Guide to installing and upgrading ForgeRock® Identity Edge Controller software.

Install the Edge Identity Manager as follows:

1. Download the Edge Identity Manager WAR file from the Edge Security section on the ForgeRock BackStage download site.

2. Copy the WAR file to the same server that is running the AM web server. For example:

   cp ~/Downloads/edge-identity-manager-6.5.0.war ${TOMCAT_HOME}/webapps/identitymanager.war

3. Access the Edge Identity Manager at the context path /identitymanager, for example http://openam.example.com:8080/identitymanager.

   For the Edge Identity Manager to have sufficient privileges to access AM, an AM admin user must be logged into the AM Admin Console in the same browser session.

Install the IEC Service as follows:

1. Download the IEC Service binary from the Edge Security section on the ForgeRock BackStage download site.

   Choose the binary specific to your device operating system. Binaries are provided for the following operating systems:

   • ARM7

   • ARM8 - RichOS

   • ARM8 - OP-TEE

     This ARM TrustZone-enabled version of the IEC Service provides secure storage on devices that support OP-TEE.

   • x86_64

2. Unpack the tarball to a temporary directory:

   mkdir ~/Downloads/iec-service
   tar -xzvf ~/Downloads/iec-service-<OS>-6.5.0.tgz -C ~/Downloads/iec-service

3. In any text editor, open the IEC Service configuration file (~/Downloads/iec-service/iec-config.json) and set at least the following properties to match the Service configuration you set in "To Add the IEC Service".

   {
     "iec_configuration": {
       ...
       "id_token_config.audience": "openam.example.com",
       ...
     },
     "am_configuration": {
       "url": "http://openam.example.com/openam",
       ...
     }...  

   Note

   The value provided for id_token_config.subject is used as the name of the IEC identity and must be unique within the AM realm. ^[1]

4. Run the install script:

   ~/Downloads/iec-service/install.sh
   iec util: Initialising service
   iec util: Finished service initialisation
   Created symlink /etc/systemd/system/multi-user.target.wants/iec.service - /lib/systemd/system/iec.service.

   The IEC Service is now installed and running as a daemon.

   For a list of the files in the tarball, and where they are installed by the install script, see "IEC Service File Layout".

First, install the IEC SDK as follows:

1. Download the IEC SDK from the Edge Security section on the ForgeRock BackStage download site.

   Choose the binary specific to your device operating system. Binaries are provided for the following operating systems:

   • ARM7

   • ARM8

   • x86_64

2. Unpack the SDK tarball to an accessible directory, for example:

   mkdir ~/forgerock
   tar -xzvf ~/Downloads/iec-sdk-<OS>-6.5.0.tgz -C ~/forgerock

3. Add the extracted lib directory to your path. For example:

   export LD_LIBRARY_PATH=~/forgerock/lib
   export DYLD_LIBRARY_PATH=~/forgerock/lib

   The SDK is now installed.

The SDK binary includes a number of example applications.

To test the SDK, run the simpleclient example application as follows:

1. Copy the SDK configuration file (sdk-config.json) to the directory containing the simpleclient application:

   cd ~/forgerock/examples/simpleclient
   cp ~/forgerock/sdk-config.json .

2. Edit the SDK configuration file to specify the IP address on which the SDK runs. For example, if you are setting this up in the training environment, edit the file as follows:

   zmq_client.endpoint: tcp://172.16.0.11:5556

   Note

   The value provided for client_configuration/id is used as the name of the client identity and must be unique within the AM realm. ^[1]

3. Use the IEC Utility (iecutil) to initialize the SDK:

   ~/forgerock/iecutil -file sdk-config.json -initialise sdk
   iec util: Initialising sdk
   iec util: Finished sdk initialisation

   Note

   If you change the configuration and need to reinitialize the SDK, remove the iec-sdk.db in the application directory, then run the initialization again. For example:

   cd ~/forgerock/examples/simpleclient
   rm iec-sdk.db
   ~/forgerock/iecutil -file sdk-config.json -initialise sdk

4. Run the example application:

   ./simpleclient
   *** Running simpleclient
   
   Setting attributes ... Done
   Initialising sdk... Done
   Registering device (id: Narwhal)... Done
   Requesting configuration for device (id: Narwhal)... Done
   Received configuration: {  }
   Requesting tokens for device (id: Narwhal)... Done
   Received tokens: {
    "access_token": "zcKlIqmDIgD70J7M0yukH3OmfbM",
    "id_token": "eyJ0e...Wgw",
    "token_type": "Bearer",
    "expires_in": "3599"
    }
   Executing 'Hello World' custom command... Custom command request failed: Error: am_error, Description: no script found for command, URL:    

   The client application should register successfully and retrieve OAuth2 tokens.

   Confirm that the registration has been successful by checking that the simpleclient identities were created in the AM Admin console or in the Edge Identity Manager. When you have successfully initialized the client application, delete the configuration file.