Configuring TLS and Client Authentication

TLS communication between the virtual appliance and the SailPoint Disconnected Application Agent is required. The agent does not accept requests on a non-TLS port.

Client authentication is also required. The agent confirms that the user is registered, and then authenticates the credentials with Windows, before it runs a request from Identity Security Cloud.

Note
Client authentication is required for operations that use the SailPoint Disconnected Application Agent.

Prerequisites

TLS Communication

• The agent host X.509 certificate, with Extended Key Usage (EKU) set to Server Authentication, is in the Personal certificate store of the local computer. The subject matches the fully qualified domain name of the agent host. For example, spdisconappsvc.test.com.

• The matching private key is in the local computer certificate store and is associated with the certificate.

• If the certificate is not available, create a certificate signing request on the agent host and submit it to a trusted internal or third-party certificate authority.

• The certificate authority is a trusted root certificate authority on the agent host.

Client Authentication

• If the agent host is joined to a domain, use a domain user to authenticate the connection between Identity Security Cloud and the agent.

• If the agent host is not joined to a domain, use a local Windows user on the agent host.

Note
No additional user permissions are required for client authentication.

Configuring the Agent Host Certificate

Confirm the following on the SailPoint Disconnected Application Agent host:

• The X.509 certificate is in Local Computer > Personal.

• The certificate has a private key. In the certificate store, a certificate with a private key uses a different icon from a certificate without one.

• Enhanced Key Usage includes Server Authentication (1.3.6.1.5.5.7.3.1).

• The agent host fully qualified domain name is the common name (CN) in Subject, and a DNS entry in Subject Alternative Name.

• The agent host trusts the certificate. Trust is established when the host trusts the root certificate authority that issued the certificate.

Configuring the Virtual Appliance Certificate

The virtual appliance must trust the SailPoint Disconnected Application Agent X.509 certificate. Trust is established when the virtual appliance trusts the root certificate authority that issued the certificate.

Note
Export the full certificate chain and convert it to a single PEM file.

To export the certificate chain and add it to the virtual appliance:

1. In the Microsoft Management Console (MMC), export the certificate chain as a .p7b file in DER/Binary format.

2. Convert the .p7b file to a .pem file:

   openssl pkcs7 -print_certs -in certchain.p7b -inform DER -out certificate.pem -outform PEM

3. Copy certificate.pem to /home/sailpoint/certificates on the virtual appliance.

4. Restart the CCG service. The CCG service loads the certificates from that directory.

Configuring Client Authentication

To register the user that Identity Security Cloud uses to call the agent:

1. On the agent host, register the user. A domain user uses the msDS-PrincipalName format domain\user. A local user uses the local user name only.

   SpDisconAppSvc.exe -a "Corp\John.Doe"

2. In Agent Settings, enter that user in Client Authentication Username and the password in Client Authentication Password. Use the same format you used when you registered the user.

Troubleshooting