IDM generates a self-signed certificate the first time it starts up. This procedure uses the self-signed certificate to demonstrate how to get the password synchronization plugin up and running. In a production environment, you should use a certificate that has been signed by a Certificate Authority (CA).

The default Java truststore contains signing certificates from well-known CAs. If your CA certificate is not in the default truststore, or if you are using a self-signed certificate, import it into a DS truststore as described here.

127.0.0.1       localhost openidm-localhost

DS does not enable a trust manager provider by default. For DS to trust the IDM certificate, you must enable a trust manager provider and reference it from the password plugin configuration.

1. Export the IDM generated self-signed certificate to a file, as follows:

   $ keytool \
    -export \
    -alias openidm-localhost \
    -file openidm-localhost.crt \
    -keystore /path/to/openidm/security/keystore.jceks \
    -storetype jceks
   Enter keystore password: changeit
   Certificate stored in file <openidm-localhost.crt>

   The default IDM keystore password is changeit.

2. Import the self-signed certificate into a DS truststore. The following command creates a new truststore file and imports the certificate:

   $ keytool \
    -import \
    -alias openidm-localhost \
    -file openidm-localhost.crt \
    -keystore /path/to/opendj/config/truststore \
    -storepass:file /path/to/opendj/config/keystore.pin \
    -storetype PKCS12 \
    -noprompt
   Certificate was added to keystore

3. (Optional) Check that the IDM certificate is in the DS truststore:

   keytool \
    -list -v \
    -keystore /path/to/opendj/config/truststore \
    -storepass:file /path/to/opendj/config/keystore.pin
   ...
   Alias name: openidm-localhost
   Creation date: Nov 5, 2019
   Entry type: trustedCertEntry
   
   ...

4. Add a trust manager provider to access the truststore:

   $ /path/to/opendj/bin/dsconfig \
    create-trust-manager-provider \
    --hostname localhost \
    --port 4444 \
    --bindDN "cn=Directory Manager" \
    --bindPassword password \
    --type file-based \
    --provider-name "PKCS12 Trust Manager" \
    --set enabled:true \
    --set trust-store-file:/path/to/opendj/config/truststore \
    --set trust-store-pin:"&{file:config/keystore.pin}" \
    --trustAll \
    --no-prompt
   The File Based Trust Manager Provider was created successfully

For mutual authentication, you must import the DS certificate into the IDM truststore.

DS generates a self-signed certificate when you set up communication over LDAPS. This procedure uses the self-signed certificate to get the password synchronization plugin up and running. In a production environment, use a certificate that has been signed by a Certificate Authority.

1. Export the generated DS self-signed certificate to a file, as follows:

   $ keytool \
    -export \
    -alias server-cert \
    -file server-cert.crt \
    -keystore /path/to/opendj/config/keystore \
    -storepass:file /path/to/opendj/config/keystore.pin
   Certificate stored in file <server-cert.crt>

2. Import the DS self-signed certificate into the IDM truststore:

   $ keytool \
    -importcert \
    -alias ds-server-cert \
    -keystore /path/to/openidm/security/truststore \
    -storepass changeit \
    -file server-cert.crt
   Certificate was added to keystore

3. Restart IDM:

   /path/to/openidm/shutdown.sh; /path/to/openidm/startup.sh

1. Download the password synchronization plugin (DS-IDM-account-change-notification-handler-6.5.0.zip) from the ForgeRock BackStage download site.

2. Extract the contents of the .zip file to the directory where DS is installed:

   $ unzip ~/Downloads/DS-IDM-account-change-notification-handler-6.5.0.zip -d /path/to/opendj/
   Archive:  DS-IDM-account-change-notification-handler-6.5.0.zip
      creating: opendj/
      ...

3. Restart DS to load the additional schema from the password synchronization plugin:

   $ /path/to/opendj/bin/stop-ds --restart
   Stopping Server...
   [11/Nov/2019:12:51:39 +0200] category=com.forgerock.opendj.ldap.config.config severity=NOTICE msgID=571
    msg=Loaded extension from file '/path/to/opendj/lib/extensions/opendj-openidm-account-change-notification-handler-6.5.0-sources.jar'...
    ...
   [11/Nov/2019:12:51:42 +0200] category=CORE severity=NOTICE msgID=135
    msg=The Directory Server has started successfully

4. Configure the password synchronization plugin.

   Change the values of the parameters in the following example to match your DS and IDM deployments:

   /path/to/opendj/bin/dsconfig \
    create-account-status-notification-handler \
    --type openidm \
    --handler-name OpenIDM\ Notification\ Handler \
    --set enabled:true \
    --set openidm-url:https://openidm-localhost:8444/openidm/managed/user \
    --set attribute-type:entryUUID \
    --set attribute-type:uid \
    --set password-attribute:password \
    --set query-id:for-userName \
    --set log-file:logs/pwsync \
    --set update-interval:0s \
    --set ssl-cert-nickname:ssl-key-pair \
    --set private-key-alias:openidm-localhost \
    --set request-retry-attempts:0 \
    --set certificate-subject-dn:CN=openidm-localhost,O=OpenIDM\ Self-Signed\ Certificate,OU=None,L=None,ST=None,C=None \
    --set key-manager-provider:PKCS12 \
    --set trust-manager-provider:PKCS12 \
    --hostname localhost \
    --port 4444 \
    --bindDn uid=admin \
    --trustAll \
    --bindPassword password \
    --no-prompt
   The Openidm Account Status Notification Handler was created successfully

   The configurable properties of the plugin are as follows:

   enabled

   Specifies whether the plugin is enabled.

   openidm-url

   The endpoint at which the plugin should find IDM managed user accounts.

   Example: https://localhost:8444/openidm/managed/user

   For HTTP basic authentication, specify the http protocol in the URL, and a non-mutual authentication port, for example http://localhost:8080/openidm/managed/user.

   attribute-type

   Specifies zero or more attribute types that the plugin will send along with the password change. If no attribute types are specified, only the DN and the new password will be synchronized to IDM.

   Suggested values: entryUUID and uid

   password-attribute

   The attribute in IDM that stores user passwords. This property is used to construct the patch request on the IDM managed user object.

   Suggested value: password

   query-id

   The query-id for the patch-by-query request. This query must be defined in the repository configuration.

   Default value: for-userName

   log-file

   The directory where plugin log files are written, and where modified passwords are written when the plugin cannot contact IDM. Passwords in this directory will be encrypted.

   Suggested value: logs/pwsync

   Note that this setting has no effect if the update-interval is set to 0 seconds.

   update-interval

   The interval, in seconds, at which password changes are propagated to IDM. If this value is 0, updates are made synchronously in the foreground, and no encrypted passwords are stored in the configured log-file.

   ssl-cert-nickname

   The client key alias.

   Example: server-cert

   private-key-alias

   The alias of the private key that should be used by IDM to decrypt the JSON object.

   Example: openidm-localhost

   request-retry-attempts

   The number of times the plugin will attempt a synchronization request if the first attempt fails. If this value is zero, the request is not retried. If the value is more than zero, the request will be retried that number of additional times before the request is removed from the queue. Note that if ds-cfg-update-interval is set to zero, the request will not be retried regardless of what this property is set to.

   In cases where a request fails for a transient reason (such as when IDM is down or the connection is timing out), the number of retry attempts will not decrement. The reason the request failed will be included in logs, and attempts will continue to occur until IDM responds.

   certificate-subject-dn

   The certificate subject DN of the IDM private key. The previous example assumes that you are using the self-signed certificate that is generated when IDM first starts.

   Example: CN=localhost, O=OpenIDM Self-Signed Certificate, OU=None, L=None, ST=None, C=None

   key-manager-provider

   The DS key manager provider. The key manager provider specified here must be enabled.

   Example: "Default Key Manager"

   trust-manager-provider

   The DS trust manager provider. The trust manager provider specified here must be enabled.

   Default value: "PKCS12 Trust Manager"

5. Restart DS for the new configuration to take effect:

   /path/to/opendj/bin/stop-ds --restart
   Stopping Server...
   ...
   ...The Directory Server has started successfully

6. Adjust your DS password policy configuration to use the password synchronization plugin.

   The following command adjusts the default password policy:

   $ /path/to/opendj/bin/dsconfig \
    set-password-policy-prop \
    --port 4444 \
    --hostname localhost \
    --bindDN "cn=Directory Manager" \
    --bindPassword password \
    --policy-name "Default Password Policy" \
    --set account-status-notification-handler:"OpenIDM Notification Handler" \
    --no-prompt \
    --trustAll

The password synchronization plugin uses client certificate authentication to authenticate to IDM. If your project does not already have client certificate authentication configured, you must add the authentication module to your server configuration. You must also update your security configuration to add the IDM key alias.

1. Add the CLIENT_CERT authentication module to your project's conf/authentication.json file and set the allowedAuthenticationIdPatterns property to the certificate DN of the DS SSL certificate.

   The following example assumes that you are using the self-signed DS certificate:

   more /path/to/openidm/project-dir/conf/authentication.json
   "authModules" : [
       ...
       {
           "name" : "CLIENT_CERT",
           "properties" : {
               "queryOnResource" : "managed/user",
               "defaultUserRoles" : [
                   "internal/role/openidm-cert",
                   "internal/role/openidm-authorized"
               ],
               "allowedAuthenticationIdPatterns" : [
                   ".*CN=localhost, O=OpenDJ RSA Self-Signed Certificate.*"
               ]
           },
           "enabled" : true
       },
       ...
   ]

   For more information about client certificate authentication, see "Authenticating With Client Certificates" in the Integrator's Guide.

2. Update the IDM secret store (conf/secrets.json) to add the openidm-localhost alias to the idm.default secretId:

   "mappings": [
       {
           "secretId" : "idm.default",
           "types": [ "ENCRYPT", "DECRYPT" ],
           "aliases": [ "&{openidm.config.crypto.alias|openidm-sym-default}", "openidm-localhost" ]
       },
       ...
   ]

   For more information about secret stores, see "Configuration Options in secrets.json" in the Integrator's Guide.

1. Reset your DS password policy configuration so that it no longer uses the password synchronization plugin.

   The following command resets the default password policy:

   $ cd /path/to/opendj/bin
   $ ./dsconfig \
    set-password-policy-prop \
    --port 4444 \
    --hostname `hostname` \
    --bindDN "cn=Directory Manager" \
    --bindPassword password \
    --policy-name "Default Password Policy" \
    --reset account-status-notification-handler \
    --no-prompt

2. Delete the IDM Notification Handler from the DS configuration:

   $ ./dsconfig \
    delete-account-status-notification-handler \
    --port 4444 \
    --hostname `hostname` \
    --bindDN "cn=Directory Manager" \
    --bindPassword password \
    --handler-name "OpenIDM Notification Handler" \
    --no-prompt
   The Account Status Notification Handler was deleted successfully

3. Remove the password synchronization plugin from the DS extensions:

   $ cd /path/to/opendj
   $ rm lib/extensions/opendj-openidm-account-change-notification-handler*

4. Restart DS for the new configuration to take effect:

   $ cd /path/to/opendj/bin
   $ ./stop-ds --restart

1. Download the Active Directory password synchronization plugin from the ForgeRock BackStage download site.

2. Install the plugin using one of the following methods:

   • Double-click the setup file to launch the installation wizard.

   • Alternatively, from a command-line, start the installation wizard with the idm-setup.exe command. To save the settings in a configuration file, use the /saveinf switch as follows:

     PS C:\path\to\dir> idm-setup.exe /saveinf=C:\temp\adsync.inf

   • If you have a configuration file with installation parameters, you can install the password plugin in silent mode as follows:

     PS C:\path\to\dir> idm-setup.exe /verysilent /loadinf=C:\temp\adsync.inf

3. Provide the following information during the installation. You must accept the license agreement shown to proceed with the installation:

   OpenIDM Connection information

   • OpenIDM URL. Enter the URL where IDM is deployed, including the query that targets each user account. For example:

     https://localhost:8444/openidm/managed/user?_action=patch&_queryId=for-userName&uid=${samaccountname}

   • OpenIDM User Password attribute. The password attribute for the managed/user object, such as password.

     If the password attribute does not exist in the IDM managed/user object, the password sync service will return an error when it attempts to replay a password update that has been made in Active Directory. If your managed user objects do not include passwords, you can add an onCreate script to the Active Directory > Managed Users mapping that sets an empty password when managed user accounts are created. The following excerpt of a sample sync.json file shows such a script in the mapping:

     "mappings" : [
      {
        "name" : "systemAdAccounts_managedUser",
        "source" : "system/ad/account",
        "target" : "managed/user",
        "properties" : [
          {
            "source" : "sAMAccountName",
            "target" : "userName"
          }
        ],
        "onCreate" : {
          "type" : "text/javascript",
          "source" : "target.password=''"
        },
     ...

     The onCreate script creates an empty password in the managed/user object, so that the password attribute exists and can be patched.

   OpenIDM Authentication Parameters

   Provide the following information:

   • User name. Enter the name of an administrative user that can authenticate to IDM, for example, openidm-admin.

   • Password. Enter the password of the user that authenticates to IDM, for example, openidm-admin.

   • Select authentication type. Select the type of authentication that Active Directory will use to authenticate to IDM.

     For plain HTTP authentication, select OpenIDM Header. For SSL mutual authentication, select Certificate.

   Certificate authentication settings

   If you selected Certificate as the authentication type on the previous screen, specify the details of the certificate that will be used for authentication.

   • Select Certificate file. Browse to select the certificate file that Active Directory will use to authenticate to IDM. The certificate file must be configured with an appropriate encoding, cryptographic hash function, and digital signature. The plugin can read a public or a private key from a PKCS12 archive file.

     For production purposes, you should use a certificate that has been issued by a Certificate Authority. For testing purposes, you can generate a self-signed certificate. Whichever certificate you use, you must import that certificate into the IDM truststore.

     To generate a self-signed certificate for Active Directory, follow these steps:

     1. On the Active Directory host, generate a private key, which will be used to generate a self-signed certificate with the alias ad-pwd-plugin-localhost:

        > keytool.exe ^
         -genkey ^
         -alias ad-pwd-plugin-localhost ^
         -keyalg rsa ^
         -dname "CN=localhost, O=AD-pwd-plugin Self-Signed Certificate" ^
         -keystore keystore.jceks ^
         -storetype JCEKS
        Enter keystore password: changeit
        Re-enter new password: changeit
        Enter key password for <ad-pwd-plugin-localhost>
              <RETURN if same as keystore password>

     2. Now use the private key, stored in the keystore.jceks file, to generate the self-signed certificate:

        > keytool.exe ^
         -selfcert ^
         -alias ad-pwd-plugin-localhost ^
         -validity 365 ^
         -keystore keystore.jceks ^
         -storetype JCEKS ^
         -storepass changeit

     3. Export the certificate. In this case, the keytool command exports the certificate in a PKCS12 archive file format, used to store a private key with a certificate:

        > keytool.exe ^
         -importkeystore ^
         -srckeystore keystore.jceks ^
         -srcstoretype jceks ^
         -srcstorepass changeit ^
         -srckeypass changeit ^
         -srcalias ad-pwd-plugin-localhost ^
         -destkeystore ad-pwd-plugin-localhost.p12 ^
         -deststoretype PKCS12 ^
         -deststorepass changeit ^
         -destkeypass changeit ^
         -destalias ad-pwd-plugin-localhost ^
         -noprompt

     4. The PKCS12 archive file is named ad-pwd-plugin-localhost.p12. Import the contents of the keystore contained in this file to the system that hosts IDM. To do so, import the PKCS12 file into the IDM keystore file, named truststore, in the /path/to/openidm/security directory.

        On the machine that is running IDM, enter the following command:

        $ keytool \
         -importkeystore \
         -srckeystore /path/to/ad-pwd-plugin-localhost.p12 \
         -srcstoretype PKCS12 \
         -destkeystore truststore \
         -deststoretype JKS

   • Password to open the archive file with the private key and certificate. Specify the keystore password (changeit, in the previous example).

   Password Encryption settings

   Provide the details of the certificate that will be used to encrypt password values.

   • Select certificate file. Browse to select the certificate that will be used for password encryption. The certificate must be in PKCS12 format.

     For evaluation purposes, you can use a self-signed certificate, as described earlier. For production purposes, you should use a certificate that has been issued by a Certificate Authority.

     Whichever certificate you use, the certificate must be imported into the IDM keystore, so that IDM can locate the key with which to decrypt the data. To import the certificate into the IDM keystore, keystore.jceks, run the following command on the IDM host (UNIX):

     $ keytool \
      -importkeystore \
      -srckeystore /path/to/ad-pwd-plugin-localhost.p12 \
      -srcstoretype PKCS12 \
      -destkeystore /path/to/openidm/security/keystore.jceks \
      -deststoretype jceks

   • Private key alias. Specify the alias for the certificate, such as ad-pwd-plugin-localhost. The password sync plugin sends the alias when communicating with IDM, which uses the alias to retrieve the corresponding private key in IDM's keystore.

     Update the IDM secret store (conf/secrets.json) to add this certificate alias to the idm.default secretId:

     "mappings": [
         {
             "secretId": "idm.default",
             "types": [ "ENCRYPT", "DECRYPT" ],
             "aliases": [ "&{openidm.config.crypto.alias|openidm-sym-default}","ad-pwd-plugin-localhost" ] },
             ...
         }
     ]

   • Password to open certificate file. Specify the password to access the PFX keystore file, such as changeit, from the previous example.

   • Select encryption standard. Specify the encryption standard that will be used when encrypting the password value (AES-128, AES-192, or AES-256).

     If you are using Oracle JDK 8 and you select an encryption key type greater than AES-128, you must install the Unlimited JCE Policy, on the machine on which the password sync plugin is installed. To install the unlimited JCE Policy, follow these steps:

     • Download the JCE zip file for Java 8 from the Oracle Technology Network site.

     • Locate the lib\security folder of your JRE, for example, C:\Program Files\Java\jre8\lib\security.

     • Remove the following .jar files from the lib\security folder:

       local_policy.jar

       US_export_policy.jar

     • Unzip the JCE zip file and copy the two _policy.jar files to the lib\security folder of your JRE.

     • If the password sync plugin is already running, you must restart it for the installation of the JCE policy files to take effect.

   Data storage

   Provide the details for the storage of encrypted passwords in the event that IDM is not available when a password modification is made.

   • Select a secure directory in which the JSON files that contain encrypted passwords are queued. The server should prevent access to this folder, except access by the Password Sync service. The path name cannot include spaces.

   • Directory poll interval (seconds). Enter the number of seconds between calls to check whether IDM is available, for example, 60, to poll IDM every minute.

   Log storage

   Provide the details of the messages that should be logged by the plugin.

   • Select the location to which messages should be logged. The path name cannot include spaces.

   • Select logging level. Select the severity of messages that should be logged, either error, info, warning, fatal, or debug.

   Select Destination Location

   Setup installs the plugin in the location you select, by default C:\Program Files\OpenIDM Password Sync.

4. After running the installation wizard, restart the computer.

5. If you selected to authenticate over plain HTTP in the previous step, your setup is now complete.

   If you selected to authenticate with mutual authentication, complete this step.

   1. The Password Sync Service uses Windows certificate stores to verify IDM's identity. The certificate that IDM uses must therefore be added to the list of trusted certificates on the Windows machine.

      In a production environment, use a certificate that has been issued by a certificate authority. For test purposes, you can use the self-signed certificate that is generated by IDM on first startup.

      To add the IDM certificate to the list of trusted certificates, use the Microsoft Management Console.

      1. Select Start and type mmc in the Search field.

      2. In the Console window, select File > Add/Remove Snap-in.

      3. From the left hand column, select Certificates and click Add.

      4. Select My user account, and click Finish.

      5. Repeat the previous two steps for Service account and Computer account.

         For Service account, select Local computer, then select OpenIDM Password Sync Service.

         

         For Computer account, select Local computer.

      6. Click Finish when you have added the three certificate snap-ins.

      7. Still in the Microsoft Management Console, expand Certificates - Current User > Personal and select Certificates.

      8. Select Action > All Tasks > Import to open the Certificate Import Wizard.

      9. Browse for the IDM certificate. If you have exported IDM's self-signed certificate, the certificate is openidm-localhost.crt.

      10. Enter the Password for the certificate (changeit by default, if you use the IDM self-signed certificate).

      11. Accept the default for the Certificate Store.

      12. Click Finish to complete the import.

      13. Repeat the previous six steps to import the certificate for:

          Certificates - Current User > Trusted Root Certification Authorities

          Certificates - Service > OpenIDM Password Sync\Personal

          Certificates - Service > OpenIDM Password Sync\Trusted Root Certification Authorities

          Certificates > Local Computer > Personal

          Certificates > Local Computer > Trusted Root Certification Authorities