Preparing the WebSphere® Application Server

Edit online

To install the single sign-on application on a separate system than where IBM Verify Identity Governance is installed, you must modify the WebSphere environment on that system.

About this task

Procedure

  1. Make sure that administrative security is enabled for the profile on which the SSO application is to be installed.
  2. Create a folder that is named classes, if it does not exist, in WAS_HOME/profiles/profile_name folder on which SSO application is deployed.

    Copy the itim_server.jar, itim_common.jar, and jlog.jar files from IM_HOME/lib to the WAS_HOME/profiles/profile_name/classes folder on the WebSphere Application Server client.

  3. Copy the following property files from IM_HOME/data to the WAS_HOME/profiles/profile_name /properties folder on the WebSphere Application Server client.
    • enRole.properties
    • enRoleAuthentication.properties
    • enRoleLDAPConnection.properties

      Specify the IBM Security Identity Manager LDAP server in the url java.naming.provider.url field. Use the IP address or machine name, such as java.naming.provider.url=ldap://10.88.36.209:389.

    • Properties.properties
    • tmsMessages.properties
  4. Create a data folder in the WAS_HOME/profiles/profile_name folder on the WebSphere Application Server client.
  5. Copy the IM_HOME/data/keystore folder to the WAS_HOME/profiles/profile_name/data folder on the WebSphere Application Server client.
  6. Restart the WebSphere Application Server client/server.
  7. Log in to the WebSphere Application Server client.
    On WebSphere administrative console, click Global security > Security Domains > Copy Global Security.
  8. Enter the information for IBM Security Identity Manager Security Domain.
  9. Click OK and save the changes to the master configuration.
  10. Configure the security domain.
    1. Go to Security Domain > ISIMSecurityDomain.
      Specify server1 as the scope of the domain. Click OK and save the changes to the master configuration.
    2. Go to Security Domain > ISIMSecurityDomain > Security Attributes > Application Security.
      Select the option Customize for this domain and check the checkbox Enable Application Security. Click OK and save the changes to master configuration.
    3. Go to Security Domain > ISIMSecurityDomain > User Realm.
      Select Standalone custom registry.
    4. Click Configure.
      Enter the realm name and custom registry class name. Select Ignore case for authorization.
    5. Click OK and save the changes to master configuration.
  11. Export and import the LTPA keys for the encryption and decryption of the identity tokens.
    1. Export the LTPA key from the WebSphere Application Server, where IBM Verify Identity Governance is installed.
      1. Go to Global Security > LTPA.
      2. Specify a password in the Password and Confirm password fields.
      3. Specify the path and LTPA key file name in the Fully qualified key file name field.
      4. Click Export keys.
    2. Import the LTPA key on the WebSphere Application Server client, where SSO application is installed.
      1. Go to Global Security > LTPA.
      2. Specify the password that was used in exporting the LTPA key in the Password and Confirm password fields.
      3. Copy the LTPA key file from the WebSphere Application Server to the WebSphere Application Server client. Specify the path of the LTPA key file on the WebSphere Application Server client in the Fully qualified key file name field.
      4. Click Import keys.
      5. Save the changes to the master configuration.