ISAMESSO : Replacing the IBM HTTP Server SSL certificate with an SSL certificate signed by a third-party CA

Make sure that:

• you have installed and configured WebSphere® Application Server 7.0 with minimum fix pack 5 in your computer
• you have installed and configured IBM® HTTP Server 7.0 in your computer
• you have a copy of the third-party CA certificate file, in Base64-encoded ASCII or binary DER format
• you have a copy of the SSL certificate signed by the third-party CA and its corresponding private key
  Note: the SSL certificate and its private key must be stored in a keystore file with any one of the following supported types:

  • JKS
  • JCEKS
  • PKCS11
  • PKCS12
  • CMSKS
  • PKCS12JarSigner
• the third-party CA certificate has been distributed to the computers where AccessAgent is installed, and
• the certificate must be imported into the Trusted Root Certification Authorities container of the Computer account in the Windows® Certificate Store
  Note: AccessAgent does not work if the third-party CA that signs the IBM HTTP Server SSL certificate is not trusted by Windows, on which the AccessAgent is installed.

Procedure

1. Log on to the IBM Integrated Solutions Console.
2. Add the third-party CA certificate to the WebSphere Application Server truststores.
   Note:

   • If you are using a standalone WebSphere Application Server, complete step 2 for the NodeDefaultTrustStore.
   • If you are using a WebSphere Application Server Network Deployment cluster, complete step 2 for the CellDefaultTrustStore and every NodeDefaultTrustStore.
   1. On the Integrated Solutions Console left navigation pane, select Security > SSL certificate and key management.
   2. Under Related Items, click Key stores and certificates.
   3. Click the <truststore name>. For example, NodeDefaultTrustStore or CellDefaultTrustStore.
   4. Under Additional Properties, click Signer certificates.
   5. Click Add.
   6. In the Alias field, enter an alias name for the third-party CA certificate. For example, rootca.
   7. In the File name field, enter the file path to the third-party CA certificate file. For example, C:\rootca.der.
   8. From the Data type list, select the format of the certificate file.
   9. Click OK.
   10. Changes have been made to the local configuration. Click Save.
3. If you are using a standalone WebSphere Application Server, restart the WebSphere Application Server.
   If you are using a WebSphere Application Server Network Deployment cluster, perform a full resynchronization of the nodes; restart the cluster; and start the IMS Server.
   To perform a full resynchronization of the nodes:

   1. On the Integrated Solutions Console left navigation pane, select System administration > Nodes.
   2. Select the check boxes of the nodes where the IMS Server is installed.
   3. Click Full Resynchronize.
   To restart the cluster:

   1. On the Integrated Solutions Console left navigation pane, select Servers > Clusters > Websphere Application server clusters.
   2. Select the check box of the cluster.
   3. Click Stop.
   4. Select the check box of the cluster.
   5. Click Start.
   To start the IMS Server:

   1. On the Integrated Solutions Console left navigation pane, click Applications > Application Types > WebSphere enterprise applications.
   2. Select the TAM E-SSO IMS check box from the list of applications.
   3. Click Start.

Note: Complete steps 4-7 for all IBM HTTP Servers configured to front the WebSphere Application Servers.

4. Delete the current IBM HTTP Server SSL certificate.
   1. On the Integrated Solutions Console left navigation pane, select Servers > Server Types > Web servers.
   2. Click the Web server name whose SSL certificate is to be replaced.
   3. Under Additional Properties, click Plug-in properties.
   4. Under Plug-in properties, click Manage keys and certificates.
   5. Under Additional Properties, click Personal certificates.
   6. Select the check box of the default certificate.
   7. Click Delete.
   8. Changes have been made to the local configuration. Click Save.
5. Import the new IBM HTTP Server SSL certificate.
   1. Still on the same page, click Import.
   2. Select Key store file.
   3. In the Key file name field, enter the path to the keystore file that contains the new SSL certificate. For example, C:\keystore.p12.
   4. From the Type list, select the keystore type.
   5. In the Key file password field, enter the keystore password.
   6. Click Get Key File Aliases.
   7. Select the certificate alias to be imported from the list. For example, sslcert.
   8. In the Imported certificate alias field, enter default.
   9. Click OK.
   10. Changes have been made to the local configuration. Click Save.
6. Synchronize the change to IBM HTTP Server.
   1. On the Integrated Solutions Console left navigation pane, select Servers > Server Types > Web servers.
   2. Click the Web server name.
   3. Under Additional Properties, click Plug-in properties.
   4. Under Plug-in properties, click Copy to Web server key store directory.
7. Restart the IBM HTTP Server. 

Unable to access IMS Configuration Utility after IMS server machine IP address is changed

Steps to resolve this issue.

1. Go to network connection in the PC, and change the network setting of 
IP Environment: TAM ESSO IMS> 
Solution: 
If the IP address has changed, you will need to modify a tomcat 
configuration file as follow: 
1. Go to [IMS Server installation folder]\conf 
2. Open server.xml 
3. Search for "WebConfigurator-Service" - this should be the "name" 
attribute value of the element node "Service" 
4. Within the "Service" node, edit the second IP address in the 
attribute node "allow" of the element node "Value" 
5. Save the xml file 
6. Restart the IMS Server

Configuring ISAM ESSO with ISIM.

Configuring ISAM ESSO with ISIM.

1) As ISAM ESSO is a TDI based adapter, make sure only one instance of TDI is running on the box where you are configuring ISAM ESSO. In my case, there were two instances which results in communication error.

2) Also as part of configuration, in the ISAM ESSO Adapter document he has mentioned configuring the SSL between the Dispatcher and IMS is an optional step. But without the SSL configuration, you cannot integrate ISAM ESSO with ISIM.

Following are the steps to be followed while configuring ISAM ESSO with ISIM.

1) Copy SAMESSOConnector.jar file from the installation package to the TivoliDirectory Integrator directory. The location depends on your operating system. For Windows: ITDI_HOME\jars\connectors

2) Configure the IBM Security Access Manager Enterprise Single Sign-On IMS Server.

a) Start the IMS Configuration Utility.

b) Click IMS Bridges on the left side under Advanced settings.

c) Select IMS Bridge from the Add configuration group drop-down box and Click Configure.

d) Define a name and an IMS Bridge password, a shared secret, in the available test input boxes.

e) Enter an IMS Bridge IP address value. This address is the IP address of the systems on which Tivoli Directory Integrator is installed.

f) Click Add. Set the value for IMS Bridge Type to Provisioning.

g) Click Add.. Log on to IBM Security Access Manager Enterprise Single Sign-On AccessAdmin.

h) Navigate to System Policies > Sign up Policies > Option for specifying secret. Choose Secret not required.

i) Click Update.

j) At the WebSphere console, restart the IMS Server application for the changes to take effect.

3) Configure the SSL connection between Dispatcher and the IMS Server

a) Go to https://SAM_ESSO_server/. The SAM_ESSO_server is the IMS Server hostname.

b) View the certificate. Click SSL lock. If your browser reports that revocation information is not available, click View Certificate. Click Certification Path. Select the CA Root certificate. Export the certificate into a file encoded in the Base64 format.

c)  If the Dispatcher already has a configured keystore, use the keytool.exe program to import the IMS Server certificate. If the keystore is not configured, create it by running the following command from a command prompt. Type the command on a single line.

keytool -import -alias ims -file c:\TAMESSO.cer -keystore c:\truststore.jks –storepass passw0rd

d) Edit ITDI_HOME/timsol/solution.properties file to specify truststore and keystore information.

è javax.net.ssl.trustStore=truststore.jks

è javax.net.ssl.trustStorePassword=passw0rd

è javax.net.ssl.trustStoreclass=jks

e) After modifying the solution.properties file, restart the RMI Dispatcher. And then Import the adapter profile into the IBM Security Identity Manager server.