====== Remote loader installation ====== ===== Overview ===== The remote loader is used to synchronize data between the meta directory and the connected system (AD, LDAP, MySQL, etc). It is required to open the communication port (default 8090 (TCP) incoming) for the following IP addresses within your firewall: 134.76.9.64/28 For system requirements see: [[https://docs.microfocus.com/doc/2159/25.2/systemrequirementsidentity_manager|System requirements]] ===== Installation on Windows ===== Remote loader files: [[https://idm.gwdg.de/RemoteLoader/Identity_Manager_4.10.2_RL_Windows.iso|- download -]]\\ dfn-community-ca: [[https://idm.gwdg.de/RemoteLoader/dfn-community-ca.zip|- download -]]\\ Documentation remote loader installation (opentext): [[https://docs.microfocus.com/doc/2159/25.2/driver_admin_t461ohcqydr7|- link -]]\\ Documentation remote loader configuration (opentext): [[https://docs.microfocus.com/doc/2159/25.2/driver_admin_b18xta1v|- link -]]\\ Documentation Creating an Administrative Account (opentext): [[https://docs.microfocus.com/doc/39/25.4/ad_creating_an_administrative_account|- link -]]\\ PW-Filter installation: [[https://docs.microfocus.com/doc/39/25.4/ad_synchronizing_passwords|- link -]] ==== Update ==== * Before updating, please copy the folder C:\NetIQ to another location so that you have a backup copy in case of problems after updating remote loader. * After backing up the folder C:\NetIQ, proceed to the “Installation” section. ==== Installation ==== * We strongly recommend not to install directly on a domain controller but using a member server of the domain * Download remote loader iso image * Download DFN community chain * Mount remote loader iso and extract certificate * Run ''install.exe'' * Recommendation: Do not install directly on a domain controller but on a active directory member server. * Accept license agreement (can be ignored - is associated with IDENTITY MANAGER server software not the remote loader) * How to verify the version installed. * Go to the installation path (Default: C:\NetIQ\IDM\RemoteLoader\64bit). Open preferences of file ''dirxml_remote.exe''. * Switch to details tab. Check if productversion is 4.10.1.0 ==== Configuration ==== * Run rlconsole.exe within the installation path **as administrator** (Default: C:\NetIQ\IDM\RemoteLoader\64bit) * Click add * Add description * Choose driver (eg. ADDriver.dll) * Choose the IP address where to listen (Default: All) * Set communication port (Default: 8090) * Set remote loader password (required by GWDG) * Requirements: At least 12 character of upper and lower case letters and digits (no special character) * Set driver object password (required by GWDG) * Requirements: At least 12 character of upper and lower case letters and digits (no special character) * Activate SSL * Choose path to //dfn-community-ca.pem// * Check "Remote Loader-Service für diese Treiber-Instanz erstellen" * Accept (don't start the remote loader service) * Open windows services (services.msc) identify the "DirXML Loader" Service and enter the active directory user as service logon account * Start the remote loader ==== Active Directory User ==== * The user who runs the service has to be in the **local** administrator group (Local Users and Groups -> Groups -> Administrators). * Necessary user right: "Replicating Directory Changes" (**not** Replication Directory Changes All) for all object and all descendant objects for the domain * Domain -> Properties -> Tab Security -> Advanced -> Add * Choose user -> "clear all" -> check "Replicating Directory Changes" * Necessary user right: "Log on as a service" * Grant full access for relevant objects in ou/container * Container -> Properties -> Security -> Advanced -> Add -> choose user -> Descendant User objects -> check "Full control" * Container -> Properties -> Security -> Advanced -> Add -> choose user -> Descendant Group objects -> check "Full control" ===== Installation on Linux ===== The installation on Linux systems differs between certified systems (eg SLES 15, RHEL 8, etc. [[https://docs.microfocus.com/doc/2159/25.2/osplatforms|see ]]) and non-certified systems. If you are using a non-certified system eg. Ubuntu the Java remote loader has to be installed (see below). ==== Installation on certified Linux systems ==== Remote loader iso: [[https://idm.gwdg.de/RemoteLoader/Identity_Manager_4.10.2_RL_Linux.iso|- download -]]\\ dfn-community-ca: [[https://idm.gwdg.de/RemoteLoader/dfn-community-ca.zip|- download -]]\\ Documentation remote loader installation (opentext): [[https://docs.microfocus.com/doc/2159/25.2/setup_linux_installing_remote_loader|- link -]] === Prerequisites === * Download remote loader files * Download DFN community chain certificate * Extract the certificate == CentOS == The 32Bit version of glibc has to be installed on x86_64 systems: yum install glibc.i686 === Installation === * Mount remote loader * Create file **silent.properties** * ./create_silent_props.sh * METADIRECTORY_SERVER_SELECTED=false * WEB_ADMIN_SELECTED=false * UTILITIES_SELECTED=false * Choose remote loader * 32 Bit * CONNECTED_SYSTEM_SELECTED=true * X64_CONNECTED_SYSTEM_SELECTED=false * 64 Bit * CONNECTED_SYSTEM_SELECTED=false * X64_CONNECTED_SYSTEM_SELECTED=true * Run the following commands as root in the setup directory: ./install.sh -s -f ==== Installation on **non-certified** Linux systems ==== Remote Loader files: [[https://idm.gwdg.de/RemoteLoader/JavaRemoteLoader4.10.2.zip|- download -]]\\ dfn-community-ca: [[https://idm.gwdg.de/RemoteLoader/dfn-community-ca.zip|- download -]]\\ Documentation remote loader installation (opentext): [[https://docs.microfocus.com/doc/2159/25.2/setup_linux_install_linux_java_remote_loader|- link -]] === Prerequisites === * Download remote loader files * Download certificate chain * Extract the certificate * Java 21, at a minimum is required * Java has to be in PATH variable! PATH=$PATH:/path/to/java/bin/ === Update Java remote loader === * Before updating, please copy the actual installation path (eg. ///opt/novell/eDirectory///) to another location so that you have a backup copy in case of problems after updating remote loader. * After backing up the folder proceed to the “Install Java remote loader” section. * Password requirements for remote loader and driver object password have changed! Existing passwords may no longer be accepted by the application === Install Java remote loader === * Extract Java remote loader * Make ''dirxml_jremote'' and ''create_keystore'' executable === Configuration === * Change into installation directory eg. ///opt/novell/eDirectory/// * Create keystore file ./create_keystore [ca-file] * Edit dirxml_jremote * Replace the path for the jarlist with the actual installation path jarlist=`ls /opt/novell/eDirectory/lib/dirxml/classes/*.jar` jarlist=`ls //lib/*.jar` * Add/Edit **config8000.txt** * Example LDAP Konfiguration: -commandport 8000 -connection "port=8090 keystore='/dirxml.keystore' storepass=dirxml" -trace 4 -tracefile ./trace8000.log -tracefilemax 10M -class com.novell.nds.dirxml.driver.ldap.LDAPDriverShim * Set remote loader and driver object password * Both are required by GWDG and need to be set in the complement driver * Password requirements: At least 12 character of upper and lower case letter and digits (**no special character**) ./dirxml_jremote -config config8000.txt -sp * Run the Java remote loader: ./dirxml_jremote -config config8000.txt ==== Remote loader start script example ==== #!/bin/sh INSTDIR=/opt/novell/eDirectory USER=ldap export PATH=/usr/local/bin:$PATH export LD_LIBRARY_PATH=$INSTDIR/lib64\${LD_LIBRARY_PATH:+:\$LD_LIBRARY_PATH} cd $INSTDIR case "$1" in stop) kill `ps aux | grep '[d]irxml_remote' | awk '{ print $2}'` ;; start|*) echo -n " rloader" exec > /dev/null 2>&1 touch trace8000.log chown $USER trace8000.log su $USER -c "$INSTDIR/dirxml_jremote -config $INSTDIR/config8000.txt &" ;; esac ==== Remote loader unit file example ==== * Requires user: remoteloader and group: remoteloader * touch trace8000.log && chown remoteloader:remoteloader trace8000.log [Unit] Description=IDM Remote Loader After=docker.service [Service] Type=simple ExecStart=/opt/novell/remoteloader/dirxml_jremote -config config8000.txt WorkingDirectory=/opt/novell/remoteloader User=remoteloader Group=remoteloader Restart=on-failure [Install] WantedBy=multi-user.target ==== Univention Corporate Server ==== Import Univention CA to Keystore to allow self signed LDAP certificate **LDAP Certificate must also be available in Keystore** keytool -import -trustcacerts -alias univention-ca -file /opt/idm/univention-ca.pem -keystore dirxml.keystore keytool -import -trustcacerts -alias ldap -file /opt/idm/ldap.pem -keystore dirxml.keystore