Prepare configuration stores
This page explains how to prepare a single DS server as an external configuration data store.
Directory Services 6.5 added support for setup profiles to greatly simplify initial configuration.
Using a setup profile will create the backend, schema, bind user, and indexes required for use with configuration data.
To install DS using a setup profile, follow the steps in DS for AM Configuration Data in the Directory Services documentation.
Proceed to installation of AM to use the prepared DS directory server as an external configuration store. See To Configure an Instance.
The default bind DN of the service account to use when installing AM to authenticate to the external configuration store is:
Share the configuration store certificate with the AM container to prepare for TLS/LDAPS.
The configuration store should communicate over secure connections for security reasons.
DS 7 or later is configured to require secure connections by default; therefore, share its certificate with the AM container before continuing.
Export the DS server certificate:
$ keytool -exportcert \ -keystore /path/to/opendj/config/keystore \ -storepass $(cat /path/to/opendj/config/keystore.pin) \ -alias ssl-key-pair \ -rfc \ -file ds-cert.pem
The default DS server certificate only has the hostname you supplied at setup time, and
localhost, as the value of the
SubjectAlternativeNameattribute; however, certificate hostname validation is strict. Ensure that the certificate matches the hostname (or the FQDN) of the DS server before continuing.
ds-cert.pemfile to an accessible location on the AM host.
Import the DS certificate into the AM truststore:
$ keytool \ -importcert \ -file ds-cert.pem \ -keystore /path/to/openam/security/keystores/truststore
For more information on configuring AM’s truststore, see Prepare the truststore.
Once the certificate is in place, continue installing AM.