CA Strong Authentication Administration Guide › Managing CA Strong Authentication Server Instances › Configure CA AuthMinder Connectivity

Configure CA AuthMinder Connectivity

You can install multiple instances of CA AuthMinder Server. However, you can use the Administration Console to configure the connection details to only one of these instances. This configured instance obtains the data of other instances for performing multi-instance management and failover from one instance to other for operations such as, configuration creation and credential issuance performed using Administration Console.

Note: In most cases of single-system deployments, you do not need to configure the instance. The default values will work out-of-the-box.

When you configure the two-way SSL transport mode to connect CA AuthMinder Server instance in the WebFort Connectivity on the WebSphere application server, you get the error message, "SDK failed to initialize. Configuration is invalid". You must download the Unrestricted JCE policy files—local_policy.jar and US_export_policy.jar—from IBM website, and copy to the following locations:

• <WebSphere_JAVA_HOME>\lib\security (Create the security directory if it does not exist.)
• <WebSphere_JAVA_HOME>\jre\lib\security

Follow these steps:

1. Click the Services and Server Configurations tab.
2. Verify that the CA Strong Authentication option on the submenu is selected.
3. If not already displayed, click CA Strong Authentication Connectivity in the tasks pane to display the corresponding page.
4. Use the information in the following table to edit the fields on the CA Strong AuthenticationConnectivity page:

   IP Address of the AuthMinder Server

   Define the IP address of the system where you installed the required CA AuthMinder Server instance.

   Note: Verify that the systems where you installed CA AuthMinder components are accessible to each other by their host name on the network.

   Default: localhost

   Port

   Define the port on which the Server Management web Service protocol service is exposed.

   Note: This field is valid only for Server Management Web Services protocol because it has to fetch information about other CA AuthMinder instances.

   Default: 9743

   Transport

   Specify the transport mode for the corresponding component (Server Management Web Services, Administration Web Services, Transaction Web Services, and Authentication Native) to connect to the specified CA AuthMinder Server instance.

   The supported values are:

   SSL(1-Way): One-way Secure Sockets Layer (SSL) is used to encrypt and decrypt data under transmission.

   SSL(2-Way): Two-way SSL is used to encrypt and decrypt data under transmission.

   TCP: Transmission Control Protocol (TCP) mode is used to encrypt and decrypt data under transmission.

   Default: TCP

   Server CA Certificate in PEM

   Upload the server certificate chain by using the respective Browse button in the corresponding field.

   Note: This field is applicable if SSL(1-Way) or SSL(2-Way) is selected in the Transport field.

   Client Certificate-Key Pair in PKCS#12

   Upload the public and private key pair of the client certificate by using the respective Browse button in the corresponding field.

   Note: This field is applicable if SSL(2-Way) is selected in the Transport field.

   Client PKCS#12 Password

   The password corresponding to the P12 file.

   Note: This field is applicable if SSL(2-Way) is selected in the Transport field.

   Advanced Configurations Section

   Maximum Active Connections

   The maximum active connections that can be maintained between the client and the CA AuthMinder Server.

   Default: 32

   Maximum Idle Connection

   The maximum number of idle connections that can be maintained with the CA AuthMinder Server.

   Default: 8

   Maximum Wait Time (in Milliseconds)

   The maximum amount of time (in milliseconds) the client must wait (when there are no available connections) for a connection to become available, before timing out.

   Default: -1

   Minimum Wait Time for Eviction (in Milliseconds)

   The minimum amount of time (in milliseconds) a connection might be idle in the pool before it is evicted by the idle connection evictor (if any).

   Default: 300000

   Time Between Eviction Runs (in Milliseconds)

   The amount of time (in milliseconds) to wait before checking the pool to evict the idle connections.

   Default: 600000

   Connection Timeout

   The maximum amount of time (in milliseconds) before the CA AuthMinder Server is considered unreachable.

   Default: 10000

   Read Timeout

   The maximum amount of time (in milliseconds) allowed for a response from CA AuthMinder Server.

   Default: 30000

5. Click Save to save the configurations that you have set.

   Note: If you add a new CA AuthMinder Server instance, before proceeding with the instance-specific configurations, click Save on this page. This verifies that the Administration Console receives the details of the newly added instance and the instance management functions will work smoothly for the newly added instance.