Prepare configuration stores

This page explains how to prepare a single DS server as an external configuration data store. Make sure DS replicas use the same configuration.

Installing DS with a DS setup profile creates the required backend, schema, bind user, and indexes::

Follow the steps in Install DS for AM configuration in the Directory Services documentation.
Proceed to installation of AM to use the prepared DS directory server as an external configuration store.

For details, refer to Install an instance.

The default bind DN of the service account to use when installing AM to authenticate to the external configuration store is:
```
uid=am-config,ou=admins,ou=am-config
```
Share the configuration store certificate with the AM container to prepare for TLS/LDAPS.

The configuration store should communicate over secure connections for security reasons.

DS 7 or later is configured to require secure connections by default; therefore, share its certificate with the AM container before continuing.
1. Export the DS server certificate:
  $ keytool -exportcert \ -keystore /path/to/opendj/config/keystore \ -storepass:file /path/to/opendj/config/keystore.pin \ -alias ssl-key-pair \ -rfc \ -file ds-cert.pem
  The default DS server certificate only has the hostname you supplied at setup time, and localhost, as the value of the SubjectAlternativeName attribute; however, certificate hostname validation is strict. Ensure that the certificate matches the hostname (or the FQDN) of the DS server before continuing.
  
  Copy the ds-cert.pem file to an accessible location on the AM host.
2. Import the DS certificate into the AM truststore:
  $ keytool \ -importcert \ -file ds-cert.pem \ -keystore /path/to/openam/security/keystores/truststore
  For more information on configuring AM’s truststore, refer to Prepare the truststore.

Once the certificate is in place, continue installing AM.

AM 7.3.1

Prepare configuration stores