Log in to the Active Directory (AD) server.

From the Start menu, choose Programs > Administration Tools and choose Active Directory Users and Computers.

Right-click Users and choose New > User.

In the User logon name field, enter the OpenAM server hostname.

Click Next.

Enter and confirm a password.

Uncheck the User must change password at next login check box.

Click Next.

Click Finish to finish creating the new user account.

Create a keytab file on the AD server using the following command from the command prompt.

ktpass -princ HTTP/<hostname>.<domainname>@<DCDOMAIN> -pass <password> -mapuser <userName> -out <hostname>.HTTP.keytab -ptype KRB5_NT_PRINCIPAL -target <DCDOMAIN>

ktpass -princ HTTP/server1.cisco.com@CISCO.COM -pass cisco!123 -mapuser server1 -out server1.HTTP.keytab -ptype KRB5_NT_PRINCIPAL -target CISCO.COM

After successful creation of the keytab file, copy the keytab file to a location on the OpenAM server; this path will later be specified in OpenAM configuration. Create a directory under C:\> and copy the above keytab file. For example, C:/keytab/server1.HTTP.keytab.

Go to either of the following locations, depending on your operating system:

Right-click the folder, choose New > DWORD (32-bit) Value, and rename it to be allowtgtsessionkey.

Right-click the newly created registry key and choose Modify.

In the Value data field, enter I.

Go to http://www.oracle.com/technetwork/java/archive-139210.html.

Download the recommended version of the JDK installation file by choosing the executable file that corresponds to your server architecture (Windows x86 or Windows x64).

Double-click the downloaded file to begin the installation of the JDK and accept the default values provided in the Installation wizard.

A Java keystore and the associated security certificates are required to facilitate secure connections to the OpenAM server, which runs on Apache Tomcat. Perform one of the following actions:

Create the Java keystore by opening a Windows command prompt on the Windows Server, and executing the following command: C:\>"C:\Program Files\Java\jdkl.7.0_03\bin\keytool.exe" -genkey -alias tomcat -keyalg RSA -validity 1825 -keystore C:\keystore

When you are prompted for a keystore password, enter a valid keystore password. For example, "cisco!123". Make a note of the keystore password as it is required to access the keystore.

When you are prompted to enter the first name and last name, enter the FQDN (hostname.domainname) of the OpenAM server.

When you are prompted for a Tomcat password, press RETURN to use the same keystore password value for the Tomcat private key. The Java keystore is created at the location specified in the keytool command. For example, C:\keystore.

You can view the Tomcat certificate in the keystore using the following command:

If you chose to use a self-signed security certificate for Tomcat, proceed to the end of this procedure and consider this task complete.

Create a Java keystore to store Certificate Authority (CA)-signed security certificates for OpenAM/Tomcat. Open a command prompt on the Windows Server and execute the following command:

When you are prompted for a keystore password, enter a valid keystore password. For example, “cisco!123”. Make a note of the keystore password as it is required to access the keystore.

When you are prompted to enter the first name and last name, enter the FQDN (hostname.domainname) of the OpenAM server.

When you are prompted for a Tomcat password, press RETURN to use the same keystore password value for the Tomcat private key. The Java keystore is created at the location specified in the keytool command. For example, C:\keystore.

You can view the Tomcat certificate in the keystore using the following command:

Generate a certificate signing request (CSR) for this OpenAM/Tomcat instance. Open a command prompt on the Windows Server and execute the following command .

Submit the CSR to your CA, request the CA to sign the CSR and create a certificate. Obtain and copy the following certificates to the Windows Server that is going to be the OpenAM server:

Import the CA signing or root certificate into the Java keystore that was created in Step 11. Open a command prompt on the Windows Server and execute the following command, answering “yes” to the prompt, “Trust this certificate?”:

You can view the CA signing certificate in the keystore using the following command:

Import any other intermediate signing certificates (if applicable) into the Java keystore that was created in Step 11. Open a command prompt on the Windows Server and execute the following command, answering “yes” to the prompt, “Trust this certificate?”:

You can view any of the intermediate signing certificates in the keystore using the following command:

Import the newly signed certificate OpenAM/Tomcat certificate into the Java keystore that was created in Step 11. Open a command prompt on the Windows Server and execute the following command:

You can view the new OpenAM/Tomcat certificate in the keystore using the following command:

Sign in to Cisco Unified IM and Presence Operating System Administration for the IM and Presence Service node for which SSO is to be enabled.

Choose Security > Certificate Management.

Click Find.

Locate the entry with Certificate Name of tomcat.

Examine the Description column of the tomcat certificate.

If the description states that the tomcat certificate is Self-signed certificate generated by system, this indicates that the IM and Presence Service node is using a self-signed certificate. If this description is not present, a CA-signed certificate can be assumed.

Click the tomcat.pem link.

Click Download to download the tomcat.pem file.

Copy the tomcat.pem file to the OpenAM server.

Import the tomcat.pem file as a trusted certificate into the keystore that was created on the OpenAM server when you installed Java. Open a command prompt on the Windows server (OpenAM) and execute the following command, updating the command with the values for your keytool command path and keystore location as applicable for your environment, and answer Yes to the prompt “Trust this certificate?”: C:\>"C:\Program Files\Java\jdkl.7.0_03\bin\keystool.exe" -import -alias cup01 -trustcacerts -file <full_filepath_of_the_tomcat.pem> -keystore C:\keystore

You can view the tomcat.pem in the keystore using the following command, updating the command with the values for your keytool command path and keystore location as applicable for your environment:

Skip to Step 16.

Identify the CA root certificates and any intermediate certificates that were used to sign your IM and Presence Service Tomcat certificate. Download the required certificates (CA root certificates and any intermediate certificates) from your CA to your OpenAM server.

Import these certificates into the keystore on the OpenAM server as trusted certificates. Open a command prompt on the Windows server (OpenAM) and execute the following command for each downloaded certificate, updating the command with the values for your keytool command path and keystore location as applicable for your environment, and answer “yes” to the prompt “Trust this certificate?”.

You can view the certificate in the keystore using the following command, updating the command with the values for your keytool command path and keystore location as applicable for your environment:

Repeat this procedure for each IM and Presence node for which SSO is to be enabled.

Download the recommended version of Apache Tomcat to your Windows server that forms the OpenAM base system. For a list of recommended software and versions, see topics related to third-party software and system requirements for Single Sign-On .

Double-click the downloaded file to begin the installation of Apache Tomcat.

From the Apache Tomcat Setup wizard, click Next.

In the License Agreement dialog box, click I Agree.

In the Choose Components dialog box, choose Minimum as the type of install and click Next.

In the Configuration dialog box, accept the default settings and click Next.

In the Java Virtual Machine dialog box, ensure the installed JRE path is set to the value of jre-path.

Click Next.

In the Choose Install Location dialog box, accept the default settings and click Install. Note the Tomcat install location, because it is required later

Click Finish.

Configure Apache Tomcat to start automatically.

1. Choose Start > All Programs > Apache Tomcat 7.0 Tomcat7 > Configure Tomcat.

2. From the General tab, set the Startup type as Automatic.

3. Click Apply.

4. Click OK.

Configure the Apache Tomcat runtime parameters:

1. Choose Start > All Programs > Apache Tomcat 7.0 Tomcat7 > Configure Tomcat.

2. From the Java tab, add the following Java options:

   -Djavax.net.ssl.trustStore=<certstore-path>

   -Djavax.net.ssl.trustStorePassword=<certstore-password>

   -XX:MaxPermSize=256m

   Tip	See the parameter table at the beginning of this procedure for variable descriptions.

   Example:

   -Djavax.net.ssl.trustStore=C:\keystore

   -Djavax.net.ssl.trustStorePassword=cisco!123

   -XX:MaxPermSize=256m

3. Set the Initial memory pool to 512.

4. Set the Maximum memory pool to 1024.

5. Click Apply.

6. Click OK.

Using a Text Editor, open the server.xml file under <tomcat-dir>\conf folder. See Step 9 to determine the value for <tomcat-dir>.

Comment out the 8080 connector port. Enter the code as follows:

<!-- <Connector port=”8080” protocol=”HTTP/1.1”
connectionTimeout=”20000”
redirectPort=”8443” /> -->

Uncomment the 8443 connector port. Remove the <!- - code at the beginning and - -> at the end of the 8443 connector. You must add three more attributes to the connector configuration:

<Connector port=”8443” protocol=”HTTP/1.1” SSLEnabled=”true”
maxThreads=”150” scheme=”https” secure=”true”
clientAuth=”false” sslProtocol=”TLS”
keystoreFile=”<certstore-path>”
keystorePass=”<certstore-password>”
keystoreType”JKS”/>

Save the server.xml file.

Start the Tomcat service.

1. Start > All Programs > Apache Tomcat 7.0 Tomcat7 > Configure Tomcat

2. From the General tab, click Start. If the Tomcat service was already running, click Stop, then Start.

To test the configuration, launch a web browser on the Windows Server that contains the Tomcat instance and go to https://localhost:8443/tomcat.gif. The web browser may present warning dialogs about insecure connections because the web browser does not trust the security certificates that are presented by the Tomcat instance. Either examine the certificates and add them to your local certificate store so that the browser trusts them or proceed to the web application (less secure option) using the available browser controls. If the configuration is correct, the Tomcat logo appears in the web browser window.

Configure Windows firewall to allow incoming connections to Apache Tomcat.

1. Choose Start > Administrative Tools > Windows Firewall and Advanced Security.

2. Choose Windows Firewall and Advanced Security > Inbound Rules.

3. Right-click Inbound Rules.

4. Click New Rule.

5. From the What type of rule would you like to create list of options, choose Port.

6. Click Next.

7. From the Does this rule apply to TCP or UDP? list of options, choose TCP.

8. From the Does this rule apply to all local ports or specific local ports? list of options, choose Specific local ports.

9. Enter 8443 and click Next.

10. From the What action should be taken when a connection matches the specified conditions? list of options, choose Allow the connection.

11. Click Next.

12. From the When does the rule apply? list of options, choose Domain only.

13. Click Next.

14. Enter a name and description of your choosing and click Finish.

To test the configuration, log in to another host on the network, launch a web browser on the Windows server that contains the Tomcat instance and go to https://<openam-fqdn>:8443/tomcat.gif, where <openam-fqdn> is the Fully Qualified Domain Name of the Windows Server that contains the Tomcat instance. The web browser may present warning dialogs about insecure connections because the web browser does not trust the security certificates that are presented by the Tomcat instance. Either examine the certificates and add them to your local certificate store so that the browser trusts them or proceed to the web application anyway (this is less secure) using the available browser controls. If the configuration is correct, the Tomcat logo appears loaded into the web browser window.

Download the recommended OpenAM release from the ForgeRock website.

Extract the .zip file and locate the opensso.war file that is contained within it.

Copy the WAR file to the Windows server that is to be your OpenAM server. This Windows server should be running the previously configured Tomcat service.

Stop the Apache Tomcat service if it is running:

1. Choose Start > All Programs > Apache Tomcat 7.0 Tomcat7 > Configure Tomcat.

2. From the General tab, click Stop.

Deploy the WAR file on the Windows server that contains the Tomcat instance by copying the WAR file to the following location: <tomcat-dir>\webapps.

Start the Apache Tomcat service:

1. Choose Start > All Programs > Apache Tomcat 7.0 Tomcat7 > Configure Tomcat Tomcat7

2. From the General tab, click Start.

   Note	The WAR file will fully deploy within a couple minutes. Under the webapps folder, a new folder is created with the same name as the WAR file but with the .war extension removed.

Verify your configuration by launching a web browser and entering https://<openam-fqdn>:8443/<war-file-name>, where <openam-fqdn> is the FQDN of the Windows server that contains the OpenAM/Tomcat instance and <war-file-name> is the name of the OpenAM WAR file with the .war extension removed. If the configuration is correct, the OpenAM administration interface should load in the web browser window.

Open the web browser and navigate to the OpenAM server using the following URL: https://<fqdn of openam server>:8443/<WAR filename>.

Choose Create Default Configuration.

In the OpenSSO Configurator window, specify and confirm passwords for the OpenAM administrator (amAdmin) and the default policy agent user (UrlAccessAgent). The default policy agent user is not used later in this example configuration; amAdmin is used each time you log in to OpenAM to change the configuration.

Click Create Configuration.

Choose Proceed to Login.

Log in to your deployed OpenAM web application using the previously configured username and password for “amAdmin”.

From the Access Control tab, click /(Top Level Realm).

From the Authentication tab, click Core.

Click All Core Settings.

Set the User Profile to Ignored.

Click Save to update the profile.

Log out of the OpenAM GUI.

Log in to the OpenAM Administration interface.

From the Access Control tab, choose / (Top Level Realm).

From the Policies tab, click New Policy.

In the Name field, enter the PolicyName (for example, IMPPolicy) and click OK.

Choose the new policy, IMPPolicy, for editing.

Click Rules.

Add the rules in the following order:

1. Under the Rules section, click New.

2. Choose Service Type as URL Policy Agent (with resource name)

3. Click Next.

4. In the Name field, enter the suggested rule Name from the Policy Rules table above, replacing <hostname> with the actual hostname of the IM and Presence node.

5. In the ResourceName field provided, enter the corresponding Resource Name for this rule, replacing <IMP FQDN> with the actual Fully Qualified Domain Name of the IM and Presence node.

6. Check the GET action with a value of Allow.

7. Check the POST action with a value of Allow.

8. Click Finish to complete the rule update.

9. Click Save to save the policy update.

10. Repeat this entire step for each rule in the above table, then click Finish.

You must add a single Subject to the policy. Add the Subject as follows:

1. Under the Subjects section, click New.

2. Choose Authenticated Users as Subject Type.

3. Click Next.

4. Enter IMPSubject as the Name value.

   IMPSubject is only a suggested value. You can use any valid value. This value is not required later in this configuration.

5. Click Finish to complete the Subject update.

6. Click Save to save the policy update.

You must add a single Condition to the policy. Add the Condition as follows:

1. Under the Conditions section, click New.

2. Choose Active Session Time as Condition Type.

3. Click Next.

4. Enter IMPTimeOutCondition as the Name value.

   IMPTimeOutCondition is only a suggested value. You can use any valid name value. This value required later in this configuration.

5. Enter 120 as the Maximum Session Time (minutes).

6. Ensure the Terminate Session field is set to No.

7. Click Finish to complete the Subject update.

8. Click Save to save the policy update.

Log in to the OpenAM administration interface.

From the Access Control tab, click Top Level Realm.

From the Authentication tab, click Module Instances.

In the Module Instances window, click New.

Enter a name for the new login module instance (for example, IMPKRB) and choose Windows Desktop SSO from the Type list.

Click OK.

Click Save.

In the Module Instances window, choose the name of the new login module (for example, IMPKRB) and provide the following information:

Click Save.

Validate that the SSO Module is working correctly by logging in to a Windows Desktop session as a valid Windows user (a valid end user that exists in the AD; do not use the Administrator account). Access the following URL:

Log in to OpenAM administration interface.

From the Access Control tab, click /(Top Level Realm).

From the Agents tab, choose the J2EE tab.

In the Agents section, click New.

Enter the J2EE setup parameters.

Click Create.

Choose the J2EE agent that you created.

From the Application tab, under the Login Processing section, add the Login Form URIs for each web GUI application on IM and Presence Service.

Click Save.

From the OpenAM Services tab, add OpenSSO Login URL as https://<OpenAM FQDN>:8443/<war-file-name>/UI/Login?module=<SSO_Module>.

In the text area, remove all URLs other than the Login URL. Only the Login URL specified in the previous step should be listed in the text area.

Click Save.

Click Back to Main Page.

Repeat Steps 4 through 13 to create a J2EE Profile Agent for every other IM and Presence Service node to be enabled for SSO.

Log in to the OpenAM Administration interface.

From the Configuration tab, choose Global.

Click Session.

Click Dynamic Attributes.

Enter a value in the Maximum Idle Time field.

Click Save.

Sign in to the Cisco Unified CM IM and Presence Administration for the IM and Presence database publisher node that is to be enabled with SSO.

Choose System > Security > Certificate Import Tool.

Choose Tomcat Trust as the Certificate Trust Store.

Enter the Fully Qualified Domain Name of the OpenAM server as the Peer Server.

Enter 8443 as the Peer Server Port.

Click Submit.

Click Configure to open the Certificate Viewer. The Certificate Viewer provides a visual representation of the certificate chain presented by OpenAM during a TLS connection handshake. This indicates which certificates must be imported into this IM and Presence Service node.

Inspect the certificates in the chain and ensure that you trust the issuers.

Check Accept Certificate Chain and click Save.

Click Close.

Restart the Cisco Intercluster Sync Agent service on this node using the following CLI command:utils service restart Cisco Intercluster Sync Agent.

Restart the Tomcat service on this node using the following CLI command: utils service restart Cisco Tomcat

Repeat Steps 11 and 12 for each IM and Presence Service subscriber node in this cluster.

Verify the secure connection by using the Certificate Import Tool on each subscriber node in this cluster.

1. Sign in to Cisco Unified CM IM and Presence Administration of the IM and Presence Service subscriber node that is being configured for SSO.

2. Choose System > Security > Certificate Import Tool.

3. Choose Tomcat Trust as the Certificate Trust Store

4. Enter the FQDN of the OpenAM server as the Peer Server.

5. Enter 8443 as the Peer Server Port.

Repeat this procedure for all IM and Presence Service clusters for which you will be enabling SSO.

Access the OpenAM server Windows desktop and choose Start > All Programs > Apache Tomcat 7.0 Tomcat7 > Configure Tomcat.

From the General tab, click Stop to stop the Tomcat service if it is running on the OpenAM server.

Delete the OpenAM configuration data. This data is typically stored in two directories that can be found in the home directory of the user running the Tomcat instance. For example, C:\opensso (where the folder name matches the deployed URI for the OpenAM WAR file such as opensso) and C:\.openssocfg.

Delete the deployed OpenAM WAR file and the WAR file itself from the following location on the OpenAM/Tomcat instance: tomcat-dir\webapps.

Access the Windows desktop of the OpenAM server and choose Start > All Programs > Apache Tomcat 7.0 Tomcat7 > Configure Tomcat.

From the General tab, click Start to start the Tomcat service.

Sign in to OpenAM (https://<OpenAM FQDN>:8443/opensso) from your web browser (for example, Mozilla Firefox).

From the Access Control menu, choose Top Level Realm > Agents > J2EE.

Under the General heading, choose Agent Debug Level.

Under the Agent Debug Level, specify the desired level (Message or Error).

Click Save.

On the IM and Presence Service node, restart the Cisco Tomcat service.

1. Access the IM and Presence Administration CLI.

2. Execute the following command: utils service restart Cisco Tomcat.

Retrieve the logs using Cisco Unified Real Time Monitoring Tool for IM and Presence Service by browsing and downloading the logs for the Cisco SSO component.