Installation without Internet access.

This installation type is suitable for the servers without Internet access (Server from which you can't reach OpenIAM website).

This type of installation is suitable for both el8 and el7 CentOS version. Also, during the installation you will be prompted to install MariaDB RDBMS. This is suitable for Demo and POC installations. If you have already had the database server you should answer 'N' for the prompt.

1. Download RPM of the OpenIAM Installer from the link below and locate it to the server:

   https://download.openiam.com/release/enterprise/4.2.1.3/rpm/openiam-4.2.X.noarch.x86_64.rpm

2. Download binaries files using following URLs:

   https://download.openiam.com/release/enterprise/4.2.1.3/binaries/backend.tar.gz
   https://download.openiam.com/release/enterprise/4.2.1.3/binaries/frontend.tar.gz

3. Download dependencies based on your CentOS version el7 or el8. If you don't know what is your version perform the following command:

    uname -a | grep -Po '(el\d)'

   For CentOS 7.X (if output of the command above is el7) please use the following link to download dependencies:

   https://download.openiam.com/release/enterprise/4.2.1.3/dependencies/el7/openiamrepo.tar.gz

   For CentOS 8.X (if output of the command above is el8) please use the following link to download dependencies:

   https://download.openiam.com/release/enterprise/4.2.1.3/dependencies/el8/openiamrepo.tar.gz

4. Copy downloaded at step 3 files backend.tar.gz, frontend.tar.gz, openiamrepo.tar.gz to the folder /usr/local/openiam/

5. Install from the RPM using command:

   sudo rpm -i openiam-4.2.X.noarch.x86_64.rpm

6. Perform initialization script. During the initialization installer will download additional required files from OpenIAM server. Please follow the instructions on the screen.

   sudo openiam-cli init

   System will download additional files, extract them locally, update yum repository and install some base packages.

7. You will be asked about installating the MariaDB as a default database. Please answer 'Y' if you would like to use local MariaDB RDBMS as a database server (good choice for quick and simple installation, like demo or POC or small size production platform (up to 500 active users)). Otherwise, please, answer 'N'.

7.1. If you answered 'Y' for MariaDB installation, installer will prepare all files and after will ask you about some details:

• Enter current password for root (enter for none): -> Press: 'Enter' button
• Set root password? [Y/n] -> Press 'y' button and after 'Enter'
• New password: -> Type password for the root user. You will need it later during the installation.
• Re-enter new password: -> Type the password for the root user as on the previous
• Remove anonymous users? [Y/n] -> Press 'y' button and after press 'Enter'.
• Disallow root login remotely? [Y/n] -> Press 'y' button and after press 'Enter'.
• Remove test database and access to it? [Y/n] -> Press 'y' button and after press 'Enter'.
• Reload privilege tables now? [Y/n] -> Press 'y' button and after press 'Enter'.

Otherwise, please continue from step 5.

8. The installation process will continue. The Cassandra backend as a Graph storage will be installed. Please, keep calm, it can take up to 4-5 minutes.

9. The installer will ask a number to questions during the initializaiton process. For most questions, a default value has been provided to simplify the effort for users new to OpenIAM. The section which requires input from the installer is market with the following message in the console: =============== CRITICAL SECTION ===============

Create the database schema accounts

OpenIAM has two schemas which are created by default: openiam and activiti. The openiam schema is the primary schema used by the platform and it stores a variety of information ranging from policies to user profile information and more. activiti is used to store information about workflows and their execution. The first set of questions raised by the installler are related to the creation of database user for every schema. Each question and its intent are listed below.

Message broker password

OpenIAM uses RabbitMQ as the message broker and is the primary transport service used by OpenIAM application. Services are loosely coupled and they communicate with each other through the message broker. Cross service communicaiton is encrypted.

The next question raised by the installer is to define a password for RabbitMQ. As seen in the above questions, a default password value is provided for simplicity. For production use, please use a strong password.

Set OpenIAM password for RabbitMQ message broker, default: passwd00

Memory cache password

Redis is an in-memory distributed cache which is used by OpenIAM to improve system performance. A variety of objects are temporarily stored in Redis including:

• End user web session
• Database object cache
• High level application cache.

As with other components, access to the cache is secured and the next question ask for a password which should be used for Redis.

Set OpenIAM password for Redis., default: passwd00

SMTP Credentials

E-mail notifications can be enabled for a broad range of operations in OpenIAM. Configuring a valid SMTP service is a pre-requisite to being able to send e-mail notifications. The next two questions ask the user to provide the SMTP credentials for the account which will be used to send e-mails from the application. These questions are optional at this time and you have the option to configure these later if needed.

Set SMTP username. You can change it later., default: none
Set SMTP password. You can change it later., default: none

At this point the installer has enough information to complete the installation of: Elasticseach, Redis, and RabbitMQ.

Initialize Database Schema

The OpenIAM RPM installer will continue with initialization and apply the SQL scripts which are required for successful startup. The OpenIAM services will automatically run the application stack after successful initialization and will show you the current stack status. Usually startup takes near 6-10 minutes. You can view the status of the system as its coming up using the command line tools described below in OpenIAM components and Status.

Copying downloaded file from local machine to remote server

Use scp [OPTION] [user@]SRC_HOST:]file1 [user@]DEST_HOST:]file2

Example:

• C:\Users\Asus>scp openiam-4.2.1.2.noarch.x86_64.rpm root@10...*:/usr/local/openiam/
• The authenticity of host '10... (10...)' can't be established.
• ECDSA key fingerprint is SHA256:5pP7vxJnDzbQ+Xg1VANjSBYL7HboHyM4RqFKW4qHkPU.
• Are you sure you want to continue connecting (yes/no/[fingerprint])?`
• Warning: Permanently added '10...*' (ECDSA) to the list of known hosts.
• root@10...*'s password:
• openiam-4.2.1.2.noarch.x86_64.rpm 23% 133MB 1.4MB/s 05:12 ETA`

First time login

Pending

OpenIAM components and status

Using the OpenIAM Command line utility

OpenIAM provides a command line utility to help you view the status of all components as well as perform common operations such as view logs, start, stop,etc . The command is openiam-cli.

Just running the command by itself, as shown below, will display the list of all options.

openiam-cli

Output

Usage: /usr/bin/openiam-cli {start|stop|status|init|log|log <service_name>|list-connectors|list-source-adapters}

To check the status of the components or the confirm that the system is up, please use the following command:

openiam-cli status

To check current logs of any service you can use the following command. You can get the services using the following command: openiam-cli status command .

openiam-cli log <service_name>

For example, to check the logs of the openiam-esb module use the following command.

openiam-cli log openiam-esb

OpenIAM core services