Building an IDM 3 Test Environment using edirectory 8.8 Multi-Instances

Transcription

1 1 of :03 Software for the Open Enterprise > cool solutions home Building an IDM 3 Test Environment using edirectory 8.8 Multi-Instances Novell Cool Solutions: AppNote By Akos Szechy Digg This - Slashdot This Posted: 20 Sep 2006 Introduction edirectory 8.8 introduced some great features. One of them is the multi-instances support that allows you to run multiple copies of edirectory trees on one box. This is also a cool feature; you can test how the edirectory-edirectory driver works, and all you need is one server. You can test all the other drivers as well on the box - it's just a question of resources. In this AppNote I will show you how can you build a test environment using one SLES 9 (SP3) box with edirectory 8.8 (SP1), running the following drivers: edirectory-edirectory LDAP driver Delimited file driver Basically you will create 3 edirectory instances. Two will host the edirectory drivers, while one will operate as an LDAP directory so you can run the LDAP Driver against it. Warning: This configuration should run fine in production as well, but I don't suggest you bet your life on one single box. edirectory 8.8 SP1 Installation After you install the SLES9 box - which we won't cover here - you have to install edirectory You can get a copy at 1. Choose the installation path and run the nds-install script. 2. Accept the terms. 3. Choose 1 - edirectory server components. 4. Add the following lines to /root/.bashrc file, so it will find the utilities and the related stuff. If.bashrc does not exist, you can copy it from the /etc/skel directory to /root. export PATH=/opt/novell/eDirectory/bin:/opt/novell/eDirectory/sbin:$PATH export LD_LIBRARY_PATH=/opt/novell/eDirectory/lib:/opt/novell/eDirectory/lib/nds-modules:/opt/novell/lib:$LD_LIBRARY_PATH export MANPATH=/opt/novell/man:/opt/novell/eDirectory/man:$MANPATH export TEXTDOMAINDIR=/opt/novell/eDirectory/share/locale edirectory is now installed, so you can go ahead and configure your edirectory instances to be used by IDM. Note: Please be sure 'openldap' is not installed! If it's installed, you have to stop it or move the default LDAP port to a different port, as port 389 is already used. Configuring edirectory Instances You can configure the instances with ndsconfig or ndsmanage. We'll use ndsconfig, as it can specify with one command how to create your tree. 1. Create the first instance: ndsconfig new -t IDM3_TREE -n o=novell -S SLES91 -a admin.novell -d /var/opt/novell/edirectory/idm3_tree/dib -D /var/opt/novell/edirectory/idm3_tree/data -L 389 -l 636 Sample parameters and descriptions to create a new tree: -t - the name of the tree: IDM3_TREE -n - the context of the server: o=novell -S - the name of the server: SLES91 -a - the name of the admin user: admin.novell -d - the path for the dib: /var/opt/novell/edirectory/idm3_tree/dib -D - the path for the data files: /var/opt/novell/edirectory/idm3_tree/data -L - the port for clear text LDAP: 389 -l - the port for LDAP SSL: 636 -o - Remote Manager over HTTP: O - Remote Manager over HTTPS: The installation will ask for an Admin password; provide it now. 3. Create the second instance: ndsconfig new -t IDM3_TREE2 -n o=novell -S SLES92 -a admin.novell -d /var/opt/novell/edirectory/idm3_tree2/dib -D /var/opt/novell/edirectory/idm3_tree2/data -L l Sample parameters and descriptions to create a second tree: -t - the name of the tree: IDM3_TREE2 -n - the context of the server: o=novell -S - the name of the server: SLES92 -a - the name of the admin user: admin.novell -d - the path for the dib: /var/opt/novell/edirectory/idm3_tree2/dib -D - the path for the data files: /var/opt/novell/edirectory/idm3_tree2/data -L - the port for clear text LDAP: l - the port for LDAP SSL: o - Remote Manager over HTTP: O - Remote Manager over HTTPS: b - the NCP port where edirectory will listen on : config-file - the configuration file for this instance: /var/opt/novell/edirectory/idm3_tree2/conf 4. The installation will ask for an Admin password; provide it now. 5. As a summary, check the following table to verify the most important values of your trees: Value Tree1 (IDM3_TREE) Tree2 (IDM3_TREE) Tree name IDM3_TREE IDM3_TREE2 IP address of your server NCP port

2 2 of :03 Admin name admin.novell admin.novell LDAP clear text port LDAP SSL port Just to be on the safe side, check if you can log in using ndslogin: ndslogin -t IDM3_TREE -h :524 admin.novell ndslogin -t IDM3_TREE2 -h :1524 admin.novell Both logins should succeed before you continue. Identity Manager Installation To install IDM, you need the IDM 3.01 ISO available (you can get a copy from Once you have it, follow these instructions: 1. Install IDM3 by starting the dirxml_setup.bin file from the /linux/setup directory. 2. Accept the License agreement. 3. Choose "1 - Metadirectory Server". 4. Choose the edirectory instance where you would like to install IDM. In your case this is the first instance with IDM3_TREE. 5. Specify the username: cn=admin,o=novell (NOTE the LDAP format!) 6. Specify the password and accept the offered drivers, so the installation can continue. 7. Repeat the steps for the second instance, but at point 4 choose the second instance. Administration For administering the system, you use Mobile imanager 2.6 and installed the IDM 3.01 imanager Plug-ins from I prefer Mobile imanager; if something goes wrong, you just unzip it again, and it runs fine. Configuring the edirectory-edirectory Driver Now you need to configure the drivers. 1. Log in to the first tree using Mobile imanager. Figure 1 - Mobile imanager login 2. Create a new container called "dirxml" under [Root], using imanager or any administrative tools. You will synchronize this container with the second trees dirxml container. Using imanager you can create it with the Create Object task under the Directory Administration role. 3. Go to the Identity Manager Overview page of the Identity Manager role.

3 3 of :03 Figure 2 - IDM Overview page 4. Click Search and then start the Create New DriverSet wizard to create your Driverset. 5. Create a new driverset called DSet under "novell" and associate with the server object. Figure 3 - Creating the DSet driverset 6. Import the edirectory.xml file from the /nw/dirxml/drivers directory on the CD.

4 4 of :03 Figure 4 - Importing edirectory.xml 7. Enter the necessary parameters: Driver name: edirectory1 (I suggest you don't put any spaces in the name) Remote tree address: Remote tree port: put 2222 here, you will see this later Base container: dirxml Password sync version: 2.0 Remote container: dirxml Define admin.novell as security equivalent Note: Unless you specify this lots of operation will not work as the IDM engine will not have rights to perform. You don't have to modify/specify the remaining fields. You can click on Finish, so the driver should be imported, and you should see something like this:

5 5 of :03 Figure 5 - Finishing the driver import Now, lets go to the Second tree and do the same Exit from imanager. 9. At the login prompt, specify the second tree by placing :1524 in the Tree field. 10. Once you log in, do the same as you did with the first tree, but name the driver "edirectory2". 11. Once you are done with the second tree, generate the Key material objects used to allow the two drivers to talk to each other. If no PKI snapins are installed, you'll get an error message while trying to generate the certificates that NPKIT cannot be initialized. 12. Select the NDS-to-NDS Driver Certificates task from the Identity manager Utilities role and fill in with the details as follows for the first tree:

6 6 of :03 Figure 6 - NDS2NDS Driver Certificates, first tree 13. Do the same for the second tree: Figure 7 - NDS2NDS Driver Certificates, second tree The summary should be something like this: Figure 8 - Driver Certificates Summary 13. Click Finish to create the certificates.

7 7 of :03 The Trick As you might realize, you set both drivers on port Of course, this is not possible - only one application can use a TCP port. However, you only have one network card...so, what is the solution? You have to specify for both drivers two ports: one where it listens, and a second one where it can find the remote driver. Basically you will set your first driver to listen on port 1234 and the second driver to listen on Let's do it: 1. Log in to the first tree. 2. Now you need to open the Driver. 3. Access the Identity Manager role / Identity Manager Overview. 4. Search for the driver and click on the driver icon to select it. In the Authentication context box you should see: : Modify it to :1234:4321. This will let the driver know that it listens on port 1234 and it can find the other tree on port You may want to set the Startup option to Manual instead of Auto. 7. Click Apply. 8. Switch to the Misc tab and specify a trace level of 3, to see what's going on in NDSTRACE. 9. Click Apply and then OK. 10. Repeat the above steps for the second tree, but in this case specify :4321:1234 in the Authentication Context. It should look like this: Figure 9 - Setting the Authentication Context Preparing for the Startup It's a good idea to enable NDSTRACE on the server, so you can track what's going on. You can use these NDSTRACE commands all the time to track IDM: ndstrace Select the appropriate instance set dstrace = nodebug ndstrace dxml dvrs Starting the Drivers 1. Log in to the first tree. 2. Open the Driver (Identity Manager role, Identity Manager overview, Search). 3. Select the stop sign and from the dropdown box and click Start. The driver should start and the status should change to a little Yin-Yang sign like this:

8 8 of :03 Figure 10 - Driver startup 4. Once, its done, repeat it for the second tree. Testing Once the drivers start up, you can create a user under the dirxml organization in any tree, and that should sync to the other tree. Also, in ndstrace you should see something like this: edirectory2 ST: DirXML Log Event Driver: \IDM3_TREE2\novell\DSet\eDirectory2 Channel: Subscriber Object: \IDM3_TREE2\dirxml\user1 Status: Success Message: <application>dirxml</application> <module>edirectory1 <object-dn>\idm3_tree2\dirxml\user1 (dirxml\user1)</object-dn> <component>publisher</component> LDAP Driver So now you have a working edirectory-edirectory driver. You can add one more edirectory instance, so it can serve as an LDAP directory for your LDAP Driver. First, you have to create one more edirectory instance in the well known way: ndsconfig new -t LDAP_TREE -n o=novell -S SLES93 -a admin.novell -d /var/opt/novell/edirectory/ldap_tree/dib -D /var/opt/novell/edirectory/ldap_tree/data -L l 26 After you create the tree, 1. Try to log into it with imanager. Remember, this time you have your tree on port : Create an Organization called dirxml. That's what you will use in this tree as well for synchronization. 3. For testing, disable "Require TLS for Simple Binds with Password" by the following command on the server: ldapconfig set "Require TLS for Simple Binds with Password=no" 4. Select the 3rd instance and log in. 5. It's a good idea to test if LDAP really works in cleartext mode. If you don't get an error but see a lot of data after executing this command, you should be fine: ldapsearch -h localhost -p x -D cn=admin,o=novell -w novell Creating the LDAP driver 1. Open imanager to the first tree. 2. Go to the Identity Manager Overview and click Add Driver. 3. Add the driver to the existing driverset. 4. Browse for the LDAP.XML file. 5. Specify the following parameters: edirectory container: dirxml LDAP Container: o=dirxml LDAP Server: port: 2389 LDAP Authentication DN: cn=admin,o=novell (NOTE: LDAP format is used!) LDAP Authentication Password: novell Polling interval in seconds: 5 Publication method: LDAP Search The other parameters should be fine. Note: Don't forget to set Admin.novell as the Security equivalent! 6. Specify a trace level 3 as you did in the previous steps (on the Drivers MISC tab). 7. Start the driver. 8. Verify that creating a user in any tree under the dirxml organization creates the user in the other two trees. Delimited Driver The Delimited Text file driver is a bit different to the others, but still interesting to have it on this box. It's easy to set up - just follow these steps: 1. Create three directories: /var/idm, /var/idm/in, /var/idm/out

9 9 of :03 2. Login with imanager to the first server and create a new driver based on the DelimitedTextCSVSample.xml 3. Specify the following parameters: Output File Path: /var/idm/out Input File Path:/var/idm/in New User container: dirxml 4. By now, you should remember that you need to include the Security Equivalent, set the trace level and check to see if the driver is on Manual startup. 5. Start the driver. 6. See if any files are generated in /var/idm/out when you create users in any trees under dirxml. You should see a file in the out directory with a content like this: aszechy-sles9:/var/idm/out # ll total 4 drwxr-xr-x 2 root root 88 Sep 12 06:14. drwxr-xr-x 4 root root 96 Sep 12 06:09.. -rw-rw-rw- 1 root root 13 Sep 12 06: csv aszechy-sles9:/var/idm/out # cat csv user5,,,,,,, At this point, the most common error you'll see in DSTrace is -672, because you haven't specified the Security equivalent user. Summary So as you can see, you set up basically a four-system IDM environment quite easily on one box. Now you can play with edirectory, LDAP or with the Delim driver. Reader Comments What also works is to give the SLES box 3 IPaddresses, so you dont have to bother about the ports. Every edir instance wcan be configured with its own IPaddress and deafult port assignments. I'm not able to get the IDM 3.01 install to recognize that I have four instances of edir 8.8sp1 running. It ceases to install claiming that edirectory cannot be found. I do have edir installed into non-standard directories. Can you help. Like what you see? Sign up for our weekly newsletter. Want to contribute? It could earn you a nano! Learn more. Like Wikis? Join the Cool Solutions Wiki. Interested? Request a sales call Novell Cool Solutions (corporate web communities) are produced by WebWise Solutions Novell, Inc. All Rights Reserved.