IBM Security Verify Governance Adapter 10.0.3 for RSA Authentication Manager - Release notes

The following connectors are available:

• connectors/am80/RsaAuthMgrConnector.jar
• connectors/am81/RsaAuthMgrConnector.jar
• connectors/am82, am84 and am85/RsaAuthMgrConnector.jar
• connectors/am87/RsaAuthMgrConnector.jar

For RSA 8.7 and later: Copy the resource/RsaAuthmanConfig.properties and resource/config.properties files to the SDI_HOME/timsol/properties directory.

Note: Remove table for RSA Authentication Manager 7.1 and its related content.

In RSA Authentication Manager 8.2, for SDI 10 or above version you need to copy all jars from the RSA_SDK_HOME/lib/java to SDI_HOME/timsol/rsa folder, do not copy any other jars.

This topic describes the procedures to install ILMT tag files.

Before you begin

Ensure that the Dispatcher is installed.

Procedure

Copy the files from ILMT-Tags folder to the specified location:

• Windows: <SDI-HOME>\swidtag
• Unix/Linux: <SDI-HOME>/swidtag

Note: Remove this entire section as we are removing support of RSA 7.x

Note: Remove all the details which are regarding For RSA Authentication Manager 7.1

Do not add any version specific information like for 8.1 or 8.0 keep it like for RSA without mentioning version. Replace .cer to .der

Update section Set the following Java system property like below:

# SSL Truststore Configuration
# For SDI 7.x
weblogic.security.SSL.trustedCAKeyStore=full-path-to-rsaTruststore.jks
# For SDI 10 and above version use below property
ims.ssl.client.trust.keystore.filename=full-path-to-rsaTruststore.jks
# For SDI 10 and above version to add truststore password use below property
#com.rsa.ssl.trust.store.password=password

# TLS Protocol Configuration for all SDI versions
weblogic.security.SSL.protocolVersion=TLSv1.2
weblogic.security.SSL.minimumProtocolVersion=TLSv1.2
weblogic.security.SSL.ignoreHostnameVerification=true

This section is applicable for SDI 10 or above versions only, Java 17 enforces strict module encapsulation. WebLogic thin client requires access to internal Java modules. The configuration differs between Windows and Linux platforms.

For Windows: Update ibmdiservice.props

1. Navigate to: <SDI_HOME>\ibmdiservice.props
2. Locate the jvmcmdoptions property
3. Update with the following configuration:

jvmcmdoptions=--add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.lang.reflect=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.nio=ALL-UNNAMED --add-opens=java.base/java.security=ALL-UNNAMED --add-opens=java.base/java.text=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.base/sun.nio.ch=ALL-UNNAMED --add-opens=java.base/sun.security.action=ALL-UNNAMED --add-opens=java.base/sun.security.util=ALL-UNNAMED --add-opens=java.management/javax.management=ALL-UNNAMED --add-opens=java.management/javax.management.openmbean=ALL-UNNAMED --add-opens=java.naming/com.sun.jndi.ldap=ALL-UNNAMED --add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED --add-exports=java.naming/com.sun.jndi.ldap=ALL-UNNAMED --add-exports=java.base/sun.security.internal.spec=ALL-UNNAMED --add-exports=java.base/sun.security.provider=ALL-UNNAMED -Dlog4j2.configurationFile=etc\log4j2.xml

Important Notes for Windows:

• Ensure there are NO trailing spaces after backslashes if using multi-line format
• The entire jvmcmdoptions value should be on a single line
• Verify the configuration after saving the file

For Linux: Update ibmdisrv Script

1. Navigate to: <SDI_HOME>/ibmdisrv
2. Locate the Java execution command (typically the line starting with $JAVA_HOME/bin/java or similar)
3. Add the following --add-opens and --add-exports flags to the Java command:

--add-opens=java.base/java.io=ALL-UNNAMED \
--add-opens=java.base/java.lang=ALL-UNNAMED \
--add-opens=java.base/java.lang.invoke=ALL-UNNAMED \
--add-opens=java.base/java.lang.reflect=ALL-UNNAMED \
--add-opens=java.base/java.net=ALL-UNNAMED \
--add-opens=java.base/java.nio=ALL-UNNAMED \
--add-opens=java.base/java.security=ALL-UNNAMED \
--add-opens=java.base/java.text=ALL-UNNAMED \
--add-opens=java.base/java.time=ALL-UNNAMED \
--add-opens=java.base/java.util=ALL-UNNAMED \
--add-opens=java.base/java.util.concurrent=ALL-UNNAMED \
--add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED \
--add-opens=java.base/sun.nio.ch=ALL-UNNAMED \
--add-opens=java.base/sun.security.action=ALL-UNNAMED \
--add-opens=java.base/sun.security.util=ALL-UNNAMED \
--add-opens=java.management/javax.management=ALL-UNNAMED \
--add-opens=java.management/javax.management.openmbean=ALL-UNNAMED \
--add-opens=java.naming/com.sun.jndi.ldap=ALL-UNNAMED \
--add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED \
--add-exports=java.naming/com.sun.jndi.ldap=ALL-UNNAMED \
--add-exports=java.base/sun.security.internal.spec=ALL-UNNAMED \
--add-exports=java.base/sun.security.provider=ALL-UNNAMED

Note: From Table 1. Adapter components remove all reference related to RSA Authentication Manager 7.1

For Verify Governance target management, you can install an IBM Security Verify Governance adapter or a custom adapter on the built-in Security Verify Directory Integrator in the virtual appliance instead of installing the adapter externally. As such, there is no need to manage a separate virtual machine or system.

About this task

This procedure is applicable to install this adapter on the virtual appliance for a selected list of Identity Adapters. See the Identity Adapters product documentation to determine which adapters are supported in Identity Governance and Intelligence, and which can be installed on the virtual appliance.

All Identity Governance and Intelligence supported adapters can be installed externally on the virtual appliance. Depending on the adapter, an external Security Directory Integrator may be required.

See the corresponding Adapter Installation and Configuration Guide for the specific prerequisites, installation and configuration tasks, and issues and limitations. See the Adapters Release Notes for any updates to these references.

Procedure

1. Download the adapter package from the IBM Passport Advantage.

   For example, Adapter-.zip.

   The adapter package includes the following files:

   Files	Descriptions
   bundledefinition.json	The adapter definition file. It specifies the content of the package, and the adapter installation and configuration properties that are required to install and update the adapter.
   Adapter JAR profile	A Security Directory Integrator adapter always include a JAR profile which contains: • targetProfile.json • Service provider configuration • Resource type configuration • SCIM schema extensions • List of assembly lines • A set of assembly lines in XML files • A set of forms in XML files • Custom properties that include labels and messages for supported languages. Use the Target Administration module to import the target profile.
   Additional adapter specific files	Examples of adapter specific files: • Connector jar files • Configuration files • Script files • Properties files The file names are specified in the adapter definition file along with the destination directory in the virtual appliance.

2. From the top-level menu of the Appliance Dashboard, click Configure > SDI Management.

3. Select the instance of the Security Directory Integrator for which you want to manage the adapters and click Manage > SDI Adapters.

   The SDI Adapters window is displayed with a table that list the name, version, and any comments about the installed adapters.

4. On the SDI Adapters window, click Install.

5. On the File Upload window, click Browse to locate the adapter package and then click OK.

   • For example, Adapter-.zip.
   • Provide the missing 3rd party libraries when prompted.

6. On the File Upload for Pre-requisite files window, click Select Files.

   • A new File Upload window is displayed.
   • Browse and select all the missing libraries. For example, httpclient-4.0.1.jar, sapjco3.jar
   • Click Open.
   • The selected files are listed in the File Upload for Pre-requisite files window.
   • Click OK.
   • The missing files are uploaded and the adapter package is updated with the 3rd party libraries.

7. Enable secure communication.

   • Select the instance of the Security Directory Integrator for which you want to manage the adapter.
   • Click Edit.
   • Click the Enable SSL check box.
   • Click Save Configuration.
   • Import the SSL certificate to the IBM Security Verify Directory Integrator server.
   • Select the instance of the Security Directory Integrator for which you want to manage the adapter.
   • Click Manage > Certificates.
   • Click the Signer tab.
   • Click Import.
   • The Import Certificate window is displayed.
   • Browse for the certificate file.
   • Specify a label for the certificate. It can be any name.
   • Click Save.

Note: While uploading the Adapter package, you may receive System Error: A file included in the SDI Adapter zip already exists on the system. The Server Message log under Appliance tab of VA has a reference to error - com.ibm.identity.sdi.SDIManagementService File ibm.com_IBM_Verify_Identity_Governance_xxxx.swidtag found in the adapter zip at location ILMT-Tags or already exists in system. This is because, you can install the same swidtags only once. So, if another adapter of the same type is installed, remove the swidtags.

The ibm.com_IBM_Verify_Identity_Governance_Enterprise-xxxx.swidtag file is common to all adapters. In addition to the common swidtag file, an application adapter needs ibm.com_IBM_Verify_Identity_Governance_Application_Adapters-xxxx.swidtag file and an infra adapter needs ibm.com_IBM_Verify_Identity_Governance_Lifecycle-xxxx.swidtag and ibm.com_IBM_Verify_Identity_Governance_Compliance-xxxx.swidtag files. So, if an application adapter is already installed and this is an infra adapter, then only install the infra-specific swidtags and the other way around. See Security Verify Governance Adapters v10.x to identify the type of the installed adapters.

Before you begin

The steps to install adapter and related files into the container can be performed using the adapterUtil.sh script, which is shipped with the dispatcher package. This script should be staged on the machine running Kubernetes cli. The adapterUtil.sh script is also readily available in the bin directory of ISIM IBM Security Verify Governance Identity Manager Container Starter Kit installation directory (If ISVDI was selected for installation during the ISIM container installation steps).

If, for any reason, the adapter util script cannot be executed or used, the below manual instructions must be followed to copy the files to the persistent volume.

Note: The container must be restarted after installing, uninstalling the adapter or any changes to the configuration yaml. To activate changes and restart the container run the following commands:

• <path_to_starterkit>/bin/createConfigs.sh isvdi
• For OpenShift container: oc -n isvgim rollout restart deployment isvdi
• For Kubernetes container: kubectl -n isvgim rollout restart deployment isvdi

Note: This document only describes the adapterUtil.sh command options that are required to install this adapter. For other command options, such as listing installed connectors and 3rd party jars, please refer to the Dispatcher10 Installation and Configuration Guide.

Installing / Upgrading / Re-installing / Downgrading the adapter

Using Script

Use below command to install / upgrade/ re-install / downgrade the adapter:

/path/to/adapterUtil.sh -loadAdapter "/path/to/Adapter-RsaAuthMgr-*.zip" accept

Where /path/to/adapterUtil.sh is the location where the adapterUtil.sh script is installed and /path/to/Adapter-RsaAuthMgr-*.zip is the location where the Adapter zip file is staged on the machine running Kubernetes cli.

Manually copying files to Persistent Volume

Copy the files to the persistent volume mapped to the /opt/IBM/svgadapters directory of the container image as per the given directory structure:

RsaAuthMgrConnector.jar

Copy this file to <Persistent_Volume>/jars/connectors directory.

ILMT-Tags

Copy below files to <Persistent_Volume>/swidtag directory:

• ibm.com_IBM_Verify_Identity_Governance_Compliance-11.0.0.swidtag
• ibm.com_IBM_Verify_Identity_Governance_Enterprise-11.0.0.swidtag
• ibm.com_IBM_Verify_Identity_Governance_Lifecycle-11.0.0.swidtag

Copying 3rd party libraries:

Using Script

Use below command to copy 3rd party jars: (List of the jars required are mentioned in Managed Resource section of Release Notes, need to copy all of these jars)

/path/to/adapterUtil.sh -copyToPatches "RSA_SDK_HOME/lib/java/*.jar"

This command will copy the 3rd party jars to <Persistent_Volume>/jars/patches directory.

Manually copying files to Persistent Volume

Copy 3rd party jar files to <Persistent_Volume>/jars/patches directory (List of the jars required are mentioned in Managed Resource section of Release Notes, need to copy all of these jars):

Configuring the SSL connection between the IBM Security Verify Directory Integrator Container and the RSA Authentication Manager Target

Export certificate and create trustStore jks file using java, refer to Enabling secure communication section for the same. Copy the created rsaTruststore.jks to the dispatcher container using the following command:

/path/to/adapterUtil.sh -copyFile path_to_crt/rsaTruststore.jks /opt/IBM/svgadapters/

Configuring RsaAuthmanConfig.properties

Update RsaAuthmanConfig.properties within /opt/IBM/svgadapters/timsol/properties folder by updating required properties mentioned in Authentication Manager config.properties file update section as well as add properties mentioned in Enabling secure communication section in the same file.

ims.ssl.client.trust.keystore.filename=/opt/IBM/svgadapters/rsaTruststore.jks
com.rsa.ssl.trust.store.password=password
weblogic.security.SSL.ignoreHostnameVerification=true
weblogic.security.SSL.protocolVersion=TLSv1.2
weblogic.security.SSL.minimumProtocolVersion=TLSv1.2

Enabling TLS 1.2

Refer https://www.ibm.com/docs/api/v1/content/SSCQGF_10.0.0/container/html/verify-directory-integrator.html#advanced page from SVDI.

If the config.yaml file which is used as the YAML_CONFIG_FILE environment variable for the container doesn't have an advanced configuration element, follow the instructions that are provided in https://www.ibm.com/docs/api/v1/content/SSCQGF_10.0.0/container/html/verify-directory-integrator.html#advanced to add an advanced configuration section to the config.yaml file.

Update ibmdisrv file

1. Copy ibmdisrv file from container by using the following command:

For OpenShift container:

oc cp -n isvgim <isvdi_pod_name>:/opt/IBM/TDI/ibmdisrv <destination_on_local_system>

For Kubernetes container:

kubectl cp -n isvgim <isvdi_pod_name>:/opt/IBM/TDI/ibmdisrv <destination_on_local_system>

2. Update ibmdisrv file as mentioned in the Configure Java 17 Module Access.

3. Copy updated ibmdisrv file to <Persistent_Volume> path:

/path/to/adapterUtil.sh -copyFile <destination_on_local_system>/ibmdisrv <Persistent_Volume>

4. Create rsa.sh script file having script as mentioned below to Copy ibmdisrv file to the <Persistent_Volume> path:

#!/bin/bash
cp <Persistent_Volume>/ibmdisrv /opt/IBM/TDI 

5. Give executable permission to rsa.sh file

6. Configure rsa.sh script in the container

Copy script to the <Persistent_Volume>/scripts directory manually in the container or you can use the following command:

/path/to/adapterUtil.sh -copyFile /path/to/rsa.sh <Persistent_Volume>/scripts

Add line for rsa.sh above the setHostname.sh script.

Add script as mentioned in the SVDI guide as follows:

init:
 aux-config-programs:
  - command: /opt/IBM/svgadapters/scripts/rsa.sh

If the config.yaml file which is used as the YAML_CONFIG_FILE environment variable for the container doesn't have an advanced configuration element, follow the instructions that are provided in https://www.ibm.com/docs/api/v1/content/SSCQGF_10.0.0/container/html/verify-directory-integrator.html#advanced to add an advanced configuration section to the config.yaml file.

Updating the container

Using Script

To update the dispatcher container with the new certificate using the ISVG-IM starter kit, run the following commands:

• <path_to_starterkit>/bin/createConfigs.sh isvdi
• For OpenShift container: oc -n isvgim rollout restart deployment isvdi
• For Kubernetes container: kubectl -n isvgim rollout restart deployment isvdi

Manually

To update the dispatcher container with the new certificate on Kubernetes/OpenShift, now run the following commands to create a config map and update the dispatcher specific yaml:

<kubectl or oc > create configmap <namespace> --from-file=<path to main isvdi config yaml> --from-file=<directory where certificates are stored> --dry-run=client -o yaml –namespace=<namespace where dispatcher container resides> > <path_to_dispatcher_container_that_runs_this_adapter_yaml>

e.g.

kubectl create configmap isvgimsdi --from-file=/root/isvg/config/adapters/isvdi_config.yaml --from-file=/root/isvg/config/certs --dry-run=client -o yaml --namespace=isvgim > /root/isvg/yaml/045-config-adapters.yaml

Then apply the updated dispatcher that runs this adapter yaml.

<kubectl or oc> apply -f <path_to_dispatcher_container_that_runs_this_adapter_yaml>

e.g.

oc apply -f /root/isvg/yaml/045-config-adapters.yaml

Finally restart the container

<kubectl or oc> rollout restart deployment <isvdi container deployment>

e.g.

oc -n isvgim rollout restart deployment isvdi

Enabling TLSv1.2 in Security Directory Integrator

Procedure:

1. Apply recommended fix packs and limited availability (LA) versions on the Security Directory Integrator. See Recommended fixes for IBM Security Directory Integrator (SDI).

2. After applying the appropriate updates, modify the /solution.properties file by appending the following text to the bottom of the file:

#####################
# # Protocols to enforce SSL protocols in a SDI Server
# # Optional values for com.ibm.di.SSL* property (TLSv1, TLSv1.1, TLSv1.2). # # This can be a multi-valued comma separated property
# # Optional values for com.ibm.jsse2.overrideDefaultProtocol property (SSL_TLSv2, TLSv1,TLSv11,TLSv12).
# # This is a single value property.
#####################

com.ibm.di.SSLProtocols=TLSv1,TLSv1.1,TLSv1.2
com.ibm.di.SSLServerProtocols=TLSv1,TLSv1.1,TLSv1.2
com.ibm.jsse2.overrideDefaultProtocol=TLSv1
com.ibm.jsse2.overrideDefaultTLS=true
#####################