iPlanet Directory Server Access Management Edition Installation and Configuration Guide: Chapter 11 Basic Configurations

Previous Contents Index Next

iPlanet Directory Server Access Management Edition Installation and Configuration Guide

Chapter 11 Basic Configurations

This chapter describes configurations typically implemented when you initially deploy iPlanet Directory Server Access Management Edition (DSAME).
Topics in this chapter include:

Installing Multiple DSAME Instances Against the Same Directory Server

Support for Directory Replication and High Availability

Secure Sockets Layer (SSL)

Installing Multiple DSAME Instances Against the Same Directory Server

You can install more than one instance of DSAME against this Directory Server for enhanced performance, to support directory replication, or for agent failover purposes. When you run the DSAME installation program for the first time, you'll typically use Option 1) Install DSAME Policy and Management Services. When you use this option, Directory Server is automatically installed for you. This is the master Directory Server. If you plan to install multiple installations of DSAME against this same master directory, you must configure the second DSAME—as well as all subsequent installations—to use the existing remote Directory Server. You do this during installation.
Figure 11-1    Two DSAME Instances Installed Against a Single Directory Server.

To Install Multiple DSAME Instances Against the Same Directory Server

Run the DSAME installation program to install the DSAME services and a master Directory Server. You must have root permissions when you run the DSAME installation program. Be sure all web browsers are closed before starting the installation program.

Install DSAME services for the first time. Use the instructions in "Installing DSAME Services and Directory Server" or in "Using an Existing Directory Server" as appropriate for your needs.

Run the setup.exe program a second time to install the second instance of DSAME services.

Read the License Agreement. At the prompt, Do you agree to the license terms? enter y for Yes.

Read the License Agreement. When prompted, Do you agree to the license terms? Enter y for Yes.

Note
After installation you will not yet be able to login to the DSAME administration console. The appropriate LDIF and XML files have not yet been loaded. See the following sections for instructions.

In the Installation Directory window, provide the following information:

Install DSAME in this directory: Enter the path to the directory where DSAME Services will be installed. Plan to install the DSAME Services and Directory Server in different directories. Ideally, you would install DSAME Services and Directory Server on different computer systems.

In the Components to Be Installed window, select only DSAME Management and Policy Services. De-select all other components.

In the iPlanet Web Server Information window, provide the following information about the Web Server that will run DSAME services, and then click Next:

Web Server Administrator: Enter a user name for the administrator who will access and manage the Web Server when necessary.

Web Server Administration Port: Enter a port number. Typically, this administration port is set to 8888.

Password (8 chars minimum): Enter the password for the Administrator specified above. The password must be a minimum of 8 characters in length.

Re-enter Password: To confirm the Administrator password, enter it again.

In The Web Server that Runs DSAME Services window, provide the following information about the computer system where DSAME will be installed, and then click Next:

Host Name: Enter the name of the computer system where DSAME will be installed.

Port: Enter the port number of the Web Server that will run DSAME services.

DSAME Services Protocol: If the Web Server that will run DSAME services will not be using Secure Socket Layer (SSL) protocol, then select HTTP. If it will be SSL-enabled, then select HTTPS.

Domain: Enter the domain name of the computer system where DSAME will be installed.

DSAME Services Deployment URI: Enter the Deployment Universal Resource Identifier (URI) that was specified when DSAME was installed. The default is /amserver.

In the Directory Schema window, provide the following information, and then click Next:

Do you want DSAME to run in iPlanet-compliance mode? In most cases, select No. The iPlanet-compliant DIT uses specialized directory objects, and its tree structure is optimized for use by hosting companies. For detailed information about the iPlanet-compliance mode, see "Compliant vs. Default DIT".

In the next Directory Schema window, provide the following information, and then click Next:

Root Suffix of Your Directory Tree: This is the point in your directory where you want DSAME to start managing entries. Enter a relative distinguished name (RDN) that includes at least one attribute_naming=value pair. Examples:

  o=isp

  o=madisonparc

  dc=sun,dc=com,l=us

Organization Name: Enter a name for the first organization to be used or created in your DSAME Directory Information Tree (DIT). This name will be displayed in the DSAME graphical user interface. Examples: iPlanet or iplanet.com.

Directory Component Node: Enter the point in the DIT where DSAME will start managing entries. Example: o=isp.

In the iPlanet Directory Server Information window, provide the following information, and then click Next:

Directory Server Host: Enter the fully qualified domain name for the computer system where Directory Server will be installed.

Directory Server Port: Enter a port number. Directory Server typically uses port 389.

Directory Manager: Enter the distinguished name (DN) of the user who has unrestricted access to Directory Server. Example: cn=Directory Manager.

Admin password (8 chars minimum): Enter a password for the Directory Server administrator.

Re-enter Admin password: Enter the password again to confirm it.

In the DSAME Super Administrator Information window, provide the following information, and then click Next:

User name: The user name for the Super administrator is amAdmin This name cannot be reconfigured.

Password: Enter the password for the user amAdmin. the password must be a minimum of 8 characters in length.

Confirm Password: To confirm the amAdmin password, enter it again.

In the Currently Selected Settings window, review the configuration information that you've entered. If you need to make changes, click Back. Otherwise, click Next to proceed.

In the Ready to Install window, review the installation information. If you need to make changes, click Back. Otherwise, click Next to begin the installation.

In the Installation Summary window, click Details for a detailed summary of the configuration information that was processed during Installation. Then click Exit to end the program.

Support for Directory Replication and High Availability

Load balancing across replicated servers and locating replicated servers closer to users are two ways to improve server performance and response time in your enterprise. You can implement directory replication agreements in your DSAME deployment to increase the availability and performance of the DSAME servers and services. You can set up DSAME directory servers in single-supplier or multi-supplier configurations. You can also configure load-balancing applications such as iPlanet Directory Access Router to work with DSAME.

Replication Considerations

Configure your directory servers for replication before you install DSAME. This ensures that the supplier and consumer databases are synchronized from the beginning, and gives you a chance to verify that referrals and updates are working properly. The information must be identical in each DSAME database.
When you install DSAME for replication purposes, in each instance of Directory Server and in each instance of DSAME, specify the same values for the following:

Directory Manager

Directory Manager Password

Directory Server Administrator ID

Server Administrator Password

Base Suffix

Default Organization
There may be situations in which you cannot implement directory replication in a DSAME deployment. For example, authentication server host names or IP addresses must be the same. This precludes using geographically separated replicated DSAME servers. The remote servers would not be able to perform authentication against servers that are only local to their respective LANs.
For comprehensive information on planning and implementing Directory Server replication, see the Deployment Guide and the Installation Guide for iPlanet Directory Server. You can access these guides on the Internet at:
  http://docs.iplanet.com/docs/manuals/directory.html

Configuring DSAME to Support Directory Replication

You can configure DSAME to work with single-supplier or multi-supplier replication. For each of the configurations pictured in this section, follow the same instructions. See "To Configure DSAME to Work with Directory Replication" of this manual.
Figure 11-2 illustrates a single-supplier configuration where the Consumer is a read-only database. Requests for write operations are referred to the supplier database. This configuration provides some measure of enhanced server performance by distributing the workload to more than one directory.
Figure 11-2    Single-Supplier Replication.

Figure 11-3 illustrates a multi-supplier configuration using multiple instances of DSAME. This configuration provides failover protection as well as high availability, resulting in further enhanced server performance.
Figure 11-3    Multi-Supplier configuration. Also known as Multi-Master Replication (MMR)

Figure 11-4 illustrates a multi-supplier configuration that includes iPlanet Access Router. This configuration takes full advantage of DSAME support for failover, high availability, and managed load-balancing.
Figure 11-4    Multi-Supplier Replication with Load-Balancing Application.

To Configure DSAME to Work with Directory Replication

Use the following steps to configure replication at the root or top level of the DSAME directory tree. You can also use these steps to configure replication at the default organization level.

Install your supplier and consumer Directory Servers (version 5.1). See the Directory Server Installation Guide for detailed instructions.

Set up replication agreements between your supplier and consumer Directory Servers, and then verify that the directory referrals and updates are working properly. See the Directory Server Administrator's Guide for detailed instructions.

If you plan to use DSAME with user data from an existing, pre-5.1 Directory Server, you must migrate the user data and make Directory Tree Information (DIT) changes before proceeding. Follow the detailed instructions in Chapter 5 "Using an Existing Directory Server" on page 65 of this manual. Then skip to step 5.

If you are deploying DSAME and Directory Server for the first time, or if you simply do not plan to use existing user data with DSAME, then run the DSAME installation program to install the DSAME Management and Policy services.

During installation, you'll be asked if you're using an existing Directory Server. You'll answer "yes," and then you'll specify the host name and port number for a supplier Directory Server you installed in step 1.

For detailed instructions, see "Installing Multiple DSAME Instances Against the Same Directory Server".

In the Web Server where DSAME Management and Policy services are installed, modify the following file:

  DSAME_root/web-apps/services/WEB-INF/classes/AMConfig.properties

Modify the following properties to reflect the host and port number of a consumer Directory Server you installed in step 1.

com.iplanet.am.directory.host

com.iplanet.am.directory.port

Modify the following properties:

replica.enabled=true

com.iplanet.am.replica.retries

Specify the number of times DSAME should continue to make the same request when the requested entry is not found.

com.iplanet.am.replica.delay.between.retries

Specify the number of milliseconds DSAME should allow to elapse between retries.

In each DSAME Authentication module you've enabled, you must specify the consumer directory that you installed in step 1. In the following substeps, the LDAP Authentication module is used as an example:

In the DSAME console, in the View field, choose Service Management.

In the Service Name column, under Authentication, locate the module you need to reconfigure. In the Properties column, click the arrow that corresponds to module you need to reconfigure.

In the right pane, there are two fields named LDAP Server and Port.

In the first field named LDAP Server and Port, enter the host name and port number for your primary (consumer) Directory Server.
Example: consumer1.madisonparc.com:389

In the second field named LDAP Server and Port, enter the host name and port number for your secondary or (supplier) directory.
Example: supplier1.madisonparc.com:399

Click Submit.

In the file DSAME_root\web-apps\services\WEB-INF\config\ums\serverconfig.xml specify the host name and port number of the consumer directory you installed in step1. Example:

<iPlanetDataAccessLayer>

<ServerGroup name="default" minConnPool="1"              maxConnPool="10">

<Server name="Server1"                       host="consumer1.madisonparc.com" port="389"                             type="SIMPLE" />

Restart DSAME. Use one of the following methods:

In a DOS prompt window, enter the following commands:

  cd DSAME_root\web-apps\services\WEB-INF\bin

  amserver stop

  amserver start

From the Start menu, select Programs > Administrative Tools > Services. In the Services window, right-click the icon for DSAME-hostname. From the menu, choose Restart.

Configuring a Load-Balancing Application to Work With DSAME

You can configure load-balancing applications such as iPlanet Directory Access Router (iPlanet DAR) to work with DSAME. iPlanet DAR dynamically performs proportional load balancing of LDAP operations across a set of configured directory servers. If one or more directory servers should become unavailable, the load is proportionally redistributed among the remaining servers. When a directory server comes back on line, the load is proportionally and dynamically reallocated.
Figure 11-5    Multi-Master Replication with Managed Load-Balancing.

Using a load-balancing application adds a layer of high availability and directory failover protection beyond the basic level that comes with DSAME. For example, when you configure iPlanet DAR, you can specify what percentage of the load gets redistributed to each of your servers when one server becomes unavailable. iPlanet DAR continues to manage request traffic, and begins rejecting client queries when all back-end LDAP servers become unavailable.
By comparison, the DSAME high availability feature cannot be configured or managed as precisely. But when you add a load-balancing application such as iPlanet DAR, DSAME seamlessly directs all requests to the application for total management.
If you choose to install a load-balancing application, you must configure DSAME to recognize the application.

To Configure DSAME to Work With a Load-Balancing Application

Before you can perform the following steps, you must:

Set up your Directory Servers for replication. For comprehensive information about directory replication and for detailed setup instructions, see "Managing Replication" in the iPlanet Directory Server Administrator's Guide.

Install and configure your load-balancing application. Follow the instructions in the documentation that comes with the product.

In the file, DSAME_root\web-apps\services\WEB-INF\classes\AMconfig.properties

modify the following properties to reflect the host and port number of a consumer Directory Server you installed in step 1.

com.iplanet.am.directory.host

com.iplanet.am.directory.port

For each DSAME Authentication module you've enabled, specify the consumer directory that you installed in step 1. In the following substeps, the LDAP Authentication module is used as an example:

In the DSAME console, in the View field, choose Service Management.

In the Service Name column, under Authentication, locate the module you need to reconfigure. In the Properties column, click the arrow that corresponds to module you need to reconfigue.

In the right pane, there are two fields named LDAP Server and Port.

In the first field named LDAP Server and Port, enter the host name and port number for your primary (consumer) Directory Server using the form:

  iPlanet_DAR_host.domain_name.com:port_number

In the second field named LDAP Server and Port, enter nothing.

Click Submit.

In the file: DSAME_root\web-apps\services\WEB-INF\config\ums\serverconfig.xml specify the host name and port number of the consumer directory you installed in step1. Example:

<iPlanetDataAccessLayer>

<ServerGroup name="default" minConnPool="1"              maxConnPool="10">

<Server name="Server1"                      host="iDAR_hostname.madisonparc.com"                        port="389" type="SIMPLE" />

Restart DSAME. Use one of the following methods:

In a DOS prompt window, enter the following commands:

  cd DSAME_root\web-apps\services\WEB-INF\bin

  amserver stop

  amserver start

From the Start menu, select Programs > Administrative Tools > Services. In the Services window, right-click the icon for DSAME-hostname. From the menu, choose Restart.

Secure Sockets Layer (SSL)

You can use the Secure Sockets Layer (SSL) protocol to provide secure connections between Directory Server and the DSAME services you use in your enterprise. The SSL protocol consists of rules governing server authentication, client authentication, and encrypted communication between servers and clients. When you enable SSL to work with DSAME, the requests and transactions between Directory Server and the DSAME console are encrypted and protected from intrusion by unauthorized entities.
Figure 11-6    How SSL Works in DSAME.

Enabling SSL for DSAME is a two-step process:

Step 1: Enable LDAP Over SSL

Step 2: Enable DSAME to Run in SSL Mode
This section explains how to enable SSL for DSAME services and URL access agents. It references the following resources for SSL information, which are appended to this manual for your convenience:

iPlanet Directory Server Administrator's Guide

Chapter 11, "Managing SSL"

iPlanet Web Server Administrator's Guide

Chapter 5, "Securing Your Web Browser"

For comprehensive information on SSL and on determining your SSL needs, see Chapter 7, "Designing a Secure Directory" in iPlanet Directory Server Deployment Guide. This guide comes with iPlanet Directory Server, and is also available on the Internet at
  http://docs.iplanet.com/docs/manuals/directory.html.

Step 1: Enable LDAP Over SSL

Install a Server Certificate in Directory Server.

Follow the detailed instructions in "Obtaining and Installing Server Certificates" of this manual to perform the following steps. Or access the iPlanet Directory Server documentation on the Internet at http://docs.iplanet.com/docs/manuals/directory.html.

Step 1: Generate a Certificate Request

Step 2: Send the Certificate Request to the Certificate Authority

Step 3: Install the Certificate (on Directory Server)

Step 4: Trust the Certificate Authority (Install the Root CA Certificate)

Step 5: Confirm That Your New Certificates Are Installed

Activate SSL in the Directory Server.

Follow the detailed instructions in "Activating SSL" of this manual.

In the Web Server that runs DSAME services is installed, in the Web Server console, create a trust database.

Follow the detailed instructions "Creating a Trust Database".

In the Web Server that runs DSAME services, install the root CA Certificate for Directory Server's server certificate.

Follow the detailed instructions in "Requesting and Installing Other Server Certificates".

Edit the following DSAME configuration file:

  DSAME_root\web-apps\services\WEB-INF\config\ums\
        serverconfig.xml

For the server corresponding to the Directory Server configured for SSL, provide the following values:

port. Enter the SSL port number you specified in Step 2.

type. Enter SSL.

Example:

<?xml version="1.0" encoding="ISO-8859-1" standalone="yes"?>

<iPlanetDataAccessLayer>

<ServerGroup name="default" minConnPool="1"               maxConnPool="10">

<Server name="Server1"                      host="adam.red.madisonparc.com"

                       port="636" type="SSL" />

<User name="User1" type="proxy">

<DirDN>

cn=puser,ou=People,o=isp

</DirDN>

<DirPassword>

AQAA5Q9jwkb4pAJ2LGFYRDlqWxXxId+5v4nU

</DirPassword>

</User>

Restart DSAME. Use one of the following methods:

At the command line, enter the following commands:

  cd DSAME_root\web-apps\services\WEB-INF\bin

  amserver stop

  amserver start

From the Start menu, select Programs > Administrative Tools > Services. In the Services window, right-click the icon for DSAME-hostname. From the menu, choose Restart.

If the Directory Server is not yet running, you are prompted for the internal key. Enter the key (password) you specified when creating the trust database in Step 3.
When DSAME starts up, its connection to Directory Server will be secured with SSL.

Step 2: Enable DSAME to Run in SSL Mode

When you enable DSAME to run in SSL mode, requests and transactions between the DSAME console and other SSL-configured Web Servers are encrypted and protected from intrusion by unauthorized entities.

Login to DSAME as Super Administrator.

In the View field, choose Service Management.

In the Service Name column, locate the service named Naming. In the Properties column, click the arrow that corresponds to Naming.

In the right pane, edit the Profile Service URL to reflect the https protocol.

Profile Service URL. Change http to https.

If you want to change the port too (default port is 8080), modify the port number in the Profile Service URL.

Click Submit.

In Service Name column, choose DSAME Platform.

In the Server List box:

Remove this DSAME server from the list. First select its name in the list, and then click Remove.

Change Protocol to https (instead of http).

To add the same server with https, click Add.

Edit the following DSAME configuration file: DSAME_root\web-apps\services\WEB-INF\classes\AMConfig.properties

Modify values for the following to reflect the HTTPS protocol and new port number (if the port number was changed):

com.iplanet.am.server.protocol

com.iplanet.am.server.port

com.iplanet.am.profile.port

com.iplanet.am.naming.url

com.iplanet.am.notification.url

In the Web Server that runs DSAME services, using the Web Server console, obtain and install a server certificate if one is not already installed.

Note
In the following substeps, the following warning message may display:
"Warning: Manual edits not loaded,"
In this case, click the Apply link in the upper right corner of the console, and then click Load Configuration Files

To obtain a server certificate, follow the detailed instructions for "Requesting Other Server Certificates".

To install the server certificate, follow the detailed instructions for "Installing Other Server Certificates".

In the Web Server console, select the Web Server that runs DSAME services, and then click Manage.

In the Web Server instance, choose Preferences.

Click Add Listen Sockets.

In the Security field for the default DSAME port, enter On.

Click OK to save the change.

Click Apply.

To save changes to Web Server configuration files, click Apply Changes.

Restart DSAME. Use one of the following methods:

In a DOS prompt window, enter the following commands:

  cd DSAME_root\web-apps\services\WEB-INF\bin

  amserver stop

  amserver start

From the Start menu, select Programs > Administrative Tools > Services. In the Services window, right-click the icon for DSAME-hostname. From the menu, choose Restart.

Previous Contents Index Next
Copyright 2002 Sun Microsystems, Inc. All rights reserved.

Last Updated March 27, 2002