Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision | ||
en:services:general_services:idm:installing_remote_loader_software [2020/01/24 10:25] – [Installation on Windows] skloepp2 | en:services:general_services:idm:installing_remote_loader_software [2023/09/15 09:09] – [Installation] ggroesc | ||
---|---|---|---|
Line 1: | Line 1: | ||
+ | ====== | ||
+ | ===== Overview ===== | ||
+ | The remote loader is used to synchronize data between the meta directory and the connected system (AD, LDAP, MySQL, etc). | ||
+ | It is required to open the communication port (default 8090 (TCP) incoming) for the following IP addresses within your firewall: | ||
+ | < | ||
+ | 134.76.9.64/ | ||
+ | </ | ||
+ | |||
+ | For system requirements see: [[https:// | ||
+ | |||
+ | ===== Installation on Windows | ||
+ | Remote loader files: [[https:// | ||
+ | Remote loader service pack: [[https:// | ||
+ | Sectigo-chain: | ||
+ | Documentation remote loader installation (NetIQ) P. 47 ff: [[https:// | ||
+ | Documentation remote loader configuration (NetIQ) P. 32 ff: [[https:// | ||
+ | Documentation Creating an Administrative Account (NetIQ) P. 26 ff: [[https:// | ||
+ | PW-Filter installation P 47 ff: [[https:// | ||
+ | |||
+ | ==== Installation | ||
+ | * Download remote loader files | ||
+ | * Download T-TeleSec-GlobalRoot-Class-2 certificate | ||
+ | * Extract remote loader files and certificate | ||
+ | * If necessary unblock extracted files e.g. '' | ||
+ | * Run '' | ||
+ | * Accept license agreement (can be ignored - is associated with IDENTITY MANAGER server software not the remote loader) | ||
+ | * Run '' | ||
+ | * How to verify if SP is installed. | ||
+ | * Go to the installation path (Default: C: | ||
+ | * Switch to details tab. Check if productversion is 4.8.__6__.0 where __6__ ist the Number of the downloaded SP. | ||
+ | |||
+ | ==== Configuration | ||
+ | * Run rlconsole.exe within the installation path **as administrator** (Default: C: | ||
+ | * Click add | ||
+ | * Add description | ||
+ | * Choose driver (eg. ADDriver.dll) | ||
+ | * Choose the IP address where to listen (Default: All) | ||
+ | * Set communication port (Default: 8090) | ||
+ | * Set remote loader password (required by GWDG) | ||
+ | * Set driver object password (required by GWDG) | ||
+ | * Activate SSL | ||
+ | * choose path to // | ||
+ | * Select "run as servcie" | ||
+ | * Accept (don't start the remote loader service) | ||
+ | * Go to the installation path (Default: C: | ||
+ | * Start the remote loader | ||
+ | |||
+ | ==== Notices | ||
+ | If you are using the Active Directory driver the user who runs the service needs to be in the **local** administrator group. | ||
+ | |||
+ | ===== Installation on Linux ===== | ||
+ | The installation on Linux systems differs between certified systems (eg SLES 15, RHEL 8, etc. [[https:// | ||
+ | If you are using a non-certified system eg. Ubuntu the Java remote loader has to be installed. | ||
+ | |||
+ | ==== Installation on certified Linux systems | ||
+ | Remote loader files: [[https:// | ||
+ | Remote loader service pack: [[https:// | ||
+ | Sectigo-chain: | ||
+ | Documentation remote loader installation (NetIQ) P. 65ff: [[https:// | ||
+ | |||
+ | === Prerequisites | ||
+ | * Download remote loader files | ||
+ | * Download Sectigo chain certificate | ||
+ | * Extract the certificate | ||
+ | |||
+ | == CentOS | ||
+ | The 32Bit version of glibc has to be installed on x86_64 systems: | ||
+ | < | ||
+ | yum install glibc.i686 | ||
+ | </ | ||
+ | |||
+ | === Installation | ||
+ | * Extract remote loader | ||
+ | * Edit file **silent.properties** | ||
+ | * METADIRECTORY_SERVER_SELECTED=false | ||
+ | * WEB_ADMIN_SELECTED=false | ||
+ | * UTILITIES_SELECTED=false | ||
+ | * Choose remote loader | ||
+ | * 32 Bit | ||
+ | * CONNECTED_SYSTEM_SELECTED=true | ||
+ | * X64_CONNECTED_SYSTEM_SELECTED=false | ||
+ | * 64 Bit | ||
+ | * CONNECTED_SYSTEM_SELECTED=false | ||
+ | * X64_CONNECTED_SYSTEM_SELECTED=true | ||
+ | |||
+ | * Run the following commands as root in the setup directory: | ||
+ | < | ||
+ | chmod -R 755 * | ||
+ | ./ | ||
+ | </ | ||
+ | |||
+ | |||
+ | |||
+ | ==== Installation on **non-certified** Linux systems | ||
+ | Remote Loader files: [[https:// | ||
+ | Sectigo-chain: | ||
+ | |||
+ | === Prerequisites | ||
+ | * Download remote loader files | ||
+ | * Download Sectigo chain certificate | ||
+ | * Extract the certificate | ||
+ | * JRE Java8u112, at a minimum is required | ||
+ | |||
+ | === Install Java remote loader | ||
+ | * Extract Java remote loader | ||
+ | * Make dirxml_jremote and create_keystore executable | ||
+ | |||
+ | ==== Configuration | ||
+ | * Change into installation directory eg. /// | ||
+ | * Create keystore file | ||
+ | * < | ||
+ | * Edit dirxml_jremote and replace | ||
+ | * < | ||
+ | * with | ||
+ | * < | ||
+ | * Add/Edit **config8000.txt** | ||
+ | |||
+ | |||
+ | **Example LDAP Konfiguration** | ||
+ | < | ||
+ | -commandport 8000 | ||
+ | -connection " | ||
+ | -trace 4 | ||
+ | -tracefile ./ | ||
+ | -tracefilemax 10M | ||
+ | -class com.novell.nds.dirxml.driver.ldap.LDAPDriverShim | ||
+ | </ | ||
+ | * Set remote loader and driver object password (both are required by GWDG): | ||
+ | < | ||
+ | ./ | ||
+ | </ | ||
+ | |||
+ | * Run the Java remote loader: | ||
+ | < | ||
+ | ./ | ||
+ | </ | ||
+ | * Java has to be in PATH variable! | ||
+ | < | ||
+ | PATH=$PATH:/ | ||
+ | </ | ||
+ | |||
+ | ==== Remote loader start script example ==== | ||
+ | < | ||
+ | #!/bin/sh | ||
+ | INSTDIR=/ | ||
+ | STAGEDIR=$INSTDIR/ | ||
+ | USER=ldap | ||
+ | |||
+ | export PATH=/ | ||
+ | |||
+ | cd $INSTDIR | ||
+ | |||
+ | case " | ||
+ | |||
+ | stop) | ||
+ | kill `ps aux | grep ' | ||
+ | ;; | ||
+ | |||
+ | start|*) | ||
+ | echo -n " rloader" | ||
+ | exec > /dev/null 2>&1 | ||
+ | touch trace8000.log | ||
+ | chown $USER trace8000.log | ||
+ | su $USER -c " | ||
+ | ;; | ||
+ | |||
+ | esac | ||
+ | </ | ||
+ | |||
+ | ==== Remote loader unit file example ==== | ||
+ | * Requires user: remoteloader and group: remoteloader | ||
+ | * touch trace8000.log && chown remoteloader: | ||
+ | |||
+ | < | ||
+ | [Unit] | ||
+ | Description=IDM Remote Loader | ||
+ | After=docker.service | ||
+ | |||
+ | [Service] | ||
+ | Type=simple | ||
+ | ExecStart=/ | ||
+ | WorkingDirectory=/ | ||
+ | User=remoteloader | ||
+ | Group=remoteloader | ||
+ | Restart=on-failure | ||
+ | |||
+ | [Install] | ||
+ | WantedBy=multi-user.target | ||
+ | </ | ||
+ | |||
+ | ==== Univention Corporate Server ==== | ||
+ | Import Univention CA to Keystore to allow self signed LDAP certificate | ||
+ | **LDAP Certificate must also be available in Keystore** | ||
+ | < | ||
+ | keytool -import -trustcacerts -alias univention-ca -file / | ||
+ | keytool -import -trustcacerts -alias ldap -file / | ||
+ | </ |