Deploying via Docker
This section describes how to deploy the OpenIAM platform in a
Docker Swarm environment; Kubernetes is supported only in the Enterprise version. The procedures described in this section must be performed in the order that they are presented. Some steps in this installation require root level privileges to the system where OpenIAM will be deployed.
What is Docker?
Docker is a tool for creating, deploying, and running applications using containers. Docker Compose is a tool for defining and running multi-container Docker applications. Docker provides a standardized, lightweight, execution environment that maintains all dependencies within it. It can be run on either physical or virtualized environments which are on-premise or in the cloud. For more information about docker, please see see the Docker website and Docker Documentation.
OpenIAM on Docker
The OpenIAM Docker deployment method enables you to deploy on OpenIAM using a series of pre-configured containers in a short amount of time without the complexity of deploying a series of dependencies. The simplified deployment method requires:
- Installing the Docker software
- Configuring environment variables
- Running scripts for setting up and starting up the OpenIAM instance. Running the deployment scripts automatically takes care of all component dependencies and release updates.
OpenIAM docker containers are maintained on Docker hub. Once these containers have been pulled into your environment using the details below, you will also need:
- Docker client - Docker Community Edition (CE) versions 19.03.12 or higher
- Docker compose - Defines and enables the operation of a multi-container Docker application. OpenIAM uses
docker-composefile format 3.2
OpenIAM Solution Stacks
The OpenIAM solution consists of several stacks that are deployable the Docker Swarm. Docker swarm is a container orchestration tool, meaning that it allows for the manage multiple containers deployed across multiple host machines. The content of each stack is described below
Critical Infrastructure stacks
The infrastructure stacks are used across the OpenIAM solution regardless of the functionality that you are enabling. These components must be operational for the OpenIAM solution to function correctly.
|Elasticsearch||Runs Elasticsearch. Elasticsearch is an enterprise-level search engine. Elasticsearch uses an index-based search approach, which allows for fast searching. The architecture allows for scalability, flexibility, and multi-tenancy support|
|Redis||Runs Redis. Redis is an in-memory data structure store used as a database, cache, and message broker by OpenIAM|
|MariaDB / PostgresSQL||Runs either MariaDB or PostgreSQL as the product repository. MariaDB is configured as the default repository. Aside from these two databases, you can also use a remote database|
|RabbitMQ||Runs RabbitMQ. RabbitMQ is the message brokering software service for sending and receiving messages between systems|
|Vault||Runs Hashicorp's Vault. Vault secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets|
|Etcd||Runs Etcd, which is used to store Vault data. Etcd is a distributed key-value store.|
MariaDB is the default Database. You can change this to PostgreSQL if you prefer. You will not enable both database
|OpenIAM core services||Runs services shared across the product.|
|Identity manager||Runs the identity manager application. Identity manager automates the task of managing identities across various devices and applications used by the enterprise.|
|Workflow||Runs the workflow application. A workflow is a repeatable process during which documents, information, or requests are passed from one participant to another for action, according to a set of procedural rules. A participant can be a person, machine, or both.|
|Groovy manager||Runs Groovy Manager, an application for managing Groovy scripts in OpenIAM. Apache Groovy is a dynamic programming language for the Java platform. allows you to add, update, edit, and modify Groovy scripts to extend the identity governance and web access management functionality to meet specific, complex requirements.|
|Synchronization||Runs the synchronization application. Synchronization allows you to synchronize data from one or more authoritative sources to a set of managed systems. Synchronization configuration enables monitoring a source system for changes and then updating target systems at scheduled periodic intervals.|
|Reconciliation||Runs the reconciliation application. This is two side synchronization between OpenIAM and the target system|
|Authorization manager||Runs the authorization manager. This module handles RBAC authorization via relationships between Users, Organizations, Roles, Groups, and Resources.|
|E-mail Manager||Runs the email manager. Handles sending and receiving email.|
|Tomcat with three applications||Three web applications which are described below|
- IdP - The OpenIAm web application which provides centralized authentication and self-service password reset functionality. This application also allows OpenIAM to be configured as both an Identity Provider and a Service Provider
- Webconsole - The OpenIAM web application for administrators for managing identities across various devices and applications used by an enterprise, and for controlling access to these devices and applications.
- Self-service - The OpenIAM end-user web application that allows users to create new requests, reset and change passwords, manage their profiles, manage access requests, manage challenge response security questions, look up corporate users through a directory search, and reset their accounts if they are locked out. Authorized users can also use the request approval functionality.
Reverse Proxy Stack
|Apache Webserver with rProxy||Gateway between clients and a server for managing inbound traffic to a server.|
The table below specifies the minimum system requirements for deploying a non-production OpenIAM v4.2.x instance using Docker.
MINIMUM Hardware requirements
|Configuration||Non-Production||Production (may increase based on sizing)|
|Memory||24 GB||32 GB|
|CPU||6 CPUs||8 CPUs|
|Disk||80 GB||100 GB|
Please ensure that you are environment is aligned with the minimum system requirements described above. These parameters are not optional. OpenIAM will not start if system resources are below the minimum levels.
For production use: Customers with active subscriptions and partners, should contact OpenIAM Support (email@example.com) for assistance with sizing requirements.
|OS||Ubuntu (18.04 LTS, 20.04 LTS) or CentOS/RHEL (7.x, 8.x)|
|Docker client||19.03.12 or higher|
|Docker compose||1.28.2 or higher|
|Supported Browsers||Google Chrome (v89.0.4389.114 and later), Microsoft Edge, Mozilla Firefox (v87 and later)|
Preparing your system
The OpenIAM application requires a few configurations to be performed prior to installing the application. These steps are described below.
Install required packages
Prior to installing the OpenIAM, please execute the commands below to install the required packages. If you have already logged in as “root”, you do not need to prefix them with “sudo”. If you have used another account, then you need to use “sudo”
|Description||Command on CentOS 8+||Command on CentOS 7+||Command on Ubuntu|
|Update the OS||dnf update||yum update||apt-get update|
|Install Nano||dnf install nano||yum install nano||apt-get install nano|
|Install wget||dnf install wget||yum install wget||apt-get install wget|
|Install git||dnf install git||yum install git||apt-get install git|
Example for CentOS 8.x
dnf updatednf install nano wget git
Example for Ubuntu 20.04
apt-get updateapt-get upgradeapt-get install nano wget git
Update the hosts file
Make sure that your
/etc/hosts file contains a value for the hostname that you defined earlier. To edit the hosts file, use an editor like Nano.
Settings for Elasticsearch and Docker
OpenIAM uses Elasticsearch as a search engine. To enable fast access, Elasticsearch maps portions of an index into its memory address space. This is done through
nmap, a Unix system call that maps files or devices into memory. To use mmap effectively, Elasticsearch requires sufficient mmap counts. The default operating system limits on mmap counts are inadequate for the required performance and this may result in out of memory exceptions. The required mmap value can be configured by setting the
vm.max_map_count value in
/etc/sysctl.conf to be at least 262144. To ensure that the vm.max_map_count persists across restarts, set this value in the /etc/sysctl.conf file
Disabling IPv6 on Docker Host
By default, IPv6 is disabled in Docker. Disabling IPv6 on Docker host(s) prevents any potential network issues. To disable IPv6 on host(s) where Docker is running, ensure that the Docker host(s) have the following value set in /etc/sysctl.conf:
net.ipv6.conf.default.disable_ipv6 = 1
To summarize, the /etc/sysctl.conf file must have the following changes:
Save the above changes and then run
sudo sysctl -p to apply these settings without restarting the system.
Install the Docker engine
Docker Engine is a containerization technology for building and containerizing applications. Docker Engine acts as a client-server application with:
- A server with a long-running daemon process
- APIs which specify interfaces that programs can use to talk to and instruct the Docker daemon.
- A command line interface (CLI) client
To install the docker engine, follow the OS specific steps below. For, additional information related to the installation of the docker engine can be found at:
Setup the repository
Update the apt package index and install packages to allow apt to use a repository over HTTPS
apt-get install \apt-transport-https \ca-certificates \curl \gnupg-agent \software-properties-common
Use the following command to set up the stable repository.
add-apt-repository \"deb [arch=amd64] https://download.docker.com/linux/ubuntu \$(lsb_release -cs) \stable"
Note: if you see the following error while running this operation on Ubuntu 20.04LTS, follow the additional steps describe below before installing the docker engine.
Err:5 https://download.docker.com/linux/ubuntu focal InReleaseThe following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7EA0A9C3F273FCD8Reading package lists... DoneW: GPG error: https://download.docker.com/linux/ubuntu focal InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7EA0A9C3F273FCD8E: The repository 'https://download.docker.com/linux/ubuntu focal InRelease' is not signed.
Open apt sources list in a text editor, like nano:
Scroll to the bottom and find the following lines:
deb [arch=amd64] https://download.docker.com/linux/ubuntu focal stable# deb-src [arch=amd64] https://download.docker.com/linux/ubuntu focal stable
Comment out that first line with a # at the beginning. Next, copy the same line right below it, except switching out the ubuntu codename
eoan. After the changes, it should look like the example below:
# deb [arch=amd64] https://download.docker.com/linux/ubuntu focal stabledeb [arch=amd64] https://download.docker.com/linux/ubuntu eoan stable# deb-src [arch=amd64] https://download.docker.com/linux/ubuntu focal stable
Save this file and run the following two commands to install the docker engine.
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
Install the docker engine
sudo apt-get update && sudo apt install docker-ce docker-ce-cli containerd.iosudo systemctl enable docker.servicesudo systemctl enable containerd.service
Verify that Docker Engine is installed correctly by running the hello-world image.
docker run hello-world
CentOS / RHEL
Setup the repository
Install the yum-utils package (which provides the yum-config-manager utility) and set up the stable repository
yum install -y yum-utilsyum-config-manager \--add-repo \https://download.docker.com/linux/centos/docker-ce.repo
Install the Docker engine
Install the latest version of Docker Engine and containerd. The next step is to start the engine.
yum install docker-ce docker-ce-cli containerd.iosystemctl start dockersystemctl enable docker.servicesystemctl enable containerd.service
Install Docker compose
Compose is a tool for defining and running multi-container Docker applications such as OpenIAM. With Compose, you use a YAML file to configure your application’s services. Then, with a single command, you create and start all the services from your configuration. The procedure described below installs version 1.28.2 of Docker Compose on your system
- Run the command below to download the current stable release of Docker Compose
curl -L "https://github.com/docker/compose/releases/download/1.28.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
- Apply executable permissions to the binary
chmod +x /usr/local/bin/docker-compose
- To check the version of docker compose, run the command below
Installing the OpenIAM Application
The installation process allows for a significant amount of flexibility. The steps below describes the minimum number of parameters which need to be configured to install on a single VM. Additional details in the sections referenced by the table below. If you are new to OpenIAM, we recommend starting with the simpler path with a more limited set of options.
Clone the OpenIAM Docker repository
Next we need to clone the OpenIAM Docker Git Repository which contains import scripts which set environment variables, start and stop the container services. To clone the repository follow the steps below. They should be performed in a Linux terminal window.
mkdir -p /usr/local/openiamcd /usr/local/openiamgit clone https://bitbucket.org/openiam/openiam-docker-compose.gitcd openiam-docker-compose/git checkout RELEASE-18.104.22.168
The cloned repository will contain the following scripts.
|env.sh||File containing environment variables. The required environment variables can be updated and added in this file. The env.sh file is sourced during the installation process and the export statements in this file are executed.|
|setup.sh||Script for setting up and updating the OpenIAM configuration. During the initial OpenIAM deployment, this script initializes the network and pulls the latest images from the OpenIAM repository (openiamdocker) on Docker Hub. When updating the OpenIAM deployment, running this script pulls newer images from the OpenIAM repository on Docker Hub|
|startup.sh||Script for starting up the OpenIAM instance.When updating the OpenIAM deployment, running this script updates the configuration on your system with the latest release updates.|
|Warning: Please do not modify this script in any way.|
|shutdown.sh||Script for shutting down all OpenIAM stacks, except volumes.|
|teardown.sh||Script for tearing down all OpenIAM stacks, volumes, and networks.|
|genrate.cert.sh||Script to generate certificates or Vault authentication.|
Additional configuration options
|Yaml Files||YAML configuration files are provided for the services and infrastructure components used within OpenIAM. These files provide configuration information for the containers.|
|Configuration options||Configuration options which will be used during installation.|
OpenIAM uses Vault in order to store secrets, such as database passwords, redis passwords, etc. Communication with Vault occurs via a certificate.
- Edit the
/usr/local/openiam/openiam-docker-compose/env.shfile which was downloaded from the openiam-docker-compose project above.
- Set the
VAULT_JKS_PASSWORDin the env.sh file. This password can be anything that you want.
- Run the command, shown below, to generate a CA Certificate.
- In the Enterprise version, you have the option to use an existing CA Certificate from a trusted CA.
cd /usr/local/openiam/openiam-docker-composesudo ./generate.cert.sh
You should see output similar to the example shown below:
SQL Files existThis script will generate a key-pair that vault will use. Make sure to first set VAULT_JKS_PASSWORD in env.shPress enter to continueGenerating RSA private key, 2048 bit long modulus (2 primes).......+++++.....................................+++++e is 65537 (0x010001)Generating RSA private key, 2048 bit long modulus (2 primes)...+++++.........+++++e is 65537 (0x010001)Signature oksubject=C = CZ, ST = Test, L = Test, O = Test, OU = Test, CN = vaultGetting CA Private Keywriting RSA key
Upon successful completion of the above operation, you should also see several certificates related files as shown in the image below.
Define database ports
Starting with V4.2.0, OpenIAM uses Flyway to manage database schema generation and migrations from one version to the next. This ensures that your database is properly versioned and up-to-date. OpenIAM supports Flyway versioning for MariaDB, PostgreSQL, and MSSQL, and Oracle 12.2+
env.sh file defines properties which will be used by Flyway.
At a minimum, you will need to define to set the following parameters: To enable Flyway, set the following properties in env.sh
- DB_TYPE - This parameter define the type of database that you will be using as the OpenIAM product repository. My default this value is set to "MariaDB" which is installed by default .
- FLYWAY_OPENIAM_HOST - Host where the OpenIAM database will be residing. This is the primary product schema. If you are using MariaDB or PostgreSQL in a docker container, set it to
- FLYWAY_OPENIAM_PORT - Port where the OpenIAM database will be running. Default ports for the supported databases include:
- Microsoft SQL Server=1433
- FLYWAY_ACTIVITI_HOST - Host where the Activti database will be residing. Activiti, is the database used by the workflow engine. If you are using MariaDB or PostgreSQL in a docker container, set it to
- FLYWAY_ACTIVITI_PORT - Port where Activiti database, which is used by the workflow engine, will be running.
Initialize Docker Swarm
Docker uses swarms for cluster management and orchestration features of Docker Engine, the technology for containerizing applications. Docker engines participating in a cluster run in the swarm mode. The swarm mode is enabled by either initializing a swarm, as in the command above, or by joining an existing swarm. For more information, see docker swarm and Swarm mode key concepts documentation.
Make sure that you initialize the Docker swarm. Log into Docker and initialize the swarm by entering the following command in a terminal:
sudo docker swarm init
You will see output similar to this:
Swarm initialized: current node (7risfc2161nwzir4a65po3lro) is now a manager.To add a worker to this swarm, run the following command:docker swarm join --token SWMTKN-1-15mdug8xi71uap0dgaayqi2ohhl8qxaaeg7m8k6q015yiuqt0j-6ip90bh1rm2td8y9baoya4qlx 22.214.171.124:2377To add a manager to this swarm, run 'docker swarm join-token manager' and follow the instructions.
Open ports for Docker Swarm
By default, the shell scripts provided by OpenIAM deploy to the docker swarm. You must ensure that the necessary ports are opened otherwise the manager and worker node(s) will not be able to communicate with each other.
Important: Please see this information about ports above 30000 used by the swarm from the load balancing section of Docker documentation: The swarm manager uses ingress load balancing to expose the services you want to make available externally to the swarm. The swarm manager can automatically assign the service a PublishedPort or you can configure a PublishedPort for the service. You can specify any unused port. If you do not specify a port, the swarm manager assigns the service a port in the 30000-32767 range.
Pull the docker images
To setup (and/or update) your configuration, you can run the setup.sh script. This will initialize the network, and pull the latest images from dockerhub.
For users, familiar with OpenIAM, you can modify the script as required by your internal needs.
- Run the setup.sh script as shown below to pull the docker images form Docker Hub.
This process will take several minutes. Upon successful completion, you will see the following lines at the end.
6b5a3f1b27b2: Pull completeDigest: sha256:c6203c5d0aff447e22b45a47d89520d911fd66f1dea46fbb09686630143f6dadStatus: Downloaded newer image for openiamdocker/vault-ce:alpine-126.96.36.199-proddocker.io/openiamdocker/vault-ce:alpine-188.8.131.52-prod+ docker pull openiamdocker/vault-bootstrap-ce:alpine-184.108.40.206-prodalpine-220.127.116.11-prod: Pulling from openiamdocker/vault-bootstrap-cee7c96db7181b: Pull complete223f524ede65: Pull complete8a9b395ef2a1: Pull complete548fb5617b91: Pull complete8481eb09db37: Pull complete5d5a8a804852: Pull complete0a7be734b4c8: Pull completedfe91b384f33: Pull completed62695d9e373: Pull completedd03756330a9: Pull complete0b987ede0960: Pull completeDigest: sha256:7a70df865c7d7fccdba17e8be372e34677b719cf23b730b14ecf9469022e6fe2Status: Downloaded newer image for openiamdocker/vault-bootstrap-ce:alpine-18.104.22.168-proddocker.io/openiamdocker/vault-bootstrap-ce:alpine-22.214.171.124-prod...
Start the OpenIAM Application
Now you are ready to start the OpenIAM containers. Run the startup.sh script to initiate the startup process
You should see output similar to the example below
SQL Files existUsing MariaDB as the database type...Nothing found in stack: flywayetcd_storagevault_server_storagevault_client_storageconnector_data_storagefilebeat-storageupload_storageUnable to find image 'busybox:latest' locallylatest: Pulling from library/busyboxaa2a8d90b84c: Pull completeDigest: sha256:be4684e4004560b2cd1f12148b7120b0ea69c385bcc9b12a637537a2c60f97fbStatus: Downloaded newer image for busybox:latestCreating service etcd_etcdCreating service vault_vaultCreating service vault-bootstrap_vault_bootstrapCreating service openiam-elasticsearch-storage_serviceCreating service openiam-jks-storage_serviceCreating service openiam-activiti-storage_serviceCreating service openiam-rabbitmq-storage_serviceCreating service openiam-iamscripts-storage_serviceconnector_data_storageCreating service redis_serviceCreating service elasticsearch_serviceCreating service rabbitmq_serviceopeniam-mysql-storage_storageCreating service database_databaseCreating service flyway_flywayCreating service openiam_synchronizationCreating service openiam_groovy_managerCreating service openiam_reconciliationCreating service openiam_device-managerCreating service openiam_auth-managerCreating service openiam_workflowCreating service openiam_email-managerCreating service openiam_esbCreating service openiam_idmCreating service ui_uiCreating service ldap-connector_serviceCreating service rproxy_rproxy
Watch the container startup process
The containers may take 8 to 15 minutes (depending your environment) to startup completely. You can watch the start up process using the command below. Note, that the UI container will take sometime and be among the last to start up as it has dependencies on other components being up first.
watch -n 5 'docker ps'
You should see output similar to the example below when all containers have started successfully
Every 5.0s: docker ps localhost: Sat May 15 16:56:39 2021CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES5c098a123c84 openiamdocker/ui-ce:debian-126.96.36.199-prod "docker-entrypoint.s…" 6 minutes ago Up 6 minutes (healthy) 8080/tcp ui_ui.yjyaxoepjp4qpxxaclcr1e4hj.1jtwi5sbamhs6ldvunrxuuyyj5c724d05c06f openiamdocker/email-manager-ce:debian-188.8.131.52-prod "docker-entrypoint.sh" 14 minutes ago Up 14 minutes (healthy) openiam_email-manager.yjyaxoepjp4qpxxaclcr1e4hj.tdpgtu9jby9vqnl2nva35938z9ae62d7f6814 openiamdocker/device-manager-ce:debian-184.108.40.206-prod "docker-entrypoint.sh" 14 minutes ago Up 14 minutes (healthy) openiam_device-manager.yjyaxoepjp4qpxxaclcr1e4hj.u2xrgtca08dqdwm2eaz8qcape4b937980ac60 openiamdocker/esb-ce:debian-220.127.116.11-prod "docker-entrypoint.sh" 14 minutes ago Up 14 minutes (healthy) 9080/tcp openiam_esb.yjyaxoepjp4qpxxaclcr1e4hj.n3uwoyndx733n01vcbw8ne7qz1849e75a0c04 openiamdocker/workflow-ce:debian-18.104.22.168-prod "docker-entrypoint.sh" 14 minutes ago Up 14 minutes (healthy) openiam_workflow.yjyaxoepjp4qpxxaclcr1e4hj.lorx3lm0cj6n5dgclrjnvqo9p3ebba79a550a openiamdocker/groovy-manager-ce:debian-22.214.171.124-prod "docker-entrypoint.sh" 15 minutes ago Up 14 minutes (healthy) openiam_groovy_manager.yjyaxoepjp4qpxxaclcr1e4hj.tjmrtwlfs4e58uqlh9fdqfutf51ef30e22ec4 openiamdocker/rproxy-ce:debian-126.96.36.199-prod "httpd-foreground" 21 minutes ago Up 21 minutes (healthy) 0.0.0.0:80->80/tcp, 443/tcp rproxy_rproxy.yjyaxoepjp4qpxxaclcr1e4hj.5asjr7ov89y230q07nfdtdcsoe453003ae06e openiamdocker/ldap-connector-rabbitmq-ce:debian-188.8.131.52-prod "docker-entrypoint.sh" 21 minutes ago Up 21 minutes (healthy) ldap-connector_service.yjyaxoepjp4qpxxaclcr1e4hj.ls6wlm5rkvmq5h2b45twitixu0a271e763d68 openiamdocker/idm-ce:debian-184.108.40.206-prod "docker-entrypoint.sh" 21 minutes ago Up 21 minutes (healthy) openiam_idm.yjyaxoepjp4qpxxaclcr1e4hj.on5fgrf1i9a7azjwb6xzmjr6saa9b173e7b90 openiamdocker/auth-manager-ce:debian-220.127.116.11-prod "docker-entrypoint.sh" 21 minutes ago Up 21 minutes (healthy) openiam_auth-manager.yjyaxoepjp4qpxxaclcr1e4hj.vkfm6qel3d6gqo4jtjfndjpuhd997e6a4ad87 openiamdocker/reconciliation-ce:debian-18.104.22.168-prod "docker-entrypoint.sh" 21 minutes ago Up 21 minutes (healthy) openiam_reconciliation.yjyaxoepjp4qpxxaclcr1e4hj.o36h8nnskc74jstgg4fizwtp019649556b81b openiamdocker/synchronization-ce:debian-22.214.171.124-prod "docker-entrypoint.sh" 21 minutes ago Up 21 minutes (healthy) openiam_synchronization.yjyaxoepjp4qpxxaclcr1e4hj.hb5fyaui8rk9sa9s9134f5v4o8cb1c48685db openiamdocker/mariadb-ce:debian-126.96.36.199-prod "init.sh /run.sh" 22 minutes ago Up 22 minutes (healthy) 3306/tcp database_database.1.s1xa5f7i7fxh3jf3mjn70mqkc2c4512376aea openiamdocker/rabbitmq-ce:alpine-188.8.131.52-prod "docker-entrypoint.s…" 23 minutes ago Up 22 minutes (healthy) 4369/tcp, 5671-5672/tcp, 15691-15692/tcp, 25672/tcp rabbitmq_service.1.pwyyligv23znvwxuxahatu7xc19276fcf0b6a openiamdocker/elasticsearch-ce:debian-184.108.40.206-prod "init.sh" 23 minutes ago Up 22 minutes (healthy) 9200/tcp, 9300/tcp elasticsearch_service.yjyaxoepjp4qpxxaclcr1e4hj.3x1l1qn7hu9surqpab7d41ajs73257460b5df openiamdocker/redis-ce:debian-220.127.116.11-prod "redis.sh /run.sh" 23 minutes ago Up 22 minutes (healthy) 6379/tcp redis_service.1.lw4vnvbavbtncqppu7qjz7y8v7e90b90240b3 openiamdocker/vault-ce:alpine-18.104.22.168-prod "docker-entrypoint.s…" 23 minutes ago Up 23 minutes (healthy) 8200/tcp vault_vault.1.9i1u6mygrlazjajimm4ytm9dxf26e95760cd6 bitnami/etcd:3.3.13 "/entrypoint.sh etcd" 23 minutes ago Up 23 minutes 2379-2380/tcp etcd_etcd.1.y3b8bub61beji7pw8jxn6o412
Validate the startup
curl -k -I -L http://127.0.0.1/idp/login
You should see output similar to the example below
HTTP/1.1 200Date: Sat, 15 May 2021 16:57:47 GMTServer: ApacheContent-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' apis.google.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' *; form-action 'self' 'unsafe-inline' 'unsafe-eval' *; img-src 'self' *; font-src 'self' *;Access-Control-Allow-Origin: *X-Frame-Options: sameoriginX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockCache-Control: no-cachePragma: no-cacheExpires: Wed, 31 Dec 1969 23:59:59 GMTX-UA-Compatible: IE=EmulateIE10x-openiam-force-auth: falsex-openiam-login-uri: /idp/loginContent-Type: text/html;charset=utf-8Content-Language: enSet-Cookie: SESSION=NzQ2MTQ5Y2EtNDgwMS00OTFjLWIwODktMjYzYzJhNWI4MzNm; Path=/idp/; HttpOnly; SameSite=LaxVary: Accept-EncodingTransfer-Encoding: chunked
The application is now operational and you can login.
First time login
The final validation of our deployment is to be able to login to the OpenIAM web applications. To do this, must first find the IP address of our VM.
Next open your browser (preferably Chrome or Firefox), and hit:
http://[ip address of your installation ]/webconsole
Use the following credentials for the first-time login:
Username: sysadminPassword: passwd00
The next screen will ask you to change the default password. On the side is the password policy. Please enter a new password which complies with this policy. You will be able to change both the password and the policy later
The following screen will ask for answers to a set of challenge questions. The answers to these questions can be used as part of the forgot password functionality. This to can be changed later as you start to configure the solution for your needs.
The last step in the startup process is to define a "Content Provider". A content provider is an important concept in OpenIAM and is explained in more detail in the administration guide. For this initial setp, we only need to provide the following information to define the default content provider.
|Content Provider Name||You can think of a content provider an “alias” which represents a domain. This is described in more detail in the OpenIAM documentation. For this setup, please enter a value such as : Default CP|
|Domain Pattern||This value is defaulted in. It should be the IP address or host DNS name of the instance where OpenIAM has been installed|
|Is SSL?||Flag which indicates if communication will be over SSL. For this step, select |
After setting the content provider, you will be taken to the landing page of the admin interface in OpenIAM called the
Webconsole. You will see the search screen below.
After the content provider is setup, OpenIAM will need a few minutes for the system cache to refresh. During this time, you may see some screens which are blank. Allow for the refresh to complete.
After this time, you instance is ready for additional configuration.
Frequently used commands with Docker
The following commands are frequently used with Docker.
|./startup.sh||Starts the OpenIAM Docker containers|
|./shutdown.sh||Stops the OpenIAM Docker containers|
|Ensure that all containers have stopped before restarting. You can validate that the containers have stopped using the docker ps command|
|docker ps||Shows all the containers which are running|
|watch -n 5 'docker ps'||Allows you to observe the docker containers. The view is refreshed every -n seconds.|
|docker logs [container id]||Shows the logs related to the Container ID. You can get the Container ID from the docker ps command.|
|docker exec -it [container id] bash||Allows you to connect to the container|
|docker restart -t [time][container id]||Allows you to restart a container. Time is the number seconds to wait after stopping a container, but its started again.|