Page Comparison

This topic describes how to configure Identity Forge IdentityForge for use with EmpowerID. Once you have followed the steps outlined in this topic, you can connect EmpowerID to your AS/400 directories. 

To install

the Java environment

1. Execute the Java JDK installer and click Next.
2. On the optional features page, change Public JRE to This feature will not be available and changeSource Code to click the Source Code button and select This feature will not be available.
   
   Image Added
   
   
3. Click Development Tools and then click the Change button.
   
   Image Added
   
   
4. Change C:\Program Files (x86)\Java\jdk1jdk-11.7.0_250.1\ to a shorter path without spaces in it, such as C:\software\jdk1jdk-11.70.0_25\.1\, and click OK.
   
   Image Added
   
   
5. Click Next to begin the installation .
6. Click Close when finished.
7. Open Control Panel by clicking Start, typing Control and pressing ENTER.
8. From Control Panel, navigate to System > Advanced system settings and then click Environment Variables.and click Close when it finishes.
   
   Image Added

To configure the Java environment

1. From the Start menu, type "Control" and press ENTER to open Control Panel.
2. In Control Panel, search for "Environment" and under System, click the link for Edit environment variables for your account.
   
   Image Added
   
   
3. In the System variables pane of the Environment Variables window that appears, click New.
   
   Image Added
   
   
4. In the New System Variable dialog that appears, do type the following :
5. Type JAVA_HOME in the Variable name field
Type the installation values and click OK.

Image Added


1. Variable name: JAVA_HOME 
2. Variable value: installation path of the Java JDK, such as e.g. C:\software\jdk1jdk-11.7._25, in the Variable value field
3. Click OK to close the dialog.
Close the Environment Variables and System Properties windows
1. 0.1\
   
   
6. Close the Environment Variables window and then close Control Panel.
7. Extract From the downloads mentioned as prerequisites above, extract i5_advanced_adapter_5.0.0.4_enterprise.zip to the root of the partition (C:\ in our example) and then navigate to .
   1. Navigate to the C:\i5_Advanced_Adapter_5.0.0.4_Enterprise\etc\LDAP Gateway folder.
   2. Extract ldapgateway.zip to the root of the partition (C:\ in our example).
      
      
8. Extract From the downloads, extract jtopen_79_106.zip to a folder named jtopen_79_106 in the root of the partition (C:\ in our example).
   1. Navigate
   to 
   1. to the C:\jtopen_
   7
   1. 9_
   10
   1. 6\lib
   \ and copy 
   1.  folder.
   2. Copy jt400.jar and util400.jar
    to 
   1.  and paste them in the C:\ldapgateway\lib folder.
      
      
9. Navigate to C:\ldapgateway\bin and open run.bat in the text editor of your choice.

   1. Adjust the following line to the installation path of the Java JDK:

      
      

      Code Block
      language java

   theme
   Emacs

   1. set JAVA_HOME=\software\jdk1.

   6

   1. 7.0_

   16

   1. 01

      
      

      In our example, we change this line

   is changed

   1. to the following:

      
      

      Code Block
      language java

   themeEmacs

   1. set JAVA_HOME=C:\software\

   jdk1.7.0_25

   1. jdk-11.0.1

      
      

   2. Save and close the file.

To configure the IdentityForge as400.properties file

1. Navigate to the C:\ldapgateway\conf folder and open the as400.properties file in the text editor of your choice.

2. From In the text editor, change the following parameter to true:

   
   

   Code Block
   language java theme Emacs
   _isSSL_

   
   

3. Adjust the following parameters with the IP address of your target iSeries:

   
   

   Code Block
   language java theme Emacs
   _host_ _agentHost_

   
   

4. Adjust the following parameters with the UID of the administrative AS/400 account:

   
   

   Code Block
   language java theme Emacs
   _adminId_ _agentAdminId_

   
   

5. Place a '#' in front of the following parameters to comment them out:

   
   

   Code Block
   language java theme Emacsjava
   _adminPwd_ _agentAdminPwd_

   
   

6. Remove the '#' from the following parameters to uncomment them:

   
   

   Code Block
   language java theme Emacs
   _adminPwdEncrypt_ _agentAdminPwdEncrypt_

   Copy 

   
   

7. Save the file and leave it open for the encrypted hex values.

To encrypt hex values for the passwords

1. Navigate to the C:\i5_Advanced_Adapter_5.0.0.4_Enterprise\scripts\propertyEncrypt.bat to  folder and copy the propertyEncrypt.bat file.
2. Paste the file in the C:\ldapgateway\dist and then open C:\ldapgateway\dist\propertyEncrypt.bat in  folder, and then open the file in the text editor of your choice.

3. Adjust the following line to the installation path of the Java JDK:

   
   

   Code Block
   language java theme Emacs
   set JAVA_HOME=C:\software\jdk1.5.0_15

   
   

   In our example, this line is changed to the following:

   
   

   Code Block
   language java theme Emacs
   set JAVA_HOME=C:\software\jdk1jdk-11.70.0_251

   
   

4. Scroll through the propertyEncrypt.bat file until you see the following line:

   
   

   Code Block
   theme language java Emacs
   SET CLASSPATH=C:\software\identityforge\ldapgateway\dist\idfserver.jar

   
   

   This Change this path needs to point to the IdentityForge installation directory. In our example, this line would be changed to the followingis:

   
   

   Code Block
   theme language java Emacs
   SET CLASSPATH=C:\ldapgateway\dist\idfserver.jar

   
   

5. Scroll to the end of the propertyEncrypt.bat file until you see the following lines:

   
   

   Code Block
   theme language java Emacs
   rem Start Property Encrypt Utility %JAVACMD%  %JVM_OPTS%  -cp %CLASSPATH%  com.identityforge.idfserver.util.AESCipherUtil idfRacfPwd

   
   

6. Change the bolded text idfRacfPwd to the password of the AS/400 administrative account, then save the propertyEncrypt.bat fileclose and save the file.

7. Double-click propertyEncrypt.bat. You should  to see something output similar to the following output:

   
   

   Code Block
   language java theme Emacs
   New encrypted string as HEX: 10902AA71C4DF819C965E8B5B7DF0208

   
   

8. Copy this the hex value (in our example, 10902AA71C4DF819C965E8B5B7DF0208) to the clipboard.
9. Navigate to to the C:\ldapgateway\conf and open  folder and open the as400.properties in  file in the text editor of your choice.

10. Paste the hex value into the following parameters:

    
    

    Code Block
    language java theme Emacs
    _adminPwdEncrypt_ _agentAdminPwdEncrypt_

    
    

To unpack the IdentityForge environment

1. Navigate to C:\ldapgateway\dist and rename idfserver.jar to idfserver.zip.
2. Extract the contents of idfserver.zip to C:\ldapgateway\dist\idfserver.

To configure the Front-End LDAP Administrative Account

The next step is to set the Front-End LDAP administrative account and password. This is the account used by EmpowerID to bind to the IdentityForge LDAP server.

1. Open C:\ldapgateway\dist\idfserver\beans.xml in the text editor of you choice and scroll to the below as400 section. We will be changing change the value for theFrontthe Front-End LDAP administrative account listed in bold:account adminUserDN and altAdminUserDN.

   
   

   Code Block
   language xml theme Emacs
   <bean name="as400" singleton="true" class="com.identityforge.idfserver.backend.as400.As400Module">

   
   

   Code Block
   theme language xml Emacs
   <property name="suffix" value="dc=as400,dc=com"/> <property name="workingDirectory" value="../as400"/> <property name="adminUserDN" value="cn=idfAs400Admin, dc=as400,dc=com"/> <property name="adminUserPassword" value="idfAs400Pwd"/> <property name="altAdminUserDN" value="cn=oimAs400Admin, dc=as400,dc=com"/> <property name="altAdminUserPassword" value="oimAs400Pwd"/> <property name="allowAnonymous" value="false"/> <property name="entryCacheSize" value="1000"/> <property name="defaultUacc" value="read"/> <property name="searchUsersType" value="user"/>

   
   

   IdentityForge provides the ability to have allows two Front-End LDAP administrative accounts, but for our purposes we only need one.

   
   

2. Change the adminUserDN and altAdminUserDN property values to the DN of the Front-End account you wish to use to bind to LDAP. For example:

   
   

   Code Block
   theme language xml Emacs
   <bean name="as400" singleton="true" class="com.identityforge.idfserver.backend.as400.As400Module">

   
   

   Code Block
   theme language xml Emacs
   <property name="suffix" value="dc=as400,dc=com"/> <property name="workingDirectory" value="../as400"/> <property name="adminUserDN" value="cn=EIDIDF, dc=as400,dc=com"/> <property name="adminUserPassword" value="idfAs400Pwd"/> <property name="altAdminUserDN" value="cn=EIDIDF, dc=as400,dc=com"/> <property name="altAdminUserPassword" value="oimAs400Pwd"/> <property name="allowAnonymous" value="false"/> <property name="entryCacheSize" value="1000"/> <property name="defaultUacc" value="read"/> <property name="searchUsersType" value="user"/>

   
   

3. Open C:\ldapgateway\dist\propertyEncrypt.bat in the text editor of yur your choice.

4. Scroll to the end of the propertyEncrypt.bat file until you see the following lines:

   
   

   Code Block
   language bash theme Emacs
   rem Start Property Encrypt Utility %JAVACMD%  %JVM_OPTS%  -cp %CLASSPATH%  com.identityforge.idfserver.util.AESCipherUtil idfRacfPwd

   
   

5. Change the bolded text idfRacfPwd to the password of the Front-End LDAP administrative account and then save the propertyEncrypt.bat file.

6. Double-click propertyEncrypt.bat. You should  to see something output similar to the following output:

   
   

   Code Block
   language bash theme Emacs
   New encrypted string as HEX: 10902AA71C4DF819C965E8B5B7DF0208

   
   

7. Copy the value (in our example, 10902AA71C4DF819C965E8B5B7DF0208) to the clipboard.

8. Change the adminUserPassword and altAdminUserPassword property values to the encrypted password string in the clipboard. For example:

   
   

   Code Block
   language xml theme Emacs
   <bean name="as400" singleton="true" class="com.identityforge.idfserver.backend.as400.As400Module">

   
   

   Code Block
   language xml theme Emacs
   <property name="suffix" value="dc=as400,dc=com"/> <property name="workingDirectory" value="../as400"/> <property name="adminUserDN" value="cn=EIDIDF, dc=as400,dc=com"/> <property name="adminUserPassword" value="10902AA71C4DF819C965E8B5B7DF0208”/> <property name="altAdminUserDN" value="cn=EIDIDF, dc=as400,dc=com"/> <property name="altAdminUserPassword" value="10902AA71C4DF819C965E8B5B7DF0208"/> <property name="allowAnonymous" value="false"/> <property name="entryCacheSize" value="1000"/> <property name="defaultUacc" value="read"/> <property name="searchUsersType" value="user"/>

   
   

To configure the Back-End LDAP Administrative Account

The next step is to set the Back-End LDAP administrative password. This is the account used by EmpowerID to bind to the IdentityForge LDAP server and sync inventory to the Back-End.

1. Open C:\ldapgateway\dist\idfserver\beans.xml in the text editor of your choice.

2. Scroll to the section shown below. We will be changing change the Back-End LDAP administrative account password listed in boldfor adminUserPassword and altAdminUserPassword:

   
   

   Code Block
   language xml theme Emacs
   <bean name="hpbe2" singleton="true" class="com.identityforge.idfserver.backend.hpbe.HPBEModule"> <property name="suffix" value="dc=system,dc=backend"/> <property name="workingDirectory" value="../system"/> <property name="schema" ref="schemas"/> <property name="adminUserDN" value="cn=Directory Manager, dc=system,dc=backend"/> <property name="adminUserPassword" value="testpass"/> <property name="altAdminUserDN" value="cn=Directory Manager, dc=system,dc=backend"/> <property name="altAdminUserPassword" value="testpass"/> <property name="entryCacheSize" value="1000"/>

   
   

3. Open C:\ldapgateway\dist\propertyEncrypt.bat in the text editor of your choice.

4. Scroll to the end of the propertyEncrypt.bat file until you see the following lines:

   
   

   Code Block
   language bash theme Emacs
   rem Start Property Encrypt Utility %JAVACMD%  %JVM_OPTS%  -cp %CLASSPATH%  com.identityforge.idfserver.util.AESCipherUtil idfRacfPwd

   
   

5. Change the bolded text Change idfRacfPwd to the password of the Back-End LDAP administrative account and then save the propertyEncrypt.bat file.

6. Double-click propertyEncrypt.bat. You should  to see something output similar to the following output:

   
   

   Code Block
   language bash theme Emacs
   New encrypted string as HEX: 10902AA71C4DF819C965E8B5B7DF0208

   
   

7. Copy the value (in our example, 10902AA71C4DF819C965E8B5B7DF0208) to the clipboard.

8. Change the adminUserPassword and altAdminUserPassword property values to the encrypted password string in the clipboard. For example:

   
   

   Code Block
   language xml theme Emacs
   <bean name="hpbe2" singleton="true" class="com.identityforge.idfserver.backend.hpbe.HPBEModule"> <property name="suffix" value="dc=system,dc=backend"/> <property name="workingDirectory" value="../system"/> <property name="schema" ref="schemas"/> <property name="adminUserDN" value="cn=Directory Manager, dc=system,dc=backend"/> <property name="adminUserPassword" value="10902AA71C4DF819C965E8B5B7DF0208"/> <property name="altAdminUserDN" value="cn=Directory Manager, dc=system,dc=backend"/> <property name="altAdminUserPassword" value="10902AA71C4DF819C965E8B5B7DF0208"/> <property name="entryCacheSize" value="1000"/>

   
   

To configure SSL for the IdentityForge LDAP server

To configure secure communications between EmpowerID and the IdentityForge LDAP server we

need a PFX copy of the certificate being used by EmpowerID and an installed copy of OpenSSL to convert the PFX to a format usable by Java keystores.

1. Install the Microsoft Visual C++ 2008 Redistributable Package (x86) by running vcredist_x86.exe.
2. Next, install Win32 OpenSSL v1.0.1e Light by running Win32OpenSSL_Light-1_0_1e.exe. In our example, we are choosing an installation path of C:\software\OpenSSL-Win32.
   1. Click Next. When prompted where to copy the OpenSSL DLLs, choose The OpenSSL binaries (/bin) directory.
   2. Click Next and finish the installation.
3. Copy the PFX certificate (named EIDcert.pfx in our example) to the root of the partition (C:\ in our example).
4. Open a Command Prompt window and navigate to C:\software\OpenSSL-Win32\bin.

   1. Execute the following command to convert the PFX file to a PEM file.

      
      

      Code Block
      language bash theme Emacs
      openssl pkcs12 -in C:\EIDcert.pfx -out C:\EIDcert.pem

      
      

      The OpenSSL toolkit will ask you to enter the import password; this is the pass phrase currently set on the PFX certificate. If you exported the certificate from the MMC snap-in, this will be the password you set on the certificate during the export.
      
      

   2. Enter the password for the certificate and press ENTER.
5. Next OpenSSL will prompt for the PEM pass phrase. We are setting a new pass phrase here--be sure to remember this value! You can use the same password as the import password if you want. Enter the pass phrase and press ENTER, then enter the pass phrase again to confirm and press ENTER once more. We now have a PEM file available at C:\EIDcert.pem.
6. Using a text editor of your choice, open the PEM file (C:\EIDcert.pem in our example). We need to extract the private key and place it in a separate file.

7. Find the following lines below:

   
   

   Code Block
   language xml theme Emacs
   -----BEGIN ENCRYPTED PRIVATE KEY----- DATA HERE -----END ENCRYPTED PRIVATE KEY-----

   
   

8. Copy everything from the beginning of the-----BEGIN ENCRYPTED PRIVATE KEY----- line to the end of the-----END ENCRYPTED PRIVATE KEY----- line and paste them into a new text file namedC:\encrypted.pem. Make sure there are no extra line breaks or spaces at the beginning or end of the file.

9. Next, we need to pull out the public key and put it into a separate file. Find the following lines below:

   
   

   Code Block
   language xml theme Emacs
   -----BEGIN CERTIFICATE----- DATA HERE -----END CERTIFICATE-----

   
   

10. Copy everything from the beginning of the -----BEGIN CERTIFICATE----- line to the end of the -----END CERTIFICATE----- line and paste them into a new text file named C:\cert.pem. Make sure there are no extra line breaks or spaces at the beginning or end of the file.
11. Next, we need to decrypt the RSA private key.
12. Open a Command Prompt window and navigate to C:\software\OpenSSL-Win32\bin.

13. Execute the following command:

    
    

    Code Block
    language bash theme Emacs
    openssl rsa -in C:\encrypted.pem -out C:\key.pem

    
    

14. When OpenSSL prompts you for the pass phrase, enter the PEM password you created earlier.
15. Next, we need to convert the PEM files to DER files.
16. Open a Command Prompt window and navigate to C:\software\OpenSSL-Win32\bin.

17. Execute the following two commands:

    
    

    Code Block
    language bash theme DJango
    openssl pkcs8 -topk8 -nocrypt -in C:\key.pem -inform PEM -out C:\key.der -outform DER openssl x509 -in C:\cert.pem -inform PEM -out C:\cert.der -outform DER

    
    

    Once these commands are completed, you will have two DER files. At this time it is recommended to delete the PFX and PEM files.
    
    

18. Next, copy ImportKey.class to the Java JDK bin folder (C:\software\jdk1.7.0_25\bin in our example).

19. Open a Command Prompt, navigate to C:\software\jdk1.7.0_25\bin and execute the following command to merge the two DER certificate files into a single Java keystore.

    
    

    Code Block
    language bash theme Emacs
    java ImportKey C:\key.der C:\cert.der

    
    

    
    

    Note the following line: Using keystore-file : C:\Users\USERNAME\keystore.ImportKey.
    
    
20. Navigate to the above directory, rename the keystore.ImportKey file to as400.jks and then copy it to the IdentityForge \conf directory (C:\ldapgateway\conf in our example).

21. Finally, we need to configure IdentityForge to point to this Java keystore. Open C:\ldapgateway\dist\idfserver\beans.xml in the text editor of your choice and scroll to the following section. We will be changing the Java keystore filename listed in bold:

    
    

    Code Block
    language xml theme Emacs
    <bean id="sslChannelFactory" class="com.identityforge.idfserver.nio.ssl.SSLChannelFactory"> <constructor-arg><value>false</value></constructor-arg> <constructor-arg><value>../conf/testnew.jks</value></constructor-arg> <constructor-arg><value>abc123</value></constructor-arg> <constructor-arg><value>false</value></constructor-arg> </bean>

    
    

22. Change the second constructor-arg value to the name of the Java keystore we created earlier. For example:

    
    

    Code Block
    language xml theme Emacs
    <bean id="sslChannelFactory" class="com.identityforge.idfserver.nio.ssl.SSLChannelFactory"> <constructor-arg><value>false</value></constructor-arg> <constructor-arg><value>../conf/as400.jks</value></constructor-arg> <constructor-arg><value>abc123</value></constructor-arg> <constructor-arg><value>false</value></constructor-arg> </bean>

    
    

23. The final step is to set the Java keystore password. We will be changing the Java keystore password listed inbold:

    
    

    Code Block
    language xml theme Emacs
    <bean id="sslChannelFactory" class="com.identityforge.idfserver.nio.ssl.SSLChannelFactory"> <constructor-arg><value>false</value></constructor-arg> <constructor-arg><value>../conf/as400.jks</value></constructor-arg> <constructor-arg><value>abc123</value></constructor-arg> <constructor-arg><value>false</value></constructor-arg> </bean>

    
    

24. Open C:\ldapgateway\dist\propertyEncrypt.bat in the text editor of your choice.

25. Scroll to the end of the propertyEncrypt.bat file until you see the following lines of code:

    
    

    Code Block
    language bash theme Emacs
    rem Start Property Encrypt Utility %JAVACMD%  %JVM_OPTS%  -cp %CLASSPATH%  com.identityforge.idfserver.util.AESCipherUtil idfRacfPwd

    
    

26. Change the bolded text to the password of the Java keystore. The default password is importkey. If you changed the keystore password earlier, please enter that value here instead. When finished, save the propertyEncrypt.bat file.

27. Double-click propertyEncrypt.bat. You should see something similar to the following output:

    
    

    Code Block
    language bash theme Emacs
    New encrypted string as HEX: 10902AA71C4DF819C965E8B5B7DF0208

    
    

28. Copy this value (in our example, 10902AA71C4DF819C965E8B5B7DF0208) to the clipboard. Change the Java keystore password listed in bold to the encrypted password string in the clipboard. For example:

    
    

    Code Block
    language xml theme Emacs
    <bean id="sslChannelFactory" class="com.identityforge.idfserver.nio.ssl.SSLChannelFactory"> <constructor-arg><value>false</value></constructor-arg> <constructor-arg><value>../conf/as400.jks</value></constructor-arg> <constructor-arg><value>10902AA71C4DF819C965E8B5B7DF0208</value></constructor-arg> <constructor-arg><value>false</value></constructor-arg> </bean>

    
    

29. Finally, since we are using an encrypted password for the Java keystore, we need to change the last constructor-arg value to true. For example:

    
    

    Code Block
    language xml theme Emacs
    <bean id="sslChannelFactory" class="com.identityforge.idfserver.nio.ssl.SSLChannelFactory"> <constructor-arg><value>false</value></constructor-arg> <constructor-arg><value>../conf/as400.jks</value></constructor-arg> <constructor-arg><value>10902AA71C4DF819C965E8B5B7DF0208</value></constructor-arg> <constructor-arg><value>true</value></constructor-arg> </bean>