Installation without Internet Access

Installation without Internet access.

This installation type is suitable for the servers without Internet access (Server from which you can't reach OpenIAM website).

This type of installation is suitable for both el8 and el7 CentOS version. Also, during the installation you will be prompted to install MariaDB RDBMS. This is suitable for Demo and POC installations. If you have already had the database server you should answer 'N' for the prompt.

  1. Download RPM of the OpenIAM Installer from the link below and locate it to the server:

    https://download.openiam.com/release/enterprise/4.2.1.4/rpm/openiam-4.2.X.noarch.x86_64.rpm
  2. Download binaries files using following URLs:

    https://download.openiam.com/release/enterprise/4.2.1.4/binaries/backend.tar.gz
    https://download.openiam.com/release/enterprise/4.2.1.4/binaries/frontend.tar.gz
  3. Download dependencies based on your CentOS version el7 or el8. If you don't know what is your version perform the following command:

    uname -a | grep -Po '(el\d)'

    For CentOS 7.X (if output of the command above is el7) please use the following link to download dependencies:

    https://download.openiam.com/release/enterprise/4.2.1.4/dependencies/el7/openiamrepo.tar.gz

    For CentOS 8.X (if output of the command above is el8) please use the following link to download dependencies:

    https://download.openiam.com/release/enterprise/4.2.1.4/dependencies/el8/openiamrepo.tar.gz
  4. Create folder /usr/local/openiam on the server.

  5. Copy downloaded at step 3 files backend.tar.gz, frontend.tar.gz, openiamrepo.tar.gz to the folder /usr/local/openiam/.

  6. Download https://download.openiam.com/release/enterprise/infra/httpd-libs.tar.gz and copy it to the /usr/src folder.

  7. Install from the RPM using command:

    sudo rpm -i openiam-4.2.X.noarch.x86_64.rpm
  8. Perform initialization script. During the initialization installer will download additional required files from OpenIAM server. Please follow the instructions on the screen.

    sudo openiam-cli init

    System will download additional files, extract them locally, update yum repository and install some base packages.

  1. You will be asked about installating the MariaDB as a default database. Please answer 'Y' if you would like to use local MariaDB RDBMS as a database server (good choice for quick and simple installation, like demo or POC or small size production platform (up to 500 active users)). Otherwise, please, answer 'N'.

9.1. If you answered 'Y' for MariaDB installation, installer will prepare all files and after will ask you about some details:

  • Enter current password for root (enter for none): -> Press: 'Enter' button
  • Set root password? [Y/n] -> Press 'y' button and after 'Enter'
  • New password: -> Type password for the root user. You will need it later during the installation.
  • Re-enter new password: -> Type the password for the root user as on the previous
  • Remove anonymous users? [Y/n] -> Press 'y' button and after press 'Enter'.
  • Disallow root login remotely? [Y/n] -> Press 'y' button and after press 'Enter'.
  • Remove test database and access to it? [Y/n] -> Press 'y' button and after press 'Enter'.
  • Reload privilege tables now? [Y/n] -> Press 'y' button and after press 'Enter'.

Otherwise, please continue from step 5.

  1. The installation process will continue. The Cassandra backend as a Graph storage will be installed. Please, keep calm, it can take up to 4-5 minutes.

  2. The installer will ask a number to questions during the initializaiton process. For most questions, a default value has been provided to simplify the effort for users new to OpenIAM. The section which requires input from the installer is market with the following message in the console: =============== CRITICAL SECTION ===============

Create the database schema accounts

OpenIAM has two schemas which are created by default: openiam and activiti. The openiam schema is the primary schema used by the platform and it stores a variety of information ranging from policies to user profile information and more. activiti is used to store information about workflows and their execution. The first set of questions raised by the installler are related to the creation of database user for every schema. Each question and its intent are listed below.

Question raised by the installerExplanation
Set OpenIAM username for 'openiam' schema, default: idmuserThis is DB user name that will be used to manage the openiam OpenIAM schema. This is the primary schema in the solution data related to OpenIAM are stored. User nam—É will be used by the OpenIAM application to communicate with database. The default value is idmuser.
Set OpenIAM password for 'openiam' schema, default: idmuserThis is the password that will be used for username which was provided in the previous step. The default value is: idmuser
Set OpenIAM username for 'activiti' schema. For MySQL it will be the same as for 'openiam', default: idmuserThis is DB user name that will be used to manage the activiti schema. User will be used by OpenIAM application to communicate with the database. Default value is idmuser.
Set OpenIAM password for 'activiti' schema. For MySQL it will be the same as for 'openiam', default: idmuserThis is the password that for the user associatd with the activiti schema. The default value is idmuser

Message broker password

OpenIAM uses RabbitMQ as the message broker and is the primary transport service used by OpenIAM application. Services are loosely coupled and they communicate with each other through the message broker. Cross service communicaiton is encrypted.

The next question raised by the installer is to define a password for RabbitMQ. As seen in the above questions, a default password value is provided for simplicity. For production use, please use a strong password.

Set OpenIAM password for RabbitMQ message broker, default: passwd00

Memory cache password

Redis is an in-memory distributed cache which is used by OpenIAM to improve system performance. A variety of objects are temporarily stored in Redis including:

  • End user web session
  • Database object cache
  • High level application cache.

As with other components, access to the cache is secured and the next question ask for a password which should be used for Redis.

Set OpenIAM password for Redis., default: passwd00

SMTP Credentials

E-mail notifications can be enabled for a broad range of operations in OpenIAM. Configuring a valid SMTP service is a pre-requisite to being able to send e-mail notifications. The next two questions ask the user to provide the SMTP credentials for the account which will be used to send e-mails from the application. These questions are optional at this time and you have the option to configure these later if needed.

Set SMTP username. You can change it later., default: none
Set SMTP password. You can change it later., default: none

At this point the installer has enough information to complete the installation of: Elasticseach, Redis, and RabbitMQ.

Initialize Database Schema

Question raised by the installerExplanation
Use default value if this is new installation. If you are doing update, specify your current (before update) version here, like 4.1.11.0, default: 0.0.0.0If this install is an upgrade from an exisiting deployment, then the current version is important as it will determine which scripts need to be applied to upgrade the schema to the current version. If this is a new deployment, you can leave this blank
This is the name of the OpenIAM core database. If using MariaDB, this is most likely to be 'openiam', default: openiamThis question provides the option to choose the primary database schema. You should leave this blank and let it default to openiam. This value should only be changed if the scripts have been altered by the customer.
This is the name of the OpenIAM Activiti database. If using MariaDB, this is most likely 'activiti', default: activitiThis question provides the option to choose the database schema used by the workflow engine. You should leave this blank and let it default to activiti. This value should only be changed if the scripts have been altered by the customer.
Possible values: MySQL, Postgres, MSSQL, Oracle. Type of the database that you are going to use with OpenIAM. The RDBMS have to be already installed, default:mysqlSelect the type of database that you will be using as the OpenIAM product repository. You can leave this blank if you will be using either MariaDB or MySQL. If you are using either PostgreSQL, Oracle or Microsoft SQL server, enter one the following values based on your database type: postgres, oracle, mssql
Do you want to initialize OpenIAM Schema and Users? Select this if you are not created schema and users in RDBMS yet. Super user (root) password will required [y/n]If 'Y' then installer will create schemas in database and corresponded RDBMS users as well. For Oracle/MSSQL it will generate an SQL script that must be performed manualy
Enter username for Super user (for mysql this is root), default: rootThe installer needs a super user account or equivalent which has the privileges to create new schema, users, tables, etc.
Enter password for super user (sa or root, depend on the db type), default:Enter the password for account provided in the last step
This is the hostname of where the openiam core database is., default: localhostEnter the host or DNS name of the server where the primary OpenIAM database will be deployed.
This is the port of where the openiam core database is. If using mariadb, this is most likely '3306', default: 3306Enter the port number used by the database server hosting the primary OpenIAM database
This is the hostname of where the OpenIAM activiti database is., default: localhostEnter the host or DNS name of the server where the workflow database will be deployed.
This is the port of where the openiam activiti database is. If using MariaDB, this is most likely '3306', default: 3306Enter the port number used by the database server hosting the workflow database

The OpenIAM RPM installer will continue with initialization and apply the SQL scripts which are required for successful startup. The OpenIAM services will automatically run the application stack after successful initialization and will show you the current stack status. Usually startup takes near 6-10 minutes. You can view the status of the system as its coming up using the command line tools described below in OpenIAM components and Status.

Copying downloaded file from local machine to remote server

Use scp [OPTION] [user@]SRC_HOST:]file1 [user@]DEST_HOST:]file2

Example:

  • C:\Users\Asus>scp openiam-4.2.1.2.noarch.x86_64.rpm root@10...*:/usr/local/openiam/
  • The authenticity of host '10... (10...)' can't be established.
  • ECDSA key fingerprint is SHA256:5pP7vxJnDzbQ+Xg1VANjSBYL7HboHyM4RqFKW4qHkPU.
  • Are you sure you want to continue connecting (yes/no/[fingerprint])?`
  • Warning: Permanently added '10...*' (ECDSA) to the list of known hosts.
  • root@10...*'s password:
  • openiam-4.2.1.2.noarch.x86_64.rpm 23% 133MB 1.4MB/s 05:12 ETA`

First time login

Pending

OpenIAM components and status

Using the OpenIAM Command line utility

OpenIAM provides a command line utility to help you view the status of all components as well as perform common operations such as view logs, start, stop,etc . The command is openiam-cli.

Just running the command by itself, as shown below, will display the list of all options.

openiam-cli

Output

Usage: /usr/bin/openiam-cli {start|stop|status|init|log|log <service_name>|list-connectors|list-source-adapters}

To check the status of the components or the confirm that the system is up, please use the following command:

openiam-cli status

To check current logs of any service you can use the following command. You can get the services using the following command: openiam-cli status command .

openiam-cli log <service_name>

For example, to check the logs of the openiam-esb module use the following command.

openiam-cli log openiam-esb

OpenIAM core services

NameDescriptionDefault Memory (RAM)
openiam-esbThe service that provides Web Service API and to the bigger part of functionality2048m
workflowThe service that provides Business Workflow functionality768m
groovy-managerThe service that provides Groovy extension functionality256m
idmThe service that provides provisioning to target systems functionality512m
reconciliationThe service that provides reconciliation against target systems functionality512m
email-managerThe service that provides Sending and Receiving emails functionality256m
auth-managerThe service that provides End user Authorization functionality1024m
device-managerThe service that provides Device management functionality (IOS and Android)256m
business-rule-managerThe service that provides Business Rules functionality512m
openiam-uiThis is web server (tomcat) that provides Graphical interface2048m