Installation and Upgrade Guides › Policy Server Installation Guide › Configuring LDAP Directory Servers to Store CA SiteMinder® Data › Siemens DirX as a Policy Store

Siemens DirX as a Policy Store

Siemens DirX can function as a policy store. A single directory server instance can function as a:

• Policy store
• Key store

Using a single directory server simplifies administration tasks. The following sections provide instruction on how to configure a single directory server instance to store policy data and encryption keys. If your implementation requires, you can configure a separate key store.

Gather Directory Server Information

Configuring an LDAP directory server as a policy store or upgrading an existing policy store requires specific directory server information. Gather the following information before beginning. You can use the Policy Store Worksheets to record your values.

Host information

Specifies the fully-qualified host name or the IP Address of the directory server.

Port information

(Optional) Specifies a non-standard port.

Default values: 636 (SSL) and 389 (non-SSL)

Administrative DN

Specifies the LDAP user name of a user who has privileges to create, read, modify, and delete objects in the LDAP tree underneath the policy store root object.

Administrative password

Specifies the password for the Administrative DN.

Policy store root DN

Specifies the distinguished name of the node in the LDAP tree where policy store objects are to be defined.

SSL client certificate

Specifies the pathname of the directory where the SSL client certificate database file resides.

Limit: SSL only

How to Configure the Policy Store

Complete the following procedures to configure Siemens DirX as a policy store:

1. Create the policy store schema.
2. Point the Policy Server to the policy store.
3. Set the CA SiteMinder® superuser password.
4. Import the policy store data definitions.
5. Import the default policy store objects.
6. Prepare for the Administrative UI registration.

Create the Policy Store Schema

You create the policy store schema so the directory server can function as a policy store and store CA SiteMinder® objects.

Prerequisite

Certain policy store operations require searches on CA SiteMinder® attributes. The DirX directory must index the attributes to perform search operations.

By default, the DirX directory indexes 20 attributes. CA SiteMinder® contains more attributes than this default limit. Increase the number of attributes that the directory can index to a maximum. We recommend a value of 800.

To increase the attribute indexing limit, use the following command while initializing the database profile.

dbamboot -Pdatabase_profile_name -aindexing_value

Example:

dbamboot -Pprofile1 -a800

Create the Schema

Follow these steps:

1. Create the following directory structure on the directory server host system:

   DirX_installation\scripts\security\CA\SiteMinder

   DirX_installation

   Specifies the DirX installation path.

2. Log in to the Policy Server host system.
3. Navigate to siteminder_home\db\tier2\SiemensDirx and copy the following files to DirX_installation\scripts\security\CA\SiteMinder:
   • dirxabbr-ext.SiteMinderrelease
   • schema_ext_for_SiteMinderrelease.adm
   • bind.tcl
   • l-bind.cp
   • GlobalVar.tcl

   siteminder_home

   Specifies the Policy Server installation path.

   release

   Specifies the CA SiteMinder® release.

4. Navigate to siteminder_home\xps\db\Siemens_DirX and copy the following files to DirX_installation\scripts\security\CA\SiteMinder:
   • dirxabbr-ext.XPS
   • schema_ext_for_XPS.adm
5. Rename the following files:
   • schema_ext_for_SiteMinderrelease.adm to schema_ext_for_SiteMinder.adm
   • dirxabbr-ext.SiteMinderrelease to dirxabbr-ext.SiteMinder

   siteminder_home

   Specifies the Policy Server installation path.

   release

   Specifies the CA SiteMinder® release.

6. Copy the following files to DirX_installation\client\conf:
   • dirxabbr-ext.SiteMinder
   • dirxabbr-ext.XPS
7. Restart the DirX service.
8. Go to DirX_installation\scripts\security\CA\SiteMinder and edit the GlobalVar.tcl file to update the global variables that the DirX scripts reference.

   Default values:

   • LDAP port: 389
   • Root DN: o=My-Company
   • Admin username: cn=admin,o=My-Company
   • Admin password: dirx
9. From a command prompt, navigate to DirX_installation\scripts\security\CA\SiteMinder and execute the following commands:
   • dirxadm schema_ext_for_siteminder.adm
   • dirxadm schema_ext_for_XPS.adm
10. Restart the DirX service.
11. On the system where DirX is installed, index the attribute modifyTimestamp. Do this task manually or through the DirX Manager.

    The steps using the DirX Manager are as follows:

    1. Rebind to the DSA.
    2. Click on Schema on the left panel.
    3. Click on Database.
    4. Uncheck "Hide attributes with no index assigned".
    5. Click Edit.
    6. Under Index row, select the attribute modifyTimestamp.
    7. Save the changes.
    8. Right click on the Database and check consistence for attribute indexes.
12. Complete the following items using the DirX manage tool:
    1. Rebind to the DSA.
    2. Create the following base tree structure:
       • Under o=My-Company, create ou=Netegrity.
       • Under ou=Netegrity, create ou=SiteMinder.
       • Under ou=SiteMinder, create ou=PolicySvr4
       • Under ou=PolicySvr4, create ou=XPS

The policy store schema is created.

Point the Policy Server to the Policy Store

You point the Policy Server to the policy store so the Policy Server can access the policy store.

Follow these steps:

1. Open the Policy Server Management Console.

   Important! If you are accessing this graphical user interface on Windows Server 2008, open the shortcut with Administrator permissions. Use Administrator permissions even if you are logged in to the system as an Administrator. For more information, see the release notes for your CA SiteMinder® component.

2. Click the Data tab.
3. Select the following value from the Database list:

   Policy Store
   

4. Select the following value from the Storage list:

   LDAP
   

5. Configure the following settings in the LDAP Policy Store group box.
   • LDAP IP Address
   • Admin Username
   • Password
   • Confirm Password
   • Root DN

   Note: You can click Help for a description of fields, controls, and their respective requirements.

6. Click Apply.
7. Click Test LDAP Connection to verify that the Policy Server can access the policy store.
8. Select the following value from the Database list:

   Key Store
   

9. Select the following value from the Storage list:

   LDAP
   

10. Select the following option:

    Use Policy Store database
    

11. Click OK.

Set the CA SiteMinder® Super User Password

The default CA SiteMinder® administrator account is named:

siteminder

The account has maximum permissions.

We recommend that you do not use the default superuser for day–to–day operations. Use the default superuser to:

• Access the Administrative UI for the first–time.
• Manage CA SiteMinder® utilities for the first–time.
• Create another administrator with superuser permissions.

Follow these steps:

1. Copy the smreg utility to siteminder_home\bin.

   siteminder_home

   Specifies the Policy Server installation path.

   Note: The utility is at the top level of the Policy Server installation kit.

2. Run the following command:

   smreg -su password
   

   password

   Specifies the password for the default CA SiteMinder® administrator.

   Limits:

   • The password must contain at least six (6) characters and cannot exceed 24 characters.
   • The password cannot include an ampersand (&) or an asterisk (*).
   • If the password contains a space, enclose the passphrase with quotation marks.

   Note: If you are configuring an Oracle policy store, the password is case–sensitive. The password is not case–sensitive for all other policy stores.

3. Delete smreg from siteminder_home\bin. Deleting smreg prevents someone from changing the password without knowing the previous one.

   The password for the default CA SiteMinder® administrator account is set.

Import the Policy Store Data Definitions

Importing the policy store data definitions defines the types of objects that can be created and stored in the policy store.

Follow these steps:

1. Open a command window and navigate to siteminder_home\xps\dd.

   siteminder_home

   Specifies the Policy Server installation path.

2. Run the following command:

   XPSDDInstall SmMaster.xdd
   

   XPSDDInstall

   Imports the required data definitions.

Import the Default Policy Store Objects

Importing the default policy store objects configures the policy store for use with the Administrative UI and the Policy Server.

Consider the following items:

• Be sure that you have write access to siteminder_home\bin. The import utility requires this permission to import the policy store objects.

  siteminder_home

  Specifies the Policy Server installation path.

• Before running a CA SiteMinder® utility or executable on Windows Server 2008, open the command-line window with administrator permissions. Open the command-line window this way, even if your account has administrator privileges. For more information, see the release notes for your CA SiteMinder® component.

Follow these steps:

1. Open a command window and navigate to siteminder_home\db.
2. Import one of the following files:
   • To import smpolicy.xml, run the following command:

     XPSImport smpolicy.xml -npass
     

   • To import smpolicy–secure.xml, run the following command:

     XPSImport smpolicy-secure.xml -npass
     

     npass

     Specifies that no passphrase is required. The default policy store objects do not contain encrypted data.

     Both files include the default policy store objects. These objects include the default security settings in the default Agent Configuration Object (ACO) templates. The smpolicy–secure file provides more restrictive security settings. For more information, see Default Policy Store Objects Consideration.

   • To import Option Pack functionality, run the following command:

     XPSImport ampolicy.xml -npass
     

   • To import federation functionality, run the following command:

     XPSImport fedpolicy-12.51.xml -npass
     

   The policy store objects are imported.

Note: Importing smpolicy.xml makes available legacy federation and Web Service Variables functionality that is separately licensed from CA SiteMinder®. If you intend on using the latter functionality, contact your CA account representative for licensing information.

Prepare for the Administrative UI Registration

You use the default CA SiteMinder® super user account (siteminder) to log into the Administrative UI for the first–time. The initial login requires that you to register the Administrative UI with a Policy Server, which creates a trusted relationship between both components.

You prepare for the registration by using the XPSRegClient utility to supply the super user account name and password. The Policy Server uses these credentials to verify that the registration request is valid and that the trusted relationship can be established.

Consider the following items:

• The time from which you supply the credentials to when the initial Administrative UI login occurs is limited to 24 hours. If you do not plan on installing the Administrative UI within one day, complete the following steps before installing the Administrative UI.
• (UNIX) Be sure that the CA SiteMinder® environment variables are set before you use XPSRegClient. If the environment variables are not set, set them manually.

Follow these steps:

1. Log in to the Policy Server host system.
2. Run the following command:

   XPSRegClient siteminder[:passphrase] -adminui-setup -t timeout -r retries -c comment -cp -l log_path -e error_path -vT -vI -vW -vE -vF
   

   passphrase

   Specifies the password for the default CA SiteMinder® super user account (siteminder).

   Note: If you do not specify the passphrase, XPSRegClient prompts you to enter and confirm one.

   -adminui–setup

   Specifies that the Administrative UI is being registered with a Policy Server for the first–time.

   -t timeout

   (Optional) Specifies the allotted time from when you to install the Administrative UI to the time you log in and create a trusted relationship with a Policy Server. The Policy Server denies the registration request when the timeout value is exceeded.

   Unit of measurement: minutes

   Default: 240 (4 hours)

   Minimum Limit: 15

   Maximum Limit: 1440 (24 hours)

   -r retries

   (Optional) Specifies how many failed attempts are allowed when you are registering the Administrative UI. A failed attempt can result from submitting incorrect CA SiteMinder® administrator credentials when logging in to the Administrative UI for the first time.

   Default: 1

   Maximum Limit: 5

   -c comment

   (Optional) Inserts the specified comments into the registration log file for informational purposes.

   Note: Surround comments with quotes.

   -cp

   (Optional) Specifies that registration log file can contain multiple lines of comments. The utility prompts for multiple lines of comments and inserts the specified comments into the registration log file for informational purposes.

   Note: Surround comments with quotes.

   -l log path

   (Optional) Specifies where the registration log file must be exported.

   Default: siteminder_home\log

   siteminder_home

   Specifies the Policy Server installation path.

   -e error_path

   (Optional) Sends exceptions to the specified path.

   Default: stderr

   -vT

   (Optional) Sets the verbosity level to TRACE.

   -vI

   (Optional) Sets the verbosity level to INFO.

   -vW

   (Optional) Sets the verbosity level to WARNING.

   -vE

   (Optional) Sets the verbosity level to ERROR.

   -vF

   (Optional) Sets the verbosity level to FATAL.

3. Press Enter.

   XPSRegClient supplies the Policy Server with the administrator credentials. The Policy Server uses these credentials to verify the registration request when you log in to the Administrative UI for the first–time.