Deployment Example: SAML v2 Using Sun OpenSSO Enterprise 8.0

Chapter 4 Installing Sun Java System Directory Server and Creating Instances for User Data

This chapter contains instructions for installing Sun Java™ System Directory Server and creating the instances in which user data will be stored. Additionally, the procedure for enabling multi-master replication between the two instances and the procedure for configuring the user data load balancer are included. This chapter contains the following sections:

Note –

If you have an existing user data store, you can go directly to the instructions in Chapter 5, Deploying and Configuring OpenSSO Enterprise.

4.1 Installing and Configuring Directory Server 1 and Directory Server 2

This section contains the instructions for installing Directory Server on two different host machines on the identity provider side. Post installation, create the directory instances named idp-users in which the user data will be stored. Use the following list of procedures as a checklist for completing the task.

To Download the Directory Server Bits and Required Patches to the Host Machines

Use this procedure to download the Directory Server Enterprise Edition (EE) 6.3 bits and the required system patches to both the Directory Server 1 host machine (ds1.idp-example.com) and the Directory Server 2 host machine (ds2.idp-example.com).

Access http://www.sun.com/software/products/directory_srvr_ee/get.jsp from a web browser and click Download Now.

Provide the following information in the Select product configuration section and click View Downloads.

Step 1: Select Component

Directory Server Enterprise Edition 6.x

Step 2: Select Version

6.3

Step 3: Select Delivery Type

Compress Archive (ZIP)

Step 4: Select Platform

Choose the platform you are using.

The Selection Results page will be displayed with links to the download sites for the Directory Server bits and required patches.

Note –
The patch numbers generated for download on the Selection Results page are based on your input. Check the most recent Directory Server Enterprise Edition 6.3 Release Notes to determine if you need to install other patches based on your machine's architecture and operating system. In this deployment, the Release Notes indicate that based on the hardware and operating system being used, patch 118855, patch 127112, patch 119964, patch 125379, and patch 119255 are required.

Log into the ds1.idp-example.com host machine as a root user.

Run patchadd to see if the patches are already installed.

See the patchadd man page for more information.
# /usr/sbin/patchadd -p | grep 118855
No results are returned which indicates that the patch is not yet installed on the system.
# /usr/sbin/patchadd -p | grep 127112
No results are returned which indicates that the patch is not yet installed on the system.
# /usr/sbin/patchadd -p | grep 119964
No results are returned which indicates that the patch is not yet installed on the system.
# /usr/sbin/patchadd -p | grep 125379
No results are returned which indicates that the patch is not yet installed on the system.
# /usr/sbin/patchadd -p | grep 119255
No results are returned which indicates that the patch is not yet installed on the system.

Note –
If these patches are already installed on your machine, proceed to step 7.

Make a directory for the patch downloads and change into it.
# mkdir /export/patches # cd /export/patches

Download the patches.

You can click on the patch links from the Selection Results page or search for patches directly at http://sunsolve.sun.com. If searching directly, navigate to the PatchFinder page and enter the patch number. For each patch you are downloading, click the HTTP link beside the heading Download Signed Patch (xxx bytes).

Note –
Signed patches are downloaded as JAR files. Unsigned patches are downloaded as ZIP files. In this step, ZIP files are downloaded.

Make a directory for the Directory Server download and change into it.
# mkdir /export/DS63 # cd /export/DS63

Download the Base Full Install of Directory Server EE 6.3 — Zip Distribution, Multi-Language, (DS/DPS/DE/ISW/DSRK) bits.

Note –
No Directory Server Administration Console is installed with these bits. This deployment example uses the command line to configure the software.

Log out of the ds1.idp-example.com host machine.

Repeat this same procedure on the ds2.idp-example.com host machine.

To Patch the Directory Server Host Machines

If necessary, use this procedure to patch both the ds1.idp-example.com host machine and the ds2.idp-example.com host machine.

Change into the directory that contains the downloaded patch files.
# cd /export/patches

Unzip the patch files.

# unzip 118855.zip
# unzip 127112.zip
# unzip 119964.zip
# unzip 125379.zip
# unzip 119255.zip

Install the patches.

# /usr/sbin/patchadd /export/patches/118855
# /usr/sbin/patchadd /export/patches/127112
# /usr/sbin/patchadd /export/patches/119964
# /usr/sbin/patchadd /export/patches/125379
# /usr/sbin/patchadd /export/patches/119255

Tip –

You can use the -M option to install all patches at once. See the patchadd man page for more information.

Reboot your machine, if requested.

After installation is complete, verify that each patch was added successfully.
# /usr/sbin/patchadd -p | grep 118855
A series of patch numbers are displayed, and the patch 118855 is present.
# /usr/sbin/patchadd -p | grep 127112
A series of patch numbers are displayed, and the patch 127112 is present.
# /usr/sbin/patchadd -p | grep 119964
A series of patch numbers are displayed, and the patch 119964 is present.
# /usr/sbin/patchadd -p | grep 125379
A series of patch numbers are displayed, and the patch 125379 is present.
# /usr/sbin/patchadd -p | grep 119255
A series of patch numbers are displayed, and the patch 119255 is present.

Log out of the ds1.idp-example.com host machine.

Repeat this same procedure on the ds2.idp-example.com host machine.

To Install Directory Server 1

Before You Begin

This procedures assumes To Download the Directory Server Bits and Required Patches to the Host Machines and To Patch the Directory Server Host Machines have been completed.

(Optional) Resolve the following issues, if necessary.
- The LD_LIBRARY_PATH environment variable should not be set to the default setting. Change the value to empty as in the following example:
  # setenv LD_LIBRARY_PATH
- The JAVA_HOME environment variable should be set appropriately for your system architecture as in the following example:
  # setenv JAVA_HOME /usr/jdk/jdk1.5.0_09

Unzip the Directory Server ZIP file.

# cd /export/DS63
# ls

DSEE.6.1.Solaris10-X86_AMD64-full.tar.gz

# gunzip DSEE.6.3.Solaris10-X86_AMD64-full.tar.gz

Untar the resulting .tar file.
# tar xvf DSEE.6.1.Solaris10-X86_AMD64-full.tar
The DSEE_ZIP_Distribution directory is the result of the decompression.

Change into DSEE_ZIP_Distribution and run dsee_deploy install to install Directory Server.
# cd DSEE_ZIP_Distribution # ./dsee_deploy install -i /var/opt/mps/serverroot
The Licensing Agreement is displayed. At each Type return to continue prompt, press Return to continue.

When Do you accept the license terms? is displayed, enter yes to continue.

Once you accept the license terms, the Directory Server binaries will be installed in the /var/opt/mps/serverroot/ds6 directory.

To Create a User Data Instance on Directory Server 1

Use this procedure to create a Directory Server instance named idp-users for storing user data. The instance uses port 1489 for LDAP and port 1736 for LDAPS.

Before You Begin

This procedure assumes you have just completed To Install Directory Server 1 and are still logged into the ds1.idp-example.com host machine as a root user.

Change to the bin directory.
# cd /var/opt/mps/serverroot/ds6/bin

Run dsadm create to create a user data instance called idp-users.

# ./dsadm create -p 1489 -P 1736 /var/opt/mps/idp-users

Choose the Directory Manager password: dsmanager

Confirm the Directory Manager password: dsmanager

use 'dsadm start /var/opt/mps/idp-users' to start the instance

Run dsadm start to start the instance.

# ./dsadm start /var/opt/mps/idp-users

Server started: pid=5810

Run netstat to verify that the new instance is up and running on both ports.

# netstat -an | grep 1736

.1736		*.*		0		0  65536		0 LISTEN
.1736		*.*		0		0  65536		0 LISTEN

# netstat -an | grep 1489

.1489		*.*		0		0  65536		0 LISTEN
.1489		*.*		0		0  65536		0 LISTEN

Run ldapsearch to verify that you can read the root Directory Server entry of the new instance.

# cd /var/opt/mps/serverroot/dsrk6/bin
# ./ldapsearch -h ds1.idp-example.com 
-p 1489 -b "" -s base "(objectclass=*)"

version: 1
dn:
objectClass: top
...
supportedLDAPVersion: 3
vendorname: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.3
...

To Create a Base Suffix for the User Data Instance on Directory Server 1

Use this procedure to create the base suffix in which the user entries will be stored.

Before You Begin

This procedure assumes you have just completed To Create a User Data Instance on Directory Server 1 and are still logged into the ds1.idp-example.com host machine as a root user.

Run dsconf create-suffix to create a base suffix.

# ./dsconf create-suffix -p 1489 -B dbExample 
-L /var/opt/mps/idp-users/db/exampleDS dc=company,dc=com

Provide the appropriate information when prompted.

Certificate "CN=ds1, CN=1736, CN=directory Server, O=Sun Microsystems" 
presented by the server is not trusted.

Type "Y" to accept, "y" to accept just once, "n" to refuse, "d" for more details: Y

Enter "cn=Directory Manager" password: dsmanager

Tip –

When you enter an uppercase Y, you are not asked for the certificate again in the next steps.

Run dsconf list-suffixes to verify that the base suffix was successfully created.
# ./dsconf list-suffixes -p 1489 Enter "cn=Directory Manager" password: dsmanager dc=company,dc=com
If the base suffix was successfully created, dc=company,dc=com is returned. You can also see idp-users in a command line list of directory instances.
# cd /var/opt/mps # ls idp-users serverroot

Log out of the ds1.idp-example.com host machine.

To Install Directory Server 2

Before You Begin

This procedures assumes To Download the Directory Server Bits and Required Patches to the Host Machines and To Patch the Directory Server Host Machines have been completed.

(Optional) Resolve the following issues, if necessary.
- The LD_LIBRARY_PATH environment variable should not be set to the default setting. Change the value to empty as in the following example:
  # setenv LD_LIBRARY_PATH
- The JAVA_HOME environment variable should be set appropriately for your system architecture as in the following example:
  # setenv JAVA_HOME /usr/jdk/jdk1.5.0_09

Unzip the Directory Server ZIP file.

# cd /export/DS63
# ls

DSEE.6.3.Solaris10-X86_AMD64-full.tar.gz

# gunzip DSEE.6.3.Solaris10-X86_AMD64-full.tar.gz

Untar the resulting .tar file.
# tar xvf DSEE.6.3.Solaris10-X86_AMD64-full.tar
The DSEE_ZIP_Distribution directory is the result of the decompression.

Change into DSEE_ZIP_Distribution and run dsee_deploy install to install Directory Server.
# cd DSEE_ZIP_Distribution # ./dsee_deploy install -i /var/opt/mps/serverroot
The Licensing Agreement is displayed. At each Type return to continue prompt, press Return to continue.

When Do you accept the license terms? is displayed, enter yes to continue.

Once you accept the license terms, the Directory Server binaries will be installed in the /var/opt/mps/serverroot/ds6 directory.

To Create a User Data Instance on Directory Server 2

Use this procedure to create a Directory Server instance named idp-users for storing user data. The instance uses port 1489 for LDAP and port 1736 for LDAPS.

Before You Begin

This procedure assumes you have just completed To Install Directory Server 2 and are still logged into the ds2.idp-example.com host machine as a root user.

Change to the bin directory.
# cd /var/opt/mps/serverroot/ds6/bin

Run dsadm create to create a user data instance called idp-users.

# ./dsadm create -p 1489 -P 1736 /var/opt/mps/idp-users

Choose the Directory Manager password: dsmanager

Confirm the Directory Manager password: dsmanager

use 'dsadm start /var/opt/mps/idp-users' to start the instance

Run dsadm start to start the instance.

# ./dsadm start /var/opt/mps/idp-users

Server started: pid=5810

Run netstat to verify that the new instance is up and running on both ports.

# netstat -an | grep 1736

.1736		*.*		0		0  65536		0 LISTEN
.1736		*.*		0		0  65536		0 LISTEN

# netstat -an | grep 1489

.1489		*.*		0		0  65536		0 LISTEN
.1489		*.*		0		0  65536		0 LISTEN

Run ldapsearch to verify that you can read the root Directory Server entry of the new instance.

# cd /var/opt/mps/serverroot/dsrk6/bin
# ./ldapsearch -h ds2.idp-example.com 
-p 1489 -b "" -s base "(objectclass=*)"

version: 1
dn:
objectClass: top
...
supportedLDAPVersion: 3
vendorname: Sun Microsystems, Inc.
vendorVersion: Sun-Java(tm)-System-Directory/6.3
...

To Create a Base Suffix for the User Data Instance on Directory Server 2

Use this procedure to create the base suffix in which the user entries will be stored.

Before You Begin

This procedure assumes you have just completed To Create a User Data Instance on Directory Server 2 and are still logged into the ds2.idp-example.com host machine as a root user.

Run dsconf create-suffix to create a base suffix.

# ./dsconf create-suffix -p 1489 -B dbExample 
-L /var/opt/mps/idp-users/db/exampleDS dc=company,dc=com

Provide the appropriate information when prompted.

Certificate "CN=ds2, CN=1736, CN=directory Server, O=Sun Microsystems" 
presented by the server is not trusted.

Type "Y" to accept, "y" to accept just once, "n" to refuse, "d" for more details: Y

Enter "cn=Directory Manager" password: dsmanager

Tip –

When you enter an uppercase Y, you are not asked for the certificate again in the next steps.

Run dsconf list-suffixes to verify that the base suffix was successfully created.
# ./dsconf list-suffixes -p 1489 Enter "cn=Directory Manager" password: dsmanager dc=company,dc=com
If the base suffix was successfully created, dc=company,dc=com is returned. You can also see idp-users in a command line list of directory instances.
# cd /var/opt/mps # ls idp-users serverroot

Log out of the ds2.idp-example.com host machine.

4.2 Enabling Multi-Master Replication of the User Data Instances

This section contains the instructions to enable multi-master replication (MMR) between two Directory Server instances, each configured as a master. This includes creating replication agreements between the masters and initializing the second directory master with the data and schema from the first directory master. The previously created idp1-user and idp2-user instances will serve as the two master instances. Use the following list of procedures as a checklist for completing the task.

To Enable Multi-Master Replication for the User Data Instance on Directory Server 1

(Optional) Run dsconf list-suffixes to verify that the user data instance is not already enabled for replication.

# cd /var/opt/mps/serverroot/ds6/bin
# ./dsconf list-suffixes -p 1489 -v

Enter "cn=Directory Manager" password: dsmanager
...
dc=company,dc=com 	1		not-replicated		N/A		N/A		29	0

The "list-suffixes" operation succeeded on "ds1.idp-example.com:1489"

The base suffix of the user data instance is not replicated.

Run dsconf enable-repl to enable replication of the user data instance.

# ./dsconf enable-repl -h ds1.idp-example.com 
-p 1489 -d 11 master dc=company,dc=com

Enter "cn=Directory Manager" password: dsmanager

Use "dsconf create-repl-agmt" to create replication agreements on
"dc=company,dc=com".

The -d option takes as input a randomly chosen identifier to represent the Directory Server 1 user data instance; in this case, 11 master indicates that the user data instance is a master and not a replica. The base suffix is specified as dc=company,dc=com.

Run dsconf list-suffixes again to verify that the instance is now enabled for replication.

# ./dsconf list-suffixes -p 1489 -v

Enter "cn=Directory Manager" password: dsmanager
...
dc=company,dc=com 	1		master(11)		N/A		N/A		29	0

The "list-suffixes" operation succeeded on 
"ds1.idp-example.com:1489"

The base suffix of the instance is master(11) indicating that the master was successfully enabled.

Log out of the ds1.idp-example.com host machine.

To Enable Multi-Master Replication for the User Data Instance on Directory Server 2

(Optional) Run dsconf list-suffixes to verify that the user data instance is not already enabled for replication.

# cd /var/opt/mps/serverroot/ds6/bin
# ./dsconf list-suffixes -p 1489 -v

Enter "cn=Directory Manager" password: dsmanager
...
dc=company,dc=com 	1		not-replicated		N/A		N/A		29	0

The "list-suffixes" operation succeeded on 
"ds2.idp-example.com:1489"

The base suffix of the user data instance is not replicated.

Run dsconf enable-repl to enable replication of the user data instance.

# ./dsconf enable-repl -h ds2.idp-example.com -p 1489 
-d 22 master dc=company,dc=com

Enter "cn=Directory Manager" password: dsmanager

Use "dsconf create-repl-agmt" to create replication agreements on
"dc=company,dc=com".

The -d option takes as input a randomly chosen identifier to represent the Directory Server 2 user data instance; in this case, 22 master indicates that the user data instance is a master and not a replica. The base suffix is specified as dc=company,dc=com.

Run dsconf list-suffixes again to verify that the instance is now enabled for replication.

# ./dsconf list-suffixes -p 1489 -v

Enter "cn=Directory Manager" password: dsmanager
...
dc=company,dc=com 	1		master(22)		N/A		N/A		29		0

The "list-suffixes" operation succeeded on 
"ds2.idp-example.com:1489"

The base suffix of the instance is master(22) indicating that the master was successfully enabled.

Log out of the ds2.idp-example.com host machine.

To Change the Default Replication Manager Password for Each User Data Instance

The replication manager is the user that data suppliers use to bind to the consumer server when sending replication updates. (In MMR the consumer server refers to whichever master happens to be the consumer for a particular operation.) It is recommended to change the default password created during the process of enabling replication.

Create a temporary file that contains the new replication manager password.

This file will be read once, and the password stored for future use.
# cd /var/opt/mps/serverroot/ds6/bin # echo replmanager > pwd.txt

Verify that the file was successfully created.
# cat pwd.txt replmanager

Run dsconf set-server-prop to set the replication manager password using pwd.txt as input.

# ./dsconf set-server-prop -h ds1.idp-example.com 
-p 1489 def-repl-manager-pwd-file:pwd.txt

Enter "cn=Directory Manager" password: dsmanager

Remove the pwd.txt file.

Log out of the ds1.idp-example.com host machine.

Create a temporary file that contains the new replication manager password.

This file will be read once, and the password stored for future use.
# cd /var/opt/mps/serverroot/ds6/bin # echo replmanager > pwd.txt

Verify that the file was successfully created.
# cat pwd.txt replmanager

Run dsconf set-server-prop to set the replication manager password using pwd.txt as input.

# ./dsconf set-server-prop -h ds2.idp-example.com 
-p 1489 def-repl-manager-pwd-file:pwd.txt

Enter "cn=Directory Manager" password: dsmanager

Remove the pwd.txt file.

Log out of the ds2.idp-example.com host machine.

To Create Replication Agreements for Each User Data Instance

A replication agreement is a set of parameters on a supplier that controls how updates are sent to a given consumer. In this deployment, the agreement simply makes the user data instances aware of each other.

Run dsconf create-repl-agmt to create the replication agreement.

# cd /var/opt/mps/serverroot/ds6/bin
# ./dsconf create-repl-agmt -h ds1.idp-example.com 
 -p 1489 dc=company,dc=com ds2.idp-example.com:1489

Enter "cn=Directory Manager" password: dsmanager

Use "dsconf init-repl-dest dc=company,dc=com 
ds2.idp-example.com:1489" to start replication of 
"dc=company,dc=com" data.

Run dsconf list-repl-agmts to verify that the replication agreement was successfully created.
# ./dsconf list-repl-agmts -p 1489 Enter "cn=Directory Manager" password: dsmanager dc=company,dc=com ds2.idp-example.com:1489
This response indicates that the Directory Server 1 base suffix will be replicated to Directory Server 2.

Log out of the ds1.idp-example.com host machine.

Run dsconf create-repl-agmt to create the replication agreement.

# cd /var/opt/mps/serverroot/ds6/bin
# ./dsconf create-repl-agmt -h ds2.idp-example.com 
-p 1489 dc=company,dc=com ds1.idp-example.com:1489

Enter "cn=Directory Manager" password: dsmanager

Use "dsconf init-repl-dest dc=company,dc=com ds1.idp-example.com:1489" 
to start replication of "dc=company,dc=com" data.

Run dsconf list-repl-agmts to verify that the replication agreement was successfully created.
# ./dsconf list-repl-agmts -p 1489 Enter "cn=Directory Manager" password: dsmanager dc=company,dc=com ds1.idp-example.com:1489
This response indicates that the Directory Server 2 base suffix will be replicated to Directory Server 1.

Log out of the ds2.idp-example.com host machine.

To Initialize the Replication Agreements

Use this procedure to initialize the user data instance on Directory Server 1. The previously created agreements will allow the data to replicate on Directory Server 2.

Note –

Initialization is not required on both instances when configuring for MMR.

Run dsconf show-repl-agmt-status to verify that the replication agreements are not yet initialized.

# cd /var/opt/mps/serverroot/ds6/bin
# ./dsconf show-repl-agmt-status -h ds1.idp-example.com 
 -p 1489 dc=company,dc=com ds2.idp-example.com:1489

Enter "cn=Directory Manager" password: dsmanager

Configuration Status 		: OK
Authentication Status		: OK
Initialization Status		: NOT OK

Status:						: Dest. Not Initialized

Run dsconf init-repl-dest to initialize the replication agreements.

# ./dsconf init-repl-dest -h ds1.idp-example.com 
 -p 1489 dc=company,dc=com ds2.idp-example.com:1489

Enter "cn=Directory Manager" password: dsmanager

Started initialization of "ds2.idp-example.com:1489"; Aug 25, 2008 3:10:01 PM
Sent 2 entries.
Completed initialization of "ds1.idp-example.com:1489"; Aug 25, 2008 3:10:04 PM

Run dsconf show-repl-agmt-status again to verify that the replication agreements are now initialized.

# ./dsconf show-repl-agmt-status -h ds1.idp-example.com 
 -p 1489 dc=company,dc=com ds2.idp-example.com:1489

Enter "cn=Directory Manager" password: dsmanager

Configuration Status 		: OK
Authentication Status		: OK
Initialization Status		: OK

Status:						: Enabled
Last Update Date				:  Aug 25, 2008 3:10:08 PM

To Verify Successful User Data Replication

Before You Begin

This procedure assumes you have just completed To Initialize the Replication Agreements and are still logged into the ds1.idp-example.com host machine as a root user.

Run ldapmodify on the ds1.idp-example.com host machine to create a new directory entry.

# cd /var/opt/mps/serverroot/dsrk6/bin
# ./ldapmodify -a -h ds1.idp-example.com -p 1489 
 -D cn=admin,cn=Administrators,cn=config -w dsmanager

dn: ou=People,dc=company,dc=com
objectclass: top
objectclass: organizationalUnit
ou: People
description: Container for user entries

Hit ENTER to indicate end of input.

adding new entry ou=People,dc=company,dc=com

Hit Control C to terminate the command.

^C

This step creates a new organizational unit on Directory Server 1.

After the entry is created, log in to the ds2.idp-example.com host machine as a root user.

Run ldapsearch on Directory Server 2 to verify that the directory entry was successfully replicated.

# cd /var/opt/mps/serverroot/dsrk6/bin
# ./ldapsearch -b "dc=company,dc=com" -p 1489 
-D "cn=Directory Manager" -w dsmanager 
"objectclass=organizationalUnit"

version: 1
dn: ou=People,dc=company,dc=com
objectClass: top
objectClass: organizationalUnit
ou: People
description Container for user entries

Run ldapdelete on Directory Server 2 to delete the entry just found.

# ./ldapdelete -h ds2.idp-example.com -p 1489 
 -D "cn=Directory Manager" -w dsmanager 
"ou=People,dc=company,dc=com"

Run ldapsearch on Directory Server 1 to verify that the entry was deleted.
# ./ldapsearch -b "dc=company,dc=com" -p 1489 -D "cn=Directory Manager" -w dsmanager "objectclass=organizationalUnit"
The search will return no results as the delete was successfully replicated.

Log out of both Directory Server host machines.

4.3 Modifying the Directory Server Schema

This deployment will be used to test SAML v2 communications. Towards this end, modify the LDAP schema used by the Directory Server user data instances on the identity provider side to recognize and store SAML v2 attributes.

To Modify the Directory Server LDAP Schema for SAML v2 User Data

Create an LDIF file with the following information and save it as /tmp/saml.ldif.

This file includes SAML v2 LDAP attributes.

dn: CN=schema
changetype:modify
add:attributeTypes
attributeTypes: ( 1.3.6.1.4.1.42.2.27.9.1.500 
NAME 'sun-fm-saml2-nameid-infokey' 
DESC 'SAML 2.0 Name Identifier Information Key' 
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 
'Sun Java System Access Management' )

attributeTypes: ( 1.3.6.1.4.1.42.2.27.9.1.501 
NAME 'sun-fm-saml2-nameid-info' 
DESC 'SAML 2.0 Name Identifier Information' 
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 
'Sun Java System Access Management' )
-
add:objectClasses
objectClasses: ( 1.3.6.1.4.1.42.2.27.9.2.200 
NAME 'sunFMSAML2NameIdentifier' 
DESC 'SAML 2.0 name identifier objectclass' 
SUP top AUXILIARY MAY 
( sun-fm-saml2-nameid-infokey $ sun-fm-saml2-nameid-info ) 
X-ORIGIN 'Sun Java System Access Management' )

Run ldapmodify on the ds1.idp-example.com host machine using /tmp/saml.ldif as input.

# cd /var/opt/mps/serverroot/dsrk6/bin
# ldapmodify -a -h ds1.idp-example.com -p 1489 
-D "cn=Directory Manager" -w dsmanager -f /tmp/saml.ldif

modifying entry CN=schema

Log out of the ds1.idp-example.com host machine.

4.4 Enabling Secure Communication for the Directory Server User Data Instances

By default, when an instance of Directory Server is created, its SSL port is secured with a self-signed certificate named defaultCert. A self-signed certificate contains a public and private key; the public key is signed by the private key. The idp-users instances, though, need to use a server certificate signed by a certificate authority (CA) to allow for secure communication between the instances and the soon-to-be-installed load balancer. This entails installing a CA root certificate and a server certificate (signed by the CA root certificate) on both Directory Server host machines. Use the following list of procedures as a checklist for completing this task.

To Import a Root Certificate and a Server Certificate to Directory Server 1

Before You Begin

You should already have a root certificate from the CA of your choice. Send server certificate requests to the same CA. For more information, see 3.3 Obtaining Secure Socket Layer Certificates.

Generate a request for a server certificate signed by a CA.

# cd /var/opt/mps/serverroot/ds6/bin
# ./dsadm request-cert -S "CN=ds1.idp-example.com, 
OU=OpenSSO Enterprise, O=Sun Microsystems, L=Santa Clara 
 ST=California, C=US" -F ascii -o ds1.csr /var/opt/mps/idp-users

ds1.csr is the certificate request.

Send ds1.csr to the CA of your choice.

The CA issues and returns a certified server certificate named ds1.cer.

Add ds1.cer, the CA-signed server certificate, to the certificate store.
# ./dsadm add-cert /var/opt/mps/idp-users ds1 ds1.cer

(Optional) Verify that the certificate was successfully added.
# ./dsadm list-certs /var/opt/mps/idp-users
A list of certificates for the idp-users instance is displayed including the defaultCert and ds1.

Add ca.cer, the root certificate, to the certificate store.

# ./dsadm add-cert --ca /var/opt/mps/idp-users CA-cert ca.cer

(Optional) Verify that the root certificate was successfully added.

# ./dsadm list-certs -C /var/opt/mps/idp-users | grep CA-cert

CA-cert
2007/09/20 11:41  2010/06/17 11:41  n  
E=nobody@nowhere.com,CN=openssltestca,OU=am,
O=sun,L=santa clara,ST=california,C=us  Same as issuer

Configure the Directory Server instance to use the imported certificates.

# ./dsconf set-server-prop -h ds1.idp-example.com 
-p 1489 ssl-rsa-cert-name:ds1

Enter "cn=Directory Manager" password: dsmanager

Before setting SSL configuration, export Directory Server data.

Do you want to continue [y/n] ?  y

Directory Server must be restarted for changes to take effect.

Restart the Directory Server instance.

# ./dsadm stop /var/opt/mps/idp-users
# ./dsadm start /var/opt/mps/idp-users

Server started: pid=5472

Run ldapsearch on Directory Server 1 to verify that the directory entries can be accessed through the secure port.

# cd /var/opt/mps/serverroot/dsrk6/bin
# ./ldapsearch -h ds1.idp-example.com -p 1736 
-Z -P /var/opt/mps/idp-users/alias/slapd-cert8.db 
-b "" -s base "(objectclass=*)"

version: 1
dn:
objectClass:top
namingContexts: dc=company,dc=com
supportedExtension: 2.16.840.1.113730.3.5.7
:
supportedSSLCiphers: SSL-CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL-CK_RC2_128_CBC_EXPORT40_WITH_MD5

This confirms that the Directory Server instance can be accessed through the secure port.

Log out of the ds1.idp-example.com host machine.

To Import a Root Certificate and a Server Certificate to Directory Server 2

Before You Begin

You should already have a root certificate from the CA of your choice. Send any server certificate requests to the same CA. For more information, see 3.3 Obtaining Secure Socket Layer Certificates.

Generate a request for a server certificate signed by a CA.

# cd /var/opt/mps/serverroot/ds6/bin
# ./dsadm request-cert -S "CN=ds2.idp-example.com, 
OU=OpenSSO Enterprise, O=Sun Microsystems, L=Santa Clara 
 ST=California, C=US" -F ascii -o ds2.csr /var/opt/mps/idp-users

ds2.csr is the certificate request.

Send ds2.csr to the CA of your choice.

The CA issues and returns a certified server certificate named ds2.cer.

Add ds2.cer, the CA-signed server certificate, to the certificate store.
# ./dsadm add-cert /var/opt/mps/idp-users ds2 ds2.cer

(Optional) Verify that the certificate was successfully added.
# ./dsadm list-certs /var/opt/mps/idp-users
A list of certificates for the idp-users instance is displayed including the defaultCert and ds2.

Add ca.cer, the root certificate, to the certificate store.

# ./dsadm add-cert --ca /var/opt/mps/idp-users CA-cert ca.cer

(Optional) Verify that the root certificate was successfully added.

# ./dsadm list-certs -C /var/opt/mps/idp-users | grep CA-cert

CA-cert
2007/09/20 11:41  2010/06/17 11:41  n  
E=nobody@nowhere.com,CN=openssltestca,OU=am,
O=sun,L=santa clara,ST=california,C=us  Same as issuer

Configure the Directory Server instance to use the imported certificates.

# ./dsconf set-server-prop -h ds2.idp-example.com 
-p 1489 ssl-rsa-cert-name:ds2

Enter "cn=Directory Manager" password: dsmanager

Before setting SSL configuration, export Directory Server data.

Do you want to continue [y/n] ?  y

Directory Server must be restarted for changes to take effect.

Restart the Directory Server instance.

# ./dsadm stop /var/opt/mps/idp-users
# ./dsadm start /var/opt/mps/idp-users

Server started: pid=5472

Run ldapsearch on Directory Server 2 to verify that the directory entries can be accessed through the secure port.

# cd /var/opt/mps/serverroot/dsrk6/bin
# ./ldapsearch -h ds2.idp-example.com -p 1736 
-Z -P /var/opt/mps/idp-users/alias/slapd-cert8.db 
-b "" -s base "(objectclass=*)"

version: 1
dn:
objectClass:top
namingContexts: dc=company,dc=com
supportedExtension: 2.16.840.1.113730.3.5.7
:
supportedSSLCiphers: SSL-CK_RC4_128_EXPORT40_WITH_MD5
supportedSSLCiphers: SSL-CK_RC2_128_CBC_EXPORT40_WITH_MD5

This confirms that the Directory Server instance can be accessed through the secure port.

Log out of the ds2.idp-example.com host machine.

4.5 Configuring the Directory Server Load Balancer

Load Balancer 1 (lb1.idp-example.com) is configured in front of the Directory Server instances on the identity provider side. This section assumes that you have already installed the load balancer. Before beginning, note the following:

The load balancer hardware and software used in the lab facility for this deployment is BIG-IP® manufactured by F5 Networks. If you are using different load balancer software, see the documentation that comes with that product for detailed settings information.
Contact your network administrator to obtain an available virtual IP address for the load balancer you want to configure.
Know the IP address of the load balancer hardware, the URL for the load balancer login page, and a username and password for logging in to the load balancer application.
Get the IP addresses for Directory Server 1 and Directory Server 2 by running the following command on each host machine:
# ifconfig -a

Use the following list of procedures as a checklist for completing the task.

To Import the Root Certificate to Directory Server Load Balancer 1

Import the CA root certificate to the Directory Server Load Balancer 1 to ensure that a link between Load Balancer 1 can be maintained with the CA.

Before You Begin

Use the same root certificate that you imported in 4.4 Enabling Secure Communication for the Directory Server User Data Instances. For more information, see 3.3 Obtaining Secure Socket Layer Certificates.

Access https://lb1.idp-example.com, the BIG-IP load balancer login page, in a web browser.

Click Proxies.

Click the Cert-Admin tab.

Click Import.

In the Import Type field, choose Certificate and click Continue.

Click Browse in the Certificate File field on the Install SSL Certificate page.

Choose Browser in the Choose File dialog box.

Navigate to ca.cer and click Open.

Enter OpenSSL_CA_cert in the Certificate Identifier field.

Click Install Certificate.

The CertificateOpenSSL_CA_Cert page is displayed.

Click Return to Certificate Administration on the CertificateOpenSSL_CA_Cert page.

OpenSSL_CA_Cert, the root certificate, is now included in the Certificate ID list.

To Configure the Directory Server Load Balancer 1

Before You Begin

This procedure assumes that you have just completed To Import the Root Certificate to Directory Server Load Balancer 1 and are still logged into the load balancer console.

Click Configure your BIG-IP (R) using the Configuration Utility.

Create a Pool.

A pool contains all the backend server instances.
1. In the left pane, click Pools.
2. On the Pools tab, click Add.
3. In the Add Pool dialog, provide the following information:
  
  Pool Name
  
  DirectoryServerIDP-UserData-Pool
  
  Load Balancing Method
  
  Round Robin
  
  Resources
  
  Add the IP address and port number of both Directory Server host machines.
  
  Note –
  User port number 1736.
4. Click Done.

Add a Virtual Server.

The virtual server presents an address to the outside world and, when users attempt to connect, it would forward the connection to the most appropriate real server.

Tip –
If you encounter JavaScript^TM errors or otherwise cannot proceed to create a virtual server, try using Internet Explorer.
1. In the left frame, click Virtual Servers.
2. Click Add on the Virtual Servers tab.
3. In the Add a Virtual Server dialog box, provide the following information:
  
  Address
  
  Enter the IP address for lb1.idp-example.com.
  
  Service
  
  489
4. Continue to click Next until you reach the Pool Selection dialog box.
5. Assign DirectoryServerIDP-UserData-Pool to the virtual server in the Pool Selection dialog box.
6. Click Done.

Add Monitors

Monitors are required for the load balancer to detect the backend server failures.
1. In the left frame, click Monitors.
2. Click the Basic Associations tab.
3. Add an LDAP monitor for the Directory Server 1 node.
  
  In the Node column, locate the IP address and port number previously entered for Directory Server 1 and select the Add checkbox.
4. Add an LDAP monitor for the Directory Server 2 node.
  
  In the Node column, locate the IP address and port number previously entered for Directory Server 2 and select the Add checkbox.
5. At the top of the Node column, in the drop-down list, choose tcp.
6. Click Apply.

Configure the load balancer for simple persistence.

With simple persistence, all requests sent within a specified interval are processed by the same Directory Server instance, ensuring complete replication of entries. For example, when a request requires information to be written to Directory Server 1, that information must also be replicated to Directory Server 2. As the replication takes time to complete, if a related request is directed by the load balancer to Directory Server 2 during the replication process itself, the request may fail as the entry might only be partially created. When properly configured, simple persistence ensures that both requests are routed to Directory Server 1 and processed in consecutive order; the first request is finished before the second request begins processing. Simple persistence ensures that within the specified interval, no errors or delays occur due to replication time or redirects when retrieving data. Simple persistence tracks connections based only on the client IP address.
1. In the left frame, click Pools.
2. Click the name of the pool you want to configure.
  
  In this example, DirectoryServerIDP-UserData-Pool.
3. Click the Persistence tab.
4. Under Persistence Type, select Simple.
5. Enter 300 seconds for the Timeout interval.
6. Click Apply.

Verify the load balancer configuration with the following sub procedure.

On each host machine, use the tail command to monitor the Directory Server access log.

# cd /var/opt/mps/idp-users/logs
# tail -f access

You should see connections to the load balancer IP address opening and closing. For example:

[12/July/2008:13:10:20-0700] conn=69755 op=-1 msgId=-1 - closed 
[12/July/2008:13:10:25-0700] conn=69756 op=-1 msgId=-1 
- fd=27 slot=27 LDAP connection from IP_address to IP_address
[12/July/2008:13:10:25-0700] conn=69756 op=0 msgId=0 
- RESULT err=80 tag=120 nentries=0 etime=0 
[12/July/2008:13:10:25-0700] conn=69756 op=-1 msgId=-1 
- closing from IP_address

Execute the following LDAP search against the Directory Server load balancer from Directory Server 1.

# cd /var/opt/mps/serverroot/dsrk6/bin
# ./ldapsearch -h lb1.idp-example.com -p 489 -Z 
-P /var/opt/mps/idp-users/alias/slapd-cert8.db
-b "dc=company,dc=com" -D "cn=directory manager" 
-w dsmanager "(objectclass=*)"

version: 1
dn: dc=company,dc=com
dc: company
objectClass: top
objectClass: domain

Make sure the returned entries display in the access log on only one Directory Server host machine.

Run dsadm stop to stop Directory Server 1.

# cd /var/opt/mps/serverroot/ds6/bin
# ./dsadm stop /var/opt/mps/idp-users

Perform the (same) LDAP search against the Directory Server load balancer from Directory Server 2.

# cd /var/opt/mps/serverroot/dsrk6/bin
# ./ldapsearch -h lb1.idp-example.com -p 489 -Z 
-P /var/opt/mps/idp-users/alias/slapd-cert8.db
-b "dc=company,dc=com" -D "cn=directory manager" 
-w dsmanager "(objectclass=*)"

version: 1
dn: dc=company,dc=com
dc: company
objectClass: top
objectClass: domain

Make sure that the returned entries display in the access log on only Directory Server 2.

Note –

You may encounter the following error message:

ldap_simple_bind: Cant' connect to the LDAP 
server — Connection refused

This means that the load balancer may not fully detect that Directory Server 1 is stopped. In this case, you may have started the search too soon based on the polling interval setting. For example, if the polling interval is set to 10 seconds, you should wait ten seconds to start the search. You can reset the timeout properties to a lower value using the load balancer console.

Click the Monitors tab.
Click the tcp monitor name.
In the Interval field, set the value to 5.

This tells the load balancer to poll the server every 5 seconds.
In the Timeout field, set the value to 16.
Click Apply and repeat the LDAP search.

See your load balancer documentation for more information on the timeout property.

Start Directory Server 1.
# ./dsadm start /var/opt/mps/idp-users

Stop Directory Server 2.

# cd /var/opt/mps/serverroot/ds6/bin
# ./dsadm stop /var/opt/mps/idp-users

Perform the following LDAP search against the Directory Server load balancer from Directory Server 1.

# cd /var/opt/mps/serverroot/dsrk6/bin
 ./ldapsearch -h lb1.idp-example.com -p 489 -Z 
-P /var/opt/mps/idp-users/alias/slapd-cert8.db
-b "dc=company,dc=com" -D "cn=directory manager" 
-w dsmanager "(objectclass=*)"

version: 1
dn: dc=company,dc=com
dc: company
objectClass: top
objectClass: domain

Make sure the returned entries display in the access log on only Directory Server 1.

Start Directory Server 2.
# ./dsadm start /var/opt/mps/idp-users

Log out of both Directory Server host machines and the load balancer console.

4.6 Creating a Test User

Create a user entry in the replicated Directory Server user data instances for idpuser.

Note –

If you are using an existing user data store, create the appropriate users in it and move on to Chapter 6, Configuring OpenSSO Enterprise Realms for User Authentication.

To Import Test User Data into the Replicated Directory Server Instances

Create an LDIF file for the test user and import the file into ds1.idp-example.com. The test user data will then be replicated to ds2.idp-example.com.

Create an LDIF file with the following entries.

dn: ou=users,dc=company,dc=com
objectclass: top
objectclass: organizationalUnit
ou: users
description: Container for user entries

dn: ou=Groups,dc=company,dc=com
objectClass: top
objectClass: organizationalUnit
ou: Groups
description: Container for group entries

dn: uid=idpuser,ou=users,dc=company,dc=com
uid: idpuser
givenName: idp
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetadmin
objectClass: inetorgperson
objectClass: inetUser
sn: user
cn: idp user
userPassword: idpuser
inetUserStatus: Active

Save the file as idp-users.ldif in the /tmp directory.

Import the LDIF file into Directory Server 1 using ldapmodify.

# cd /var/opt/mps/serverroot/dsrk6/bin
# ./ldapmodify -h ds1.idp-example.com -p 1489 
 -D "cn=Directory Manager" -w dsmanager 
 -a -f /tmp/idp-users.ldif

adding new entry ou=users,dc=company,dc=com

adding new entry ou=Groups,dc=company,dc=com

adding new entry uid=idpuser,ou=users,dc=company,dc=com

Verify that the new users were imported using ldapsearch.

# ./ldapsearch -h ds1.idp-example.com
 -b "dc=company,dc=com" -p 1489 -D "cn=Directory Manager"
 -w dsmanager "uid=idpuser"

version: 1
dn: uid=idpuser,ou=users,dc=company,dc=com
uid: idpuser
givenName: idp
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetadmin
objectClass: inetorgperson
objectClass: inetUser
sn: user
cn: idp user
userPassword: 
 {SSHA}H5LpB+QLZMoL9SiXzY/DokHKXRclELVy7w25AA==
inetUserStatus: Active

Log out of the ds1.idp-example.com host machine.

(Optional) Verify that the entries were replicated to Directory Server 2 by logging in as a root user to the ds2.idp-example.com host machine and using ldapsearch.

# cd /var/opt/mps/serverroot/dsrk6/bin
# ./ldapsearch -h ds2.idp-example.com
 -b "dc=company,dc=com" -p 1489 -D "cn=Directory Manager"
 -w dsmanager ""

version: 1
dn: dc=company,dc=com
objectClass: top
objectClass: domain
dc: company

dn: ou=users,dc=company,dc=com
objectClass: top
objectClass: organizationalUnit
ou: users
description: Container for user entries

dn: ou=Groups,dc=company,dc=com
objectClass: top
objectClass: organizationalUnit
ou: Groups
description: Container for group entries

dn: uid=idpuser,ou=users,dc=company,dc=com
uid: idpuser
givenName: idp
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetadmin
objectClass: inetorgperson
objectClass: inetUser
sn: user
cn: idp user
userPassword: 
 {SSHA}H5LpB+QLZMoL9SiXzY/DokHKXRclELVy7w25AA==
inetUserStatus: Active

Log out of the ds2.idp-example.com host machine.