Setup Inbound Notifications Using SSL in Identity Manager vApp - Identity Manager

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

To secure communication between the Provisioning Server and the Identity Manager server in a virtual appliance (vApp) environment, you must configure inbound notifications to use an SSL connection. This article outlines the steps to generate the necessary certificate chain and update the shared secret configuration.

Environment

Identity Manager 14.5

Resolution

Part 1: Configure the SSL Certificate Chain

1. Retrieve the certificate chain: Run the following command on the vApp server (using port 8443): openssl s_client -showcerts -verify 5 -connect localhost:8443 < /dev/null
2. Create the CA bundle file: Copy the certificate chain output (everything from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----) into a new file. Append all certificates in the chain into this file.
3. Update the Trust Store: In the Provisioning Manager, navigate to System > Domain Configuration > Identity Manager Server and set the Trusted CA Bundle to the full path of the file you created in step 2.
   
   
   
   

Part 2: Update the Shared Secret

1. Generate an encrypted password: Log in to the vApp as the config user and navigate to the tools directory: cd /opt/CA/IdentityManager/IAM_Suite/IdentityManager/tools/PasswordTool Execute the tool: ./pwdtools.sh -JSAFE -p YourNewSharedSecret
2. Update system properties: Locate the /opt/CA/wildfly-idm/standalone/deployments/iam_im.ear/custom/identitymanager/systemWideProperties.properties file. Update the IMeTASharedSecret property with the encrypted string generated in Step 1.
3. Restart services: Apply the changes by restarting the Identity Manager and Provisioning Server services: restart_im restart_ps
4. Finalize in Provisioning Manager: Navigate to System > Identity Manager Setup and re-enter the shared secret and IM server URL. Ensure the host name matches the subject name defined in your certificate.