IdM.

Prerequisite

You must have a third-party identity provider (that is, ADFS 2.0 or 3.0) installed in your system.

To deploy a single IdM instance, complete the following tasks.

ClosedTask 1. Deploy a web application server for the IdM service

You can deploy the IdM service on Tomcat 7.x or 8.x.

Note The following steps use Tomcat as an example. Version 8.x is recommended.

To do this, follow these steps:

  1. Install JDK 1.8 or later .

  2. Install Tomcat 8.x.

    Caution The Tomcat installation path must not contain any white spaces.

  3. If using Tomcat 8.5 or later, perform the following steps:

    1. Open the <Tomcat>/conf/context.xml file in a text editor.

    2. Insert the following line inside the <Context> tag pair:

      <CookieProcessor className="org.apache.tomcat.util.http.LegacyCookieProcessor"/>
    3. Save the file.
ClosedTask 2 Configure SSL in the IdM web application server

The IdM service requires the use of SSL connections. Once you have completed the deployment of the IdM web application server (Tomcat), you need to configure SSL for it.

To configure SSL for Tomcat, follow these steps:

  1. Run the following keytool command to create a keystore file:

    ​keytool -genkey -alias tomcat -keyalg RSA -keystore tomcat.keystore

    Follow the screen prompts to enter required information.

    Note When asked for your first and last names, enter the fully qualified domain name (FQDN) of the Tomcat server. For example: myhost.mycompany.net.

    The following is an example.

    ​C:\Tomcat\tomcat_9443>keytool -genkey -alias tomcat -keyalg RSA -keystore tomcat.keystore
Enter keystore password:

Re-enter new password:

What is your first and last name?

  [Unknown]:  myhost.mycompany.net  
What is the name of your organizational unit?

[Unknown]:  software

What is the name of your organization?

 [Unknown]:  hpe

What is the name of your City or Locality?

  [Unknown]:  shanghai

What is the name of your State or Province?

  [Unknown]:  shanghai

What is the two-letter country code for this unit?

  [Unknown]:  CN

Is CN=myhost.mycompany.net, OU=software, O=hpe, L=shanghai, ST=shanghai, C=CN correct?

  [no]:  yes

Enter key password for <tomcat>

        (RETURN if same as keystore password):

Re-enter new password:

  2. Run the following command to export a certificate from the keystore:

    ​keytool -keystore tomcat.keystore -export -alias tomcat -file tomcat.cer

  3. Run the following command to import the certificate into JDK:

    ​keytool -import -alias idm -file tomcat.cer -keystore  cacerts

    Follow the screen prompts to enter required information. The following is an example.

    Note The default keystore password is changeit.

    C:\Program Files\Java\jdk1.8.0_91\jre\lib\security>keytool -import -alias idm -file tomcat.cer -keystore  cacerts

Enter keystore password:

Owner: CN=myhost.mycompany.net, OU=software, O=hpe, L=shanghai, ST=shanghai, C=CN

Issuer: CN=myhost.mycompany.net, OU=software, O=hpe, L=shanghai, ST=shanghai, C=CN

Serial number: 5acc6d54

Valid from: Fri Jun 03 10:00:26 CST 2016 until: Thu Sep 01 10:00:26 CST 2016

Certificate fingerprints:

         MD5:  52:9F:9E:57:63:11:26:DB:0A:D4:99:0D:44:1B:A8:65

         SHA1: 47:8E:26:C2:CA:0E:C2:B0:3C:D8:54:4F:70:93:44:F5:D6:6E:D6:1D

         SHA256: 5C:B0:98:10:7D:13:BE:D2:24:2C:C0:EF:F0:C5:F1:7F:87:6C:E7:0B:FA:22:4C:94:DE:46:EF:6C:0E:55:61:9B

         Signature algorithm name: SHA256withRSA

         Version: 3

Extensions:

#1: ObjectId: 2.5.29.14 Criticality=false

SubjectKeyIdentifier [

KeyIdentifier [

0000: 9D DB 0D 2A 12 B9 41 6B   3D C7 66 86 3B 63 9E 98  ...*..Ak=.f.;c..

0010: 02 D7 38 CE                                        ..8.

]

]

Trust this certificate? [no]:  yes

Certificate was added to keystore

  4. Configure the https port and keystore in the server.xml file in the <Tomcat>/conf folder:

    <Connector port="9443" protocol="org.apache.coyote.http11.Http11NioProtocol"

   maxThreads="150" SSLEnabled="true" scheme="https" secure="true"

       clientAuth="false" sslProtocol="TLS" keystoreFile="/conf/tomcat.keystore" keystorePass="!qaz2wsx3edc"

         truststoreFile="/conf/tomcat.keystore" storePass="!qaz2wsx3edc" />

    Caution Be sure to enter the correct path of the tomcat.keytore file.

Closed(Optional) Task 3. Create an IdM client trust store

This is an optional task. Perform this task only if you want the IdM client (SM Web Tier, SRC, or Mobility Client) to verify the IdM server certificate. If you want the IdM clients to perform this verification, you need to do the following:

  1. Create an IdM client trust store.
  2. Copy the trust store file to the IdM client (SM Web Tier, SRC, and Mobility Client).
  3. On the IdM client side, set the idm.ssl.trustAll parameter to false (default) and specify the trust store file and password for the IdM client. For details, see the SAML Single Sign-On setup section in the Service Manager Help Center.

In the previous task ("Task 2 Configure SSL in the IdM web application server"), you have already created a certificate file (tomcat.cer) and keystore file (tomcat.keystore) for the web application server. Now, you need to create a truststore using these two files.

To create an IdM client trust store, follow these steps:

  1. Generate a trustStore.keystore file, by running the following command:

    keytool -genkey -alias tomcat1 -keyalg RSA -keysize 1024 -keypass tomcat1 -validity 365 -keystore trustStore.keystore -storepass tomcat1

  2. Import the IdM public key to the trustStore.keystore file, by running the command below:

    keytool -import -alias tomcat -file tomcat.cer -keystore trustStore.keystore -storepass tomcat1

Note Now, the trust store file is generated. The file name is trustStore.keystore, and its password is tomcat1.

ClosedTask 4. Deploy the IdM service and configure SAML SSO

To do this, follow these steps:

  1. Copy the idm-service-1.10.2.war file from the SM9.50-2.zip file to the <Tomcat>/webapps folder.

  2. Deploy the .war file.

  3. Update the IdM service configuration base for SP-initiated web SSO.

    Step 1. Configure SP-Initiated SSO: Redirect/POST Binding

    1. In the <idm-service>/WEB-INF/web.xml file, uncomment the following line: 

      /WEB-INF/spring/applicationContext-saml.xml

      Note The applicationContext-saml.xml file includes Spring beans for SAML.

    2. In the <idm-service>/WEB-INF/spring/applicationContext-security.xml file, enable SAML Web SSO with HP SSO.

      By default, the SAML Web SSO with HP SSO section is commented out. Remove the comment tags highlighted below to enable the feature.

      <!-- START SAML Web SSO with HP SSO -->
    <!--
       ...
	...
	...
    -->
<!-- END SAML Web SSO with HP SSO -->

      Note SAML Web SSO without HP SSO authenticates the user and provides user access to protected resources in one application; SAML Web SSO with HP SSO writes the HPE SSO cookie after the user is authenticated, and therefore provides single sign-on to other applications. HP SSO provides single sign-on capability across HPE software products. To be compatible with LW-SSO, you must enable SAML Web SSO with HP SSO. This means when SAML is enabled in SM and LW-SSO is enabled in another application, users can access SM without login, and vise versa.

    3. Update the <idm-service>/WEB-INF/spring/applicationContext-security.xml file.

      1. Open the file with a text editor.
      2. Search for "START HP SSO Configuration". This section is commented out by default.

      3. Uncomment this section, except the normal HPSSO login and logout filters, as shown below.

        <!-- START HP SSO Configuration -->
    <!--
    <security:http pattern="/idm/v0/login" use-expressions="true" auto-config="false">
        <security:csrf disabled="true" />
        <security:custom-filter ref="requestTokenCompositeFilter" position="FIRST" />
        <security:custom-filter ref="hpssoProvidedFilter" before="PRE_AUTH_FILTER" />
        <security:custom-filter ref="hpssoIntegrationFilter" after="PRE_AUTH_FILTER" />
        <security:custom-filter ref="noPromptFilter" before="FORM_LOGIN_FILTER" />
        <security:http-basic />
    </security:http>

    <security:http pattern="/idm/v0/logout" use-expressions="true" auto-config="false">
        <security:csrf disabled="true" />
        <security:custom-filter ref="requestTokenCompositeFilter" position="FIRST" />
        <security:custom-filter ref="hpssoProvidedFilter" before="PRE_AUTH_FILTER" />
        <security:custom-filter ref="hpssoIntegrationFilter" after="PRE_AUTH_FILTER" />
        <security:http-basic />
    </security:http>
	-->
	...
	...
	...
	</bean>
<!-- END HP SSO Configuration -->

    4. Configure HP SSO.

      1. Open the <idm-service>/WEB-INF/web.xml file with a text editor.
      2. Search for "START HP SSO Configuration". This section is commented out by default.
      3. Uncomment this section by removing the comment tags.

      4. Specify the location of the HP SSO configuration file as "/WEB-INF/hpssoConfig.xml".

        <!-- START HP SSO Configuration -->
    <listener>
        <listener-class>com.hp.ccue.identity.hpssoImpl.HpSsoContextListener</listener-class>
    </listener>

    <context-param>
        <param-name>com.hp.sw.bto.ast.security.lwsso.conf.fileLocation</param-name>
        <param-value>/WEB-INF/hpssoConfig.xml</param-value>
    </context-param>
<!-- END HP SSO Configuration -->

      5. In the <idm-service>\WEB-INF\spring\applicationContext-v0.xml file, uncomment the tokenWriter property setting in the HP SSO Configuration section, as shown below.

        <!--Authentication API -->
    <bean id="authenticationApiController" class="com.hp.ccue.identity.web.api.AuthenticationController">
        <property name="tokenService" ref="tokenService"/>
        <property name="identityService" ref="identityService"/>
        <property name="sessionStateService" ref="sessionStateService"/>
        <!-- START HP SSO Configuration -->
                <property name="tokenWriter" ref="hpssoTokenWriter" />
        <!-- END HP SSO Configuration -->
    </bean>

      6. Edit the <idm-service>\WEB-INF\hpssoConfig.xml file as described below.

        • Specify the domain name of the IdM server (for example, the Tomcat server). The domain name must match the DNS domain name of the system on which the IDM service is deployed, because the HP SSO cookies are domain-specific.

          Note All components that participate in SAML except the SM Server (the IdM service, SM web tier, SRC, and Mobility Client) must be in the same domain, because HP SSO cookies are domain-specific.

        • Change secureHTTPCookie (default: false) to true if SSL is enabled between the user's browser and the web application server of the SM web tier, SRC, or Mobility Client.

        See the following for an example.

        <creation tokenGlobalTimeout="480" tokenIdleTimeout="30" secureHTTPCookie="true">
        <!-- lwsso is required -->
        <lwsso>
            <!-- domain is required
                HPSSO 1.0 version supports a single domain only.
                All servers using HPSSO should have the same domain and it should be denoted in this tag
            -->
            <creationDomains>
                <!-- for development environments only! -->
                <domain>mycompany.net</domain>
            </creationDomains>
        </lwsso>
 </creation>

    Step 2. Configure SP-Initiated SSO: POST/Artifact Bindings

    For POST/Artifact Bindings, in addition to the configuration in the previous step, you need to make sure that the applicationContext-saml.xml file contains the following property setting (default).

    Note This file is located in the following folder: <idm-service>/WEB-INF/spring.

    <property name="bindingsSSO">
        <list>
            <value>post</value>
            <value>artifact</value>
            <value>paos</value>
        </list>
</property>

    Step 3. Disable ECP

    ADFS does not support ECP; however, the IdM metadata includes the AssertionConsumerService for ECP. Therefore, this step is required.

    To disable ECP, follow these steps:

    1. Open the <idm-service>WEB-INF\spring\applicationContext-saml.xml file with a text editor.

    2. Search for the following line, and comment it out.

      <value>paos</value>

    3. Search for the following line, and comment it out.

      <property name="ecpEnabled" value="true"/>
ClosedTask 5. Configure a tenant and specify the ADFS metadata URL

A tenant is a data space in IdM. IdM user authentication is based on a tenant. For Service Manager users, a tenant must be specified in a .json file.

The federation metadata URL of the identity provider (that is, ADFS) is required for you to add the IdM service as a replying party trust later.

To configure a tenant and specify the ADFS metadata URL, follow these steps:

  1. Locate the <idm-service>\WEB-INF\classes\seeded\samples\com.hpe.tenant1__1.3.2.1__Add_Update_Saml_Configuration.json.template file.

  2. Copy the file to the seeded directory (<idm-service>\WEB-INF\classes\seeded\) and then remove the .template extension from the file name.

  3. Open the com.hpe.tenant1__1.3.2.1__Add_Update_Saml_Configuration.json file in a text editor.

    Note The file has already a sample tenant named IdmDemoOrg1 defined. You may want to update it to your own tenant name.

  4. Update this file so that its content resembles the following example (in this example, a tenant name of IDM-SM is specified):

    [
    {
        "operation":"ADD_OR_UPDATE",
        "type":"organization",
        "attributes":{
            "name":"IDM-SM",
            "displayName":"IDM-SM"
        }
},

    {
        "operation":"ADD",
        "type":"samlConfiguration",
        "names":{
            "organizationName":"IDM-SM"
        },
        "attributes":{
            "name":"IdmSamlConfiguration1",
            "displayName":"IdmSamlConfiguration1",
            "entityUrl":"https://localhost/2007-06/federationmetadata.xml"
           
        }
    } 
]
    • Specify the same organization name for both the name attribute in the ADD_OR_UPDATE operation and the organizationName attribute in the ADD operation.
    • For the ADD_OR_UPDATE operation, the name and displayName attributes are mandatory.
    • For the Add operation, the organizationName, name, and displayName attributes are mandatory. The name attribute serves as the unique key for your SAML configuration.

    • The federation metadata URL of ADFS uses this format: https://<ADFS host>/federationmetadata/2007-06/federationmetadata.xml

    Note that when the IdM service is started, the content of the .json file is loaded into IdM. Once the tenant is already created, you cannot update the organization name (the name and organizationName attributes), unless you want to create a new tenant. However, you can update the entityUrl attribute of the existing tenant. Make sure the content of the updated .json file resembles the following example:

    [
    {
        "operation":"ADD_OR_UPDATE",
        "type":"organization",
        "attributes":{
            "name":"IDM-SM"
        }
},
    {
        "operation":"UPDATE",
        "type":"samlConfiguration",
        "names":{
            "organizationName":"IDM-SM",
            "samlConfigurationName":"IdmSamlConfiguration2"
        }, 
        "attributes":{
            "displayName":"IdmDemoSamlConfiguration2",
            "entityUrl":"https://mynewhost/2007-06/federationmetadata.xml"
        }
    }    
]

Caution After making any updates to the .json file, you must do the following:

  1. Rename the file to increase its version number. For example, rename it from com.hpe.tenant1__1.3.2.1__Add_Update_Saml_Configuration.json to com.hpe.tenant1__1.3.2.2__Add_Update_Saml_Configuration.json. If you do not increase the version number, when the IdM service is restarted, the updated content will not be loaded and hence your changes will not take effect.
  2. Restart the IdM service for the changes to take effect.

Note After you have completed the IdM service deployment and setup, you will also need to specify the same tenant on the Service Manager side. For details, search for SAML Single Sign-On setup in the Service Manager Help Center.

Next, you need to create a database and configure the database connection for the IdM service.

ClosedTask 6. Create an empty database for IdM

You need to create an empty database for the IdM service.

Tip During the creation of the database, make note of the following database connection information, which you will need to configure in the next task:

  • Database server host and port
  • Database name

  • Database login credentials

    Note Use an administrative user account to connect to the IdM database.

ClosedSupported databases

Currently, the supported database types include SQL Server, Oracle, and PostgreSQL. For information about their supported versions, see the Service Manager Support Matrix.

Tip You may want to use the same database type for both Service Manager and IdM. Currently, the supported database types for Service Manager are SQL Server and Oracle.

ClosedCreate a SQL Server or Oracle database

Follow exactly the same instructions for creating a database for Service Manager. See the "Prepare an RDBMS to support Service Manager" section in this document.

ClosedCreate a PostgreSQL database

To create an empty PostgreSQL database, follow these steps:

  1. Install PostgreSQL 9.40 or later by using the default options.

  2. Create a role and password with login privileges.

    You can do this by using the following sql statement: 

    create role <idmdbuser> with login password '<idmdbuser>';

  3. Create an empty database and set the owner to the role created in the previous step. For example, an empty database named IDM-SM.

    You can do this by using the following sql statement:

    create database <idmdb> owner <idmdbuser> template template0 encoding 'UTF8';
ClosedTask 7. Configure database connection in the IdM service

Now, you need to configure database connection according to the IdM database that you created previously. The example database name IDM-SM is used in the following steps.

To do this, follow these steps:

  1. Open the <idm-service>/WEB-INF/spring/applicationContext.properties file with a text editor.

  2. Uncomment your database section, and comment out the other database sections.

    By default, the PostgreSQL database type is used and other database types are commented out.

  3. Configure the database connection.

    SQL Server

    IdM needs a SQL Server JDBC driver to connect to the database. To configure the database connection using a SQL Server JDBC driver, follow these steps:

    1. Download Microsoft JDBC Driver 6.0 for SQL Server (or a higher version) from the Microsoft website.

    2. Extract the downloaded file, and then copy the sqljdbc42.jar file to the <idm-service>\WEB-INF\lib directory.

      Tip If the sqljdbc42.jar file cannot be found, copy a higher version of the sqljdbcxx.jar file.

    3. Set the idm.persistence.hbm2ddl.auto parameter to false.

      idm.persistence.hbm2ddl.auto = false

    4. Update the SQL Server database connection parameters as described in the following table.

      Parameter Description
      idm.persistence.flyway.type

      Set it to sqlserver.
      idm.persistence.dialect

      Change it to sqlserver.db.specific.IdmSQLServer2012Dialect.
      idm.persistence.connection.driver.class

      Change it to com.microsoft.sqlserver.jdbc.SQLServerDriver.
      idm.persistence.connection.url

      Enter a value with this format:

      jdbc:sqlserver://<IdM database server host>:<port>;DatabaseName=<IdM database name>

      For example:

      jdbc:sqlserver://localhost:1433;DatabaseName=IDM-SM

      idm.persistence.connection.username

      idm.persistence.connection.password

      		Enter the login credentials that you specified for the IdM database.

    Oracle

    Perform the following steps:

    1. From the Oracle website, download the Oracle JDBC driver appropriate for your database.
    2. Copy the driver to the <idm service>\WEB-INF\lib folder.

    3. Update the Oracle database connection parameters.

      Parameter Description
      idm.persistence.flyway.type Set it to oracle.
      idm.persistence.dialect Set it to org.hibernate.dialect.Oracle10gDialect.
      idm.persistence.connection.driver.class Set it to oracle.jdbc.OracleDriver.
      idm.persistence.connection.url

      Enter a value with this format:

      jdbc:oracle:thin:@<IdM database server host>:<port>:<IdM database name>

      For example:

      jdbc:oracle:thin:@localhost:1521:IDM-SM

      idm.persistence.connection.username

      idm.persistence.connection.password

      		Enter the login credentials that you specified for the IdM database.
    4. Add a key to the applicationContext.xml file.
      1. Open the <idm service>\WEB-INF\spring\applicationContext.xml file in a text editor.

      2. Add the hibernate.default_schema key to the following property, as shown below:

        <property name="hibernateProperties" >
    <props>
        <prop key="hibernate.jdbc.batch_size">${idm.persistence.jdbc.batch_size}</prop>
        <prop key="hibernate.dialect">${idm.persistence.dialect}</prop>
        <prop key="hibernate.cache.provider_class">${idm.persistence.cache.provider_class}</prop>
        <prop key="hibernate.show_sql">${idm.persistence.show_sql}</prop>
        <prop key="hibernate.hbm2ddl.auto">${idm.persistence.hbm2ddl.auto}</prop>
        <prop key="hibernate.connection.pool_size">${idm.persistence.connection.pool_size}</prop>
        <prop key="hibernate.enable_lazy_load_no_trans">true</prop>
	<prop key="hibernate.default_schema"><db username></prop>
    </props>
</property>

        Where: <db username> should be replaced with the login account user name of the IdM database. For example:

        <prop key="hibernate.default_schema">IDM-SM</prop>

    PostgreSQL

    Update the following PostgreSQL database connection parameters.

    Parameter Description

    idm.persistence.flyway.type

    		Set it to postgresql.
    idm.persistence.dialect Set it to org.hibernate.dialect.PostgreSQL9Dialect.
    idm.persistence.connection.driver.class Set it to org.postgresql.Driver.
    idm.persistence.connection.url

    Specify a value that uses the following format:

    jdbc:postgresql://<PostgreSQL database server host>:<port>/<IdM database name>

    Tip The default port of PostgreSQL is 5432.

    Example value:

    jdbc:postgresql://localhost:5432/IDM-SM

    idm.persistence.connection.username

    idm.persistence.connection.password

    		Enter the login credentials that you created for the PostgreSQL database.
  4. Check the log for errors.
    1. Open the <idm-service>\WEB-INF\classes\log4j.properties file in a text editor.

    2. Locate the following line:

      log4j.rootLogger=INFO, consoleAppender, jettyAppender

    3. Change jettyAppender to tomcatAppender, as shown below:

      log4j.rootLogger=INFO, consoleAppender, tomcatAppender

      Note This will make IdM logging information be written to the following log file defined in the log4j.properties file:

      log4j.appender.tomcatAppender.File=${catalina.home}/logs/hpcloud-idm-service.log

    4. Start the Tomcat instance on which the IdM service is deployed.
    5. Open the hpcloud-idm-service.log file in a text editor to check for errors, and fix them if any.
ClosedTask 8. Download the IdM metadata

After the IdM server is started, the IdM metadata is generated and can be downloaded from the IdM service URL.

To download the IdM metadata, follow these steps:

  1. Open the <idm-service>\WEB-INF\web.xml file in a text editor.

  2. Comment out the following servlet.

    <servlet>
     <servlet-name>default</servlet-name>
     <servlet-class>org.eclipse.jetty.servlet.DefaultServlet</servlet-class>
     <init-param>
        <param-name>dirAllowed</param-name>
        <param-value>false</param-value>
     </init-param>
     <load-on-startup>0</load-on-startup>
</servlet>
  3. Start the IdM service web application server. In this example, start Tomcat.

  4. Open the IdM service URL in a browser:

    https://<IdM host FQDN>:<https port>/idm-service/saml/metadata

    For example: https://myhost.mycompany.net:9443/idm-service/saml/metadata

    If the IdM service deployment is successful, the IdM metadata is displayed correctly, as shown in the following figure.

  5. Download the metadata as metadata.xml from the browser. 

    Note Later, you will need to import the metadata to the IdP when creating a trust relationship with the IdP.

ClosedTask 9. Configure the IdM service for LW-SSO compatibility

Caution If you skip this task, SAML SSO is not compatible with the legacy LW-SSO solution.

Step 1. Specify the IdM tenant for LW-SSO

Once you have specified a tenant in the .json file, you need to specify this tenant in the LW-SSO configuration of IdM.

To specify the tenant for LW-SSO, follow these steps:

  1. Open the <idm-service>\WEB-INF\hpssoConfig.xml file in a text editor.

  2. Search for the following text to locate the LW-SSO section, which is below this text line:

    <lwsso  tenant="Tenant1">

  3. Update the lwsso tag to include the tenant name that you specified in the .json file:

    <lwsso tenant="IDM-SM">
      ...
      <crypto initString="Init string must be replaced for production" cipherType="symmetricBlockCipher" engineName="AES"
                    paddingMode="CBC" keySize="256" encodingMode="Base64Url" algorithmPaddingName="PKCS7Padding" checkIntegrity="disabled"
                    cryptoSource="lw" directKeyEncoded="false" directKeyEncoding="Hex" jcePbeAlgorithmName="PBEWithHmacSHA1"
                    jcePbeMacAlgorithmName="PBEWithHmacSHA1" macAlgorithmName="SHA1" macKeySize="256" macPbeCount="20" macType="hmac"
                    pbeCount="20" pbeDigestAlgorithm="SHA1"/>

       ...
</lwsso>

Step 2. Configure LW-SSO settings

You need to specify the domain and initString settings in the IdM service.

To do this, follow these steps:

  1. Open the <idm-service>\WEB-INF\hpssoConfig.xml file in a text editor.

  2. Check that you have already specified the domain name of the IdM server (for example, the Tomcat server). The domain name must match the DNS domain name of the system on which the IDM service is deployed, because the HP SSO cookies are domain-specific.

    Note All components that participate in SAML except the SM Server (the IdM service, SM web tier, SRC, and Mobility Client) must be in the same domain, because HP SSO cookies are domain-specific.

  3. Change the initString value to match the one specified in other HPE applications that will participate in LW-SSO.

    <lwsso>
       <!-- crypto is required.
         It defines how to encrypt the tokens and how to decrypt them
	     All inline attributes have default values (denoted here) save initString.
		 initString - is the key for decryption of the lwsso token. This is the shared secret of all servers
		 protected by lwsso and connected to the same authentication point server; therefore, it
		 must be identical in all configurations of all servers in the system.
                (all other values are defaults)
		    -->
            <crypto initString="Init string must be replaced for production" cipherType="symmetricBlockCipher" engineName="AES"
                    paddingMode="CBC" keySize="256" encodingMode="Base64Url" algorithmPaddingName="PKCS7Padding" checkIntegrity="disabled"
                    cryptoSource="lw" directKeyEncoded="false" directKeyEncoding="Hex" jcePbeAlgorithmName="PBEWithHmacSHA1"
                    jcePbeMacAlgorithmName="PBEWithHmacSHA1" macAlgorithmName="SHA1" macKeySize="256" macPbeCount="20" macType="hmac"
                    pbeCount="20" pbeDigestAlgorithm="SHA1"/>

            <!-- Optional tag. however, if configured, then it must be configured on all entities in the system.-->
            <!--
            <sign lookForKeyStoreInClasspath="false" algorithmName="SHA256withRSA" keyStorePassword="topazPwd"
                  privateKeyPassword="mercuryPwd" keyStorePath="C:\MSM" privateKeyDefaultAliasName="lwsso"
                  certificateDefaultAliasName="lwsso" keyStoreName="lwsso" keyStoreType="JKS"
                  providerName="Default Provider Name" />
            -->
 </lwsso>
ClosedTask 10. Specify an IdM token signing key

You need to specify a key for signing IdM tokens.

  1. Open the \WEB-INF\spring\applicationContext.properties file in a text editor.

  2. Specify a key in the idm.encryptedSigningKey parameter.

    For example, specify the following key:

    idm.encryptedSigningKey=awscd456!

Note There is no restriction on the length and characters of this key. When the IdM service deployment is complete, you will need to specify the same key on the Service Manager side. For details, search for SAML Single Sign-On setup in the Service Manager Help Center.

Closed(Optional) Task 11. Specify an IdM user account for Service Manager

Each IdM client (the SM Web Tier, SRC, or Mobility Client) needs an IdM user account to access the IdM service.

By default, the IdM service has a user account defined: idmTransportUser (user name) and idmTransportUser (password). You can skip this task and simply specify this default user account in the SM Web Tier, SRC, and Mobility Client. For details, see the SAML Single Sign-On setup section in the Service Manager Help Center.

You cannot change the user name. However, you can change the password as you like. To change the IdM user account password, follow these steps:

  1. Open the <idm-service>WEB-INF\classes\integrationusers.properties file in a text editor.

  2. Locate the line with an encrypted string:

    idmTransportUser=ENC(xxxx)

    Where: xxxx represents an encrypted string.

  3. Change this line to the following:

    idmTransportUser=idmTransportUser,ROLE_ADMIN,PERM_IMPERSONATE,enabled

    Where:

    • "idmTransportUser" on the left side of the equals sign (=) is the user name, which must not be changed.
    • On the right side of the equals sign (=), "idmTransportUser" is the default password and the rest of the string are other properties of the user account.

  4. Change the default password to your own value. For example, change it to "1Qaz2wsx3edc":

    idmTransportUser=1Qaz2wsx3edc,ROLE_ADMIN,PERM_IMPERSONATE,enabled

    Note In a later task, you will run the IdM encryption tool to encrypt all IdM passwords and keys, including the entire IdM user account property string. You will need to copy the encrypted string back to this file. For more information, see the "Encrypt IdM passwords and keys" task.

  5. Save the file.

Note You will also need to specify the same user account on the Service Manager side. For details, search for the SAML Single Sign-On setup in the Service Manager Help Center.

ClosedTask 12. Replace JRE policy files for the IdM server

By default, Microsoft ADFS uses the SHA-256 secure hash algorithm, which requires you to replace the default JRE policy files used by the IdM web application server.

To do this, follow these steps:

  1. Download the unlimited strength JCE policy files for your JRE:

    • local_policy.jar

    • US_export_policy.jar

    For example, for Tomcat 8.0, visit the Oracle website to download the unlimited strength JCE policy files:

    http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html (for JRE 8)

    http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html (for JRE 7)

  2. On the IdM web application server host, browse to the <JRE>\lib\security folder.
  3. Replace the policy files with the unlimited strength JCE policy files that you have downloaded.
ClosedTask 13. Create a trust relationship with ADFS

Currently, the only supported identity provider is Microsoft Active Directory Federation Service (ADFS) 2.0 or 3.0. ADFS helps you use single sign-on (SSO) to authenticate users to multiple, related web applications over the life of a single online session.

Once ADFS is installed and configured to authenticate users from an LDAP directory, you are ready to add the IdM metadata to ADFS to add the IdM service as a trusted relying party.

Note The screenshots in this section are from ADFS 3.0, and may slightly differ from those in ADFS 2.0.

To add the IdM service as a trusted relying party to ADFS, follow these steps:

  1. In the ADFS 3.0 Management Console, right-click Trust Relationships and then select Add Relying Party Trust.

  2. Select Import data about the relying party from a file, and then select the IdM metadata file (metadata.xml) that you created previously. Click Next.

  3. The wizard may display a warning, indicating that some content of the metadata is not supported. You can safely ignore this warning.

    Click OK to ignore the warning.

  4. Specify a display name for the IdM service, and add optional notes. Click Next.

  5. Make sure the I do not want to configure multi-factor authentication setting for this relying party trust at this time option is selected, and then click Next.

  6. Select the Permit all users to access this replying party issuance authorization rule.

  7. You are now in the Ready to Add Trust step. Check that the Endpoints tab contains multiple endpoint values. If not, verify that your metadata was generated with https protocol URLs.

  8. Leave the Open the Edit Claim Rules dialog checkbox selected, and click Close to close the wizard.

  9. The Add Transform Claim Rule wizard opens. Perform the steps below to configure the NameID element as part of the Subject in the SAML Response message.

    1. Select Add Rule, and then select Send LDAP Attributes as Claims. Click Next.

    2. Specify the following fields to configure the claim rule:

      • Claim rule name: enter NameID
      • Attribute store: select Active Directory
      • LDAP Attribute: select SAM-Account-Name
      • Outgoing claim type: select Name ID

    3. Close the wizard and the Apply the claim rules window.

      Note In ADFS 3.0, you may need to configure the Name ID as a PassThrough claim.

ClosedTask 14. Import the IdP public key into the IdM SAML keystore

In this task, you will export the public key from the ADFS certificate and then import the key into the SAML keystore file of IdM. This task is required for IdM to decrypt SAML responses from ADFS.

Step 1. Export the public key portion of the ADFS federation service certificate

  1. From your operating system, start Active Directory Federation Services.
  2. Right-click Federation Service, and then click Properties.
  3. On the General tab, under Communicating certificate, click View.
  4. In the Certificate dialog box, select the Details tab.
  5. On the Details tab, click Copy to File.
  6. Click Next.
  7. On the Export Private Key page, make sure that No, do not export the private key is selected, and then click Next.
  8. On the Export File Format page, select DER encoded binary X.509 (.CER), and then click Next.

  9. On the File to Export page, specify the certificate file in File name, and then click Next.

    Note In this example, we use Per_ADFS.cer as the file name.

  10. Click Finish.

  11. Validate success by checking to see that the file you specified was created at the specified location.

Step 2. Import the ADFS public key into the IdM keystore

The IdM SAML keystore file is: <idm-service>\WEB-INF\classes\security\samlKeystore.jks.

To do this, run the following command:

keytool -importcert -alias some-alias -file Per_ADFS.cer -keystore samlKeystore.jks

Note When prompted for the password of samlKeystore.jks, enter nalle123.

If you want to use your own keystore file instead of the out-of-box one, you need to do the following:

  1. Replace the out-of-box keystore file with your own one.

  2. If your keystore file uses a different name, specify your file in the <idm-service>\WEB-INF\spring\applicationContext.properties file:

    idm.saml.keystore=classpath:security/samlKeystore.jks

    Replace samlKeystore.jks with your own file name.

  3. Specify the following parameters accordingly in the <idm-service>\WEB-INF\spring\applicationContext.properties file:

    • idm.saml.keystore.password=ENC(xxx)
    • idm.saml.keystore.defaultKey.name=ENC(xxx)
    • idm.saml.keystore.defaultKey.password=ENC(xxx)

    Note Replace the ENC(xxx) parts with your own values.

ClosedTask 15. Adjust the max authentication age setting in the IdM service

The IdP (Microsoft ADFS) uses a parameter named Web SSO lifetime to determine whether a user login request is sent within a valid time period of the user's last login. If yes, the user is automatically logged in without the need to enter a user name and password. Similarly, the IdM service uses a parameter named maxAuthenticationAge for the same purpose.

To enable SAML SSO for Service Manager, the maxAuthenticationAge value defined in the IdM service must be no less than the Web SSO lifetime value defined in the IdP. By default, the IdM service setting is 7200 seconds (2 hours), and the ADFS setting is 480 minutes (8 hours). Since this IdP setting is usually a global setting for your organization, you may want to change the IdM setting according to your IdP setting. To do this, perform the following steps.

Step 1. Check the web SSO lifetime value in the IdP

  1. Open Microsoft ADFS.

  2. Click Service and then select Edit Federation Service Properties.

  3. On the General tab, check the Web SSO lifetime value.

    Note The default value is 480 minutes (8 hours).

Step 2. Adjust the web SSO lifetime setting in the IdM service

To check the value in the IdM service, follow these steps:

  1. Open the <idm-service>\WEB-INF\spring\applicationContext-saml.xml file in a text editor.

  2. Search for the following line:

    <bean id="webSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerImpl"/>

  3. Change this line to the following: 

    <bean id="webSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerImpl">
    <property name="maxAuthenticationAge" value="xxxx"/>
</bean>

    Where: xxxx represents a value (in seconds) that is no less than your ADFS Web SSO lifetime. For example, if your ADFS setting is 120 (minutes), XXXX should 7200 or greater.

Closed(Optional) Task 16. Encrypt IdM passwords and keys

In this task, you will run the IdM encryption tool to encrypt all IdM passwords and keys. This task is optional but highly recommended for the best security in production environments.

To do this, follow these steps:

  1. Update the second column of the following table with the passwords and keys that you have configured for IdM.

    Location Password/Key Description
    <idm-service>\WEB-INF\classes\integrationusers.properties

    idmTransportUser=xxxxxx

    This is the IdM password that Service Manager uses to access the IdM service.

    • XXXXXX is a string that defines the password and other properties of the IdM user account. For example:

      idmTransportUser=1Qaz2wsx3edc,ROLE_ADMIN,PERM_IMPERSONATE,enabled

    • You must encrypt the entire string on the right side of the equals sign.
    <idm-service>\WEB-INF\spring\applicationContext.properties

    idm.encryptedSigningKey=xxxxxx

    This is the signing key used to sign IdM tokens.
    <idm-service>\WEB-INF\spring\applicationContext.properties

    idm.persistence.connection.password = xxxxxx

    This is the password of the IdM database connection account.

    <idm-service>\WEB-INF\spring\applicationContext.properties

    idm.saml.keystore.password=xxxxxx

    idm.saml.keystore.defaultKey.name=xxxxxx

    idm.saml.keystore.defaultKey.password=xxxxxx

    This is the password, default key name and passwords of the IdM SAML keystore file: <idm-service>\WEB-INF\classes\security\samlKeystore.jks.

    If you use the out-of-box keystore file, these parameter values are already encrypted and you must not change them.

  2. Change to the <idm-service>/web-inf/lib directory.

  3. For each parameter value in the previous table, run the following command:

    java -cp "cryptoUtil-1.0.3.jar;jasypt-1.9.1.jar;commons-codec-1.7.jar;slf4j-log4j12-1.7.5.jar;slf4j-api-1.7.5.jar;log4j-1.2.17.jar" com.hp.ccue.crypto.util.App encrypt xxxxxx

    Where: xxxxxx represents the value that you want to encrypt.

    When the encryption is complete, the original value and encrypted value are returned. The following is an example:

    original:1Qazwsx3edc
encrypted:0bEhLG0zDOdYBLf013p3Qfn66kNTMYvh

  4. Copy the encrypted value back to the IdM configuration file to overwrite the original parameter value by using the following format:

    Parameter=ENC(encrypted value)

    Here are examples:

    idmTransportUser=ENC(0bEhLG0zDOdYBLf013p3Qfn66kNTMYvh)

    idm.encryptedSigningKey=ENC(0bEhLG0zDOdYBLf013p3Qfn66kNTMYvh)

Next steps

Next, you need to configure SAML authentication in the Service Manager Server, Web Tier, SRC, and Mobility Client and verify that your SAML SSO setup is successful. For details, see the SAML Single Sign-On setup.

Send Help Center feedback