Steps to configure SiteMinder Policy Server to connect to CA Directory using LDAPS

Transcription

1 Steps to configure SiteMinder Policy Server to connect to CA Directory using LDAPS Goal: 1. Policy Server to communicate with CA Directory r8.1 via LDAPS. Prerequisites: 1. CA Directory r81 installed. 2. Certificate Authority 3. OpenSSL

2 Comparison : 1. Generic LDAP a. Following is a diagram of how Policy Server will communicate with User Directories. b. The LDAP Client, Policy Server in this sample, would make requests to the SSL port directly Generic LDAP A LDAP Client (Policy Server) B LDAP (port 389) C V LDAPS (port 636) 2. CA Directory works differently a. Following is a diagram of how CA Directory works. b. The LDAP Client, Policy Server in this sample, must make an LDAPS request to port 389 and you cannot access port 636 directly CA Directory r8.1 A LDAP Client (Policy Server) B LDAP/DXserver DSA(port 389) C LDAPS/ SSL Daemon (port 636)

3 Configuration: 1. After installing CA Directory, you need to create a DSA(LDAP instance). Dxnewdsa <DSA Name> <DB Name> <NonSSL Port> o Ex) dxnewdsa siteminder siteminderdb 389 Modify the <CA Dir>\dxserver\config\knowledge\siteminder.dxc file as below. etdir1 is the hostname of this CA Directory Server. set dsa siteminder = { prefix = <dc lab><dc support> dsa-name = <cn siteminder> dsa-password = "secret" address = tcp "etdir1" port 389 disp-psap = DISP cmip-psap = CMIP snmp-port = 389 console-port = 390 ssld-port = 636 auth-levels = anonymous, clear-password, ssl-auth }; #set force-encrypt-anon = true; Make sure port snmp-port, snmp-port and console-port are not occupied by other services, else use different ports. 2. Start up the DXserver Dxserver start <DSA> Ex) dxserver start siteminder 3. Load JXplorer and connect to the siteminder DSA At the JXplorer main menu, click on Connect to a DSA button. Fill in the following o Host : etdir1 o Port: 389 o Protocol : LDAP v3 o Base DN : dc=support,dc=lab o Security Level : Anonymous

4 Save the connection as ETDIR1 Click on Connect button to get access to the siteminder DSA. 4. Create a user which will be used as the Directory Administrator account from SiteMinder AdminUI. At the RootDN level (dc=support,dc=lab), click on the right button and select New and submit the following. o EnterRDN : cn=directory Manager o Selected Classes : top, inetorgperson, person, organizationalperson o Click "OK" and then fill in the UserPassword. o Click "SUBMIT" to complete the transaction.

5 Stop the siteminder DSA o Dxserver stop siteminder Modify the siteminder.dxc file and uncomment the set force-encrypt-anon o set force-encrypt-anon = true; Start the siteminder DSA o Dxserver start siteminder Test login to siteminder DSA using the created user account o Load JXplorer and modify the security level as below Security Level : User + Password UserDN : cn=directory Manager,dc=support,dc=lab Password : password (or whatever you have specified)

6 Shutdown siteminder DSA o Dxserver stop siteminder 5. Prepare Certificates This can be done by dxcertgen but will use external CA as it fits SiteMinder environment. Generate a private key and CSR using OpenSSL o openssl genrsa -des3 -out siteminder.keyfile 1024 o openssl req -new -days 365 -key siteminder.keyfile -out siteminder.csr Sign the CSR with your CA o Signed certificate is saved in base64 encoded file, siteminder.cer Remove private key passphrase using OpenSSL o openssl rsa -in siteminder.keyfile -out siteminder.key Combine the siteminder.cer and siteminder.key file and save as <DSA>.pem which is siteminder.pem o Certificate first and then Private Key -----BEGIN CERTIFICATE----- Trimmed -----END CERTIFICATE BEGIN RSA PRIVATE KEY----- Trimmed -----END RSA PRIVATE KEY----- Copy the siteminder.pem file to <CA Dir>\dxserver\config\ssld\personalities\ folder.

7 Append the CA certificate to <CA Dir>\dxserver\config\ssld\trusted.pem file BEGIN CERTIFICATE----- Trimmed (existing CA cert) -----END CERTIFICATE BEGIN CERTIFICATE----- Trimmed (your CA cert) -----END CERTIFICATE Install SSL Daemon for siteminder DSA. Register SSL Daemon for siteminder dsa o o o o Ssld install <DSA Name> certfiles <full path to <CADir>\dxserver\config\ssld\personalities\ folder> -ca <full file path to <CADir>\dxserver\config\ssld\trusted.pem > -port <SSL port which is specified in the siteminder.dxc as ssld-port> Ex) Ssld install siteminder -certfiles C:\sample\CA Directory\dxserver\config\ssld\personalities -ca C:\sample\CA Directory\dxserver\config\ssld\trusted.pem -port 636 You should get <DSA> installed message. Please do not copy and paste from this document. The hyphen and double quotes are not the same as it appears when you copy and paste to a command line. Please type the commands manually to avoid unexpected errors. Start DSA and SSL Daemon o Dxserver start <DSA> Ex) dxserver start siteminder o Ssld start <SSLD installed name> Ex) ssld start siteminder 7. Add CA certificate to JXplorer Open JXplorer and navigate to Security tab and Trusted Servers and CAs Click on Add Certificate and select your CA certificate file then click OK to import. The default password for the CA certificate store is changeit (and for the Client Certificates store is passphrase in case if you want to use client certificate authentication) 8. Add a connection to siteminder DSA using SSL. Load JXplorer and ETDIR1 connection.

8 Modify the Security Level as below o Security Level : SSL + User + Password o Do not change any other settings o Save the connection as ETDIR1 SSL Test connection. 9. Use Netscape Communicator 4.8 or below to import CA certificate as Signer into cert7.db. By dragging and dropping the CA certificate in to Netscape browser, it will import the certificate to cert7.db with the instructions as shown in the below screenshots. Cert7.db file will be updated only when you close the netscape browser.

9

10

11 10. Copy cert7.db and key3.db pair to Policy Server machine and into a new folder ex: C:\siteminder. 11. At the policy server, load smconsole and specify the cert7.db file path smconsole => Data => Netscape Certificate Database File and restart policy server.

12

13 12. Load AdminUI and create a userstore object as below.

14 13. Click on View Contents to confirm it works.