Previous Topic: Oracle Internet Directory Server as a Key StoreNext Topic: Configuring CA SiteMinder® Data Stores in a Relational Database


Red Hat Directory Server as a Key Store

You can configure Red Hat Directory Server as a separate key store.

How to Configure the Key Store

Complete the following tasks to create the key store:

  1. Create a directory server instance that is to function as the key store. Be sure to create a root suffix and root object to store the CA SiteMinder® keys.

    Note: For more information, see your vendor–specific documentation.

  2. Create an LDAP user with privileges to create the schema, and read, modify, and delete objects in the LDAP tree underneath the key store root object.

    Note: For more information, see your vendor–specific documentation.

  3. Register the key store.
  4. Create the key store schema.
  5. Import the key store schema.
  6. Restart the Policy Server.

Register the Key Store

Registering the key store configures a connection between the key store and the Policy Server. The Policy Server uses the credentials that you supply to manage the key store.

Important! Registration does not configure the Policy Server to use the separate key store. The settings do not take effect until the Policy Server is restarted. Do not restart the Policy Server until the key store is configured and you are ready to deploy it.

Follow these steps:

  1. Log in to the Policy Server host system.
  2. Run the following command to configure the connection:
    smldapsetup reg -hhost -pport -dadmin_user -wadmin_password -rroot -k1
    

    Important! Before running a CA SiteMinder® utility or executable on Windows Server 2008, open the command line window with administrator permissions. Open the command line window this way, even if your account has administrator privileges.

    Note: For more information about these modes and arguments, see the Policy Server Administration Guide.

    Example:

    smldapsetup reg -host172.16.0.0 -p389 -d"cn=directory manager" -wpassword -r"dc=test" -k1
    
  3. Start the Policy Server Management Console and open the Data tab.
  4. Complete one of the following procedures:

    Note: The Use Policy Store database setting is cleared. The cleared setting is expected normal behavior. The Policy Server continues to use the key store that is collocated with the policy store.

  5. Exit the Policy Server Management Console.

    The separate key is registered with the Policy Server.

Create the Key Store Schema

The key store instance requires the schema to store and retrieve CA SiteMinder® web agent keys. Use the smldapsetup utility to create the key store schema file.

Follow these steps:

  1. Log in to the Policy Server host system.
  2. Run the following command to create the key store schema file:
    smldapsetup ldgen -ffile_name -k1
    

    Important! Before running a CA SiteMinder® utility or executable on Windows Server 2008, open the command line window with administrator permissions. Open the command line window this way, even if your account has administrator privileges.

    Note: For more information about these modes and arguments, see the Policy Server Administration Guide.

    Example: smldapsetup ldgen -fkeystoreschema -k1

    The key store schema file is created.

Import the Key Store Schema

The key store instance requires the schema to store and retrieve CA SiteMinder® web agent keys. Use the smldapsetup utility to import the key store schema file.

Follow these steps:

  1. Log in to the Policy Server host system.
  2. Run the following command to import the key store schema:
    smldapsetup ldmod -ffile_name -k1
    

    Note:

    Example:

    smldapsetup ldmod -fkeystoreschema -k1
    

    The key store–specific schema is imported.

  3. Complete the following steps:
    1. Restart the directory server. Restarting the directory server is required to save the key store schema correctly.
    2. Repeat step 2. Restarting the directory server removed the key store root. Importing the key store schema again is required to create the key store root.

    The key store–specific schema is imported.

Restart the Policy Server

The Policy Server continues to use the collocated key store until you restart the Policy Server. Restart the Policy Server to begin using the separate key store.

Note: For more information, see the Policy Server Administration Guide.