Page Comparison

Div

class	breadcrumbs

/wiki/spaces/E2D/pages/29982926 / Installation and Configuration / Configuring EmpowerID / Connecting to Directory Systems / Current: Configuring Identity Forge for EmpowerID

This topic describes how to configure Identity Forge for use with EmpowerID. Once you have followed the steps outlined in this topic, you can connect EmpowerID to your AS/400 directories. Configuring Identity Forge for EmpowerID involves the following:

File preparation and downloads

Installing and configuring

To install and configure the Java environment

Installing the IdentityForge as400.properties file

Unpacking the IdentityForge environment

Configuring the Front-End LDAP Administrative Account

Configuring the Back-End LDAP Administrative Account

Configuring SSL for the IdentityForge LDAP Server

Configuring SSL for the AS/400

Packaging the IdentityForge environment

Configuring the IdentityForge Windows wrappers server

Troubleshooting and monitoring the IdentityForge server

SAML
Download the latest Java JDK from:
http://www.oracle.com/technetwork/java/javase/downloads/index.html
Download the IdentityForge i5 Advanced Adapter Enterprise from:
http://download.thedotnetfactory.com/downloads/i5_advanced_adapter_5.0.0.4_enterprise.zip
DownloadJTOpen from:
http://sourceforge.net/projects/jt400/
Download theMicrosoft Visual C++ 2008 Redistributable Package (x86) from:
http://www.microsoft.com/en-us/download/details.aspx?id=29
DownloadWin32 OpenSSL v1.0.1e Light from:
http://slproweb.com/download/Win32OpenSSL_Light-1_0_1e.exe
DownloadImportKey.class from:
http://www.agentbob.info/agentbob/79-AB.html
(right click > Save As on the ImportKey.class link near the bottom of the page)

To install and configure the Java environment

Execute the Java JDK installer and click Next.

On the optional features page, change Public JRE to This feature will not be available and changeSource Code to This feature will not be available.

Click Development Tools and then click the Change button.

Change C:\Program Files (x86)\Java\jdk1.7.0_25 to a shorter path without spaces in it, such as C:\software\jdk1.7.0_25\.

Click Next to begin the installation.

Click Close when finished.

Open Control Panel by clicking Start, typing Control and pressing ENTER.

From Control Panel, navigate to System > Advanced system settings and then click Environment Variables.

In the System variables pane of the Environment Variables window that appears, click New.

In the New System Variable dialog that appears, do the following:

Type JAVA_HOME in the Variable name field
Type the installation path of the Java JDK, such as C:\software\jdk1.7._25, in the Variable value field
Click OK to close the dialog.

Close the Environment Variables and System Properties windows and then close Control Panel.

Extract i5_advanced_adapter_5.0.0.4_enterprise.zip to the root of the partition (C:\ in our example) and then navigate toC:\i5_Advanced_Adapter_5.0.0.4_Enterprise\etc\LDAP Gateway.

Extract ldapgateway.zip to the root of the partition (C:\ in our example).

Extract jtopen_7_10.zip to a folder named jtopen_7_10 in the root of the partition (C:\ in our example).

Navigate to C:\jtopen_7_10\lib\ and copy jt400.jar and util400.jar to C:\ldapgateway\lib.

Navigate to C:\ldapgateway\bin and open run.bat in

Execute the Java JDK installer and click Next.
On the optional features page, change Public JRE to This feature will not be available and changeSource Code to This feature will not be available.
Click Development Tools and then click the Change button.
Change C:\Program Files (x86)\Java\jdk1.7.0_25 to a shorter path without spaces in it, such as C:\software\jdk1.7.0_25\.
Click Next to begin the installation.
Click Close when finished.
Open Control Panel by clicking Start, typing Control and pressing ENTER.
From Control Panel, navigate to System > Advanced system settings and then click Environment Variables.
In the System variables pane of the Environment Variables window that appears, click New.
In the New System Variable dialog that appears, do the following:
1. Type JAVA_HOME in the Variable name field
2. Type the installation path of the Java JDK, such as C:\software\jdk1.7._25, in the Variable value field
3. Click OK to close the dialog.
Close the Environment Variables and System Properties windows and then close Control Panel.
Extract i5_advanced_adapter_5.0.0.4_enterprise.zip to the root of the partition (C:\ in our example) and then navigate toC:\i5_Advanced_Adapter_5.0.0.4_Enterprise\etc\LDAP Gateway.
Extract ldapgateway.zip to the root of the partition (C:\ in our example).
Extract jtopen_7_10.zip to a folder named jtopen_7_10 in the root of the partition (C:\ in our example).
Navigate to C:\jtopen_7_10\lib\ and copy jt400.jar and util400.jar to C:\ldapgateway\lib.
Navigate to C:\ldapgateway\bin and open run.bat in the text editor of your choice.
Adjust the following line to the installation path of the Java JDK:
Code Block
language java
theme DJango
set JAVA_HOME=\software\jdk1.6.0_16
In our example, this line would be changed to the following:
Code Block
language java
theme DJango
set JAVA_HOME=C:\software\jdk1.7.0_25

To configure the IdentityForge as400.properties file

Navigate to C:\ldapgateway\conf and open as400.properties in the text editor of your choice.
From the text editor, change the following parameter to true:
Code Block
language java
theme DJango
_isSSL_
Adjust the following parameters with the IP address of your target iSeries:
Code Block
language java
theme DJango
_host_ _agentHost_
Adjust the following parameters with the UID of the administrative AS/400 account:
Code Block
language java
theme DJango
_adminId_ _agentAdminId_
Place a '#' in front of the following parameters to comment them out:
Code Block
language java
theme DJango
_adminPwd_ _agentAdminPwd_
Remove the '#' from the following parameters to uncomment them:
Code Block
language java
theme DJango
_adminPwdEncrypt_ _agentAdminPwdEncrypt_
Copy C:\i5_Advanced_Adapter_5.0.0.4_Enterprise\scripts\propertyEncrypt.bat to C:\ldapgateway\dist and then open C:\ldapgateway\dist\propertyEncrypt.bat in the text editor of your choice.
Adjust the following line to the installation path of the Java JDK:
Code Block
language java
theme DJango
set JAVA_HOME=C:\software\jdk1.

6

5.0_

16

15
In our example, this line would be changed to the following:
Code Block
language java
theme DJango
set JAVA_HOME=C:\software\jdk1.7.0_25

To configure the IdentityForge as400.properties file

Navigate to C:\ldapgateway\conf and open as400.properties in the text editor of your choice.

From the text editor, change the following parameter to true

Scroll through the propertyEncrypt.bat file until you see the following line:

Code Block
language java
theme DJango

_isSSL_

Adjust the following parameters with the IP address of your target iSeries

SET CLASSPATH=C:\software\identityforge\ldapgateway\dist\idfserver.jar
This path needs to point to the IdentityForge installation directory. In our example, this line would be changed to the following:

Code Block
language java
theme DJango

_host_ 
_agentHost_

Adjust the following parameters with the UID of the administrative AS/400 account

SET CLASSPATH=C:\ldapgateway\dist\idfserver.jar

Scroll to the end of the propertyEncrypt.bat file until you see the following lines:

Code Block
language java
theme DJango

_adminId_

rem Start Property Encrypt Utility %JAVACMD%  %JVM_OPTS%  -cp %CLASSPATH%

_agentAdminId_

Place a '#' in front of the following parameters to comment them out:

Code Block

language	java
theme	DJango

_adminPwd_           
_agentAdminPwd_

Remove the '#' from the following parameters to uncomment them

com.identityforge.idfserver.util.AESCipherUtil idfRacfPwd

Change the bolded text to the password of the AS/400 administrative account, then save the propertyEncrypt.bat file.
Double-click propertyEncrypt.bat. You should see something similar to the following output:

Code Block
language java
theme DJango

_adminPwdEncrypt_

New encrypted string as

_agentAdminPwdEncrypt_Copy C:\i5_Advanced_Adapter_5.0.0.4_Enterprise\scripts\propertyEncrypt.bat to C:\ldapgateway\dist and then open C:\ldapgateway\dist\propertyEncrypt.bat in

HEX: 10902AA71C4DF819C965E8B5B7DF0208
Copy this value (in our example, 10902AA71C4DF819C965E8B5B7DF0208) to the clipboard.
Navigate to C:\ldapgateway\conf and open as400.properties in the text editor of your choice.

Adjust

Paste the value into the following

line to the installation path of the Java JDK

parameters:

Code Block
language java
theme DJango

set JAVA_HOME=

_adminPwdEncrypt_
_agentAdminPwdEncrypt_

To unpack the IdentityForge environment

Navigate to C:\

software\jdk1.5.0_15

In our example, this line would be changed to the following:

Code Block

language	java
theme	DJango

set JAVA_HOME=C:\software\jdk1.7.0_25

Scroll through the propertyEncrypt.bat file until you see the following line:

Code Block

language	java
theme	DJango

SET CLASSPATH=C:\software\identityforge\ldapgateway\dist\idfserver.jar

This path needs to point to the IdentityForge installation directory. In our example, this line would be changed to the following

ldapgateway\dist and rename idfserver.jar to idfserver.zip.
Extract the contents of idfserver.zip to C:\ldapgateway\dist\idfserver.

To configure the Front-End LDAP Administrative Account

The next step is to set the Front-End LDAP administrative account and password. This is the account used by EmpowerID to bind to the IdentityForge LDAP server.

Open C:\ldapgateway\dist\idfserver\beans.xml in the text editor of you choice and scroll to the below section. We will be changing the value for theFront-End LDAP administrative account listed in bold:

Code Block
language

java

xml
theme DJango

SET CLASSPATH=C:\ldapgateway\dist\idfserver.jar

Scroll to the end of the propertyEncrypt.bat file until you see the following lines:

<bean name="as400" singleton="true" class="com.identityforge.idfserver.backend.as400.As400Module">

Code Block

language

java

Paste the value into the following parameters:

Code Block

language	java
theme	DJango

_adminPwdEncrypt_
_agentAdminPwdEncrypt_

To unpack the IdentityForge environment

Navigate to C:\ldapgateway\dist and rename idfserver.jar to idfserver.zip.
Extract the contents of idfserver.zip to C:\ldapgateway\dist\idfserver.

To configure the Front-End LDAP Administrative Account

The next step is to set the Front-End LDAP administrative account and password. This is the account used by EmpowerID to bind to the IdentityForge LDAP server.

Open C:\ldapgateway\dist\idfserver\beans.xml in the text editor of you choice and scroll to the below section. We will be changing the value for theFront-End LDAP administrative account listed in bold
xml
theme DJango

rem Start Property Encrypt Utility %JAVACMD%  %JVM_OPTS%  -cp %CLASSPATH%  com.identityforge.idfserver.util.AESCipherUtil idfRacfPwd

Change the bolded text to the password of the AS/400 administrative account, then save the propertyEncrypt.bat file.

Double-click propertyEncrypt.bat. You should see something similar to the following output:

Code Block

language	java
theme	DJango

New encrypted string as HEX: 10902AA71C4DF819C965E8B5B7DF0208

Copy this value (in our example, 10902AA71C4DF819C965E8B5B7DF0208) to the clipboard.

Navigate to C:\ldapgateway\conf and open as400.properties in the text editor of your choice.

<property name="suffix" value="dc=as400,dc=com"/>    
<property name="workingDirectory" value="../as400"/>    
<property name="adminUserDN" value="cn=idfAs400Admin, dc=as400,dc=com"/>     
<property name="adminUserPassword" value="idfAs400Pwd"/>    
<property name="altAdminUserDN" value="cn=oimAs400Admin, dc=as400,dc=com"/>    
<property name="altAdminUserPassword" value="oimAs400Pwd"/>    
<property name="allowAnonymous" value="false"/>    
<property name="entryCacheSize" value="1000"/>    
<property name="defaultUacc" value="read"/>    
<property name="searchUsersType" value="user"/>

IdentityForge provides the ability to have two Front-End LDAP administrative accounts, but for our purposes we only need one.

Change the adminUserDN and altAdminUserDN property values to the DN of the Front-End account you wish to use to bind to LDAP. For example:

Code Block

language	xml
theme	DJango

<bean name="as400" singleton="true" class="com.identityforge.idfserver.backend.as400.As400Module">

Code Block

language	xml
theme	DJango

<property name="suffix" value="dc=as400,dc=com"/>    
<property name="workingDirectory" value="../as400"/>    
<property name="adminUserDN" value="cn=idfAs400AdminEIDIDF, dc=as400,dc=com"/>    

<property name="adminUserPassword" value="idfAs400Pwd"/>   

<property name="altAdminUserDN" value="cn=oimAs400AdminEIDIDF, dc=as400,dc=com"/>   

<property name="altAdminUserPassword" value="oimAs400Pwd"/>    
<property name="allowAnonymous" value="false"/>    
<property name="entryCacheSize" value="1000"/>    
<property name="defaultUacc" value="read"/>    
<property name="searchUsersType" value="user"/>

IdentityForge provides the ability to have two Front-End LDAP administrative accounts, but for our purposes we only need one.

Change the adminUserDN and altAdminUserDN property values to the DN of the Front-End account you wish to use to bind to LDAP. For example

Open C:\ldapgateway\dist\propertyEncrypt.bat in the text editor of yur choice.

Scroll to the end of the propertyEncrypt.bat file until you see the following lines:

Code Block

language	xmlbash
theme	DJango

<bean name="as400" singleton="true" class="rem Start Property Encrypt Utility
%JAVACMD%  %JVM_OPTS%  -cp %CLASSPATH%  com.identityforge.idfserver.backend.as400.As400Module">.util.AESCipherUtil idfRacfPwd

Change the bolded text to the password of the Front-End LDAP administrative account and then save the propertyEncrypt.bat file.

Double-click propertyEncrypt.bat. You should see something similar to the following output:

Code Block

language	xmlbash
theme	DJango

<property name="suffix" value="dc=as400,dc=com"/>    
<property name="workingDirectory" value="..New encrypted string as HEX: 10902AA71C4DF819C965E8B5B7DF0208

Copy the value (in our example, 10902AA71C4DF819C965E8B5B7DF0208) to the clipboard.

Change the adminUserPassword and altAdminUserPassword property values to the encrypted password string in the clipboard. For example:

Code Block

language	xml
theme	DJango

<bean name="as400" singleton="true" class="com.identityforge.idfserver.backend.as400.As400Module">

Code Block

language	xml
theme	DJango

<property name="suffix" value="dc=as400,dc=com"/>    
<property name="workingDirectory" value="../as400"/>    
<property name="adminUserDN" value="cn=EIDIDF, dc=as400,dc=com"/>   

<property name="adminUserPassword" value="idfAs400Pwd"10902AA71C4DF819C965E8B5B7DF0208â/>    
<property name="altAdminUserDN" value="cn=EIDIDF, dc=as400,dc=com"/>    
<property name="altAdminUserPassword" value="oimAs400Pwd10902AA71C4DF819C965E8B5B7DF0208"/>    
<property name="allowAnonymous" value="false"/>    
<property name="entryCacheSize" value="1000"/>    
<property name="defaultUacc" value="read"/>    
<property name="searchUsersType" value="user"/>

Open C:\ldapgateway\dist\propertyEncrypt.bat in the text editor of yur

To configure the Back-End LDAP Administrative Account

The next step is to set the Back-End LDAP administrative password. This is the account used by EmpowerID to bind to the IdentityForge LDAP server and sync inventory to the Back-End.

Open C:\ldapgateway\dist\idfserver\beans.xml in the text editor of your choice.
Scroll to the end of the propertyEncrypt.bat file until you see the following linessection shown below. We will be changing the Back-End LDAP administrative account password listed in bold:

Code Block

language	xml
theme	DJango

<bean name="hpbe2" singleton="true" class="com.identityforge.idfserver.backend.hpbe.HPBEModule">
<property name="suffix" value="dc=system,dc=backend"/>
<property name="workingDirectory" value="../system"/>
<property name="schema" ref="schemas"/>
<property name="adminUserDN" value="cn=Directory Manager, dc=system,dc=backend"/>
<property name="adminUserPassword" value="10902AA71C4DF819C965E8B5B7DF0208"/>
<property name="altAdminUserDN" value="cn=Directory Manager, dc=system,dc=backend"/>
<property name="altAdminUserPassword" value=â10902AA71C4DF819C965E8B5B7DF0208"/>
<property name="entryCacheSize" value="1000"/>

To configure SSL for the IdentityForge LDAP server

To configure secure communications between EmpowerID and the IdentityForge LDAP server we will need a PFX copy of the certificate being used by EmpowerID and an installed copy of OpenSSL to convert the PFX to a format usable by Java keystores.
Install the Microsoft Visual C++ 2008 Redistributable Package (x86) by running vcredist_x86.exe.
Next, install Win32 OpenSSL v1.0.1e Light by running Win32OpenSSL_Light-1_0_1e.exe. In our example, we are choosing an installation path of C:\software\OpenSSL-Win32.
Click Next. When prompted where to copy the OpenSSL DLLs, choose The OpenSSL binaries (/bin) directory.
Click Next and finish the installation.
Copy the PFX certificate (named EIDcert.pfx in our example) to the root of the partition (C:\ in our example).
Open a Command Prompt window and navigate to C:\software\OpenSSL-Win32\bin.

Execute the following command to convert the PFX file to a PEM file.

Code Block

language	bash
theme	DJango

openssl pkcs12 -in C:\EIDcert.pfx -out C:\EIDcert.pem

The OpenSSL toolkit will ask you to enter the import password; this is the pass phrase currently set on the PFX certificate. If you exported the certificate from the MMC snap-in, this will be the password you set on the certificate during the export.

Enter the password for the certificate and press ENTER.
Next OpenSSL will prompt for the PEM pass phrase. We are setting a new pass phrase hereâ€”make sure to remember this value! You can use the same password as the import password if you want. Enter the pass phrase and press ENTER, then enter the pass phrase again to confirm and press ENTER once more. We now have a PEM file available at C:\EIDcert.pem.
Using a text editor of your choice, open the PEM file (C:\EIDcert.pem in our example). We need to extract the private key and place it in a separate file.

Find the following lines below:

Code Block

language	xml
theme	DJango

-----BEGIN ENCRYPTED PRIVATE KEY-----
            DATA HERE
-----END ENCRYPTED PRIVATE KEY-----

Copy everything from the beginning of the-----BEGIN ENCRYPTED PRIVATE KEY----- line to the end of the-----END ENCRYPTED PRIVATE KEY----- line and paste them into a new text file namedC:\encrypted.pem. Make sure there are no extra line breaks or spaces at the beginning or end of the file.

Next, we need to pull out the public key and put it into a separate file. Find the following lines below:

Code Block

language	xml
theme	DJango

-----BEGIN CERTIFICATE-----
        DATA HERE
-----END CERTIFICATE-----

Copy everything from the beginning of the -----BEGIN CERTIFICATE----- line to the end of the -----END CERTIFICATE----- line and paste them into a new text file named C:\cert.pem. Make sure there are no extra line breaks or spaces at the beginning or end of the file.
Next, we need to decrypt the RSA private key.
Open a Command Prompt window and navigate to C:\software\OpenSSL-Win32\bin.

Execute the following command:

Code Block

language	bash
theme	DJango

openssl rsa -in C:\encrypted.pem -out C:\key.pem

When OpenSSL prompts you for the pass phrase, enter the PEM password you created earlier.

Next, we need to convert the PEM files to DER files

Code Block

language	bash
theme	DJango

rem Start Property Encrypt Utility
%JAVACMD%  %JVM_OPTS%  -cp %CLASSPATH%  com.identityforge.idfserver.util.AESCipherUtil idfRacfPwd

Change the bolded text to the password of the Front-End LDAP administrative account and then save the propertyEncrypt.bat file.

Double-click propertyEncrypt.bat. You should see something similar to the following output:

Code Block

language	bash
theme	DJango

New encrypted string as HEX: 10902AA71C4DF819C965E8B5B7DF0208

Copy the value (in our example, 10902AA71C4DF819C965E8B5B7DF0208) to the clipboard.

Change the adminUserPassword and altAdminUserPassword property values to the encrypted password string in the clipboard. For example:

Code Block

language	xml
theme	DJango

<bean name="as400" singleton="true" class="com.identityforge.idfserver.backend.as400.As400Module">

Code Block

language	xml
theme	DJango

<property name="suffix" value="dc=as400,dc=com"/>    
<property name="workingDirectory" value="../as400"/>    
<property name="adminUserDN" value="cn=EIDIDF, dc=as400,dc=com"/>   
<property name="adminUserPassword" value="10902AA71C4DF819C965E8B5B7DF0208â/>    
<property name="altAdminUserDN" value="cn=EIDIDF, dc=as400,dc=com"/>    
<property name="altAdminUserPassword" value="10902AA71C4DF819C965E8B5B7DF0208"/>    
<property name="allowAnonymous" value="false"/>    
<property name="entryCacheSize" value="1000"/>    
<property name="defaultUacc" value="read"/>    
<property name="searchUsersType" value="user"/>

To configure the Back-End LDAP Administrative Account

The next step is to set the Back-End LDAP administrative password. This is the account used by EmpowerID to bind to the IdentityForge LDAP server and sync inventory to the Back-End.

Open C:\ldapgateway\dist\idfserver\beans.xml in the text editor of your choice.

Scroll to the section shown below. We will be changing the Back-End LDAP administrative account password listed in bold:

Code Block

language	xml
theme	DJango

<bean name="hpbe2" singleton="true" class="com.identityforge.idfserver.backend.hpbe.HPBEModule">
<property name="suffix" value="dc=system,dc=backend"/>
<property name="workingDirectory" value="../system"/>
<property name="schema" ref="schemas"/>
<property name="adminUserDN" value="cn=Directory Manager, dc=system,dc=backend"/>
<property name="adminUserPassword" value="testpass"/>
<property name="altAdminUserDN" value="cn=Directory Manager, dc=system,dc=backend"/>
<property name="altAdminUserPassword" value="testpass"/>
<property name="entryCacheSize" value="1000"/>

Open C:\ldapgateway\dist\propertyEncrypt.bat in the text editor of your choice.

Scroll to the end of the propertyEncrypt.bat file until you see the following lines:

Code Block

language	bash
theme	DJango

rem Start Property Encrypt Utility
%JAVACMD%  %JVM_OPTS%  -cp %CLASSPATH%  com.identityforge.idfserver.util.AESCipherUtil idfRacfPwd

Change the bolded text to the password of the Back-End LDAP administrative account and then save the propertyEncrypt.bat file.

Double-click propertyEncrypt.bat. You should see something similar to the following output:

Code Block

language	bash
theme	DJango

New encrypted string as HEX: 10902AA71C4DF819C965E8B5B7DF0208

Copy the value (in our example, 10902AA71C4DF819C965E8B5B7DF0208) to the clipboard.

Change the adminUserPassword and altAdminUserPassword property values to the encrypted password string in the clipboard. For example:

xml
theme	DJango

<bean name="hpbe2" singleton="true" class="com.identityforge.idfserver.backend.hpbe.HPBEModule">
<property name="suffix" value="dc=system,dc=backend"/>
<property name="workingDirectory" value="../system"/>
<property name="schema" ref="schemas"/>
<property name="adminUserDN" value="cn=Directory Manager, dc=system,dc=backend"/>
<property name="adminUserPassword" value="testpass"/>
<property name="altAdminUserDN" value="cn=Directory Manager, dc=system,dc=backend"/>
<property name="altAdminUserPassword" value="testpass"/>
<property name="entryCacheSize" value="1000"/>

Open C:\ldapgateway\dist\propertyEncrypt.bat in the text editor of your choice.

Scroll to the end of the propertyEncrypt.bat file until you see the following lines:

Code Block

language	bash
theme	DJango

rem Start Property Encrypt Utility
%JAVACMD%  %JVM_OPTS%  -cp %CLASSPATH%  com.identityforge.idfserver.util.AESCipherUtil idfRacfPwd

Change the bolded text to the password of the Back-End LDAP administrative account and then save the propertyEncrypt.bat file.
Double-click propertyEncrypt.bat. You should see something similar to the following output:
Code Block
language bash
theme DJango
New encrypted string as HEX: 10902AA71C4DF819C965E8B5B7DF0208
Copy the value (in our example, 10902AA71C4DF819C965E8B5B7DF0208) to the clipboard.

Change the adminUserPassword and altAdminUserPassword property values to the encrypted password string in the clipboard. For example:

Code Block

language	xml
theme	DJango

<bean name="hpbe2" singleton="true" class="com.identityforge.idfserver.backend.hpbe.HPBEModule">
<property name="suffix" value="dc=system,dc=backend"/>
<property name="workingDirectory" value="../system"/>
<property name="schema" ref="schemas"/>
<property name="adminUserDN" value="cn=Directory Manager, dc=system,dc=backend"/>
<property name="adminUserPassword" value="10902AA71C4DF819C965E8B5B7DF0208"/>
<property name="altAdminUserDN" value="cn=Directory Manager, dc=system,dc=backend"/>
<property name="altAdminUserPassword" value=â10902AA71C4DF819C965E8B5B7DF0208"/>
<property name="entryCacheSize" value="1000"/>

To configure SSL for the IdentityForge LDAP server

To configure secure communications between EmpowerID and the IdentityForge LDAP server we will need a PFX copy of the certificate being used by EmpowerID and an installed copy of OpenSSL to convert the PFX to a format usable by Java keystores.
Install the Microsoft Visual C++ 2008 Redistributable Package (x86) by running vcredist_x86.exe.
Next, install Win32 OpenSSL v1.0.1e Light by running Win32OpenSSL_Light-1_0_1e.exe. In our example, we are choosing an installation path of C:\software\OpenSSL-Win32.
Click Next. When prompted where to copy the OpenSSL DLLs, choose The OpenSSL binaries (/bin) directory.
Click Next and finish the installation.
Copy the PFX certificate (named EIDcert.pfx in our example) to the root of the partition (C:\ in our example).
Open a Command Prompt window and navigate to C:\software\OpenSSL-Win32\bin.

Execute the following two commands:command to convert the PFX file to a PEM file.

Code Block

language	bash
theme	DJango

openssl pkcs8 -topk8 -nocryptopenssl pkcs12 -in C:\keyEIDcert.pempfx -inform PEM -out C:\key.der -outform DER
openssl x509 -in C:\cert.pem -inform PEM -out C:\cert.der -outform DER

Once these commands are completed, you will have two DER files. At this time it is recommended to delete the PFX and PEM files.

Next, copy ImportKey.class to the Java JDK bin folder (C:\software\jdk1.7.0_25\bin in our example).

Open a Command Prompt, navigate to C:\software\jdk1.7.0_25\bin and execute the following command to merge the two DER certificate files into a single Java keystore.

Code Block

language	bash
theme	DJango

java ImportKey C:\key.der C:\cert.der

Note the following line: Using keystore-file : C:\Users\USERNAME\keystore.ImportKey.

Navigate to the above directory, rename the keystore.ImportKey file to as400.jks and then copy it to the IdentityForge \conf directory (C:\ldapgateway\conf in our example).
Finally, we need to configure IdentityForge to point to this Java keystore. Open C:\ldapgateway\dist\idfserver\beans.xml in the text editor of your choice and scroll to the following section. We will be changing the Java keystore filename listed in bold
EIDcert.pem
The OpenSSL toolkit will ask you to enter the import password; this is the pass phrase currently set on the PFX certificate. If you exported the certificate from the MMC snap-in, this will be the password you set on the certificate during the export.
Enter the password for the certificate and press ENTER.
Next OpenSSL will prompt for the PEM pass phrase. We are setting a new pass phrase hereâ€”make sure to remember this value! You can use the same password as the import password if you want. Enter the pass phrase and press ENTER, then enter the pass phrase again to confirm and press ENTER once more. We now have a PEM file available at C:\EIDcert.pem.
Using a text editor of your choice, open the PEM file (C:\EIDcert.pem in our example). We need to extract the private key and place it in a separate file.

Find the following lines below:

Code Block

language	xml
theme	DJango

-----BEGIN ENCRYPTED PRIVATE KEY-----
            DATA HERE
-----END ENCRYPTED PRIVATE KEY-----

Copy everything from the beginning of the-----BEGIN ENCRYPTED PRIVATE KEY----- line to the end of the-----END ENCRYPTED PRIVATE KEY----- line and paste them into a new text file namedC:\encrypted.pem. Make sure there are no extra line breaks or spaces at the beginning or end of the file.

Next, we need to pull out the public key and put it into a separate file. Find the following lines below:

Code Block

language	xml
theme	DJango

<bean id="sslChannelFactory" class="com.identityforge.idfserver.nio.ssl.SSLChannelFactory">
<constructor-arg><value>false</value></constructor-arg>
<constructor-arg><value>../conf/testnew.jks</value></constructor-arg>
<constructor-arg><value>abc123</value></constructor-arg>
<constructor-arg><value>false</value></constructor-arg>
</bean>

Change the second constructor-arg value to the name of the Java keystore we created earlier. For example

-----BEGIN CERTIFICATE-----
        DATA HERE
-----END CERTIFICATE-----

Copy everything from the beginning of the -----BEGIN CERTIFICATE----- line to the end of the -----END CERTIFICATE----- line and paste them into a new text file named C:\cert.pem. Make sure there are no extra line breaks or spaces at the beginning or end of the file.
Next, we need to decrypt the RSA private key.
Open a Command Prompt window and navigate to C:\software\OpenSSL-Win32\bin.

Execute the following command:

Code Block

language	xmlbash
theme	DJango

<bean id="sslChannelFactory" class="com.identityforge.idfserver.nio.ssl.SSLChannelFactory">
<constructor-arg><value>false</value></constructor-arg>
<constructor-arg><value>../conf/as400.jks</value></constructor-arg>
<constructor-arg><value>abc123</value></constructor-arg>
<constructor-arg><value>false</value></constructor-arg>
</bean>

The final step is to set the Java keystore password. We will be changing the Java keystore password listed inbold

openssl rsa -in C:\encrypted.pem -out C:\key.pem

When OpenSSL prompts you for the pass phrase, enter the PEM password you created earlier.
Next, we need to convert the PEM files to DER files.
Open a Command Prompt window and navigate to C:\software\OpenSSL-Win32\bin.

Execute the following two commands:

Scroll to the end of the propertyEncrypt.bat file until you see the following lines of code:

Code Block

language	xmlbash
theme	DJango

<bean id="sslChannelFactory" class="com.identityforge.idfserver.nio.ssl.SSLChannelFactory">
<constructor-arg><value>false</value></constructor-arg>
<constructor-arg><value>../conf/as400.jks</value></constructor-arg>
<constructor-arg><value>abc123</value></constructor-arg>
<constructor-arg><value>false</value></constructor-arg>
</bean>

Open C:\ldapgateway\dist\propertyEncrypt.bat in the text editor of your choice.

openssl pkcs8 -topk8 -nocrypt -in C:\key.pem -inform PEM -out C:\key.der -outform DER
openssl x509 -in C:\cert.pem -inform PEM -out C:\cert.der -outform DER

Once these commands are completed, you will have two DER files. At this time it is recommended to delete the PFX and PEM files.

Next, copy ImportKey.class to the Java JDK bin folder (C:\software\jdk1.7.0_25\bin in our example).
Open a Command Prompt, navigate to C:\software\jdk1.7.0_25\bin and execute the following command to merge the two DER certificate files into a single Java keystore.
Code Block
language bash
theme DJango
remjava Start Property Encrypt Utility %JAVACMD% %JVM_OPTS% -cp %CLASSPATH% com.identityforge.idfserver.util.AESCipherUtil idfRacfPwd
Change the bolded text to the password of the Java keystore. The default password is â€œimportkeyâ€? without the quotes â€“ if you changed the keystore password earlier, please enter that value here instead. When finished, save the propertyEncrypt.bat file.
Double-click propertyEncrypt.bat. You should see something similar to the following output
ImportKey C:\key.der C:\cert.der
Note the following line: Using keystore-file : C:\Users\USERNAME\keystore.ImportKey.
Navigate to the above directory, rename the keystore.ImportKey file to as400.jks and then copy it to the IdentityForge \conf directory (C:\ldapgateway\conf in our example).

Finally, we need to configure IdentityForge to point to this Java keystore. Open C:\ldapgateway\dist\idfserver\beans.xml in the text editor of your choice and scroll to the following section. We will be changing the Java keystore filename listed in bold:

Code Block

language	bashxml
theme	DJango

New encrypted string as HEX: 10902AA71C4DF819C965E8B5B7DF0208

Copy this value (in our example, 10902AA71C4DF819C965E8B5B7DF0208) to the clipboard. Change the Java keystore password listed in bold to the encrypted password string in the clipboard

<bean id="sslChannelFactory" class="com.identityforge.idfserver.nio.ssl.SSLChannelFactory">
<constructor-arg><value>false</value></constructor-arg>
<constructor-arg><value>../conf/testnew.jks</value></constructor-arg>
<constructor-arg><value>abc123</value></constructor-arg>
<constructor-arg><value>false</value></constructor-arg>
</bean>

Change the second constructor-arg value to the name of the Java keystore we created earlier. For example:

Code Block

language	xml
theme	DJango

<bean id="sslChannelFactory" class="com.identityforge.idfserver.nio.ssl.SSLChannelFactory">
<constructor-arg><value>false</value></constructor-arg>
<constructor-arg><value>../conf/as400.jks</value></constructor-arg>
<constructor-arg><value>10902AA71C4DF819C965E8B5B7DF0208<arg><value>abc123</value></constructor-arg>
<constructor-arg><value>false</value></constructor-arg>
</bean>

Finally, since we are using an encrypted password for the Java keystore, we need to change the last constructor-arg value to true. For example

bean>

The final step is to set the Java keystore password. We will be changing the Java keystore password listed inbold:

Code Block

language	xml
theme	DJango

<bean id="sslChannelFactory" class="com.identityforge.idfserver.nio.ssl.SSLChannelFactory">
<constructor-arg><value>false</value></constructor-arg>
<constructor-arg><value>../conf/as400.jks</value></constructor-arg>
<constructor-arg><value>10902AA71C4DF819C965E8B5B7DF0208</value></constructor-arg>
<constructor-arg><value>true</value></constructor-arg>
</bean>

To configure SSL for the AS/400

To configure secure communications between the IdentityForge server and the AS/400 we will need to retrieve the SSL certificate from the OS/400 Certificate Manager.

From a web browser, navigate to the Digital Certificate Manager on http://OS400domain:2001, where OS400domain is the OS/400 target system. Use the same user account and password that you use to access the OS/400.

In the left panel, select Create Certificate Authority. If the Create Certificate Authority setting is not an option, select Install Local CA Certificate on Your PC.

Select Install Certificate and copy the certificate to a text file. In our example we are copying the cert to the root of the partition, to C:\cert.cer.

Open a Command Prompt and navigate to the Java JDK bin folder. In our example, this is C:\software\jdk1.7.0_25\bin. Execute the following commandTo verify the presence of the certificate in the certificate store, run the following command

arg><value>abc123</value></constructor-arg>
<constructor-arg><value>false</value></constructor-arg>
</bean>

Open C:\ldapgateway\dist\propertyEncrypt.bat in the text editor of your choice.

Scroll to the end of the propertyEncrypt.bat file until you see the following lines of code:

Code Block

language	bash
theme	DJango

rem Start Property Encrypt Utility
%JAVACMD%  %JVM_OPTS%  -cp %CLASSPATH%  com.identityforge.idfserver.util.AESCipherUtil
idfRacfPwd

Change the bolded text to the password of the Java keystore. The default password is â€œimportkeyâ€? without the quotes â€“ if you changed the keystore password earlier, please enter that value here instead. When finished, save the propertyEncrypt.bat file.
Double-click propertyEncrypt.bat. You should see something similar to the following output:

Code Block
language bash
theme DJango

keytool -importcert -file C:\cert.cer -alias arbitraryaliashere -keystore C:\software\jdk1.7.0_25\jre\lib\security\cacerts

The alias is just a text string used to reference the certificateâ€”you can enter any value. Enter the default JDK keystore password (changeit) to confirm the addition.

New encrypted string as HEX: 10902AA71C4DF819C965E8B5B7DF0208

Copy this value (in our example, 10902AA71C4DF819C965E8B5B7DF0208) to the clipboard. Change the Java keystore password listed in bold to the encrypted password string in the clipboard. For example:

Code Block
language

bashthemeDJango

keytool -list -keystore C:\software\jdk1.7.0_25\jre\lib\security\cacerts

Enter the defaukt JDK keystore password (changeit) to view the contents of the Java keystore.
InfoTo allow IdentityForge and AS/400 to communicate through a firewall, the following ports may need to be opened between the IdentityForge server and the AS/400:

Port 446 (TCP) DDM

Port 448 (TCP) Secure DDM

Port 449 (TCP) Server mapper

Port 8470 (TCP) Central server

Port 8475 (TCP) Remote command and program call server

Port 8476 (TCP) Signon server

Port 9470 (TCP) Secure central server

Port 9475 (TCP) Secure remote command/ Program call server

Port 9476 (TCP) Secure signon server

For more information, please see the following JTOpen and IBM iSeries documentation pages:

To package the IdentityForge environment

Navigate to C:\ldapgateway\dist\idfserver, press CTRL+A to select all of files and folders in this location, then right click and choose Send to > Compressed (zipped) folder. This will create a .zip file in the C:\ldapgateway\dist\idfserver directory. Rename the .zip file to idfserver.jar. Copy idfserver.jar to C:\ldapgateway\dist. Overwrite the existing file.

To configure the IdentityForge windows service wrapper

Execute C:\ldapgateway\bin\run.bat to start the IdentityForge server.

To host the IdentityForge java executable as a windows service, navigate to C:\ldapgateway\win_service and open IDF-Win-Server.bat in the text editor of your choice.

Scroll to the section shown below. We will be changing the JAVA_HOME and JVM path variables listed in bold:

Code Block

language	bash
theme	DJango

set JAVA_HOME=C:\Program Files\Java\jre7
set JVM=C:\Program Files\Java\jre7\bin\client\jvm.dll

This path needs to point to the installation path of the Java JDK. In our example, this line would be changed to the following:

Code Block

language	java
theme	DJango

set JAVA_HOME=C:\software\jdk1.7.0_25 set JVM=

xml
theme	DJango

<bean id="sslChannelFactory" class="com.identityforge.idfserver.nio.ssl.SSLChannelFactory">
<constructor-arg><value>false</value></constructor-arg>
<constructor-arg><value>../conf/as400.jks</value></constructor-arg>
<constructor-arg><value>10902AA71C4DF819C965E8B5B7DF0208</value></constructor-arg>
<constructor-arg><value>false</value></constructor-arg>
</bean>

Finally, since we are using an encrypted password for the Java keystore, we need to change the last constructor-arg value to true. For example:

Code Block

language	xml
theme	DJango

<bean id="sslChannelFactory" class="com.identityforge.idfserver.nio.ssl.SSLChannelFactory">
<constructor-arg><value>false</value></constructor-arg>
<constructor-arg><value>../conf/as400.jks</value></constructor-arg>
<constructor-arg><value>10902AA71C4DF819C965E8B5B7DF0208</value></constructor-arg>
<constructor-arg><value>true</value></constructor-arg>
</bean>

To configure SSL for the AS/400

To configure secure communications between the IdentityForge server and the AS/400 we will need to retrieve the SSL certificate from the OS/400 Certificate Manager.

From a web browser, navigate to the Digital Certificate Manager on http://OS400domain:2001, where OS400domain is the OS/400 target system. Use the same user account and password that you use to access the OS/400.
In the left panel, select Create Certificate Authority. If the Create Certificate Authority setting is not an option, select Install Local CA Certificate on Your PC.
Select Install Certificate and copy the certificate to a text file. In our example we are copying the cert to the root of the partition, to C:\cert.cer.
Open a Command Prompt and navigate to the Java JDK bin folder. In our example, this is C:\software\jdk1.7.0_25\
jre\bin\client\jvm.dll
Scroll through the IDF-Win-Service.bat file until you see the HOME and APPLICATION_SERVICE_HOME variables listed in boldbin. Execute the following command:
Code Block
language bash
theme DJango
set HOME=keytool -importcert -file C:\ldfService\ldapgateway set APPLICATION_SERVICE_HOME=C:\ldfService\ldapgateway\win_service
This path needs to point to the IdentityForge installation directory. In our example, this line would be changed to the following
cert.cer -alias arbitraryaliashere -keystore C:\software\jdk1.7.0_25\jre\lib\security\cacerts
The alias is just a text string used to reference the certificateâ€”you can enter any value. Enter the default JDK keystore password (changeit) to confirm the addition.
To verify the presence of the certificate in the certificate store, run the following command:
Code Block
language bash
theme DJango
set HOME=keytool -list -keystore C:\ldapgateway set APPLICATION_SERVICE_HOME=C:\ldapgateway\win_service
Scroll through the IDF-Win-Service.bat file until you see the SERVICE_NAME value listed in bold:
Code Block
language bash
theme DJango
set SERVICE_NAME=IdentityForgeService
This variable can be changed to a name of your choosing. This will be the name of the Windows service as shown in Service Manager.
Scroll through the IDF-Win-Service.bat file until you see the CG_STDOUTPUT variable listed below:
Code Block
language bash
theme DJango
set CG_STDOUTPUT=%CG_LOGPATH%\IDFServiceOut.log
In order to disable verbose logging, this line should be changed to the following:
Code Block
language bash
theme DJango
REM -- set CG_STDOUTPUT=%CG_LOGPATH%\IDFServiceOut.log
Scroll through the IDF-Win-Service.bat file until you see the CG_DESCRIPTION and CG_DISPLAY_NAME values listed in bold:
Code Block
language bash
theme DJango
Set CG_DESCRIPTION=âIdentity Forge Service for LDAP Gatewayâ set CG_DISPLAY_NAME=IdentityForgeService
These variables can be changed as you see fit. The text will become the description and the display name of the Windows service as shown in Service Manager, respectively.
Open a Command Prompt window and
software\jdk1.7.0_25\jre\lib\security\cacerts

Enter the defaukt JDK keystore password (changeit) to view the contents of the Java keystore.

Info

To allow IdentityForge and AS/400 to communicate through a firewall, the following ports may need to be opened between the IdentityForge server and the AS/400:

Port 446 (TCP) DDM
Port 448 (TCP) Secure DDM
Port 449 (TCP) Server mapper
Port 8470 (TCP) Central server
Port 8475 (TCP) Remote command and program call server
Port 8476 (TCP) Signon server
Port 9470 (TCP) Secure central server
Port 9475 (TCP) Secure remote command/ Program call server
Port 9476 (TCP) Secure signon server

For more information, please see the following JTOpen and IBM iSeries documentation pages:

To package the IdentityForge environment

Navigate to C:\ldapgateway\dist\idfserver, press CTRL+A to select all of files and folders in this location, then right click and choose Send to > Compressed (zipped) folder. This will create a .zip file in the C:\ldapgateway\dist\idfserver directory.
Rename the .zip file to idfserver.jar. Copy idfserver.jar to C:\ldapgateway\dist.
Overwrite the existing file.

To configure the IdentityForge windows service wrapper

Execute C:\ldapgateway\bin\run.bat to start the IdentityForge server.
To host the IdentityForge java executable as a windows service, navigate to C:\ldapgateway\win_service and open IDF-Win-Server.Execute the following commandbat in the text editor of your choice.
Scroll to the section shown below. We will be changing the JAVA_HOME and JVM path variables listed in bold:
Code Block
language bash
theme DJango
IDF-Win-Service.bat install
If you wish to remove the service at a later date, execute the following command
DJango
set JAVA_HOME=C:\Program Files\Java\jre7 set JVM=C:\Program Files\Java\jre7\bin\client\jvm.dll
This path needs to point to the installation path of the Java JDK. In our example, this line would be changed to the following:
Code Block
language bashjava
theme DJango
IDF-Win-Service.bat remove

Troubleshooting and monitoring the IdentityForge server

To check and monitor the IdentityForge log files, look for the log files located in C:\ldapgateway\logs.

To enable Java debugging do the following:

Open C:\ldapgateway\bin\run.bat in the text editor of your choice and scroll down to the following linesAdd -javax.net.debug=all directly after the %CLASSPATH% variable. Once completed, it should look like the following

	DJango

set JAVA_HOME=C:\software\jdk1.7.0_25
set JVM=C:\software\jdk1.7.0_25\jre\bin\client\jvm.dll

Scroll through the IDF-Win-Service.bat file until you see the HOME and APPLICATION_SERVICE_HOME variables listed in bold:

Code Block
language bash
theme DJango

rem Start Ldap Gateway Server
%JAVACMD% %DEBUG% %JVM_OPTS% %SECURE% -cp %CLASSPATH% com.identityforge.idfserver.Main %1 %2 %3 %4 %5 %6 %7 %8 %9

Execute C:\ldapgateway\bin\run.bat to start the IdentityForge server with Java debugging enabled.

To increase the memory available to the Java JVM, do the following:

Open C:\ldapgateway\bin\run.bat in the text editor of your choice and scroll down to the following lines

set HOME=C:\ldfService\ldapgateway
set APPLICATION_SERVICE_HOME=C:\ldfService\ldapgateway\win_service

This path needs to point to the IdentityForge installation directory. In our example, this line would be changed to the following:

Code Block

language	bash
theme	DJango

set HOME=C:\ldapgateway
set APPLICATION_SERVICE_HOME=C:\ldapgateway\win_service

Scroll through the IDF-Win-Service.bat file until you see the SERVICE_NAME value listed in bold:

Code Block
language bash
theme DJango

rem Start Ldap Gateway Server
%JAVACMD% %DEBUG% %JVM_OPTS% %SECURE% -cp %CLASSPATH% -Djavax.net.debug=all com.identityforge.idfserver.Main %1 %2 %3 %4 %5 %6 %7 %8 %9

Add -Xms512>m -Xmx1024m directly after the %CLASSPATH% variable. Once completed, it should look like

set SERVICE_NAME=IdentityForgeService
This variable can be changed to a name of your choosing. This will be the name of the Windows service as shown in Service Manager.
Scroll through the IDF-Win-Service.bat file until you see the CG_STDOUTPUT variable listed below:

Code Block
language bash
theme DJango

rem Start Ldap Gateway Server
%JAVACMD% %DEBUG% %JVM_OPTS% %SECURE% -cp %CLASSPATH% com.identityforge.idfserver.Main %1 %2 %3 %4 %5 %6 %7 %8 %9

set CG_STDOUTPUT=%CG_LOGPATH%\IDFServiceOut.log
In order to disable verbose logging, this line should be changed to the following:

Code Block
language bash
theme DJango

rem

REM

Start

--

Ldap Gateway Server %JAVACMD% %DEBUG% %JVM_OPTS% %SECURE% -cp %CLASSPATH% -Xms512m -Xmx1024m com.identityforge.idfserver.Main %1 %2 %3 %4 %5 %6 %7 %8 %9Execute C:\ldapgateway\bin\run.bat to start the IdentityForge server with the specified minimum and maximum memory available to the Java JVM.

set CG_STDOUTPUT=%CG_LOGPATH%\IDFServiceOut.log

Scroll through the IDF-Win-Service.bat file until you see the CG_DESCRIPTION and CG_DISPLAY_NAME values listed in bold:
Code Block
language bash
theme DJango
Set CG_DESCRIPTION=âIdentity Forge Service for LDAP Gatewayâ set CG_DISPLAY_NAME=IdentityForgeService
These variables can be changed as you see fit. The text will become the description and the display name of the Windows service as shown in Service Manager, respectively.
Open a Command Prompt window and navigate to C:\ldapgateway\win_service.
Execute the following command:
Code Block
language bash
theme DJango
IDF-Win-Service.bat install
If you wish to remove the service at a later date, execute the following command:
Code Block
language bash
theme DJango
IDF-Win-Service.bat remove

Div

style	float: left; position: fixed; top: 70px; padding: 5px;
id	toc
class	topicTOC

Div

style	margin-left: 40px; margin-bottom: 40px;

Live Search

spaceKey	E2D
placeholder	Search the documentation
type	page

Div

style	font-size: 1rem; margin-bottom: -15px; margin-left: 40px;text-transform: uppercase;

In this article

Table of Contents

style	none

Versions Compared

Old Version 4

New Version 5

Key

To install and configure the Java environment

To install and configure the Java environment

To configure the IdentityForge as400.properties file

To configure the IdentityForge as400.properties file

To unpack the IdentityForge environment

To configure the Front-End LDAP Administrative Account

To unpack the IdentityForge environment

To configure the Front-End LDAP Administrative Account

To configure the Back-End LDAP Administrative Account

To configure SSL for the IdentityForge LDAP server

To configure the Back-End LDAP Administrative Account

To configure SSL for the IdentityForge LDAP server

To configure SSL for the AS/400

To package the IdentityForge environment

To configure the IdentityForge windows service wrapper

To configure SSL for the AS/400

To package the IdentityForge environment

To configure the IdentityForge windows service wrapper

Troubleshooting and monitoring the IdentityForge server