Installation and Upgrade Guides › Policy Server Installation Guide › Configuring LDAP Directory Servers as a Policy or Key Store › Create a Policy Store in an LDAP Directory › Manually Configure Policy Store Data in an LDAP Directory

Manually Configure Policy Store Data in an LDAP Directory

Important! Before running a SiteMinder utility or executable on Windows Server 2008, open the command line window with Administrator permissions. Open the command line window this way, even if your account has Administrator privileges. For more information, see the release notes for your SiteMinder component.

To configure policy store data in an LDAP directory server manually

1. If applicable, use the vendor–specific software to create an LDAP directory server instance.
2. On the Policy Server host system, navigate to siteminder_home/bin.

   siteminder_home

   Specifies the Policy Server installation path.

3. Point the Policy Server at the LDAP directory server by running the following commands:

   smldapsetup status -hhost -pport -dAdminDN 
   -wAdminPW -rrootDN -ssl1/0 -ccert
   smldapsetup reg -hhost -pport -dAdminDN 
   -wAdminPW -rrootDN -ssl1/0 -ccert
   

   host

   Specifies the name or IP address of the LDAP directory server.

   port

   Specifies the port on which the LDAP directory server is listening.

   AdminDN

   Specifies the name of an LDAP user with privileges to create LDAP schema in the LDAP directory server. This user appears in the Admin Username field on the Data tab of the Policy Server Management Console after you run the smldapsetup utility.

   ADAM and AD LDS: Specifies the full domain name, including the guid value, of the directory server administrator.

   Example: CN=user1,CN=People,CN=Configuration,CN,{guid}

   AdminPW

   Specifies the password for the administrator DN.

   rootDN

   Specifies the DN location of the SiteMinder data in the LDAP directory server.

   ADAM and AD LDS: Specifies the existing root DN location of the application partition in the directory server where the policy store schema must be created.

   1/0

   If you are connecting to the LDAP directory server over SSL, specify -ssl1 and -ccert

   cert

   Specifies the path of the directory where the SSL client certificate database file (cert7.db) exists.

   Note: If client certificate database file exists in /app/siteminder/ssl, specify -capp/siteminder/ssl.

   The smldapsetup utility tests the connection to the LDAP directory server. If the connection is successful, smldapsetup configures the Policy Server to use the LDAP directory server as the policy store.

4. Create the policy store schema by running:

   smldapsetup ldgen -ffile_name
   smldapsetup ldmod -ffile_name
   

   file_name

   Specifies the name of the LDIF file you are creating.

   Example: smldapsetup ldmod -fpstoreschema.ldif

5. Change the SiteMinder super user password by completing the following steps:
   1. Copy the smreg utility (smreg.exe) from the Policy Server installation kit to siteminder_home\bin.
   2. Execute the following command:

      smreg -su super_user_password
      

      super_user_password

      Specifies the password for the SiteMinder super user account.

      Note: Be sure that there is a space between -su and the password.

   3. Delete the smreg utility.

      Deleting the smreg utility prevents someone from changing the super user password without knowing the previous one.

6. From siteminder_home/bin, import the basic SiteMinder objects required to set up a policy store by running:

   smobjimport -isiteminder_home\db\smdif\smpolicy.smdif
   -dSM_super_user_name -wsuper_user_password -v
   

   siteminder_home

   Specifies the Policy Server installation path.

   smpolicy.smdif

   Specifies the name of the file containing the default policy store objects that are imported into the policy store.

   Note: When manually configuring a policy store on Windows, you can import one of the following:

   • smpolicy.smdif
   • smpolicy–secure.smdif

   The file named smpolicy–secure provides additional security through enhanced default Web Agent configuration parameters.

   SM_super_user_name

   Specifies the name of the SiteMinder administrator with super user privileges.

   super_user_password

   Specifies the password for the SiteMinder super user.

   Note: If an argument contains spaces, use double quotes around the entire argument.

   Windows example: smobjimport -i“C:\Program Files\Netegrity\siteminder\db\smdif\smpolicy.smdif” -d"SM Admin"
   -wPassword -v

   UNIX example: smobjimport -i$NETE_PS_ROOT/db/smdif/smpolicy.smdif
   -d"SM Admin" -wPassword -v

   -v

   Outputs error, warning, and comment messages in verbose format so you can monitor the status of the import.

   Be aware of the following:

   • This step creates the default objects required by SiteMinder. The objects are automatically saved in their appropriate locations in the policy store.
   • If you do not complete this step, required SiteMinder objects are not added to the policy store. As a result, you cannot use the Policy Server User Interface to configure policies.
7. Restart the Policy Server service by doing the following:
   1. Start the Policy Server Management Console.

      Important! If you are accessing this graphical user interface on Windows Server 2008, open the shortcut with Administrator permissions, even if you are logged into the system as an Administrator. For more information, see the release notes for your SiteMinder component.

   2. Under the Status tab, stop the service by clicking the Stop button in the Policy Server group box.

      The stoplight icon changes from green to red.

   3. Click the Start button in the Policy Server group box to restart the service.
   4. Click OK to exit the Policy Server Management Console.

   (UNIX systems) Enter the commands stop–all followed by start–all.

   The policy store is configured and you can log into the Policy Server User Interface.

More Information:

smldapsetup

Import Policy Data Using smobjimport

Change the SiteMinder Super User Password Using smreg

Policy Store Schema Considerations