Online install of Infrastructure Automation for IBM Cloud Pak for Watson AIOps

1. Create Infrastructure Automation custom resource with customization

The following command creates an instance of the Infrastructure Automation custom resource called IAConfig with customization to Managed services. You must have your customization parameters under spec.manageservice section. The list of install parameters that can be customized along with its default values are listed in Managed services installation parameters page.

cat << EOF | oc apply -f -
kind: IAConfig
apiVersion: aiops.ibm.com/v1alpha1
metadata:
  name: ibm-ia-installer
  namespace: cp4waiops
spec:
  imagePullSecret: ibm-entitlement-key
  infraAutoComposableComponents:
  - enabled: <Set to true to install Infrastructure Management component of Infrastructure Automation, false otherwise>
    name: ibm-management-im-install
    spec: {}
  - enabled: <Set to true to install Managed services component of Infrastructure Automation, false otherwise>
    name: ibm-management-cam-install
    spec:
      manageservice:
        <Set your custom installation parameter values>
  license:
    accept: <Set true to accept the license>
  storageClass: <Storage Class name that supports RWX>
  storageClassLargeBlock: <Select a storage class with a large block size (for example, 64k)>
EOF

2. Create Infrastructure Automation custom resource with default values

Run the following command to create an instance of the Infrastructure Automation custom resource called IAConfig. The list of install parameters with its default values are listed in Managed services installation parameters page.

cat << EOF | oc apply -f -
kind: IAConfig
apiVersion: aiops.ibm.com/v1alpha1
metadata:
  name: ibm-ia-installer
  namespace: cp4waiops
spec:
  imagePullSecret: ibm-entitlement-key
  infraAutoComposableComponents:
  - enabled: <set to true to install Infrastructure Management component of Infrastructure Automation, false otherwise>
    name: ibm-management-im-install
    spec: {}
  - enabled: <set to true to install Managed services component of Infrastructure Automation, false otherwise>
    name: ibm-management-cam-install
    spec: {}
  license:
    accept: <set true to accept the license>
  storageClass: <Storage Class name that supports RWX>
  storageClassLargeBlock: <Select a storage class with a large block size (for example, 64k)>
EOF

After a few minutes, verify that the Infrastructure Automation operator is installed in the cp4waiops project (namespace) with the following command:

oc get pods -n cp4waiops | grep ibm-infrastructure-automation-operator-controller-manager

Deploying Infrastructure management as a containerized deployment (podified).

Complete these steps to install Infrastructure management as a containerized deployment.

• Prerequisites
• Deploy the ibm-management-im-install operand

Prerequisites

• Ensure the following operators for Infrastructure management have been installed.

  • ibm-management-im-install for Infrastructure management has been installed. For more information, see Infrastructure management.

• Ensure IBM Cloud Pak® is setup for LDAP authentication. You need an existing user-group from this LDAP repository to use for the Infrastructure management deployment.

Deploy the ibm-management-im-install operand

Install an instance of the Infrastructure management using the Red Hat® OpenShift® Container Platform console or the CLI (command-line tools).

1. Create an installation instance CR file <im-install-cr.yaml> using the following yaml file and update the applicationDomain, imagePullSecret, initialAdminGroupName and accept license.

   apiVersion: infra.management.ibm.com/v1alpha1
   kind: IMInstall
   metadata:
     labels:
       app.kubernetes.io/instance: ibm-infra-management-install-operator
       app.kubernetes.io/managed-by: ibm-infra-management-install-operator
       app.kubernetes.io/name: ibm-infra-management-install-operator
     name: im-iminstall
     namespace: cp4waiops
   spec:
     applicationDomain: <YOUR_IM_HTTPD_ROUTE>
     imagePullPolicy: Always
     imagePullSecret: ibm-entitlement-key
     initialAdminGroupName: <YOUR_LDAP_USER_GROUP>
     storageClassName: <STORAGE_CLASS_NAME>
     license:
       accept: true
   

   Where:

   YOUR_IM_HTTPD_ROUTE is a user-defined route, which must include a name for your installation plus part of your IBM Cloud Pak Automation console console's route. Use the following oc command to obtain the console route and modify it to derive your Infrastructure management route.

   oc get ingress.config.openshift.io -o=jsonpath='{.items[0].spec.domain}'

   Example output:

   apps.mycluster.myibm.com
   

   
   

   Add inframgmtinstall to the output to create YOUR_IM_HTTPD_ROUTE. For example: inframgmtinstall.apps.mycluster.myibm.com.

   YOUR_LDAP_USER_GROUP is an existing user-group defined in your LDAP repository. As part of the initial setup, this LDAP group is created in Infrastructure management to match your existing LDAP group by name, and assigned an account role which facilitates SSO login.

   Important: You must specify an LDAP user-group and it must contain at least one user that is able to login to the IBM Cloud Pak Automation console. For example, you have an existing LDAP group that is named group100 and a user with the username user100 is a member of the group. You enter group100 for the value of <YOUR_LDAP_USER_GROUP>.

   STORAGE_CLASS_NAME The storage class that will be used by the Infrastructure management data stores. You can specify the same storage class name you used for Infrastructure Automation's storageClass. If you do not specify the storageClassName keyword, then the cluster's default storage class will be used.

   ACCEPT LICENSE set the accept value to true to accept the license.

2. Deploy the installation instance CR yaml using one of the following methods:

   • Using the CLI login to your OpenShift cluster where Infrastructure Automation is installed. For example,

     oc login --token=`<sha256~EUe-BThLn-qRm32K16QDqLMCQZz5VKlM42JKIj2-U7M>` --server=https://`<api.mycluster.myibm.com>`:6443
     

     oc apply -f im-install-cr.yaml
     

   • Using the OpenShift Console.

     Create an IMInstall instance to deploy Infrastructure management.

     1. Navigate to Operators > Installed Operators.
     2. Switch the project to cp4waiops.
     3. Click IBM Infrastructure Management Install.
     4. Click Create Instance in the IMInstall tile.
     5. Switch to YAML view.
     6. Copy and paste the installation instance yaml created in step 1.
     7. Click Create.

3. Verify the pods are running (It can take a few minutes for the pods to start) with the command,

   oc get pods -n cp4waiops
   

   The following Infrastructure management pods should be running.

   • 1-event-handle-*
   • 1-generic-*
   • 1-priority-*
   • 1-remote-console-*
   • 1-reporting-*
   • 1-schedule-*
   • 1-ui-*
   • 1-web-service-*
   • httpd-*
   • ibm-infra-management-application-*
   • memcached-*

Deploying Infrastructure management as a virtual machine appliance

Complete these steps to install Infrastructure management as a virtual machine appliance.

• Prerequisites
• Step 1. Download the appliance image
• Step 2. Install and configure the appliance
• Step 3. Configure OIDC for Infrastructure management appliance

Prerequisites

• Ensure you enable the operators for Infrastructure management by opening the installation YAML file. Locate the pakModules section, and change enabled: false to enabled: true. Enable these Infrastructure management-related operators:

  • ibm-management-im-install for Infrastructure management has been installed. For more information, see Infrastructure management.

• You must configure and connect an LDAP directory with IBM Cloud Pak®. You must have an LDAP group in your configuration for IBM Cloud Pak with users defined who will access Infrastructure management.

Step 1. Download the Infrastructure management appliance package for your environment.

Follow the steps in Install the Infrastructure management appliance for your virtual environment.

Step 2. Install and configure the Infrastructure management appliance.

Follow the steps in Install the Infrastructure management appliance for your virtual environment.

Step 3. Configure OIDC integration between IBM Cloud Pak® and the Infrastructure management appliance.

**Note:**Only OIDC-based authentication (OpenID Connect) is supported. The configuration of OpenID Connect (OIDC) is required for integration with Infrastructure management and IBM Cloud Pak®.

• Prerequisites
• Step 1. Register Infrastructure management instance with IAM as an OIDC client
• Step 2. Import the Root CA certificate to Infrastructure management
• Step 3. Configure the Administrative UI
• Step 4. Integrating Infrastructure management with IBM Cloud Pak for Watson AIOps

Prerequisites

• Before you configure OIDC make sure you install the Infrastructure management virtual machine appliance. For more information, see Installation and Upgrade.

• Single sign-on with Infrastructure management and IBM Cloud Pak for Watson AIOps requires an LDAP server connection.

  For more information about adding an LDAP connection, see Configuring LDAP connection.

Step 1. Register Infrastructure management instance with IAM as an OIDC client

In order to enable single sign-on (SSO) for Infrastructure management with OIDC, the Infrastructure management instance needs to register as an OIDC client with Identity and Access Management (IAM). Complete these steps on the IBM Cloud Pak for Watson AIOps cluster.

You can register Infrastructure management as an OIDC client with IAM using the cloudctl command.

The registration method requires the following registration payload in a file "registration.json":

{
  "token_endpoint_auth_method":"client_secret_basic",
  "client_id": "<YOUR_CLIENT_ID>",
  "client_secret": "<YOUR_CLIENT_SECRET>",
  "scope":"openid profile email",
  "grant_types":[
     "authorization_code",
     "client_credentials",
     "password",
     "implicit",
     "refresh_token",
     "urn:ietf:params:oauth:grant-type:jwt-bearer"
  ],
  "response_types":[
     "code",
     "token",
     "id_token token"
  ],
  "application_type":"web",
  "subject_type":"public",
  "post_logout_redirect_uris":[
     "https://<YOUR_CLOUD_PAK_ROUTE>"   ],
  "preauthorized_scope":"openid profile email general",
  "introspect_tokens":true,
  "trusted_uri_prefixes":[
     "https://<YOUR_CLOUD_PAK_ROUTE>/"    ],
  "redirect_uris":["https://<YOUR_CLOUD_PAK_ROUTE>/auth/liberty/callback","https://<INFRA_MGMT_URL>/oidc_login/redirect_uri"]
}

Example registration payload (for reference only):

{
  "token_endpoint_auth_method":"client_secret_basic",
  "client_id": "AaNzNVFsSjlLVkl6Zk5hZ01MRzJVaVdnbFcxNGl5cnQK",
  "client_secret": "AaNVNzF4ZUxNSVBQUHZHdG1xQmNsTTFOWmNUUGlnYUkK",
  "scope":"openid profile email",
  "grant_types":[
     "authorization_code",
     "client_credentials",
     "password",
     "implicit",
     "refresh_token",
     "urn:ietf:params:oauth:grant-type:jwt-bearer"
  ],
  "response_types":[
     "code",
     "token",
     "id_token token"
  ],
  "application_type":"web",
  "subject_type":"public",
  "post_logout_redirect_uris":["https://cp-console.apps.mycluster.mydomain.com"],
  "preauthorized_scope":"openid profile email general",
  "introspect_tokens":true,
  "trusted_uri_prefixes":["https://cp-console.apps.mycluster.mydomain.com/"],
  "redirect_uris":["https://cp-console.apps.mycluster.mydomain.com/auth/liberty/callback","https://im-mycluster.mydomain.com/oidc_login/redirect_uri"]
}

1. Create a file named registration.json from the example template. Replace the values in the example template payload registration with the actual values based on your installation.

   • YOUR_CLIENT_ID Your base64 encoded character string.

   • YOUR_CLIENT_SECRET Your base64 encoded character string.

     Note: The <YOUR_CLIENT_ID> and <YOUR_CLIENT_SECRET> need to be generated. The values can be any string, but normally a 32 character string that is base64 encoded is used. You can use BASE64 to encode your character string. For more information, see: BASE64. Make a note of the values you generate for <YOUR_CLIENT_ID> and <YOUR_CLIENT_SECRET>. You will use the values in the next section to update the Apache configuration file.

     Example command that uses base64 to encode a character string:

     #
     # Generate two encrypted streams from some longer-than-32-characters strings
     #
     echo There is a huge white elephant in LA zoo |base64
     echo 12345678901234567890123456789012345 |base64
     

   • YOUR_CLOUD_PAK_ROUTE The URL of the IBM Cloud Pak for Watson AIOps console.

   • INFRA_MGMT_URL The URL of the Infrastructure management virtual machine appliance.

   • post_logout_redirect_uris The URL of the IBM Cloud Pak for Watson AIOps console.

   • trusted_uri_prefixes The URL of the IBM Cloud Pak for Watson AIOps console with "forward slash" /.

   • redirect_uris The URL of the IBM Cloud Pak for Watson AIOps console with the path to call back and the URL of the Infrastructure management host with the path to the redirect_uri.

   Note: You can run the following command on the IBM Cloud Pak for Watson AIOps cluster to determine the URL of the IBM Cloud Pak for Watson AIOps console:

   oc get routes cp-console -o=jsonpath='{.spec.host}' -n ibm-common-services
   

2. After the file registration.json is completed, log in and run the command to register Infrastructure management as an OIDC client.

   Note: Include the -n kube-system to specify this project, or the cloudctl iam command can fail.

   cloudctl login -a https://<YOUR_CLOUD_PAK_ROUTE> -n kube-system
   

   Example cloudctl iam command:

   cloudctl iam oauth-client-register -f registration.json
   

Step 2. Import the Root CA certificate to the Infrastructure management appliance

1. Retrieve the cluster CA cert by running this command on the cluster:

   oc get secret -n ibm-common-services ibmcloud-cluster-ca-cert -o jsonpath='{.data.ca.crt}'| base64 -–decode
   

   Note: When copying this command there can be some additional characters added that can cause incorrect command syntax. You can copy the first portion oc get secret -n ibm-common-services ibmcloud-cluster-ca-cert -o jsonpath= and manually add the remaining syntax '{.data.ca\.crt}'| base64 --decode.

2. Copy and paste the output to a file, for example ibm_cp_im.crt

3. Edit the ibm_cp_im.crt file, and change:

   • BEGIN CERTIFICATE to BEGIN TRUSTED CERTIFICATE
   • END CERTIFICATE to END TRUSTED CERTIFICATE

   Note: The following steps must be completed by logging in to the Infrastructure management appliance system as root user:

4. Copy the updated ibm_cp_im.crt file to the Infrastructure management appliance and save it in the directory: /etc/pki/ca-trust/source/anchors

5. Run the command:

   update-ca-trust
   

6. Restart the evm server by running the command:

   systemctl restart evmserverd
   

7. Copy the Apache OIDC template configuration file with these steps:

   export TEMPLATE_DIR="/opt/IBM/infrastructure-management-appliance/TEMPLATE"
   

   cp ${TEMPLATE_DIR}/etc/httpd/conf.d/manageiq-remote-user-openidc.conf /etc/httpd/conf.d/
   

   cp ${TEMPLATE_DIR}/etc/httpd/conf.d/manageiq-external-auth-openidc.conf.erb  /etc/httpd/conf.d/manageiq-external-auth-openidc.conf
   

8. The Apache /etc/httpd/conf.d/manageiq-external-auth-openidc.conf configuration file must be updated with installation-specific values. Replace the contents of the file with the actual values based on the installation.

   Sample configuration file:

   LoadModule          auth_openidc_module modules/mod_auth_openidc.so
   ServerName          https://<YOUR_IM_APPLIANCE_HOSTNAME>
   LogLevel            warn
   
   OIDCCLientID                   <YOUR_CLIENT_ID>
   OIDCClientSecret               <YOUR_CLIENT_SECRET>
   OIDCRedirectURI                https://<YOUR_IM_APPLIANCE_HOSTNAME>/oidc_login/redirect_uri
   OIDCCryptoPassphrase           <PASSPHRASE>
   OIDCOAuthRemoteUserClaim       sub
   OIDCRemoteUserClaim            name
   
   OIDCOAuthClientID                  <YOUR_CLIENT_ID>
   OIDCOAuthClientSecret              <YOUR_CLIENT_SECRET>
   OIDCOAuthIntrospectionEndpoint     https://<YOUR_CLOUD_PAK_ROUTE>/idprovider/v1/auth/introspect
   OIDCOAuthIntrospectionEndpointAuth client_secret_basic
   
   OIDCProviderIssuer                  https://127.0.0.1:443/idauth/oidc/endpoint/OP
   OIDCProviderAuthorizationEndpoint   https://<YOUR_CLOUD_PAK_ROUTE>/idprovider/v1/auth/authorize
   OIDCProviderTokenEndpoint           https://<YOUR_CLOUD_PAK_ROUTE>/idprovider/v1/auth/token
   OIDCProviderJwksUri                 https://<YOUR_CLOUD_PAK_ROUTE>/idprovider/v1/auth/jwk
   OIDCProviderEndSessionEndpoint      https://<YOUR_CLOUD_PAK_ROUTE>/idprovider/v1/auth/logout
   
   OIDCScope                        "openid email profile"
   OIDCResponseMode                 "query"
   OIDCProviderTokenEndpointAuth     client_secret_post
   
   OIDCPassUserInfoAs json
   OIDCSSLValidateServer off
   OIDCOAuthSSLValidateServer off
   OIDCHTTPTimeoutShort 10
   
   OIDCCacheEncrypt On
   <Location /oidc_login>
     AuthType  openid-connect
     Require   valid-user
   </Location>
   
   <Location /ui/service/oidc_login>
     AuthType openid-connect
     Require valid-user
     Header set Set-Cookie "miq_oidc_access_token=%{OIDC_access_token}e; Max-Age=10; Path=/ui/service"
   </Location>
   
   <LocationMatch ^/api(?!\/(v[\d\.]+\/)?product_info$)>
     SetEnvIf X-Auth-Token  '^.+$'                 let_api_token_in
     SetEnvIf X-MIQ-Token   '^.+$'                 let_sys_token_in
     SetEnvIf X-CSRF-Token  '^.+$'                 let_csrf_token_in
   
     AuthType  oauth20
     AuthName  "External Authentication (oidc) for API"
   
     Require   valid-user
     Order     Allow,Deny
     Allow from env=let_api_token_in
     Allow from env=let_sys_token_in
     Allow from env=let_csrf_token_in
     Satisfy   Any
   </LocationMatch>
   
   RequestHeader unset X-REMOTE-USER
   RequestHeader unset X-REMOTE_USER
   RequestHeader unset X_REMOTE-USER
   RequestHeader unset X_REMOTE_USER
   RequestHeader set X_REMOTE_USER %{OIDC_CLAIM_PREFERRED_USERNAME}e env=OIDC_CLAIM_PREFERRED_USERNAME
   RequestHeader set X_EXTERNAL_AUTH_ERROR %{EXTERNAL_AUTH_ERROR}e env=EXTERNAL_AUTH_ERROR
   RequestHeader set X_REMOTE_USER_EMAIL %{OIDC_CLAIM_EMAIL}e env=OIDC_CLAIM_EMAIL
   RequestHeader set X_REMOTE_USER_FIRSTNAME %{OIDC_CLAIM_GIVEN_NAME}e env=OIDC_CLAIM_GIVEN_NAME
   RequestHeader set X_REMOTE_USER_LASTNAME %{OIDC_CLAIM_FAMILY_NAME}e env=OIDC_CLAIM_FAMILY_NAME
   RequestHeader set X_REMOTE_USER_FULLNAME %{OIDC_CLAIM_NAME}e env=OIDC_CLAIM_NAME
   RequestHeader set X_REMOTE_USER_GROUPS %{OIDC_CLAIM_GROUPS}e env=OIDC_CLAIM_GROUPS
   RequestHeader set X_REMOTE_USER_DOMAIN %{OIDC_CLAIM_DOMAIN}e env=OIDC_CLAIM_DOMAIN
   

   • YOUR_IM_APPLIANCE_HOSTNAME Specifies the hostname of the Infrastructure management appliance server.
   • YOUR_CLIENT_ID The client ID used for registering Infrastructure management as an OIDC client with IAM.
   • YOUR_CLIENT_SECRET The client secret that is used for registering Infrastructure management as an OIDC client with IAM.
   • YOUR_CLOUD_PAK_ROUTE The URL of the IBM Cloud Pak UI console.
   • OIDCCryptoPassphrase Can be any arbitrary alpha-numeric string.

   Note: YOUR_CLIENT_ID and YOUR_CLIENT_SECRET values are generated when you register Infrastructure Management as an OIDC client.

   Example configuration file (for reference only):

   LoadModule          auth_openidc_module modules/mod_auth_openidc.so
   ServerName          https://im-mycluster.mydomain.com
   LogLevel            warn
   
   OIDCCLientID                       N3NzNVFsSjlLVkl6Zk5hZ01MRzJVaVdnbFcxNGl5cnQK
   OIDCClientSecret                   VWNVNzF4ZUxNSVBQUHZHdG1xQmNsTTFOWmNUUGlnYUkK
   OIDCRedirectURI                    https://im-mycluster.mydomain.com/oidc_login/redirect_uri
   OIDCCryptoPassphrase               alphabeta
   OIDCOAuthRemoteUserClaim           sub
   OIDCRemoteUserClaim                name
   
   OIDCOAuthClientID                  N3NzNVFsSjlLVkl6Zk5hZ01MRzJVaVdnbFcxNGl5cnQK
   OIDCOAuthClientSecret              VWNVNzF4ZUxNSVBQUHZHdG1xQmNsTTFOWmNUUGlnYUkK
   OIDCOAuthIntrospectionEndpoint     https://cp-console.apps.mycluster.mydomain.com/idprovider/v1/auth/introspect
   OIDCOAuthIntrospectionEndpointAuth client_secret_basic
   
   OIDCProviderIssuer                 https://127.0.0.1:443/idauth/oidc/endpoint/OP
   OIDCProviderAuthorizationEndpoint  https://cp-console.apps.mycluster.mydomain.com/idprovider/v1/auth/authorize
   OIDCProviderTokenEndpoint          https://cp-console.apps.mycluster.mydomain.com/idprovider/v1/auth/token
   OIDCProviderJwksUri                https://cp-console.apps.mycluster.mydomain.com/idprovider/v1/auth/jwk
   OIDCProviderEndSessionEndpoint     https://cp-console.apps.mycluster.mydomain.com/idprovider/v1/auth/logout
   
   OIDCScope                          "openid email profile"
   OIDCResponseMode                   "query"
   OIDCProviderTokenEndpointAuth      client_secret_post
   
   OIDCPassUserInfoAs json
   OIDCSSLValidateServer off
   OIDCOAuthSSLValidateServer off
   OIDCHTTPTimeoutShort 10
   
   OIDCCacheEncrypt On
   <Location /oidc_login>
     AuthType  openid-connect
     Require   valid-user
   </Location>
   
   <Location /ui/service/oidc_login>
     AuthType openid-connect
     Require valid-user
     Header set Set-Cookie "miq_oidc_access_token=%{OIDC_access_token}e; Max-Age=10; Path=/ui/service"
   </Location>
   
   <LocationMatch ^/api(?!\/(v[\d\.]+\/)?product_info$)>
     SetEnvIf X-Auth-Token  '^.+$'                 let_api_token_in
     SetEnvIf X-MIQ-Token   '^.+$'                 let_sys_token_in
     SetEnvIf X-CSRF-Token  '^.+$'                 let_csrf_token_in
   
     AuthType  oauth20
     AuthName  "External Authentication (oidc) for API"
   
     Require   valid-user
     Order     Allow,Deny
     Allow from env=let_api_token_in
     Allow from env=let_sys_token_in
     Allow from env=let_csrf_token_in
     Satisfy   Any
   </LocationMatch>
   
   RequestHeader unset X-REMOTE-USER
   RequestHeader unset X-REMOTE_USER
   RequestHeader unset X_REMOTE-USER
   RequestHeader unset X_REMOTE_USER
   RequestHeader set X_REMOTE_USER %{OIDC_CLAIM_PREFERRED_USERNAME}e env=OIDC_CLAIM_PREFERRED_USERNAME
   RequestHeader set X_EXTERNAL_AUTH_ERROR %{EXTERNAL_AUTH_ERROR}e env=EXTERNAL_AUTH_ERROR
   RequestHeader set X_REMOTE_USER_EMAIL %{OIDC_CLAIM_EMAIL}e env=OIDC_CLAIM_EMAIL
   RequestHeader set X_REMOTE_USER_FIRSTNAME %{OIDC_CLAIM_GIVEN_NAME}e env=OIDC_CLAIM_GIVEN_NAME
   RequestHeader set X_REMOTE_USER_LASTNAME %{OIDC_CLAIM_FAMILY_NAME}e env=OIDC_CLAIM_FAMILY_NAME
   RequestHeader set X_REMOTE_USER_FULLNAME %{OIDC_CLAIM_NAME}e env=OIDC_CLAIM_NAME
   RequestHeader set X_REMOTE_USER_GROUPS %{OIDC_CLAIM_GROUPS}e env=OIDC_CLAIM_GROUPS
   RequestHeader set X_REMOTE_USER_DOMAIN %{OIDC_CLAIM_DOMAIN}e env=OIDC_CLAIM_DOMAIN
   

9. Restart Apache on the appliance.

   systemctl restart httpd
   

Step 3. Configure the Administrative UI

Update the Appliance Administrative UI to be OIDC aware and function. Complete these steps on each UI-enabled Infrastructure management appliance.

1. Log in as admin.

2. Select the Settings > Application Settings, select "Server "EVM [1]" (current)" under Zones, then select the Authentication tab.

3. In the Authentication section, set the Mode to External (httpd)

4. In the External Authentication (HTTPd) Settings section, set Provider Type to Enable OpenID-Connect.

   • Note: This setting enables the OIDC login button on the login screen that redirects to the OIDC protected page for authentication, and supports the OIDC logout process.

5. Optional: In the External Authentication (HTTPd) Settings section, select Enable Single Sign-On.

   • Note: If you select this option, the initial access to the Appliance Administrative UI will redirect to the OIDC Identity Provider authentication screen.

6. In the Role Settings section, select the Get User Groups from External Authentication (HTTPd) setting.

7. Click Save.

8. Select Access Control, click Groups and make sure the user’s groups are created on the Appliance and appropriate roles are assigned to those groups. The user's groups to be added in Infrastructure management should have the same names as the groups defined in the LDAP server that is configured in the IBM Cloud Pak console.

   1. Under the Access Control, click Groups.

   2. Click Configuration, then Add a new Group.

   3. Enter your existing LDAP group name in the Description field. For example, im_ldap_group.

   4. Select the Role for this LDAP group. For example, select the EvmRole-super_administrator to map to this group. The Infrastructure management administrator can map to the roles that make sense for the user group.

   5. Select My Company for Project/Tenant.

   6. Click Add.

      Note: Access control in Infrastructure management is based on group membership as roles are assigned to groups. When Infrastructure management is integrated with IBM Cloud Pak for Watson AIOps using single sign-on (SSO), it looks at the user’s group membership in the identity token and checks if that group exists in Infrastructure management. If the group doesn't exist, then access is denied. You must create at least one group with the role EvmRole-super_administrator and assign one user to this group. This user will be the Admin user for Infrastructure management and referred to as IM_ADMIN_LDAP_USER. The IM_ADMIN_LDAP_USER must be a member of the LDAP group with the role EvmRole-super_administrator in Infrastructure management.

      Important: You must create the groups in Infrastructure management that match your existing LDAP groups by name, and assign the groups account roles. At least one group to which the user belongs in LDAP that IBM Cloud Pak for Watson AIOps is configured to use must also be created in Infrastructure management. You must assign a proper role to this group in Infrastructure management.

      Example: In LDAP a group that is named imgroup100 exists and a user with username imuser100 is a member of the group. The user imuser100 and the group imgroup100 must be created in Infrastructure management.

Step 4. Integrating Infrastructure management with IBM Cloud Pak for Watson AIOps

Enable navigation to Infrastructure management within the IBM Cloud Pak console.

Complete the following steps on a Linux system. You can use the boot node from the HUB cluster where IBM Cloud Pak for Watson AIOps is installed. These steps enable navigation to Infrastructure management from the IBM Cloud Pak​​ console:

1. Clone the IBM Cloud Pak for Watson AIOps samples GitHub repository to obtain the menu customization script. You must run the script on a Linux operating system.

   Download the supporting subdirectories to make the script run successfully. The files and subdirectories that are required to run the script are

   im-appliance-link-install.sh
   nav/automate.yml
   nav_template/automate.sh
   

2. Install and authenticate kubectl. For more information, see Installing the Kubernetes CLI (kubectl).

3. Navigate to the directoy cp4waiops-samples/infrastructure-automation/infrastructure-management/appliance. Set the file permissions on the script and run im-appliance-link-install.sh to enable navigation to your Infrastructure management instance:

   chmod 755 ./im-appliance-link-install.sh
   
   ./im-appliance-link-install.sh -i <Infrastructure management URL>
   

   • -i Is a required parameter that refers to the URL for the Infrastructure management console. For example, ./im-appliance-link-install.sh -i https://im-mycluster.mydomain.com/

4. Verify that the Infrastructure management instance is in the IBM Cloud Pak​​ console navigation menu. From the IBM Cloud Pak​​ navigation menu, click Automate infrastructure > Infrastructure management.

Infrastructure management is integrated with the IBM Cloud Pak​​ console.