Install and configure the standalone IdM service

You can deploy the IdM service on Tomcat 7.x or 8.x.

To do this, follow these steps:

1. Install JDK 1.8 or later .

2. Install Tomcat 8.x.

   Caution The Tomcat installation path must not contain any white spaces.

3. If using Tomcat 8.5 or later, perform the following steps:

   1. Open the <Tomcat>/conf/context.xml file in a text editor.

   2. Insert the following line inside the <Context> tag pair:

      <CookieProcessor className="org.apache.tomcat.util.http.LegacyCookieProcessor"/>

   3. Save the file.
4. Deploy the IdM service.
   1. Copy the idm-service WAR file from the installation package to the <Tomcat>/webapps folder.
   2. Deploy the WAR file.

The IdM service requires the use of SSL connections. Once you have completed the deployment of the IdM web application server (Tomcat), you need to configure SSL for it.

To configure SSL for Tomcat, follow these steps:

1. Run the following keytool command to create a keystore file:

   ​keytool -genkey -alias tomcat -keyalg RSA -keystore tomcat.keystore

   Follow the screen prompts to enter required information.

   Note When asked for your first and last names, enter the fully qualified domain name (FQDN) of the Tomcat server. For example: myhost.mycompany.net.

   The following is an example.

   ​C:\Tomcat\tomcat_9443>keytool -genkey -alias tomcat -keyalg RSA -keystore tomcat.keystore
   Enter keystore password:
   
   Re-enter new password:
   
   What is your first and last name?
   
     [Unknown]:  myhost.mycompany.net  
   What is the name of your organizational unit?
   
   [Unknown]:  software
   
   What is the name of your organization?
   
    [Unknown]:  hpe
   
   What is the name of your City or Locality?
   
     [Unknown]:  shanghai
   
   What is the name of your State or Province?
   
     [Unknown]:  shanghai
   
   What is the two-letter country code for this unit?
   
     [Unknown]:  CN
   
   Is CN=myhost.mycompany.net, OU=software, O=hpe, L=shanghai, ST=shanghai, C=CN correct?
   
     [no]:  yes
   
   Enter key password for <tomcat>
   
           (RETURN if same as keystore password):
   
   Re-enter new password:

2. Run the following command to export a certificate from the keystore:

   ​keytool -keystore tomcat.keystore -export -alias tomcat -file tomcat.cer

3. Run the following command to import the certificate into JDK:

   ​keytool -import -alias idm -file tomcat.cer -keystore  cacerts

   Follow the screen prompts to enter required information. The following is an example.

   Note The default keystore password is changeit.

   C:\Program Files\Java\jdk1.8.0_91\jre\lib\security>keytool -import -alias idm -file tomcat.cer -keystore  cacerts
   
   Enter keystore password:
   
   Owner: CN=myhost.mycompany.net, OU=software, O=hpe, L=shanghai, ST=shanghai, C=CN
   
   Issuer: CN=myhost.mycompany.net, OU=software, O=hpe, L=shanghai, ST=shanghai, C=CN
   
   Serial number: 5acc6d54
   
   Valid from: Fri Jun 03 10:00:26 CST 2016 until: Thu Sep 01 10:00:26 CST 2016
   
   Certificate fingerprints:
   
            MD5:  52:9F:9E:57:63:11:26:DB:0A:D4:99:0D:44:1B:A8:65
   
            SHA1: 47:8E:26:C2:CA:0E:C2:B0:3C:D8:54:4F:70:93:44:F5:D6:6E:D6:1D
   
            SHA256: 5C:B0:98:10:7D:13:BE:D2:24:2C:C0:EF:F0:C5:F1:7F:87:6C:E7:0B:FA:22:4C:94:DE:46:EF:6C:0E:55:61:9B
   
            Signature algorithm name: SHA256withRSA
   
            Version: 3
   
   Extensions:
   
   #1: ObjectId: 2.5.29.14 Criticality=false
   
   SubjectKeyIdentifier [
   
   KeyIdentifier [
   
   0000: 9D DB 0D 2A 12 B9 41 6B   3D C7 66 86 3B 63 9E 98  ...*..Ak=.f.;c..
   
   0010: 02 D7 38 CE                                        ..8.
   
   ]
   
   ]
   
   Trust this certificate? [no]:  yes
   
   Certificate was added to keystore

4. Configure the https port and keystore in the server.xml file in the <Tomcat>/conf folder:

   <Connector port="9443" protocol="org.apache.coyote.http11.Http11NioProtocol"
   
      maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
   
          clientAuth="false" sslProtocol="TLS" keystoreFile="/conf/tomcat.keystore" keystorePass="!qaz2wsx3edc"
   
            truststoreFile="/conf/tomcat.keystore" storePass="!qaz2wsx3edc" />

   Caution Be sure to enter the correct path of the tomcat.keytore file.

Each IdM client can connect to the IdM server over https or http. If you want to use https, you need to specify whether and how the IdM client should verify the IdM server certificate. The SAML SSO solution provides two options:

• Trust all https servers

  If this option is used, the IdM client will skip https server verification and trust all https servers, including the IdM server. This option simplifies the SAML SSO setup procedure but does not provide the best security. It is therefore not recommended for production environments. You can use this option for testing and demonstration purposes.

  To use this option, on the SM web tier, SRC, or Mobility Client side, set the idm.ssl.trustAll paramter to true (default: false).

• Trust only servers whose public key is contained in the client trust store

  Important This option provides the best security and is therefore strongly recommended for production environments.

  When the IdM client connects to the IdM server over https, this option requires you to configure the IdM client so that it trusts the IdM server only when the server's public key is contained in the client's trust keystore. If the IdM server is deployed as https, you need to create a trust keystore locally for the IdM client and import the IdM server's public key into the trust keystore.

Perform this task only if you want to use the second option.

1. Create an IdM client trust store.

   1. Generate a trustStore.keystore file, by running the following command:

      keytool -genkey -alias tomcat1 -keyalg RSA -keysize 1024 -keypass tomcat1 -validity 365 -keystore trustStore.keystore -storepass tomcat1

   2. Import the IdM public key to the trustStore.keystore file, by running the command below:

      keytool -import -alias tomcat -file tomcat.cer -keystore trustStore.keystore -storepass tomcat1

   Note Now, the trust store file is generated. The file name is trustStore.keystore, and its password is tomcat1.

2. Copy the trust store file to the IdM client (the Web Tier, SRC, and Mobility Client).

Later, on the Service Manager side (including the Web Tier, SRC, and Mobility Client), set the idm.ssl.trustAll parameter to false (default) and specify the trust store file and password for the IdM client. For details, see Configure SAML SSO in Service Manager (using standalone IdM).

To do this, follow these steps:

1. Update the IdM service configuration base for SP-initiated web SSO.

   Step 1. Configure SP-Initiated SSO: Redirect/POST Binding

   1. In the <idm-service>/WEB-INF/web.xml file, uncomment the following line: 

      /WEB-INF/spring/applicationContext-saml.xml
      

      Note The applicationContext-saml.xml file includes Spring beans for SAML.

   2. In the <idm-service>/WEB-INF/spring/applicationContext-security.xml file, enable SAML Web SSO with HP SSO.

      By default, the SAML Web SSO with HP SSO section is commented out. Remove the comment tags highlighted below to enable the feature.

      <!-- START SAML Web SSO with HP SSO -->
          <!--
             ...
      	...
      	...
          -->
      <!-- END SAML Web SSO with HP SSO -->

      Note SAML Web SSO without HP SSO authenticates the user and provides user access to protected resources in one application; SAML Web SSO with HP SSO writes the HPE SSO cookie after the user is authenticated, and therefore provides single sign-on to other applications. HP SSO provides single sign-on capability across HPE software products. To be compatible with LW-SSO, you must enable SAML Web SSO with HP SSO. This means when SAML is enabled in SM and LW-SSO is enabled in another application, users can access SM without login, and vise versa.

   3. Update the <idm-service>/WEB-INF/spring/applicationContext-security.xml file.

      1. Open the file with a text editor.
      2. Search for "START HP SSO Configuration". This section is commented out by default.

      3. Uncomment this section, except the normal HPSSO login and logout filters, as shown below.

         <!-- START HP SSO Configuration -->
             <!--
             <security:http pattern="/idm/v0/login" use-expressions="true" auto-config="false">
                 <security:csrf disabled="true" />
                 <security:custom-filter ref="requestTokenCompositeFilter" position="FIRST" />
                 <security:custom-filter ref="hpssoProvidedFilter" before="PRE_AUTH_FILTER" />
                 <security:custom-filter ref="hpssoIntegrationFilter" after="PRE_AUTH_FILTER" />
                 <security:custom-filter ref="noPromptFilter" before="FORM_LOGIN_FILTER" />
                 <security:http-basic />
             </security:http>
         
             <security:http pattern="/idm/v0/logout" use-expressions="true" auto-config="false">
                 <security:csrf disabled="true" />
                 <security:custom-filter ref="requestTokenCompositeFilter" position="FIRST" />
                 <security:custom-filter ref="hpssoProvidedFilter" before="PRE_AUTH_FILTER" />
                 <security:custom-filter ref="hpssoIntegrationFilter" after="PRE_AUTH_FILTER" />
                 <security:http-basic />
             </security:http>
         	-->
         	...
         	...
         	...
         	</bean>
         <!-- END HP SSO Configuration -->

   4. Configure HP SSO.

      1. Open the <idm-service>/WEB-INF/web.xml file with a text editor.
      2. Search for "START HP SSO Configuration". This section is commented out by default.
      3. Uncomment this section by removing the comment tags.

      4. Specify the location of the HP SSO configuration file as "/WEB-INF/hpssoConfig.xml".

         <!-- START HP SSO Configuration -->
             <listener>
                 <listener-class>com.hp.ccue.identity.hpssoImpl.HpSsoContextListener</listener-class>
             </listener>
         
             <context-param>
                 <param-name>com.hp.sw.bto.ast.security.lwsso.conf.fileLocation</param-name>
                 <param-value>/WEB-INF/hpssoConfig.xml</param-value>
             </context-param>
         <!-- END HP SSO Configuration -->

      5. In the <idm-service>\WEB-INF\spring\applicationContext-v0.xml file, make sure that the tokenWriter property setting in the HP SSO Configuration section is not commented out, as shown below.

         <!--Authentication API -->
             <bean id="authenticationApiController" class="com.hp.ccue.identity.web.api.AuthenticationController">
                 <property name="tokenService" ref="tokenService"/>
                 <property name="identityService" ref="identityService"/>
                 <property name="sessionStateService" ref="sessionStateService"/>
                 <!-- START HP SSO Configuration -->
                         <property name="tokenWriter" ref="hpssoTokenWriter" />
                 <!-- END HP SSO Configuration -->
             </bean>

      6. Edit the <idm-service>\WEB-INF\hpssoConfig.xml file as described below.

         • Specify the domain name of the IdM server (for example, the Tomcat server). The domain name must match the DNS domain name of the system on which the IDM service is deployed, because the HP SSO cookies are domain-specific.

           Note All components that participate in SAML except the SM Server (the IdM service, SM web tier, SRC, and Mobility Client) must be in the same domain, because HP SSO cookies are domain-specific.

         • Change secureHTTPCookie (default: false) to true if SSL is enabled between the user's browser and the web application server of the SM web tier, SRC, or Mobility Client.

         See the following for an example.

         <creation tokenGlobalTimeout="480" tokenIdleTimeout="30" secureHTTPCookie="true">
                 <!-- lwsso is required -->
                 <lwsso>
                     <!-- domain is required
                         HPSSO 1.0 version supports a single domain only.
                         All servers using HPSSO should have the same domain and it should be denoted in this tag
                     -->
                     <creationDomains>
                         <!-- for development environments only! -->
                         <domain>mycompany.net</domain>
                     </creationDomains>
                 </lwsso>
          </creation>

   Step 2. Configure SP-Initiated SSO: POST/Artifact Bindings

   For POST/Artifact Bindings, in addition to the configuration in the previous step, you need to make sure that the applicationContext-saml.xml file contains the following property setting (default).

   Note This file is located in the following folder: <idm-service>/WEB-INF/spring.

   <property name="bindingsSSO">
           <list>
               <value>post</value>
               <value>artifact</value>
               <value>paos</value>
           </list>
   </property>

   Step 3. Disable ECP

   ADFS does not support ECP; however, the IdM metadata includes the AssertionConsumerService for ECP. Therefore, this step is required.

   To disable ECP, follow these steps:

   1. Open the <idm-service>WEB-INF\spring\applicationContext-saml.xml file with a text editor.

   2. Search for the following line, and comment it out.

      <value>paos</value>

   3. Search for the following line, and comment it out.

      <property name="ecpEnabled" value="true"/>

A tenant is a data space in IdM. IdM user authentication is based on a tenant. For Service Manager users, a tenant must be specified in a .json file. 4

The federation metadata URL of the identity provider (that is, ADFS) is required for you to add the IdM service as a replying party trust later.

To configure a tenant and specify the ADFS metadata URL, follow these steps:

1. Locate the <idm-service>\WEB-INF\classes\seeded\samples\com.hpe.tenant1__1.3.2.1__Add_Update_Saml_Configuration.json.template file.

2. Copy the file to the seeded directory (<idm-service>\WEB-INF\classes\seeded\) and then remove the .template extension from the file name.

3. Open the com.hpe.tenant1__1.3.2.1__Add_Update_Saml_Configuration.json file in a text editor.

   Note The file has already a sample tenant named IdmDemoOrg1 defined. You may want to update it to your own tenant name.

4. Update this file so that its content resembles the following example (in this example, a tenant name of IDM-SM is specified):

   [
       {
           "operation":"ADD_OR_UPDATE",
           "type":"organization",
           "attributes":{
               "name":"IDM-SM",
               "displayName":"IDM-SM"
           }
   },
   
       {
           "operation":"ADD",
           "type":"samlConfiguration",
           "names":{
               "organizationName":"IDM-SM"
           },
           "attributes":{
               "name":"IdmSamlConfiguration1",
               "displayName":"IdmSamlConfiguration1",
               "entityUrl":"https://localhost/2007-06/federationmetadata.xml"
              
           }
       } 
   ]
   

   • Specify the same organization name for both the name attribute in the ADD_OR_UPDATE operation and the organizationName attribute in the ADD operation.
   • For the ADD_OR_UPDATE operation, the name and displayName attributes are mandatory.
   • For the Add operation, the organizationName, name, and displayName attributes are mandatory. The name attribute serves as the unique key for your SAML configuration.

   • The federation metadata URL of ADFS uses this format: https://<ADFS host>/federationmetadata/2007-06/federationmetadata.xml

   Note that when the IdM service is started, the content of the .json file is loaded into IdM. Once the tenant is already created, you cannot update the organization name (the name and organizationName attributes), unless you want to create a new tenant. However, you can update the entityUrl attribute of the existing tenant. Make sure the content of the updated .json file resembles the following example:

   [
       {
           "operation":"ADD_OR_UPDATE",
           "type":"organization",
           "attributes":{
               "name":"IDM-SM"
           }
   },
       {
           "operation":"UPDATE",
           "type":"samlConfiguration",
           "names":{
               "organizationName":"IDM-SM",
               "samlConfigurationName":"IdmSamlConfiguration2"
           }, 
           "attributes":{
               "displayName":"IdmDemoSamlConfiguration2",
               "entityUrl":"https://mynewhost/2007-06/federationmetadata.xml"
           }
       }    
   ]
   

Next, you need to create a database and configure the database connection for the IdM service.

You need to create an empty database for the IdM service.

Supported databases

Currently, the supported database types include SQL Server, Oracle, and PostgreSQL. For information about their supported versions, see the Service Manager Support Matrix.

Tip You may want to use the same database type for both Service Manager and IdM. Currently, the supported database types for Service Manager are SQL Server and Oracle.

Create a SQL Server or Oracle database

Follow exactly the same instructions for creating a database for Service Manager. See the "Prepare an RDBMS to support Service Manager" section in this document.

Create a PostgreSQL database

To create an empty PostgreSQL database, follow these steps:

1. Install PostgreSQL 9.40 or later by using the default options.

2. Create a role and password with login privileges.

   You can do this by using the following sql statement:

   create role <idmdbuser> with login password '<idmdbuser>';

3. Create an empty database and set the owner to the role created in the previous step. For example, an empty database named IDM-SM.

   You can do this by using the following sql statement:

   create database <idmdb> owner <idmdbuser> template template0 encoding 'UTF8';

Now, you need to configure database connection according to the IdM database that you created previously. The example database name IDM-SM is used in the following steps.

To do this, follow these steps:

1. Open the <idm-service>/WEB-INF/spring/applicationContext.properties file with a text editor.

2. Uncomment your database section, and comment out the other database sections.

   By default, the PostgreSQL database type is used and other database types are commented out.

3. Configure the database connection.

   SQL Server

   IdM needs a SQL Server JDBC driver to connect to the database. To configure the database connection using a SQL Server JDBC driver, follow these steps:

   1. Download Microsoft JDBC Driver 6.0 for SQL Server (or a higher version) from the Microsoft website.

   2. Extract the downloaded file, and then copy the sqljdbc42.jar file to the <idm-service>\WEB-INF\lib directory.

      Tip If the sqljdbc42.jar file cannot be found, copy a higher version of the sqljdbcxx.jar file.

   3. Set the idm.persistence.hbm2ddl.auto parameter to false.

      idm.persistence.hbm2ddl.auto = false

   4. Update the SQL Server database connection parameters as described in the following table.

      Parameter	Description
      idm.persistence.flyway.type	Set it to sqlserver.
      idm.persistence.dialect	Change it to sqlserver.db.specific.IdmSQLServer2012Dialect.
      idm.persistence.connection.driver.class	Change it to com.microsoft.sqlserver.jdbc.SQLServerDriver.
      idm.persistence.connection.url	Enter a value with this format: jdbc:sqlserver://<IdM database server host>:<port>;DatabaseName=<IdM database name> For example: jdbc:sqlserver://localhost:1433;DatabaseName=IDM-SM
      idm.persistence.connection.username idm.persistence.connection.password	Enter the login credentials that you specified for the IdM database.

   Oracle

   Perform the following steps:

   1. From the Oracle website, download the Oracle JDBC driver appropriate for your database.
   2. Copy the driver to the <idm service>\WEB-INF\lib folder.

   3. Update the Oracle database connection parameters.

      Parameter	Description
      idm.persistence.flyway.type	Set it to oracle.
      idm.persistence.dialect	Set it to org.hibernate.dialect.Oracle10gDialect.
      idm.persistence.connection.driver.class	Set it to oracle.jdbc.OracleDriver.
      idm.persistence.connection.url	Enter a value with this format: jdbc:oracle:thin:@<IdM database server host>:<port>:<IdM database name> For example: jdbc:oracle:thin:@localhost:1521:IDM-SM
      idm.persistence.connection.username idm.persistence.connection.password	Enter the login credentials that you specified for the IdM database.

   4. Add a key to the applicationContext.xml file.
      1. Open the <idm service>\WEB-INF\spring\applicationContext.xml file in a text editor.

      2. Add the hibernate.default_schema key to the following property, as shown below:

         <property name="hibernateProperties" >
             <props>
                 <prop key="hibernate.jdbc.batch_size">${idm.persistence.jdbc.batch_size}</prop>
                 <prop key="hibernate.dialect">${idm.persistence.dialect}</prop>
                 <prop key="hibernate.cache.provider_class">${idm.persistence.cache.provider_class}</prop>
                 <prop key="hibernate.show_sql">${idm.persistence.show_sql}</prop>
                 <prop key="hibernate.hbm2ddl.auto">${idm.persistence.hbm2ddl.auto}</prop>
                 <prop key="hibernate.connection.pool_size">${idm.persistence.connection.pool_size}</prop>
                 <prop key="hibernate.enable_lazy_load_no_trans">true</prop>
         	<prop key="hibernate.default_schema"><db username></prop>
             </props>
         </property>

         Where: <db username> should be replaced with the login account user name of the IdM database. For example:

         <prop key="hibernate.default_schema">IDM-SM</prop>

   PostgreSQL

   Update the following PostgreSQL database connection parameters.

   Parameter	Description
   idm.persistence.flyway.type	Set it to postgresql.
   idm.persistence.dialect	Set it to org.hibernate.dialect.PostgreSQL9Dialect.
   idm.persistence.connection.driver.class	Set it to org.postgresql.Driver.
   idm.persistence.connection.url	Specify a value that uses the following format: jdbc:postgresql://<PostgreSQL database server host>:<port>/<IdM database name> Tip The default port of PostgreSQL is 5432. Example value: jdbc:postgresql://localhost:5432/IDM-SM
   idm.persistence.connection.username idm.persistence.connection.password	Enter the login credentials that you created for the PostgreSQL database.

4. Check the log for errors.
   1. Open the <idm-service>\WEB-INF\classes\log4j.properties file in a text editor.

   2. Locate the following line:

      log4j.rootLogger=INFO, consoleAppender, jettyAppender

   3. Change jettyAppender to tomcatAppender, as shown below:

      log4j.rootLogger=INFO, consoleAppender, tomcatAppender

      Note This will make IdM logging information be written to the following log file defined in the log4j.properties file:

      log4j.appender.tomcatAppender.File=${catalina.home}/logs/hpcloud-idm-service.log

   4. Start the Tomcat instance on which the IdM service is deployed.
   5. Open the hpcloud-idm-service.log file in a text editor to check for errors, and fix them if any.

After the IdM server is started, the IdM metadata is generated and can be downloaded from the IdM service URL.

To download the IdM metadata, follow these steps:

1. Open the <idm-service>\WEB-INF\web.xml file in a text editor.

2. Comment out the following servlet.

   <servlet>
        <servlet-name>default</servlet-name>
        <servlet-class>org.eclipse.jetty.servlet.DefaultServlet</servlet-class>
        <init-param>
           <param-name>dirAllowed</param-name>
           <param-value>false</param-value>
        </init-param>
        <load-on-startup>0</load-on-startup>
   </servlet>

3. Start the IdM service web application server. In this example, start Tomcat.

4. Open the IdM service URL in a browser:

   https://<IdM host FQDN>:<https port>/idm-service/saml/metadata

   For example: https://myhost.mycompany.net:9443/idm-service/saml/metadata

   If the IdM service deployment is successful, the IdM metadata is displayed correctly, as shown in the following figure.

   

5. Download the metadata as metadata.xml from the browser. 

   Note Later, you will need to import the metadata to the IdP when creating a trust relationship with the IdP.

Step 1. Specify the IdM tenant for LW-SSO

Once you have specified a tenant in the .json file, you need to specify this tenant in the LW-SSO configuration of IdM.

To specify the tenant for LW-SSO, follow these steps:

1. Open the <idm-service>\WEB-INF\hpssoConfig.xml file in a text editor.

2. Search for the following text to locate the LW-SSO section, which is below this text line:

   <lwsso  tenant="Tenant1">

3. Update the lwsso tag to include the tenant name that you specified in the .json file:

   <lwsso tenant="IDM-SM">
         ...
         <crypto initString="Init string must be replaced for production" cipherType="symmetricBlockCipher" engineName="AES"
                       paddingMode="CBC" keySize="256" encodingMode="Base64Url" algorithmPaddingName="PKCS7Padding" checkIntegrity="disabled"
                       cryptoSource="lw" directKeyEncoded="false" directKeyEncoding="Hex" jcePbeAlgorithmName="PBEWithHmacSHA1"
                       jcePbeMacAlgorithmName="PBEWithHmacSHA1" macAlgorithmName="SHA1" macKeySize="256" macPbeCount="20" macType="hmac"
                       pbeCount="20" pbeDigestAlgorithm="SHA1"/>
   
          ...
   </lwsso>

Step 2. Configure LW-SSO settings

You need to specify the domain and initString settings in the IdM service.

To do this, follow these steps:

1. Open the <idm-service>\WEB-INF\hpssoConfig.xml file in a text editor.

2. Check that you have already specified the domain name of the IdM server (for example, the Tomcat server). The domain name must match the DNS domain name of the system on which the IDM service is deployed, because the HP SSO cookies are domain-specific.

   Note All components that participate in SAML except the SM Server (the IdM service, SM web tier, SRC, and Mobility Client) must be in the same domain, because HP SSO cookies are domain-specific.

3. Change the initString value to match the one specified in other HPE applications that will participate in LW-SSO.

   <lwsso>
          <!-- crypto is required.
            It defines how to encrypt the tokens and how to decrypt them
   	     All inline attributes have default values (denoted here) save initString.
   		 initString - is the key for decryption of the lwsso token. This is the shared secret of all servers
   		 protected by lwsso and connected to the same authentication point server; therefore, it
   		 must be identical in all configurations of all servers in the system.
                   (all other values are defaults)
   		    -->
               <crypto initString="Init string must be replaced for production" cipherType="symmetricBlockCipher" engineName="AES"
                       paddingMode="CBC" keySize="256" encodingMode="Base64Url" algorithmPaddingName="PKCS7Padding" checkIntegrity="disabled"
                       cryptoSource="lw" directKeyEncoded="false" directKeyEncoding="Hex" jcePbeAlgorithmName="PBEWithHmacSHA1"
                       jcePbeMacAlgorithmName="PBEWithHmacSHA1" macAlgorithmName="SHA1" macKeySize="256" macPbeCount="20" macType="hmac"
                       pbeCount="20" pbeDigestAlgorithm="SHA1"/>
   
               <!-- Optional tag. however, if configured, then it must be configured on all entities in the system.-->
               <!--
               <sign lookForKeyStoreInClasspath="false" algorithmName="SHA256withRSA" keyStorePassword="topazPwd"
                     privateKeyPassword="mercuryPwd" keyStorePath="C:\MSM" privateKeyDefaultAliasName="lwsso"
                     certificateDefaultAliasName="lwsso" keyStoreName="lwsso" keyStoreType="JKS"
                     providerName="Default Provider Name" />
               -->
    </lwsso>

You need to specify a key for signing IdM tokens.

1. Open the <idm-service>\WEB-INF\spring\applicationContext.properties file in a text editor.

2. Specify a key in the idm.encryptedSigningKey parameter.

   For example, specify the following key:

   idm.encryptedSigningKey=awscd456!

Each IdM client (the Service Manager Web Tier, SRC, or Mobility Client) needs an IdM user account to access the IdM service.

By default, the IdM service has a user account defined: idmTransportUser (user name) and idmTransportUser (password). You can skip this task and simply specify this default user account in the SM Web Tier, SRC, and Mobility Client. For details, see Configure SAML SSO in Service Manager (using standalone IdM).

To change the IdM user account password, follow these steps:

1. Open the <idm-service>/WEB-INF/classes/integrationusers.properties file in a text editor.

2. Locate the line with an encrypted string:

   idmTransportUser=ENC(xxxx)

   Where: xxxx represents an encrypted string.

3. Change this line to the following:

   idmTransportUser=idmTransportUser,ROLE_ADMIN,PERM_IMPERSONATE,enabled

   Where:

   • "idmTransportUser" on the left side of the equals sign (=) is the user name, which must not be changed.
   • On the right side of the equals sign (=), "idmTransportUser" is the default password and the rest of the string are other properties of the user account.

4. Change the default password to your own value. For example, change it to "1Qaz2wsx3edc":

   idmTransportUser=1Qaz2wsx3edc,ROLE_ADMIN,PERM_IMPERSONATE,enabled

5. Save the file.

By default, Microsoft ADFS uses the SHA-256 secure hash algorithm, which requires you to replace the default JRE policy files used by the IdM web application server.

To do this, follow these steps:

1. Download the unlimited strength JCE policy files for your JRE:

   • local_policy.jar

   • US_export_policy.jar

   For example, for Tomcat 8.0, visit the Oracle website to download the unlimited strength JCE policy files:

   http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html (for JRE 8)

   http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html (for JRE 7)

2. On the IdM web application server host, browse to the <JRE>\lib\security folder.
3. Replace the policy files with the unlimited strength JCE policy files that you have downloaded.

Currently, the only supported identity provider is Microsoft Active Directory Federation Service (ADFS) 2.0 or 3.0. ADFS helps you use single sign-on (SSO) to authenticate users to multiple, related web applications over the life of a single online session.

Once ADFS is installed and configured to authenticate users from an LDAP directory, you are ready to add the IdM metadata to ADFS to add the IdM service as a trusted relying party.

To add the IdM service as a trusted relying party to ADFS, follow these steps:

1. In the ADFS 3.0 Management Console, right-click Trust Relationships and then select Add Relying Party Trust.

   

2. Select Import data about the relying party from a file, and then select the IdM metadata file (metadata.xml) that you created previously. Click Next.

   

3. The wizard may display a warning, indicating that some content of the metadata is not supported. You can safely ignore this warning.

   Click OK to ignore the warning.

   

4. Specify a display name for the IdM service, and add optional notes. Click Next.

   

5. Make sure the I do not want to configure multi-factor authentication setting for this relying party trust at this time option is selected, and then click Next.

   

6. Select the Permit all users to access this replying party issuance authorization rule.

   

7. You are now in the Ready to Add Trust step. Check that the Endpoints tab contains multiple endpoint values. If not, verify that your metadata was generated with https protocol URLs.

   

8. Leave the Open the Edit Claim Rules dialog checkbox selected, and click Close to close the wizard.

   

9. The Add Transform Claim Rule wizard opens. Perform the steps below to configure the NameID element as part of the Subject in the SAML Response message.

   1. Select Add Rule, and then select Send LDAP Attributes as Claims. Click Next.

      

   2. Specify the following fields to configure the claim rule:

      • Claim rule name: enter NameID
      • Attribute store: select Active Directory
      • LDAP Attribute: select SAM-Account-Name
      • Outgoing claim type: select Name ID

      

   3. Close the wizard and the Apply the claim rules window.

      Note In ADFS 3.0, you may need to configure the Name ID as a PassThrough claim.

In this task, you will export the public key from the ADFS certificate and then import the key into the SAML keystore file of IdM. This task is required for IdM to decrypt SAML responses from ADFS.

Step 1. Export the public key portion of the ADFS federation service certificate

1. From your operating system, start Active Directory Federation Services.
2. Right-click Federation Service, and then click Properties.
3. On the General tab, under Communicating certificate, click View.
4. In the Certificate dialog box, select the Details tab.
5. On the Details tab, click Copy to File.
6. Click Next.
7. On the Export Private Key page, make sure that No, do not export the private key is selected, and then click Next.
8. On the Export File Format page, select DER encoded binary X.509 (.CER), and then click Next.

9. On the File to Export page, specify the certificate file in File name, and then click Next.

   Note In this example, we use Per_ADFS.cer as the file name.

10. Click Finish.

11. Validate success by checking to see that the file you specified was created at the specified location.

Step 2. Import the ADFS public key into the IdM keystore

The IdM SAML keystore file is: <idm-service>\WEB-INF\classes\security\samlKeystore.jks.

To do this, run the following command:

keytool -importcert -alias some-alias -file Per_ADFS.cer -keystore samlKeystore.jks

If you want to use your own keystore file instead of the out-of-box one, you need to do the following:

1. Replace the out-of-box keystore file with your own one.

2. If your keystore file uses a different name, specify your file in the <idm-service>\WEB-INF\spring\applicationContext.properties file:

   idm.saml.keystore=classpath:security/samlKeystore.jks

   Replace samlKeystore.jks with your own file name.

3. Specify the following parameters accordingly in the <idm-service>\WEB-INF\spring\applicationContext.properties file:

   • idm.saml.keystore.password=ENC(xxx)
   • idm.saml.keystore.defaultKey.name=ENC(xxx)
   • idm.saml.keystore.defaultKey.password=ENC(xxx)

   Note Replace the ENC(xxx) parts with your own values.

The IdP (Microsoft ADFS) uses a parameter named Web SSO lifetime to determine whether a user login request is sent within a valid time period of the user's last login. If yes, the user is automatically logged in without the need to enter a user name and password. Similarly, the IdM service uses a parameter named maxAuthenticationAge for the same purpose.

To enable SAML SSO for Service Manager, the maxAuthenticationAge value defined in the IdM service must be no less than the Web SSO lifetime value defined in the IdP. By default, the IdM service setting is 7200 seconds (2 hours), and the ADFS setting is 480 minutes (8 hours). Since this IdP setting is usually a global setting for your organization, you may want to change the IdM setting according to your IdP setting. To do this, perform the following steps.

Step 1. Check the web SSO lifetime value in the IdP

1. Open Microsoft ADFS.

2. Click Service and then select Edit Federation Service Properties.

   

3. On the General tab, check the Web SSO lifetime value.

   Note The default value is 480 minutes (8 hours).

   

Step 2. Adjust the web SSO lifetime setting in the IdM service

To check the value in the IdM service, follow these steps:

1. Open the <idm-service>\WEB-INF\spring\applicationContext-saml.xml file in a text editor.

2. Search for the following line:

   <bean id="webSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerImpl"/>            

3. Change this line to the following:

   <bean id="webSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerImpl">
       <property name="maxAuthenticationAge" value="xxxx"/>
   </bean>

   Where: xxxx represents a value (in seconds) that is no less than your ADFS Web SSO lifetime. For example, if your ADFS setting is 480 (minutes), xxxx should be 28800 or greater.

4. Restart the IdM service.

In this task, you will run the IdM encryption tool to encrypt all IdM passwords and keys. This task is optional but highly recommended for the best security in production environments.

To do this, follow these steps:

1. Update the second column of the following table with the passwords and keys that you have configured for IdM.

   Location	Password/Key	Description
   <idm-service>\WEB-INF\classes\integrationusers.properties	idmTransportUser=xxxxxx	This is the IdM password that Service Manager uses to access the IdM service. XXXXXX is a string that defines the password and other properties of the IdM user account. For example: idmTransportUser=1Qaz2wsx3edc,ROLE_ADMIN,PERM_IMPERSONATE,enabled You must encrypt the entire string on the right side of the equals sign.
   <idm-service>\WEB-INF\spring\applicationContext.properties	idm.encryptedSigningKey=xxxxxx	This is the signing key used to sign IdM tokens.
   <idm-service>\WEB-INF\spring\applicationContext.properties	idm.persistence.connection.password = xxxxxx	This is the password of the IdM database connection account.
   <idm-service>\WEB-INF\spring\applicationContext.properties	idm.saml.keystore.password=xxxxxx idm.saml.keystore.defaultKey.name=xxxxxx idm.saml.keystore.defaultKey.password=xxxxxx	This is the password, default key name and passwords of the IdM SAML keystore file: <idm-service>\WEB-INF\classes\security\samlKeystore.jks. If you use the out-of-box keystore file, these parameter values are already encrypted and you must not change them.

2. Change to the <idm-service>/web-inf/lib directory.

3. For each parameter value in the previous table, run the following command:

   java -cp "cryptoUtil-1.0.3.jar;jasypt-1.9.1.jar;commons-codec-1.7.jar;slf4j-log4j12-1.7.5.jar;slf4j-api-1.7.5.jar;log4j-1.2.17.jar" com.hp.ccue.crypto.util.App encrypt xxxxxx

   Where: xxxxxx represents the value that you want to encrypt.

   When the encryption is complete, the original value and encrypted value are returned. The following is an example:

   original:1Qazwsx3edc
   encrypted:0bEhLG0zDOdYBLf013p3Qfn66kNTMYvh

4. Copy the encrypted value back to the IdM configuration file to overwrite the original parameter value by using the following format:

   Parameter=ENC(encrypted value)

   Here are examples:

   idmTransportUser=ENC(0bEhLG0zDOdYBLf013p3Qfn66kNTMYvh)

   idm.encryptedSigningKey=ENC(0bEhLG0zDOdYBLf013p3Qfn66kNTMYvh)