JAR File Prerequisites
Complete the tasks listed on this page before configuring the connector with .jar files.
-
Configure at least one virtual appliance (VA) cluster and successfully test the connection.
-
You must set up a service account that has the required permissions.
-
Ensure that the LDAP directory server associated with IBM Security Verify Access is configured and functional.
-
To support .jar file generation on IBM Security Directory Suite version 10.0, you should use Java version 8.0.7.16-ISS-JAVA-WinX64-FP0016 or later.
Install PDJRTE
Install PDJRTE to configure the IBM Security Verify Access Runtime for Java component which enables the Java application to use Security Verify Access security.
Perform the following steps to install PDJRTE on the LDAP Directory Server Machine:
-
Copy the license file (
PDLIC.txt
) from thePDJRTE
directory to the root directory (for example,C:\
or/
in Unix). -
Go to
PDJRTE
directory through command prompt available on LDAP Directory Server machine.For example:
C:\pdjrte-x.x.x-0\pdjrte\sbin)
where x.x.x is 9.0.0.
-
Open Command Prompt and execute the following command:
-
For Windows –
pdjrtecfg.bat -action config –interactive
-
For UNIX –
pdjrtecfg -action config -interactive
-
-
On the UI dialogue box, configure the java run-time environment for Security Verify Access. Select the valid JRE path and select Next.
-
Enter the existing policy server information (where your Security Verify Access policy server is running [machine details]) as follows:
-
Host name – IP of the configured IBM Security Verify Access
-
Port – 7135 (Default port)
-
Domain – Default (Recommended)
-
-
Enable SVA common directory logging (recommended to keep it on for troubleshooting).
-
Select Finish.
This adds an additional .jar file in the $JDK_HOME\jre\lib\ext
directory which is used by the Security Verify Access Connector. For example:
PD.jar
ibmjcefips.jar
ibmjcefw.jar
ibmjceprovider.jar
ibmjsseprovider2.jar
ibmpkcs.jar
local_policy.jar
US_export_policy.jar
Generate config
and keyfile
On the LDAP Directory Server host, use the com.tivoli.pd.jcfg.SvrSslCfg
command to generate the config and keyfile required to communicate with the IBM Security Verify Access. The file path of the config file must be configured in the application configuration. For example:
>java com.tivoli.pd.jcfg.SvrSslCfg -action config -admin_id sec_master -admin_pwd <password> -appsvr_id server1 -host <host> -port <port_number> -mode remote -policysvr <host:7135:1> -authzsvr <host:7136:2> -domain default -cfg_file <path of config file to be generated> -key_file <Path of key file to generate> -cfg_action create
Where host = the IP address for IBM Security Verify Access.
Integration with IBM Security Verify Access
Perform the following steps to integrate with IBM Security Verify Access.
-
Copy the following .jar — which are generated from
jre/lib/ext
file in IBM LDAP Directory Server — to$JDK_HOME\jre\lib\ext
orWEB-INF\lib
directory on the SailPoint host.CopyIbmjcefips.jar
Ibmjcefw.jar
Ibmjceprovider.jar
ibmjsseprovider2.jar
ibmpkcs.jar
local_policy.jar
US_export_policy.jar
PD.jar -
Log in to the VA with SailPoint user credentials and create a directory as shown below:
/home/sailpoint/TAM
-
Copy the
PD.properties
andPDCA.ks
files fromPolicyDirector
to the/home/sailpoint/TAM
directory.The
PD.properties
andPDCA.ks
files are located in the$JDK_HOME\jre
directory.Note
Optionally, to configure additional SVA sources on a single VA, rename the two files names mentioned above with the source ID. The source ID can be taken from the source URL.
Using the following source URL as an example:
https://<ISC Host>/ui/admin#admin:connections:sources:614226
You can create the following file names:
614226_PDCA.ks
614226_PD.properties
-
The config file has an entry pointing to the key file. Update the config file entry (pdcert-url) to point to key file such as
pdcert-url=file\:/home/sailpoint/TAM/<keyfileName>
-
The name
keyfileName
is a format you must change as provided during generation of config and key file. -
Copy the config and keystore files from LDAP server machine generated by the SvrSslCfg command to the
/home/sailpoint/TAM
directory.Important
For multiple Security Verify Access sources on single VA, you must use unique names for the config and key file.