Identity stores
An identity store, also called an identity repository, is a persistent repository of user data. For example, DS or Microsoft Active Directory. You can configure identity stores either when installing AM, or by adding them to an existing AM instance.
AM also uses other types of data stores, like the configuration data store, the UMA data store, and the Core Token Service (CTS) data store, discussed elsewhere.
When you first set up a realm, the new realm inherits the identity store from the parent realm. For example, in an installation where the Top Level Realm has a DS server as the identity store, any new realm created would have the same DS instance as the identity store, by default.
If your administrators are in one realm and your users in another, your new child realm might retrieve users from a different identity store.
|
You should not configure more than one writable identity repository in a single realm. AM will try to perform write operations on each identity repository configured in a realm, and there is no way to configure which repository is written to. To manage identities and reconcile differences between multiple identity repositories, use ForgeRock Identity Management. |
| Task | Resources |
|---|---|
Prepare an identity store You must prepare the identity store before AM can use it. |
|
Configure an identity store Configure the store in a realm so that users can be authenticated. By default, AM re-uses your configuration store as the identity store of the Top Level realm. |
|
Customize an identity store Create custom attributes for your users or custom identity plugins to change how AM maps users and groups to a realm. |
Configure an identity store
-
Share the identity store certificate with the AM container to prepare for TLS/LDAPS. Identity stores should communicate over secure connections for security reasons.
DS 7 or later is configured to require secure connections by default; therefore, share the DS certificate with the AM container before continuing.
Share the DS certificate with AM
-
Export the DS server certificate:
$ keytool -exportcert \ -keystore /path/to/opendj/config/keystore \ -storepass:file /path/to/opendj/config/keystore.pin \ -alias ssl-key-pair \ -rfc \ -file ds-cert.pemThe default DS server certificate only has the hostname you supplied at setup time, and
localhost, as the value of theSubjectAlternativeNameattribute; however, certificate hostname validation is strict. Ensure that the certificate matches the hostname (or the FQDN) of the DS server before continuing.Copy the
ds-cert.pemfile to an accessible location on the AM host. -
Import the DS certificate into the AM truststore:
$ keytool \ -importcert \ -file ds-cert.pem \ -keystore /path/to/openam/security/keystores/truststore
For more information on configuring AM’s truststore, see Prepare the truststore.
-
-
In the AM admin UI, go to Realms > Realm Name > Identity Stores.
-
Click Add Identity Store, enter an ID, and select the type of identity store.
-
Click Create.
-
In the tabbed view, provide information on how to connect to your identity store.
Refer to the configuration hints for your identity store:
-
If you have not applied the schema configuration to your identity data, but the AM service account used to bind to the directory service has permission to alter schema, enable the Load Schema option.
-
Save your changes.
-
If you no longer need the connection to the inherited, embedded identity store in this realm, then you can delete its entry in the Identity Stores list.
Also, once you change the identity store for a realm, you might opt to change the authentication module configuration to use your realm identity store, rather than the inherited settings. Refer to Configure authentication modules.
-
To test the connection, refer to Test external identity repository access.