Configure LDAPS

Identity Manager allows to configure LDAP data sources (data pool and export configuration) either as LDAP or LDAPS (only for server-side authentication).

To set up an LDAPS data source:

1. Follow the instruction to set up an LDAP data pool, with the following exceptions:
   1. In the URL, enter the prefix ldaps:// instead of ldap://.
   2. Check which port number is used for LDAPS in the customer environment. The default port for LDAPS is 636. If needed, add a port number in the URL.
2. Follow the instruction to set up an export definition for LDAP, with the following exceptions:
   
   1. In the URL, enter the prefix ldaps:// instead of ldap://.
   2. Check which port number is used for LDAPS in the customer environment. The default port for LDAPS is 636. If needed, add a port number in the URL.

To configure LDAPS, the LDAPS server certificate must be trusted.

• For docker:
  Add the certificate in the docker/compose/cacerts folder. Run docker compose down and docker compose up from within docker/compose/identitymanager/<webappname>/ for each Smart ID application so new containers are created.
  
  
• For WAR file deployment:
  The certificate must be trusted in the java environment that starts the Tomcat.
  
  To set the LDAPS server certificate as trusted:

1. 1. Create a java truststore with the issuing CA cert or LDAPS server cert (X.509). If you are uncertain of which one to use, include both.
      See Configure https for Tomcat for keytool syntax.
      
      

      In an Active Directory environment, the LDAPS server certificate is the Domain Controller certificate.
   2. Copy the new truststore to the Tomcat Application Server.
   3. Add the following parameters to the java startup configuration of the tomcat:
      

      Add parameters

      TEXT

      Djavax.net.ssl.trustStore=c:\myCerts\myTruststore.jks
      Djavax.net.ssl.trustStorePass=123456

   4. Restart the Tomcat.

Example of Tomcat startup parameters:

• Configure https for Tomcat
• Configure secure connection for Identity Manager
• Set up data pool in Identity Manager
• Set up data export to external data source from Identity Manager