Preparing Configuration Stores

Directory Services 6.5 added support for setup profiles to greatly simplify initial configuration.

Using a setup profile will create the backend, schema, bind user, and indexes required for use with configuration data.

1. To install DS using a setup profile, follow the steps in DS for AM Configuration Data in the Directory Services 7.1 Installation Guide.

2. Proceed to installation of AM to use the prepared DS directory server as an external configuration store. See "To Configure an Instance".

   The default bind DN of the service account to use when installing AM to authenticate to the external configuration store is:

   uid=am-config,ou=admins,ou=am-config

3. Share the configuration store certificate with the AM container to prepare for TLS/LDAPS. The configuration store should communicate over secure connections for security reasons.

   DS 7 or later is configured to require secure connections by default; therefore, share its certificate with the AM container before continuing.

   Sharing the DS Certificate with AM

   1. Export the DS server certificate:

      $ keytool -exportcert \
      -keystore /path/to/opendj/config/keystore \
      -storepass $(cat /path/to/opendj/config/keystore.pin) \
      -alias ssl-key-pair \
      -rfc \
      -file ds-cert.pem*

      The default DS server certificate only has the hostname you supplied at setup time, and localhost, as the value of the SubjectAlternativeName attribute; however, certificate hostname validation is strict. Ensure that the certificate matches the hostname (or the FQDN) of the DS server before continuing.

      Copy the ds-cert.pem file to an accessible location on the AM host.

   2. Import the DS certificate into the AM truststore:

      $ keytool \
      -importcert \
      -file ds-cert.pem \
      -keystore /path/to/openam/security/keystores/truststore

   For more information on configuring AM's truststore, see "Preparing a Truststore".

   Once the certificate is in place, continue installing AM.