Sun Identity Manager 8.1 Installation

Chapter 4 Installing Identity Manager on Sun GlassFish Enterprise Server

These instructions are divided into the following steps. During installation, you will need to know the password you selected when you set up the database.

Step 1: Install the Identity Manager Software

ProcedureTo Install the Identity Manager Software

Before You Begin

If you are installing multiple instances of Identity Manager on a single application server, change the waveset.serverId system property to a unique name for each Identity Manager instance. By default, the waveset.serverId Java system property is the name of the machine the application server is installed on. To set this property to another value, add the following command to the startup script for your application server.


  1. You may install the software using one of two methods:

    • Using the installer Graphic User Interface

      Run the install.bat (for Windows) or install (for UNIX) command to launch the installation process.

      If you copy the files from the installation media to your own location, note that the idm.war and install.class files must be in the same directory.

      The installer displays the Welcome panel.

    • Using the nodisplay option (UNIX only)

      On UNIX systems, open the directory where the software is located. Enter the following command to activate the installer in nodisplay mode:

      install -nodisplay

      The installer displays the Welcome text. The installer then presents a list of questions to gather installation information in the same order as the Graphic User Interface installer in these procedures.

    If no display is present, the installer defaults to the nodisplay option. The DISPLAY environment variable must be set to a valid X server or the installation may fail.

  2. Click Next.

    The installer displays the Install or Upgrade? panel.

  3. Leave the New Installation option selected, and then click Next.

    The installer displays the Select Installation Directory panel.

  4. Replace the displayed directory location with the location where you want to install Identity Manager. This could be a staging location or a specific folder. Enter the location (or click Browse to locate it), and then click Next.

    Note –

    If the directory you enter does not exist, Identity Manager prompts for confirmation, and then creates the directory.

  5. Click Next to begin installation.

    After installing the files, Identity Manager displays the Launch Setup panel.

    Note –

    Before you continue, if you plan to use a database, you may need to copy one or more files to the idm\WEB-INF\lib directory. For example, you may need to place into idm/WEB-INF/lib a JAR file containing a JDBC driver (for a DriverManager connection) or a JAR file containing a JNDI InitialContextFactory (for a DataSource connection). To determine the steps you may need to perform before you go on, see Appendix C, Database Reference. When finished, click Launch Setup to launch the Setup Wizard and continue with setup steps. If you click Launch Setup before copying your database files, setup will not proceed correctly. If this happens, quit the installation program, and then use the lh setup command to restart the setup portion of the installation process.

  6. Click Next on the Setup Wizard panel.

    The installer displays the Locate the Repository panel.

  7. Select a database from the list provided. Depending on your selection, setup prompts for additional setup information.

    See Appendix C, Database Reference, for selections and setup instructions.

  8. Click Next.

    The Continue Identity Manager Demo Setup? panel appears.

  9. If this is a non-demo installation click No, I will configure Identity Manager myself.

    Otherwise, if appropriate, click Yes, I would like to continue setting up a demonstration environment. This option allows you to quickly configure users and enter environment and server information.

  10. Enter the following personal information:

    • First name

    • Last name

    • Email address

    This personal information is used to create the Approver user (with configurator privileges.)

  11. Enter the following Approver information:

    • Approver name

    • Approver password

  12. Click Next.

  13. Select the Server Type from the list.

    Select None if your environment has no server to manage. If there is a server you wish to manage, select the appropriate server type. You will be prompted for further server information as appropriate.

  14. If you have an email SMTP server, click SMTP Host and enter the server address. If desired, click Test Server to verify communication to the SMTP server.

  15. If you would like email notifications to be written to a file, click Notification File. Click Browse to select another notification file.

  16. Click Next.

    The installer displays the Import Save Configuration panel.

  17. Click Execute to perform all the listed functions. If desired, click Hide Details.

  18. When all functions complete, click Done in the setup panel.

  19. If the application server is installed on a UNIX machine, change directories to the $WSHOME/bin directory and run the following command to allow the scripts in this directory to be executed.

    chmod -R +x *

Getting More Information

When installation completes, the installer displays the Installation Summary panel. For detailed information about the installation, click Details.

Not all messages may not be displayed here. View the log file (identified in details) for more information.

When finished, click Close to exit the installer.

After completing installation, continue by optionally installing the Identity Manager Gateway.

Step 2. Deploy Identity Manager on Sun GlassFish Enterprise Server

ProcedureTo Deploy Identity Manager on Sun GlassFish Enterprise Server

  1. Open a command prompt, then change to the staging directory where you installed the Identity Manager files. (This is the directory you specified in Step 1: Install the Identity Manager Software.)

  2. Create a .war file with the Identity Manager files by using the jar.exe (on Windows) or jar (on UNIX) command:

    c:\java1.5\bin\jar.exe cvf ..\idm.war * /usr/bin/jar cvf ../idm.war *

  3. Launch your application server and log in to the Java System Application Server Admin Console.

  4. Navigate to and expand the Applications folder in the left panel.

  5. Click the Web Applications folder.

  6. Click Deploy in the right panel.

  7. Enter the file path for the idm.war file, and then click Next.

  8. When prompted, set the Application Name to idm. Set the Context Root to /idm, and then click Finish.

  9. If you are deploying on Platform Edition 9, perform the following steps to ensure that you can create resources in Identity Manager.

    1. Click on the Application Server link in the left pane of the Admin Console

    2. Select the JVM Settings tab, then select the JVM Options tab.

    3. Click Add JVM Option.

    4. Add the the following to the blank box in the Value column:

    5. Click Save.

  10. Do NOT restart the application server. Continue to Step 3: Edit the server.policy File on the Application Server.

Step 3: Edit the server.policy File on the Application Server

Identity Manager must be given permissions to perform certain actions.

ProcedureTo Set Permissions on the Application Server

  1. Add the following lines to the server.policy file for the domain in which Identity Manager is installed (located in ApplicationServerHome/domains/domainName/config). Note that the ${waveset.home} variable must be expanded in the server.policy file.

    grant {
    permission java.lang.RuntimePermission "";
    permission java.lang.RuntimePermission "getClassLoader";
    permission java.lang.RuntimePermission "createClassLoader";
    permission java.lang.RuntimePermission "accessDeclaredMembers";
    permission com.waveset.repository.test.testConcurrentLocking "read";
    permission "*", "connect,resolve";
    permission "*", "read";
    permission java.util.PropertyPermission "*", "read,write";
    grant codeBase "file:${waveset.home}/-" {
    permission java.util.PropertyPermission "waveset.home", "read,write";
    permission java.util.PropertyPermission "security.provider", "read,write";
    permission "${waveset.home}${/} *", "read,write,execute";
    permission "${waveset.home}/help/index/-",
    permission "$($(/)*", "read,write,delete";
    permission java.util.PropertyPermission "*", "read,write";
    permission java.lang.RuntimePermission "";
    permission "*", "connect,resolve";

    If you want to deploy Sun Identity Manager Service Provider, add the following permissions to the above server.policy file entries.

    grant {
    permission java.lang.RuntimePermission "shutdownHooks";
    permission "${waveset.home}/WEB-INF/spe/config/spe.tld", "read";

    Note –

    If you fail to update the old server.policy file with the above, and try to use the search engine, lock files may be created in the index directory that cannot be removed by the container. This always causes queries to hang, even if the server.policy file is subsequently updated.

    For example, the contents of the help/index/docs directory should contain these five files:


    In addition to the above, there may be two lock files:


    These must be deleted manually. Once these are removed (and the server.policy file updated correctly), search queries will work as expected.

    If you want to run with trace set to write to a file, you will need to add the following additional permissions to the server.policy file.

    grant {
      permission "/var/opt/SUNWappserver/domains/domain1/applications/j2ee-modules/
    idm/config/trace1.log", "read,write";
      permission "$($(/)*", "read,write,delete";
      permission java.util.PropertyPermission "trace.file", "read";
      permission java.util.PropertyPermission "trace.destination", "read";
       permission java.util.PropertyPermission "trace.enabled", "read";

    where FilePermission is the actual path of the trace file. Adjust the path to the output file as needed.

  2. Restart the application server.

  3. To verify setup, log in to Identity Manager. You can do this within the Admin Console by clicking the Launch button on the “idm” line of the Web Applications folder.

Step 4. Install Optional Components

If your IT environment has Windows Active Directory, Novell NetWare, Domino, Remedy, or RSA ACE/Server resources, you should install the Identity Manager Gateway.

If your IT environment has Windows Active Directory domains, you should also install PasswordSync. The Identity Manager PasswordSync feature keeps user password changes made on Windows Active Directory domains synchronized with other resources defined in Identity Manager.

See Part III, Installing Optional Components for installation information.