WIXLIB

RSA Identity Governance and Lifecycle Lieberman Software Rapid Enterprise Defense Identity Management Application GuideSave the settings and restart the Server:Login to the VM using Putty as: oracle and password: secret and follow the steps givenbelow:1. cd /home/oracle/Oracle/Middleware/user projects/domains/aveksaDomain/bin2. ./stopWebLogic.sh3. nohup ./startWeblogic.sh &Steps for setting hostname verification property in ACM - WebSphere Server:1. In the WebSphere Administration Console select Servers.2. Expand Server Type and select WebSphere application servers.3. Click on the name of your server.4. Expand Java and Process Management and select Process Definition.5. Under the Additional Properties section, click Java Virtual Machine.6. Scroll down and locate the textbox for Generic JVM arguments.7. Add property "–DverifyHostnameForSSL false" to JVM and save the configuration.Save the settings and restart the Server.Login to the VM using Putty as: root and password: Av3k5a and follow the steps givenbelow:1. cd /opt/IBM/WebSphere/AppServer/bin2. stopServer.sh server13. startServer.sh server1Steps for setting hostname verification property in AFX:Edit the wrapper.conf file from /home/oracle/AFX/esb/conf/ to add a property as follows:wrapper.java.additional. n -DverifyHostnameForSSL falseIf –DverifyHostnameForSSL false, hostname verification will be disabledIf –DverifyHostnameForSSL true, hostname verification will be enabledB. Installing required certificates:Lieberman Software Rapid Enterprise Defense Identity Management certificate should beadded to the appropriate trust-stores. Follow the steps mentioned below for addingcertificates to the trust-stores of WebSphere, WebLogic and WildFly application servers.a) WildFly1. Download/retrieve the Lieberman Enterprise Random Password Manager SSLcertificate in PEM format e.g. liebermanCert.pem and save at some location.2. cd JAVA HOME /jre/lib/security3. Add certificates in cacerts by using keytool:keytool -import -file Path to certificate -alias name of alias -keystore cacerts8

RSA Identity Governance and Lifecycle Lieberman Software Rapid Enterprise Defense Identity Management Application Guide4. Password for keystore (unless you have made any changes): changeit5. Restart the server:Run: afx stopRun: acm stopRun: acm startRun: afx startb) WebLogic[For ACM]1. Login into WebLogic machine using SSH (e.g. putty).2. cd /home/oracle/keytool -import -file Path to certificate -alias alias name -keystore/home/oracle/server.keystore -storepass Av3k5a15num83r0n3[For AFX]1. Import the certificate to default java homeCommand. Example: keytool -import-keystore JAVA HOME/jre/lib/security/cacerts -storepass changeit -file Pathto certificate -alias alias name .2. Restart Server:Login to the VM using Putty as: oracle and password: secret and follow the stepsgiven below:1. cd/home/oracle/Oracle/Middleware/user projects/domains/aveksaDomain/bin2. ./stopWebLogic.sh3. nohup ./startWeblogic.sh &c) WebSphereChanges at WebSphere Administrative console:[For ACM]1. Log in to WebSphere Administrative console(http:// HOST NAME :9060/ibm/console/login.do)2. In left panel, expand the Security menu.3. Click on SSL certificate and then click the key management link.4. Under Configuration Settings, click the Manage endpoint security configurationslink.5. Select outbound properties for the appropriate node.6. Click on appropriate node link to get the properties.7. Under Related Items, click Key stores and certificates and then click the‘NodeDefaultTrustStore’ key store.9

RSA Identity Governance and Lifecycle Lieberman Software Rapid Enterprise Defense Identity Management Application Guide8. Under Additional Properties, click Signer certificates.9. Click Retrieve from Port.10. In the Host field, enter host name enter 8443 in the Port field, and erpm certin the Alias field.11. Click Retrieve Signer Information.12. Verify that the certificate information is for a certificate that you trust.13. Click Apply and then click Save.14. Add certificate to WebSphere java home.Path: /opt/IBM/WebSphere/AppServer/java 1.7.1 64/jre/lib/securityKeytool command Example: keytool -import -keystore/opt/IBM/WebSphere/AppServer/java 1.7.1 64/jre/lib/security/cacerts storepass changeit -file Path to certificate -alias alias name [For AFX]:1. Import the certificate to default java home2. Command: keytool -import -keystore JAVA HOME/jre/lib/security/cacerts storepass changeit -file Path to certificate -alias alias name Save the settings and restart the Server:Login to the VM using Putty as: root and password: Av3k5a and follow the steps givenbelow:1. cd /opt/IBM/WebSphere/AppServer/bin2. stopServer.sh server13. startServer.sh server13. Create a Lieberman RED User (Delegation Identity) for API accessComplete the following steps to create a Lieberman RED explicit account (also called nativestatic account) to authenticate to the web service.a) In the Lieberman RED management console, choose Delegation Delegation Identities.The Enroll Identities dialog opens.b) Click Add.The Add Delegation Role dialog opens.c) Choose Explicit Identity, enter a Username and Password, and click OK.The identity is added to the list of identities in the Enroll Identities dialog.4. Set Permissions in Lieberman RED to enable the account to use the Web ServiceThe Delegation Identity created in the step above needs to access the web service and performoperations in Lieberman RED.To assign permissions to the Delegation Identity:a) In Lieberman RED management console, choose Delegation Web Application GlobalDelegation Permissions.10

RSA Identity Governance and Lifecycle Lieberman Software Rapid Enterprise Defense Identity Management Application GuideThe Web Application Global Delegation Permissions dialog opens.b) In the Enrolled Identities section, select the explicit account just created in the above step.c) In the Global Identity Rules section, select Logon and Grant All Access.Logon is the minimum permission required to obtain an authentication token, which isnecessary for subsequent API calls. For the purpose of using the API, the Grant All Access settingneeds to be enabled.In production, the account type that best meets the security and operations requirements mustbe used and only the minimum required permissions must be configured.Note: Any time you change permissions for the identity that logs in to the web service, follow up bygetting a new authentication token using the DoLogin2 call. The new authentication token will use thelatest permissions.11

RSA Identity Governance and Lifecycle Lieberman Software Rapid Enterprise Defense Identity Management Application GuideUsing the Lieberman RED Application Wizard toConfigure Connector and CollectorsRSA Identity Governance and Lifecycle provides an Application Wizard that simplifies the process ofsetting up Lieberman Enterprise Random Password Manager Connector and Collectors. RSArecommends that you use the Application Wizard to initially set up Lieberman Enterprise RandomPassword Manager Connectors and Collectors. To modify the collectors/connector in future, please referto the collectors/connector sections respectively.1) Log in to RSA Identity Governance and Lifecycle.2) Go to Resources Applications and click Create Application.3) From the list of applications, select Lieberman Software Rapid Enterprise Defense IdentityManagement.4) Click Next. The Setup page provides an overview of the Lieberman RED endpoint, as well ascollector and connector information.5) Click Next.6) Fill out the Connect page with connection information relevant to Lieberman RED.Parameter NameDescriptionApplication NameAny name to identify this applicationSchemeHTTP or HTTPSHostHost name of the Lieberman RED endpoint serverPortPort number of the Lieberman RED endpoint serverBase URLUsernameBase URL to connect to Lieberman RED serverE.g. ERPMWebService/JSON/V2/AuthService.svcTo be checked if explicit delegation identities are to be collectedfrom Lieberman RED.Provide the Domain Name of Active Directory/LDAP for collection.Accounts collected are filtered based on the domain name provided.Username used to login to Lieberman RED serverPasswordPassword for user of Lieberman REDAuthenticatorThe authentication server configured in Lieberman RED, forexample, an Explicit/Domain Account.Collect ExplicitDelegation IdentitiesDomainNote:Use type ‘Explicit’ when using a delegation identity not associated toany domain12

RSA Identity Governance and Lifecycle Lieberman Software Rapid Enterprise Defense Identity Management Application GuideUser type ‘Domain Account’ when using a delegation identityassociated to some domain.Domain NameIf Authenticator is Domain account, then provide the domain namefor the username used to log in to the Lieberman RED server.LoginTypeThe type of account being used for logging in to Lieberman RED.*appears when theAuthenticator field valueselected is Domain account.One of the following values:UnknownNativeStaticAccount: for a local account (explicit) without adomain/authenticator.FullyQualifiedAccount: for a domain/LDAP account.IntegratedAuthentication: for Windows integrated authentication.CertificateAuthentication: for certificate-based authentication.AFX ServerProxy HostProxy PortProxy User NameProxy Password7)8)9)10)Note:Use NativeStaticAccount for a local account without a domain/authenticator.Use FullyQualifiedAccount for a domain/LDAP account.Use IntegratedAuthentication for Windows integratedauthentication.Use CertificateAuthentication for certificate-based authentication.Select Available AFX server from the drop down list.Hostname of the proxy serverPort of the proxy serverUsername for the proxy serverPassword for the proxy serverClick Test Connection to check the connectivity to the endpoint from RSA Identity Governanceand Lifecycle instance.Click Next.On the Confirm Changes page, confirm all the provided details. If there are any correctionsrequired, click Back to return to previous page.Click Next.The Change Summary page lists all the components created by this Application Wizard.Following Components will be created using the Lieberman RED Application Wizard: Application – Lieberman RED Applications with all componentsCustom Attributes for Account – AccountName, DisplayName, EmailAddress,IsDomainAccount, EntityNameCustom Attributes for Entitlement – ResourceType, Namespace, SystemName, EntityName13

RSA Identity Governance and Lifecycle Lieberman Software Rapid Enterprise Defense Identity Management Application Guide Lieberman RED Account Data Collector (ADC)Lieberman RED Entitlement Data Collector (EDC)Lieberman RED ConnectorLieberman RED Request FormLieberman RED Account Template14

RSA Identity Governance and Lifecycle Lieberman Software Rapid Enterprise Defense Identity Management Application GuideRSA Identity Governance and Lifecycle Lieberman REDCollectorsThe following sections describe how to use the Lieberman RED Collector to get data from LiebermanRED into RSA Identity Governance and Lifecycle.Lieberman RED CollectorsThese collectors communicate with Lieberman RED and collect the Account and Entitlement data.Lieberman RED Account Data CollectorLieberman RED Account Data Collector (ADC) collects RED users and associates them with the users ofRSA Identity Governance and Lifecycle. If RED delegation identities of type Domain user/group havingdifferent domains must be collected as accounts, multiple Account Data Collectors (ADCs) withcorresponding domain must be configured.These are the RED users collected as accounts in RSA Identity Governance and Lifecycle. They usedelegation rules (permissions) to control access to the web client and the web service APIs. DelegationIdentities have several types and they are described as follows.1. Windows Domain Group - RED can provide access to groups of users from Windows domains.2. Windows Domain User - RED can provide access to users from Windows domains.3. Explicit Identity - RED can create explicit accounts (program local accounts) that exist only in theconfines of the program. They have no association with any directory or system.4. LDAP user – RED can provide access to users from LDAP servers.Data/Attributes to be collected using Account Data Collector (ADC) AccountName DisplayName EmailAddress IsDomainAccount EntityName (required for account-entitlement resolution)Adding Additional Attributes for Account Data Collector (ADC)Additional attributes are required to hold the data collected in RSA Identity Governance and Lifecyclesystem. If they do not exist then you must add them.1. Go to Admin Attributes.2. In the “Account” tab add the following attributes.Attribute NameData TypeDatabase IDData SourceAccountNameString one of available Collected15

RSA Identity Governance and Lifecycle Lieberman Software Rapid Enterprise Defense Identity Management Application GuideAttribute NameData TypeDatabase IDData SourceDisplayNameString one of available CollectedEmailAddressString one of available CollectedIsDomainAccountString one of available CollectedEntityNameString one of available CollectedCreating a New Account Data Collector (ADC)To set up a new Lieberman RED Account Data Collector without using the Application Wizard, followsteps below:1. Log in to RSA Identity Governance and Lifecycle instance.2. Select Collectors Account Data Collector/Entitlement Data Collector.3. Click Create Account Collector. Configure the Collector Description screen with these values:Field NameValueCollector NameUnique Collector nameDescriptionCollector descriptionBusiness SourceSelect any available applicationData Source TypeLieberman Enterprise Random PasswordManagerAgentAveksaAgentStatusActiveCopy FromSelect Existing Lieberman Enterprise RandomPassword Manager Account Collector template Ifyou want to use its configurationScheduledDefault : No16

RSA Identity Governance and Lifecycle Lieberman Software Rapid Enterprise Defense Identity Management Application Guide4. Click Next.5. Configure the Configuration Information screen with these values:Field NameValueSchemeHTTP or HTTPSHostHost name of the Lieberman RED instance.PortPort of Lieberman RED serverE.g. for http, use port 80.Base URLBase URL to connect to Lieberman RED server.E.g. /ERPMWebService/JSON/V2/AuthService.svcCollect Explicit Delegation IdentitiesTo be checked if explicit delegation identities areto be collected from Lieberman RED.DomainProvide the Domain Name of ActiveDirectory/LDAP for collection. Accounts collectedare filtered based on the domain name provided.UsernameUsername used to login to Lieberman RED server.PasswordPassword for user of Lieberman REDAuthenticator TypeThe authentication server configured in RED, forexample, an Explicit or domain Account.Domain Name*appears when the Authenticator field valueselected is Domain account.LoginTypeIf Authenticator is Domain account, then providethe domain name for the username used to loginto Lieberman RED server.The type of account being used for logging in toLieberman RED.One of the following values:UnknownNativeStaticAccount: for a local account (explicit)without a domain/authenticator.FullyQualifiedAccount: for a domain/LDAP17

RSA Identity Governance and Lifecycle Lieberman Software Rapid Enterprise Defense Identity Management Application Guideaccount.IntegratedAuthentication: for Windowsintegrated authentication.CertificateAuthentication: for certificate-basedauthentication.Note:Use NativeStaticAccount for a local accountwithout a domain/authenticator.Use FullyQualifiedAccount for a domain/LDAPaccount.Use IntegratedAuthentication for Windowsintegrated authentication.Use CertificateAuthentication for certificatebased authentication.Proxy HostHostname of the proxy serverProxy PortPort of the proxy server Default Port is 0,Note: Keep Proxy Port 0 if you are not using anyproxy server to connector Lieberman Server.Proxy User NameUsername for the proxy serverProxy PasswordPassword for the proxy server6. Click Next.7. Configure the Map Collector Attributes to Account Attributes screen with these values:Field NameValueLast Login DateLast login date is not collected from RED*Account NameAccountName*Display NameDisplayName18

RSA Identity Governance and Lifecycle Lieberman Software Rapid Enterprise Defense Identity Management Application Guide*Email AddressEmailAddress*Entity NameEntityName*Is Domain AccountIsDomainAccount*AccountName, DisplayName, EmailAddress, EntityName and IsDomainAccount are custom attributes created in RSAIdentity Governance and Lifecycle.8. Click Next.9. Configure the Map Collector Attributes to Account Mapping Attributes screen with these values:Field NameValueUser ReferenceAccount Name10. Click Next.11. Configure the Edit User Resolution Rules screen with these values:Field NameValueTarget CollectorSelect already created IDC. Default: UsersUser AttributeEmail AddressDefault: User Id12. Click Finish to save this Collector.Lieberman RED Explicit Delegation Identities are collected as orphan accounts in RSA IdentityGovernance and Lifecycle.Lieberman R

Identity Management provides a rich data context about delegation identity (such as their permissions of different resources such as management set, account, system etc.) from Lieberman RED. The Lieberman Software Rapid Enterprise Defense Identity Management Connector helps you govern and provision delegation identity access to Lieberman RED .