Install a Multi-Node Deployment

The install assumes that you have CentOS 7 as your operating system. Check your CentOS 7 version.

$ sudo cat /etc/centos-release

Set the user for the target machine to a username of your choice. For example, autoid.

$ sudo adduser autoid

Set the password for the user you created in the previous step.

$ sudo passwd autoid

Configure the user for passwordless sudo.

$ echo "autoid  ALL=(ALL)  NOPASSWD:ALL" | sudo tee /etc/sudoers.d/autoid

Add administrator privileges to the user.

$ sudo usermod -aG wheel autoid

Change to the user account.

$ su - autoid

Install yum-utils package on the deployer machine. yum-utils is a utilities manager for the Yum RPM package repository. The repository compresses software packages for Linux distributions.

$ sudo yum install -y yum-utils

Create the installation directory. Note that you can use any install directory for your system as long as your run the deployer.sh script from there. Also, the disk volume where you have the install directory must have at least 8GB free space for the installation.

$ mkdir ~/autoid-config

On the target machine, set up the Docker-CE repository.

$ sudo yum-config-manager \
     --add-repo https://download.docker.com/linux/centos/docker-ce.repo

Install the latest version of the Docker CE, the command-line interface, and containerd.io, a containerized website.

$ sudo yum install -y docker-ce docker-ce-cli containerd.io

Enable Docker to start at boot.

$ sudo systemctl enable docker

Start Docker.

$ sudo systemctl start docker

Check that Docker is running.

$ systemctl status docker

Add the user to the Docker group.

$ sudo usermod -aG docker ${USER}

On the deployer machine, run ssh-keygen to generate an RSA keypair, and then click Enter. You can use the default filename. Enter a password for protecting your private key.

$ ssh-keygen -t rsa -C "autoid"

The public and private rsa key pair is stored in home-directory/.ssh/id_rsa and home-directory/.ssh/id_rsa.pub.

Copy the SSH key to the autoid-config directory.

$ cp ~/.ssh/id_rsa ~/autoid-config

Change the privileges to the file.

$ chmod 400 ~/autoid-config/id_rsa

Copy your public SSH key to the target machine's ~/.ssh/authorized_keys file. If your system does not have an /authorized_keys directory, create it using mkdir -p ~/.ssh/authorized_keys.

On the target machine, set the privileges on your ~/.ssh and ~/.ssh/authorized_keys.

$ chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys

On the deployer machine, test your SSH connection to the target machine. This is a critical step. Make sure the connection works before proceeding with the installation.

$ ssh -i ~/.ssh/id_rsa <username>@34.70.190.144
Last login: Sun Jun 14 23:23:36 2020 from 74.125.45.78

If you successfully accessed the remote server, enter exit to end your SSH session.

On the deployer machine, change to the installation directory.

$ cd ~/autoid-config/

Log in to the ForgeRock Google Cloud Registry (gcr.io) using the registry key. The registry key is only available to ForgeRock Autonomous Identity customers. For specific instructions on obtaining the registry key, see How To Configure Service Credentials (Push Auth, Docker) in Backstage.

$ docker login -u _json_key -p "$(cat autoid_registry_key.json)" https://gcr.io/forgerock-autoid

Run the create-template command to generate the deployer.sh script wrapper. Note that the command sets the configuration directory on the target node to /config. Note that the --user parameter eliminates the need to use sudo while editing the hosts file and other configuration files.

$ docker run --user=`id -u` -v ~/autoid-config:/config -it gcr.io/forgerock-autoid/deployer:2020.6.4 create-template

Make the script executable.

$ chmod +x deployer.sh

The create-template commands creates a number of configuration files, including ansible.cfg. Open a text editor and edit the ansible.cfg to set up the remote user and SSH private key file location on the target node. Make sure that the remote_user exists on the target node and that the deployer machine can ssh to the target node as the user specified in the id_rsa file.

[defaults]
host_key_checking = False
remote_user = autoid
private_key_file = id_rsa

Open a text editor and enter the public IP addresses of the target machines in the ~/autoid-config/hosts file. Make sure the target host IP addresses are accessible from the deployer machine. The following is an example of the ~/autoid-config/hosts file:

[docker-managers]
34.105.16.229

[docker-workers]
34.105.16.198

[docker:children]
docker-managers
docker-workers

[cassandra-seeds]
34.105.16.201

[cassandra-workers]
34.105.16.76

[spark-master]
34.105.16.201

[spark-workers]
34.105.16.76

[analytics]
34.105.16.201

Define a mapping between the external IP and private IP addresses. This occurs when your target host is in a cloud, so that your external and internal IP addresses are different.

For each target node, add the private_ip_address_mapping property in the ~/autoid-config/vars.yml file. You can look up the private IP on the cloud console, or run sudo ifconfig on the target host. Make sure the values are within double quotes. The key should not be in double quotes and should have two spaces preceding the IP address.

private_ip_address_mapping:
  34.105.16.229:  "10.128.0.34"
  34.105.16.198:  "10.128.0.51"
  34.105.16.201:  "10.128.0.54"
  34.105.16.76:  "10.128.0.55"

Edit other properties in the ~/autoid-config/vars.yml file, specific to your deployment, such as the following:

The default Autonomous Identity URL will be: https://autoid-ui.forgerock.com. To customize your domain name and target environment, see Customize the Domain and Namespace.

Open a text editor and set the Autonomous Identity passwords for the configuration service, LDAP backend, and Cassandra database. The vault passwords file is located at ~/autoid-config/vault.yml.

configuration_service_vault:
  basic_auth_password: Welcome123

openldap_vault:
  openldap_password: Welcome123

cassandra_vault:
  cassandra_password: Welcome123
  cassandra_admin_password: Welcome123

Encrypt the vault file that stores the Autonomous Identity passwords, located at ~/autoid-config/vault.yml. The encrypted passwords will be saved to /config/.autoid_vault_password. The /config/ mount is internal to the deployer container.

$ ./deployer.sh encrypt-vault

Download the images. This step downloads software dependencies needed for the deployment and places them in the autoid-packages directory.

$ ./deployer.sh download-images

Run the deployment.

$ ./deployer.sh run

Open a browser, and point it to https://autoid-ui.forgerock.com/ (or your customized URL: https://myid-ui.abc.com).

Log in as a test user: bob.rodgers@forgerock.com. Enter the password: Welcome123.

SSH to the target node.

Check that the analytics service is running.

$ docker ps | grep analytics

If the previous step returns blank, start the analytics. For more information, see Data Preparation.

$ docker start analytics

Once you have verified that the analytics service has started, you can run the analytics commands. For more information, see Run the Analytics Pipeline.