Diagnose OVD Connection Running Tests By Using the Diagnostic Dashboard

21-2 Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager 3. Test the remote manager. See Testing the Remote Manager Connection on page 21-5 for details. This section contains the following topics: ■ Adding the Trust Relation ■ Configuring the Remote Manager by Using Your Own Certificate ■ Testing the Remote Manager Connection ■ Updating the xlconfig.xml File to Change the Port for Remote Manager

21.2.1 Adding the Trust Relation

The remote manager and Oracle Identity Manager communicate by using SSL. You must enable a trust relationship between Oracle Identity Manager and the remote manager. Oracle Identity Manager must trust the remote manager certificate. To achieve this, you must import the remote manager certificate into the Oracle Identity Manager keystore and set it up as a trusted certificate. If required, you can also enable client-side authentication in which the remote manager trusts the server certificate. For client-side authentication, import the certificate for Oracle Identity Manager into the remote manager keystore and set it up as a trusted certificate. You might have to manually edit the configuration file xlconfig.xml associated with Oracle Identity Manager and the remote manager. Perform the following steps to ensure that the trust relation between the application server and the remote manager is established through the certificate. The keytool utility is used to importexport the certificates. 1. Using a command prompt, navigate to the XLREMOTE_HOME directory and use the keytool utility to list the certificate fingerprints. 2. Enter the following command: JAVA_HOMEjrebinkeytool -list -keystore .configdefault-keystore.jks On running the keytool command shown in this step, you will be prompted to enter the default password for the keystore. When you enter the keystore password, the entries in the keystore along with their certificate fingerprints MD5 hashes are displayed, as follows: Enter the default password for xellerate keystore: KEYSTORE_PASSWORD Your keystore contains 1 entry xell, Jan 7, 2005, keyEntry, Certificate fingerprint MD5: B0:F2:33:C8:69:E4:25:A3:CB:59:E8:51:27:EE:5C:52 Note: The Oracle Identity Manager keystore is called default-keystore.jks. In Oracle Identity Manager, it is located in the DOMAIN_HOMEconfigfmwconfig directory. For the remote manager, the keystore is located in the XLREMOTE_HOMEconfig directory. The keystore name is default-keystore.jks. Installing and Configuring a Remote Manager 21-3 The certificate fingerprint is marked in bold. This is used to uniquely identify the certificate in the keystore. 3. To establish a trust relationship between Oracle Identity Manager and the remote manager: a. Copy the remote manager certificate to the server computer. On the remote manager computer, locate the XLREMOTE_HOMExlremoteconfigxlserver.cert file, and copy it to the server computer. b. Open a command prompt on the server computer. c. To import the certificate by using the keytool utility, use the following command: JAVA_HOME \jre\bin\keytool -import -alias rm_trusted_cert -file RM_CERT_LOCATION \xlserver.cert -trustcacerts -keystore DOMAIN_HOME\config\fmwconfig\default-keystore.jks -storepass KEYSTORE_PASSWORD JAVA_HOME is the location of the Java directory for the application server, the value of alias is the name for the certificate in the store, and RM_CERT_LOCATION is the location in which you copied the certificate.

d. Enter Y at the prompt to trust the certificate.

e. On to the remote manager computer, in a text editor, open the XLREMOTE_HOMExlremoteconfigxlconfig.xml file. f. Locate the RMIOverSSL property and ensure that the value is set to true, for example: RMIOverSSLtrueRMIOverSSL g. Locate the KeyManagerFactory property. If you are using the IBM JRE, then set the value to IBMX509. For example: KeyManagerFactoryIBMX509KeyManagerFactory For all other JREs, set the value to SUNX509. For example: KeyManagerFactorySUNX509KeyManagerFactory h. Save the file. i. Restart Oracle Identity Manager.

21.2.2 Configuring the Remote Manager by Using Your Own Certificate

When the remote manager is installed, the installer generates a keypair and certificate with some default parameters, such as key password, certificate expiration time, and CN. However, you might need to change some of the parameters because of business security requirements. As a result, you need to generate and use a keypair and certificate, instead of the default certificates that are installed. To configure the remote manager by using your own certificate on the remote manager server: Note: The server certificate in OIM_HOME is also named xlserver.cert. Ensure that you do not overwrite that certificate.