Sun Java System Directory Server Enterprise Edition 6.0 Installation Guide

Enabling SSL in the Active Directory Connector

Identity Synchronization for Windows automatically retrieves Active Directory SSL certificates over SSL and imports them into the Connector’s certificate database using the same credentials you provided for the Connector.

However; if an error occurs (for example, invalid credentials or no SSL certificates were found), you can retrieve an Active Directory CA certificate and add it to the Connector certificate database. See the following sections for instructions:

Retrieving an Active Directory Certificate

If an error occurs, you can use certutil (a program that ships with Windows 2000/2003) or LDAP to retrieve an Active Directory certificate, as described in the following sections.


Note –

The certutil command discussed in this section is not the same as the certutil command that ships with the Directory Server and discussed previously in this publication.


Using Window’s Certutil

ProcedureTo Retrieve an Active DirectoryCertificate Using the certutil program

  1. Run the following command from the Active Directory machine to export the certificate.


    C:\>certutil -ca.cert cacert.bin
  2. You can then import thecacert.bin file into a certificate database.

Using LDAP

ProcedureTo Retrieve an Active Directory Certificate using LDAP

  1. Execute the following search against Active Directory:


    ldapsearch -h CR-hostname -D administrator_DN -w administrator_password 
    -b "cn=configuration,dc=put,dc=your,dc=domain,dc=here" "cacertificate=*"

    Where the administrator_DN might look like:


    cn=administrator,cn=users,dc=put,dc=your,dc=domain,dc=here

    In this example, the domain name is: put.your.domain.name.here.

    Several entries will match the search filter. You probably need the entry using cn=Certification Authorities, cn=Public Key Services in its DN.

  2. Open a text editor and cut the first value of the first CA certificate attribute (it should be a base64 encoded text block). Paste that value (text block) into the text editor (only the value). Edit the contents, so that none of the lines start with white space.

  3. Add-----BEGIN CERTIFICATE----- before the first line and -----END CERTIFICATE----- after the last line. See the following example:


    -----BEGIN CERTIFICATE-----
    MIIDvjCCA2igAwIBAgIQDgoyk+Tu14NGoQnxhmNHLjANBgk
    qhkiG9w0BAQUFADCBjjEeMBwGCSqGSIb3DQEJARYPYmVydG
    9sZEBzdW4uY29tMQswCQYDVQQGEwJVUzELMAkGA1UECBMCV
    FgxDzANBgNVBAcTBkF1c3RpbjEZMBcGA1UEChMQU3VuIE1p
    Y3Jvc3lzdGVtczEQMA4GA1UECxMHaVBsYW5ldDEUMBIGA1U
    EAxMLUmVzdGF1cmFudHMwHhcNMDIwMTExMDA1NDA5WhcNMT
    IwMTExMDA1OTQ2WjCBjjEeMBwGCSqGSIb3DQEJARYPYmVyd
    G9sZEBzdW4uY29tMQswCQYDVQQGEwJVUELMAkGA1UECBMCV
    FgxDzANBgNVBAcTBkF1c3RpbjEZMBcGA1UEChMQU3VuIE1p
    Y3Jvc3lzdGVtczEQMA4GA1UECxMHaVBsYW5ldDEUMBIGA1U
    EAxMLUmVzdGF1cmFudHMwXDANBgkqhkiG9w0BAQEFAANLAD
    BIAkEAyekZa8gwwhw3rLK3eV/12St1DVUsg31LOu3CnB8cM
    HQZXlgiUgtQ0hm2kpZ4nEhwCAHhFLD3iIhIP4BGWQFjcwID
    AQABo4IBnjCCAZowEwYJKwYBBAGCNxQCBAYeBABDAEEwCwY
    DVR0PBAQDAgFGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBB
    YEFJ5Bgt6Oypq7T8Oykw4LH6ws2d/IMIIBMgYDVR0fBIIBK
    TCCASUwgdOggdCggc2GgcpsZGFwOi8vL0NOPVJlc3RhdXJh
    bnRzLENOPWRvd2l0Y2hlcixDTj1DRFAsQ049UHVibGljJTI
    wS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049Q29uZm
    lndXJhdGlvbixEQz1yZXN0YXVyYW50cyxEQz1jZW50cmFsL
    RPXN1bixEQz1jb20/Y2VydGlmaWNhdGVSZXZvY2F0aW9u
    TGlzdD9iYXNlP29iamVjdGNsYXNzPWNSTERpc3RyaWJ1dGl
    vblBvaW50ME2gS6BJhkdodHRwOi8vZG93aXRjaGVyLnJlc3
    RhdXJhbnRzLmNlbnRyYWwuc3VuLmNvbS9DZXJ0RW5yb2xsL
    1Jlc3RhdXJhbnRzLmNybDAQBgkrBgEEAYI3FQEEAwIBADAN
    BgkqhkiG9w0BAQUFAANBAL5R9R+ONDdVHWu/5Sd9Tn9dpxN
    8oegjS88ztv1HD6XSTDzGTuaaVebSZV3I+ghSInsgQbH0gW
    4fGRwaI BvePI4=
    -----END CERTIFICATE-----
  4. Save the certificate into a file (such as ad-cert.txt).

  5. You can then import that file (for example, ad-cert.txt) into a certificate database. Continue to the next section, Adding Active Directory Certificates to the Connector’s Certificate Database

Adding Active Directory Certificates to the Connector’s Certificate Database

Use this procedure only if you enabled SSL for the Active Directory Connector after installing the Connector or if invalid credentials were provided during installation.

ProcedureTo Add Active Directory Certificate to the Connector's Certificate Database

  1. On the machine where the Active Directory Connector is installed, stop the Identity Synchronization for Windows service/daemon.

  2. Retrieve the Active Directory CA certificate using one of the following methods:

  3. Assuming the Active Directory Connector has connector ID CNN101 (see logs/central/ error.log for a mapping from connector ID to the directory source it manages), go to its certificate database directory on the machine where it was installed, and import the certificate file:

    • If the certificate was retrieved using certutil, type:

      <ISW-server-root>\shared\bin\certutil.exe -A -d . -n ad-ca-cert -t C,, -i \cacert.bin
    • If the certificate was retrieved using LDAP, type:

      <ISW-server-root>\shared\bin\certutil.exe -A -d . -n ad-ca-cert -t C,,
       -a -i \ad-cert.txt

      ISW-server-root is the path where ISW-hostname directory is present

    The certificate can be imported using dsadm in the following manner(on Solaris platform):

    /opt/SUNWdsee/ds6/bin/dsadm add-cert -C <DS-server-root>/slapd-<hostname>/ ad-ca-cert cacert.bin

    where ad-ca-cert is the name of the certificate assigned after the import and cacert.bin is the certificate about to be imported

  4. Restart the Identity Synchronization for Windows service/daemon.


    Note –

    Because the Directory Server certutil.exe is installed automatically when you install Directory Server 6.0, you will not be able to add a CA certificate to a connector installed on a machine with no Directory Server.

    At a minimum, you must install the Sun Java System Server Basic Libraries and Sun Java System Server Basic System Libraries from the Directory Server 6.0 package on the server where the Active Directory Connector is installed. (You do not have to install the Administration Server or Directory Server components.)

    In addition, be sure to select the JRE subcomponent from the Console (to ensure your ability to uninstall).