his is to record the steps i used to switch LDAP repository in Websphere Application Server 7 and enabled LDAP over SSL.<\/p>\n
Lets Start<\/p>\n
Point your browser to the WAS console and login using admin account.<\/p>\n
Add in the new LDAP server configurations<\/p>\n
As i use a few repositories in my environment, i would be updating the repositories in the “Federated repositories” section.<\/p>\n
Click on left column’s link: Security -> Global Security -> Configure (the drop down box is pointed to “Federated repositories”<\/p>\n
The page refreshed, look for “Manage repositories” -> Add<\/p>\n
Fill the following.
\n– Repository identifier
\n– Directory type (here, i used IBM TDS)
\n– Primary hostname (put in IP, if you have the entry in \/etc\/hosts, can use hostname)
\n– Port (389 for a start. Later will be updated to 636)
\n– Bind DN (The account to connect to LDAP server)<\/p>\n
Click Apply when you are done. Then Click Save. Wait for sync to finish and click OK.<\/p>\n
If there is something wrong, WAS will complain.<\/p>\n
i.e.
\ncannot reach the LDAP server. (ACL\/firewall??)
\nwrong port
\nBind DN is wrong
\netc<\/p>\n
Import LDAP server SSL<\/p>\n
Store the SSL certificate as a flat file in the WAS server. You may need to convert the SSL certificate to “der” format and deposit the certificate to the deployment manager directory.<\/p>\n
Create WAS Truststore<\/p>\n
We will create the key store in WAS to store keys and certificate for LDAP. Idea is to separate key store for different functions.<\/p>\n
By java definition, keystore is an object that holds personal certificate. truststore is a Java object that holds signer certificates. I gather we will only create the truststore since WAS security guide listed this step.<\/p>\n
Click Security -> SSL Certificate and key management -> keystores and certificates<\/p>\n
Then click New <\/p>\n
Fill up the following
\n– Name (i used LDAPTruststore)
\n– Management scope (IBM security guide recommended cell level)
\n– Path (Where you want to store this key store)
\n– Password<\/p>\n
Import the LDAP SSL certiticate into LDAPTruststore<\/p>\n
From the breadcrumb of the previous step, Click on “LDAPTruststore” and Signer certificates.<\/p>\n
Click Add<\/p>\n
Fill up the following
\n– Alias (i used ldapcert)
\n– File Name (the path to the LDAP ssl certificate you put in previous step.)<\/p>\n
Click Apply when you are done. Then Click Save. Wait for sync to finish and click OK<\/p>\n
Creating SSL alias link to the Trust store<\/p>\n
We will create Click Security -> SSL certificate and key management -> SSL configuration.<\/p>\n
Click New<\/p>\n
Fill up the following
\n– Name (I used LDAPSSLSettings)
\n– Trust store name (its LDAPTruststore)
\n– Key store name (its LDAPTruststore)
\n– Management Scope (Its Cell Level)<\/p>\n
Click OK then Save then OK.<\/p>\n
We are now ready to enable LDAP over SSL communication to LDAP server<\/p>\n
Go back to the repository.<\/p>\n
Click Security -> Global Security -> Configure (drop down bar should point to “Federated repositories”)<\/p>\n
When the page refreshed, Click “Manage repositories”<\/p>\n
Fill up the following
\n– Port (change to 636)<\/p>\n
Check the “Require SSL communication”<\/p>\n
Choose the radio button “use specific SSL alias” and select LDAPSSLSettings from the drop down menu.<\/p>\n
Click Apply when you are done. Then Click Save. Wait for sync to finish and click OK<\/p>\n
Add the Base DN<\/p>\n
Here, we need to configure from where in LDAP server we should make the queries.<\/p>\n
Click Security -> Global Security -> Configure (drop down bar should point to “Federated repositories”)<\/p>\n
Click the “Add base entry to realm” button<\/p>\n
Fill up the following
\n– Repository (Put in the name you used for “Repository identifier”)
\n– OU (Put in the Base DN here)<\/p>\n
Click Apply when you are done. Then Click Save. Wait for sync to finish and click OK <\/p>\n
A little housekeeping<\/p>\n
Removethe base DN for the old LDAP server.<\/p>\n
Click on the base DN -> remove
\nThen Click Save. Wait for sync to finish and click OK <\/p>\n
Click on Manage repositories
\nCheck the old repository -> delete
\nThen Click Save. Wait for sync to finish and click OK <\/p>\n
Restart AppSvr, NodeMgr and Dmgr<\/p>\n
To be safe, i would prefer to restart everything and make sure i still can log in as administrator and the application would have no problem working with the new LDAP server.<\/p>\n
Check the Dmgr logs, AppSvr logs for signs of errors.<\/p>\n
A small test<\/p>\n
Click on “users and groups” -> manage users
\nSearch for some valid users and verify that they come from the new LDAP server.
\nGet the software team to verify too in case the problem is subtle enough not to be caught in the application logs.<\/p>\n","protected":false},"excerpt":{"rendered":"
his is to record the steps i used to switch LDAP repository in Websphere Application Server 7 and enabled LDAP over SSL.<\/p>\n
Lets Start<\/p>\n
Point your browser to the WAS console and login using admin account.<\/p>\n
Add in the new LDAP server configurations<\/p>\n
As i use a few repositories in my environment, i would be […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[25],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/3713"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3713"}],"version-history":[{"count":1,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/3713\/revisions"}],"predecessor-version":[{"id":3714,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/3713\/revisions\/3714"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3713"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3713"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3713"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}