Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Last revision Both sides next revision | ||
devel:documentation:adm:systems:connectors:remote_server [2019/11/13 09:23] apeterova key change |
devel:documentation:adm:systems:connectors:remote_server [2023/11/07 14:54] urbanl [Remote connector server configuration - Linux] |
||
---|---|---|---|
Line 1: | Line 1: | ||
====== Remote connector server ====== | ====== Remote connector server ====== | ||
+ | |||
{{tag> system connector configuration }} | {{tag> system connector configuration }} | ||
Remote connector server is a standalone daemon used for interfacing some of the more difficult systems. You deploy connector bundles into the connector server. Then, you configure CzechIdM to use connectors from within the remote connector server. As far as IdM is concerned, there is no difference if actions on end system are performed by connector server or IdM itself. The only difference is in the point of origin of network communication. | Remote connector server is a standalone daemon used for interfacing some of the more difficult systems. You deploy connector bundles into the connector server. Then, you configure CzechIdM to use connectors from within the remote connector server. As far as IdM is concerned, there is no difference if actions on end system are performed by connector server or IdM itself. The only difference is in the point of origin of network communication. | ||
+ | |||
===== Why use remote connector server? ===== | ===== Why use remote connector server? ===== | ||
+ | |||
CzechIdM comes bundled only with certain types of connectors. For some deployments, | CzechIdM comes bundled only with certain types of connectors. For some deployments, | ||
- | * We cannot run Java code on the target system (e. g. .NET code is needed). | + | |
+ | * We cannot run Java code on the target system (e. g. .NET code is needed). | ||
* The OS does not have some normal API (e. g. old Windows without WinRM) so we need to run commands on it locally. | * The OS does not have some normal API (e. g. old Windows without WinRM) so we need to run commands on it locally. | ||
* Security reasons - we do not want to run the connector code under the same user as the CzechIdM. | * Security reasons - we do not want to run the connector code under the same user as the CzechIdM. | ||
* You need to use two different versions of one connector (or two connectors which bundle different versions of the same library - for example Apache CXF). If you did deploy them both into one Java context, libraries would break due to Java Class FQDN conflicts. | * You need to use two different versions of one connector (or two connectors which bundle different versions of the same library - for example Apache CXF). If you did deploy them both into one Java context, libraries would break due to Java Class FQDN conflicts. | ||
+ | |||
===== How does a remote connector server work in CzechIdM? ===== | ===== How does a remote connector server work in CzechIdM? ===== | ||
- | The remote server connector configuration form behaves just like the local connector form - this means that definition is stored in the EAV attributes for system which it belongs. As a key to EAV attributes are used the system name, connector name, and connector version. Therefore, it is possible to have multiple connectors with different version on the remote connector server. | ||
+ | The remote server connector configuration form behaves just like the local connector form - this means that definition is stored in the EAV attributes for system which it belongs to. System name, connector name and connector version are the key to EAV attributes in the CzechIdM. It is therefore possible to have multiple connectors with different versions in one remote connector server. | ||
===== Connector server setup ===== | ===== Connector server setup ===== | ||
- | Download appropriate version of the connector server. If you are a BCV developer, use our internally provided version. | ||
- | ==== Using connector server | + | ==== Obtaining |
- | - Download the all-in-one prepared bundle from [[https:// | + | |
- | - Continue with deployment instructions. | + | |
- | ==== Using connector server | + | * Simply download the all-in-one prepared bundle from [[https:// |
- | - Download connector server from the [[https:// | + | |
- | - **Use version | + | < |
- | - Download following libraries and add them to the '' | + | |
- | * jackson-annotations-2.9.8 | + | - Download connector server from the [[https:// |
- | * jackson-core-2.9.8 | + | - **Use version 1.4.5.1** |
- | * jackson-databind-2.9.8 | + | - Download following libraries and add them to the '' |
- | - Add those libraries to the '' | + | * jackson-annotations-2.9.8 |
+ | * jackson-core-2.9.8 | ||
+ | * jackson-databind-2.9.8 | ||
+ | - Add those libraries to the '' | ||
+ | |||
+ | </ | ||
==== Remote connector server configuration - Linux ==== | ==== Remote connector server configuration - Linux ==== | ||
+ | |||
- Install Java 1.8 (OpenJDK headless is preferred). | - Install Java 1.8 (OpenJDK headless is preferred). | ||
- | - Create new OS user the connector server will run under. By default, we create user '' | + | - Create new OS user the connector server will run under. By default, we create user '' |
+ | |||
+ | < | ||
useradd -b /opt -m -s /bin/bash connector-server | useradd -b /opt -m -s /bin/bash connector-server | ||
chmod 750 / | chmod 750 / | ||
+ | |||
</ | </ | ||
- | | + | |
+ | | ||
+ | |||
+ | < | ||
cp connector-server-master.tar.gz / | cp connector-server-master.tar.gz / | ||
chown connector-server: | chown connector-server: | ||
Line 41: | Line 55: | ||
cd / | cd / | ||
tar xzf connector-server-master.tar.gz | tar xzf connector-server-master.tar.gz | ||
- | rm connector-server-master.tar.gz | + | rm connector-server-master.tar.gz |
</ | </ | ||
- | | + | |
+ | - Correct directory permissions: | ||
+ | |||
+ | < | ||
+ | cd / | ||
+ | chmod 750 bin/ bundles/ certs/ conf/ lib/ logs/ scripts/ | ||
+ | |||
+ | </ | ||
+ | |||
+ | | ||
+ | |||
+ | < | ||
ls -l / | ls -l / | ||
total 4 | total 4 | ||
Line 50: | Line 76: | ||
ls -l / | ls -l / | ||
total 23448 | total 23448 | ||
- | drwxrwxr-x 5 connector-server connector-server | + | drwxr-x--- 5 connector-server connector-server |
- | drwxrwxr-x 2 connector-server connector-server | + | drwxr-x--- 2 connector-server connector-server |
- | drwxrwxr-x 2 connector-server connector-server | + | drwxr-x--- 2 connector-server connector-server |
- | drwxrwxr-x 2 connector-server connector-server | + | drwxr-x--- 2 connector-server connector-server |
-rw-rw-r-- 1 connector-server connector-server 11976830 Oct 10 16:45 datetime | -rw-rw-r-- 1 connector-server connector-server 11976830 Oct 10 16:45 datetime | ||
- | drwxrwxr-x 3 connector-server connector-server | + | drwxr-x--- 3 connector-server connector-server |
-rw-rw-r-- 1 connector-server connector-server | -rw-rw-r-- 1 connector-server connector-server | ||
- | drwxrwxr-x 2 connector-server connector-server | + | drwxr-x--- 2 connector-server connector-server |
- | drwxrwxr-x 2 connector-server connector-server | + | drwxr-x--- 3 connector-server connector-server |
-rw-rw-r-- 1 connector-server connector-server 11976825 Oct 10 16:45 sys | -rw-rw-r-- 1 connector-server connector-server 11976825 Oct 10 16:45 sys | ||
+ | |||
</ | </ | ||
- | | + | |
+ | | ||
+ | |||
+ | < | ||
cd connid-connector-server | cd connid-connector-server | ||
chmod +x bin/ | chmod +x bin/ | ||
+ | |||
</ | </ | ||
- | | + | |
+ | | ||
+ | |||
+ | < | ||
./ | ./ | ||
+ | |||
</ | </ | ||
- | | + | |
- | - As root, create systemd unit ''/ | + | |
+ | - As root, create systemd unit ''/ | ||
+ | |||
+ | <file txt connector-server.service> | ||
[Unit] | [Unit] | ||
Description=Java Connector Server Service | Description=Java Connector Server Service | ||
Line 82: | Line 120: | ||
[Install] | [Install] | ||
WantedBy=multi-user.target | WantedBy=multi-user.target | ||
+ | |||
+ | |||
</ | </ | ||
- | | + | |
+ | | ||
+ | |||
+ | < | ||
systemctl daemon-reload | systemctl daemon-reload | ||
systemctl start connector-server | systemctl start connector-server | ||
systemctl enable connector-server | systemctl enable connector-server | ||
+ | |||
</ | </ | ||
- | | + | |
+ | | ||
- Connector server is now configured. You can deploy connector bundles into it. You have to restart the connector server for changes to take effect. | - Connector server is now configured. You can deploy connector bundles into it. You have to restart the connector server for changes to take effect. | ||
- | | + | |
- | - Add custom scripts the CzechIdM will use under the '' | + | - Add custom scripts the CzechIdM will use under the '' |
- | - Add certificates to be used under '' | + | - Add certificates to be used under '' |
+ | |||
+ | === Configuring log rotation === | ||
+ | |||
+ | The principle of rotating logs on Linux is the same as for the CzechIdM. Just create a proper logrotate file ''/ | ||
+ | |||
+ | < | ||
+ | / | ||
+ | rotate 90 | ||
+ | daily | ||
+ | dateext | ||
+ | copytruncate | ||
+ | missingok | ||
+ | notifempty | ||
+ | compress | ||
+ | } | ||
+ | |||
+ | </ | ||
=== Configuring SSL truststore === | === Configuring SSL truststore === | ||
- | When you interface end systems remotely, you **have to** secure the communication with TLS. For this to work, you need a Java truststore. This short howto will show you how to create one. | + | |
- | - Get (or create - as we do there) a certificate of the end system.< | + | When you interface end systems remotely, you **have to** secure the communication with TLS. For this to work, you need a Java truststore. This short howto will show you how to create one. |
+ | |||
+ | - Get (or create - as we do there) a certificate of the end system. | ||
+ | |||
+ | < | ||
su - connector-server | su - connector-server | ||
cd / | cd / | ||
Line 102: | Line 168: | ||
openssl req -new -key fakecert.key -out fakecert.csr -subj "/ | openssl req -new -key fakecert.key -out fakecert.csr -subj "/ | ||
openssl x509 -req -in fakecert.csr -signkey fakecert.key -days 1 -sha256 -out fakecert.crt | openssl x509 -req -in fakecert.csr -signkey fakecert.key -days 1 -sha256 -out fakecert.crt | ||
+ | |||
</ | </ | ||
- | | + | |
+ | | ||
+ | |||
+ | < | ||
keytool -importcert -file fakecert.crt -alias placeholder-cert -keystore truststore.jks | keytool -importcert -file fakecert.crt -alias placeholder-cert -keystore truststore.jks | ||
Enter keystore password: | Enter keystore password: | ||
Line 110: | Line 180: | ||
Trust this certificate? | Trust this certificate? | ||
Certificate was added to keystore | Certificate was added to keystore | ||
+ | |||
</ | </ | ||
- | | + | |
+ | | ||
+ | |||
+ | < | ||
rm fakecert.key fakecert.csr fakecert.crt | rm fakecert.key fakecert.csr fakecert.crt | ||
chmod 644 truststore.jks | chmod 644 truststore.jks | ||
# the connector server user should not be able to write the truststore, only read it | # the connector server user should not be able to write the truststore, only read it | ||
chown root: | chown root: | ||
+ | |||
</ | </ | ||
- | | + | |
+ | | ||
+ | |||
+ | < | ||
cd / | cd / | ||
vim bin/ | vim bin/ | ||
Line 123: | Line 201: | ||
# add this snippet to the command line that executes the connector server | # add this snippet to the command line that executes the connector server | ||
-Djavax.net.ssl.trustStore=/ | -Djavax.net.ssl.trustStore=/ | ||
+ | |||
</ | </ | ||
+ | |||
- Restart the connector server. | - Restart the connector server. | ||
+ | |||
==== Remote connector server configuration - Windows ==== | ==== Remote connector server configuration - Windows ==== | ||
1) Install Java 1.8 (OpenJDK headless is preferred). | 1) Install Java 1.8 (OpenJDK headless is preferred). | ||
+ | |||
+ | <note important> | ||
2) Unpack connector server to his root directory " | 2) Unpack connector server to his root directory " | ||
3) Create trustore for connector server. Use git bash in direcotory " | 3) Create trustore for connector server. Use git bash in direcotory " | ||
+ | |||
* Get (or create - as we do there) a certificate of the end system. | * Get (or create - as we do there) a certificate of the end system. | ||
Line 139: | Line 223: | ||
openssl req -new -key fakecert.key -out fakecert.csr -subj "/ | openssl req -new -key fakecert.key -out fakecert.csr -subj "/ | ||
openssl x509 -req -in fakecert.csr -signkey fakecert.key -days 1 -sha256 -out fakecert.crt | openssl x509 -req -in fakecert.csr -signkey fakecert.key -days 1 -sha256 -out fakecert.crt | ||
+ | |||
</ | </ | ||
Line 150: | Line 235: | ||
Trust this certificate? | Trust this certificate? | ||
Certificate was added to keystore | Certificate was added to keystore | ||
+ | |||
</ | </ | ||
Line 156: | Line 242: | ||
< | < | ||
rm fakecert.key fakecert.csr fakecert.crt | rm fakecert.key fakecert.csr fakecert.crt | ||
+ | |||
</ | </ | ||
- | |||
4) Add trustore location and password to service installation in „bin\ConnectorServer.bat“(windows). These parameters are in script already, so just trustore path and password. | 4) Add trustore location and password to service installation in „bin\ConnectorServer.bat“(windows). These parameters are in script already, so just trustore path and password. | ||
Line 163: | Line 249: | ||
< | < | ||
" | " | ||
+ | |||
</ | </ | ||
5) Start CMD under system admin. Then go to connector-server root directory. | 5) Start CMD under system admin. Then go to connector-server root directory. | ||
- | |||
< | < | ||
cd C: | cd C: | ||
bin\ConnectorServer.bat /setkey | bin\ConnectorServer.bat /setkey | ||
+ | |||
</ | </ | ||
+ | |||
+ | <note important> | ||
+ | |||
6) Add connectors to " | 6) Add connectors to " | ||
Line 178: | Line 268: | ||
< | < | ||
bin\ConnectorServer.bat /install connector_server | bin\ConnectorServer.bat /install connector_server | ||
+ | |||
</ | </ | ||
- | 8) Then start service in " | + | 8) Then start service in " |
- | If connector_server service started correctly set this service to automatic start. | + | |
+ | ===== Remote connector server agenda ===== | ||
+ | |||
+ | @since 10.8.0 | ||
+ | |||
+ | Standalone connector server agenda is available from main menu '' | ||
+ | |||
+ | * Remote connector servers can be configured here, configuration is effective for all related systems, | ||
+ | * connectors installed on the same server together with CzechIdM are shown, | ||
+ | * systems related to remote connector server or to concrete connector can be found on server or connector detail. | ||
+ | |||
+ | {{ .: | ||
===== Connecting CzechIdM to a remote connector server ===== | ===== Connecting CzechIdM to a remote connector server ===== | ||
+ | |||
+ | - In CzechIdM, go to '' | ||
+ | - In the detail of this remote connector server fill in every form field that IdM needs to connect to the remote system. It is necessary to supply the host and port on which the connector is available on remote server. If the server is secured by password, you will need to fill in the password in order to successfully connect to the remote connector server. Password will be stored in local confidential storage. | ||
+ | - When you are done, '' | ||
- In CzechIdM, on the system tab, create a new system. | - In CzechIdM, on the system tab, create a new system. | ||
- | - In the detail of this system, | + | - In the detail of this system, |
- | - When you are done, '' | + | - When you are done, '' |
- | - Go to the **"Configurations" | + | - Go to the '' |
- Configure everything else as you would do if you were not using remote connector server. | - Configure everything else as you would do if you were not using remote connector server. | ||
- | <note tip>If you change the key (password) of the connector server, you must change the key also in the system | + | <note tip>If you change the key (password) of the remote |
+ | |||
+ | < | ||
+ | org.identityconnectors.framework.common.exceptions.InvalidCredentialException: | ||
+ | |||
+ | </ | ||
+ | |||
+ | </ | ||
+ |