Installation and Upgrade Guides › Policy Server Installation Guide › Configuring LDAP Directory Servers as a Policy or Key Store › CA Directory as a Policy Store › How to Configure the Policy Store

How to Configure the Policy Store

To configure CA Directory as a policy store, complete the following procedures:

1. Create a DSA for the policy store.
2. Create the policy store schema.
3. Open the DSA.
4. Create the base tree structure for policy store data.
5. Create a super user administrator for the DSA.
6. Point the Policy Server to the policy store.
7. Set the SiteMinder super user password.
8. Verify the CA Directory cache configuration.
9. Import the default policy store objects.
10. Import the policy store data definitions.
11. Prepare for the Administrative UI registration.

Create a DSA for the Policy Store

Create the DSA by running the following command:

dxnewdsa DSA_Name port "o=DSA_Name,c=country_code"

DSA_Name

Specifies the name of the DSA.

port

Specifies the port on which the DSA is to listen.

o=DSA_Name,c=country_code

Specifies the DSA prefix.

Example: "o=psdsa,c=US"

The dxnewdsa utility starts the new DSA.

Note: If the DSA does not automatically start, run the following:

dxserver start DSA_Name

Create the Policy Store Schema

You create the policy store schema so the directory server can function as a policy store.

Important! By default, CA Directory configuration files are read–only. Any CA Directory files that you are instructed to modify, must be updated for write permission. Once the files are updated, you can revert the permission to read–only. Also, all default.xxx files provided by CA Directory are overwritten during a CA Directory upgrade. Use caution when modifying any read-only files.

To create the Policy Store schema

1. Copy the following files into the CA Directory DXHOME\config\schema directory:
   • netegrity.dxc
   • etrust.dxc

   DXHOME

   Specifies the Directory Server installation path.

   Note: The netegrity.dxc file is installed with the Policy Server in siteminder_home\eTrust. The etrust.dxc file is installed with the Policy Server in siteminder_home\xps\db.

   siteminder_home

   Specifies the Policy Server installation path.

   • Windows %DXHOME%
   • Unix/Linux: $DXHOME

2. Create a SiteMinder schema file by copying the default.dxg schema file and renaming it.

   Note: The default.dxg schema file is located in DXHOME\config\schema\default.dxg.

   Example: copy the default.dxg schema file and rename the copy to smdsa.dxg

3. Add the following lines to the bottom of the new SiteMinder schema file:

   #CA Schema
   

   source "netegrity.dxc";
   

   source "etrust.dxc";
   

4. Edit the DXI file of the DSA (DSA_Name.dxi) by changing the schema from default.dxg to the new SiteMinder schema file.

   DSA_Name

   Represents the name of the DSA you created for the policy store.

   Note: The DXI file is located in DXHOME\config\servers.

5. Add the following lines to the end of the DXI file of the DSA:
   • r12

     # cache configuration
     set max-cache-size = 100;
     set cache-attrs = all-attributes;
     set cache-load-all = true;
     set ignore-name-bindings = true;
     

     Note: The max-cache-size entry is the total cache size in MB. Adjust this value based on the total memory available on the CA Directory server and overall size of the policy store.

   • r12 SP1 or later

     # cache configuration
     set ignore-name-bindings = true;
     

6. Copy the default limits DXC file of the DSA (default.dxc) to create a SiteMinder DXC file.

   Example: Copy the default DXC file and rename the copy smdsa.dxc.

   Note: The default DXC file is located in DXHOME\dxserver\config\limits.

7. Edit the settings in the new DXC file to match the following:

   # size limits
   set max-users = 1000;
   set credits = 5;
   set max-local-ops = 1000;
   set max-op-size = 4000;
   set multi-write-queue = 20000;
   

   Note: Editing the size limits settings prevents cache size errors from appearing in your CA Directory log files.

   Important! The multi-write-queue setting is for text–based configurations only. If the DSA is set up with DXmanager, omit this setting.

8. Save the DXC file.
9. Edit the DXI file of the DSA (DSA_Name.dxi) by changing the limits configuration from default.dxc to the new SiteMinder limits file.

   Example: change the limits configuration from default.dxc to smdsa.dxc.

   DSA_Name

   Represents the name of the DSA you created for the policy store.

   Note: The DXI file of the DSA is located in DXHOME\config\servers.If you created the DSA using DXmanager, the existing limits file is named dxmanager.dxc.

10. As the DSA user, stop and restart the DSA using the following commands:

    dxserver stop DSA_Name
    dxserver start DSA_Name
    

    DSA_Name

    Specifies the name of the DSA.

    The policy store schema is created.

Open the DSA

You create a view into the directory server to manage objects.

Follow these steps:

1. Be sure that the database is configured for an anonymous login.
2. Launch the JXplorer GUI.
3. Select the connect icon.

   Connection settings appear.

4. Enter host_name_or_IP_address in the Host Name field.

   host_name_or_IP_address

   Specifies the host name or IP address of the system where CA Directory is running.

5. Enter port_number in the Port number field.

   port_number

   Specifies the port on which the DSA is listening.

6. Enter o=DSA_Name,c=country_code in the Base DN field.

   Example: o=psdsa,c=US

7. Select Anonymous from the Level list and click Connect.

   A view into DSA appears.

Create the Base Tree Structure for Policy Store Data

You create a base tree structure to hold policy store data. You use the JXplorer GUI to create the organizational units.

To create the base tree structure for policy store data

1. Select the root element of your DSA.
2. Create an organizational unit under the root element called:

   Netegrity

3. Create an organizational unit (root element) under Netegrity called:

   SiteMinder

4. Create an organizational unit (root element) under SiteMinder called:

   PolicySvr4

5. Create an organizational unit (root element) under PolicySvr4 called:

   XPS

   The base tree structure is created.

Create a Superuser Administrator for the DSA

You only have to create a superuser administrator if you do not have an administrator account that SiteMinder can use to access the DSA. The Policy Server requires this information to connect to the policy store.

Follow these steps:

1. Use the JXplorer GUI to access the DSA.
2. Create an administrator that SiteMinder can use to connect to the policy store.

   Note: Create the user with the following object type:

   inetOrgPerson
   

3. Note the administrator DN and password. You use the credentials when pointing the Policy Server to the policy store.

Example:

dn:cn=admin,o=yourcompany,c=in

Point the Policy Server to the Policy Store

You point the Policy Server to the policy store so the Policy Server can access the policy store.

Follow these steps:

1. Open the Policy Server Management Console.

   Important! If you are accessing this graphical user interface on Windows Server 2008, open the shortcut with Administrator permissions. Use Administrator permissions even if you are logged in to the system as an Administrator. For more information, see the release notes for your SiteMinder component.

2. Click the Data tab.
3. Select the following value from the Database list:

   Policy Store
   

4. Select the following value from the Storage list:

   LDAP
   

5. Configure the following settings in the LDAP Policy Store group box.
   • LDAP IP Address
   • Admin Username
   • Password
   • Confirm Password
   • DN

   Note: You can click Help for a description of fields, controls, and their respective requirements.

6. Click Apply.
7. Click Test LDAP Connection to verify that the Policy Server can access the policy store.
8. Select the following value from the Database list:

   Key Store
   

9. Select the following value from the Storage list:

   LDAP
   

10. Select the following option:

    Use Policy Store database
    

11. Click OK.