If you cannot log in to the ROR console after installation, the environment setup may have failed. Stop the manager and then reconfigure the environment.
Execute the keytool command, and check if the CA certificate has been correctly imported. For the -alias option, specify "svs_cms".
When using individually configured OpenDS or ActiveDirectory, specify ror_ldap_1 for the -alias option.
Example
[Windows]
>C:\Fujitsu\ROR\SVROR\Manager\runtime\jre6\bin\keytool.exe -list -alias Another_name -keystore " C:\Fujitsu\ROR\SVROR\Manager\runtime\jre6\lib\security\cacerts" <RETURN> >C:\Fujitsu\ROR\SVROR\Manager\runtime\jre6\bin\keytool.exe -list -alias Another_name -keystore " C:\Fujitsu\ROR\IAPS\JDK5\jre\lib\security\cacerts" <RETURN> |
[Linux]
# /opt/FJSVrcvmr/runtime/jre6/bin/keytool -list -alias Another_name -keystore /opt/FJSVrcvmr/runtime/jre6/lib/security/cacerts <RETURN> # /opt/FJSVrcvmr/runtime/jre6/bin/keytool -list -alias Another_name -keystore /opt/FJSVawjbk/jdk5/jre/lib/security/cacerts <RETURN> |
When the information on the CA certificate is not displayed, that means that registration of the CA certificate has failed. In this case, register the CA certificate referring to "4.5.5.2 Registering Certificates".
Use the following procedure to register CA certificates to Resource Orchestrator.
Copy the keystore of Resource Orchestrator.
[Windows]
Files to Copy
Installation_folder\SVROR\Manager\runtime\jre6\lib\security\cacerts
Copy Destination
Installation_folder\SVROR\Manager\runtime\jre6\lib\security\cacerts.org
Files to Copy
Installation_folder\IAPS\JDK5\jre\lib\security\cacerts
Copy Destination
Installation_folder\IAPS\JDK5\jre\lib\security\cacerts.org
[Linux]
Files to Copy
/opt/FJSVrcvmr/runtime/jre6/lib/security/cacerts
Copy Destination
/opt/FJSVrcvmr/runtime/jre6/lib/security/cacerts.org
Files to Copy
/opt/FJSVawjbk/jdk5/jre/lib/security/cacerts
Copy Destination
/opt/FJSVawjbk/jdk5/jre/lib/security/cacerts.org
Note
Ensure that the keystore of Resource Orchestrator is copied, as it will be necessary when changing the directory service.
Import the CA certificate (keystore) of ServerView Operations Manager to the keystore of Resource Orchestrator.
The CA certificate (keystore) of ServerView Operations Manager is stored in the following location:
[Windows]
ServerView Suite_installation_folder\jboss\server\serverview\conf\pki\keystore
[Linux]
/opt/fujitsu/ServerViewSuite/jboss/server/serverview/conf/pki/keystore
Example
[Windows]
>C:\Fujitsu\ROR\SVROR\Manager\runtime\jre6\bin\keytool.exe -importkeystore -srckeystore " C:\Program Files\Fujitsu\ServerView Suite \jboss\server\serverview\conf\pki\keystore" -destkeystore "C:\Fujitsu\ROR\SVROR\Manager\runtime\jre6\lib\security\cacerts" <RETURN> >C:\Fujitsu\ROR\SVROR\Manager\runtime\jre6\bin\keytool.exe -importkeystore -srckeystore " C:\Program Files\Fujitsu\ServerView Suite \jboss\server\serverview\conf\pki\keystore" -destkeystore "C:\Fujitsu\ROR\IAPS\JDK5\jre\lib\security\cacerts"<RETURN> |
[Linux]
# /opt/FJSVrcvmr/runtime/jre6/bin/keytool -importkeystore -srckeystore /opt/fujitsu/ServerViewSuite/jboss/server/serverview/conf/pki/keystore -destkeystore /opt/FJSVrcvmr/runtime/jre6/lib/security/cacerts <RETURN> # /opt/FJSVrcvmr/runtime/jre6/bin/keytool -importkeystore -srckeystore /opt/fujitsu/ServerViewSuite/jboss/server/serverview/conf/pki/keystore -destkeystore /opt/FJSVawjbk/jdk5/jre/lib/security/cacerts <RETURN> |
After executing the command, enter the password.
The password for the keystore of Resource Orchestrator is set to "changeit" by default.
The following messages will be displayed when import is successfully completed.
Check the "Another name" section.
Enter destination keystore password: changeit |
Execute the keytool command, and check if the CA certificate has been correctly imported.
For the -alias option, specify the "another name" checked in 3.
Example
[Windows]
>C:\Fujitsu\ROR\SVROR\Manager\runtime\jre6\bin\keytool.exe -list -alias Another_name -keystore " C:\Fujitsu\ROR\Manager\runtime\jre6\lib\security\cacerts" <RETURN> >C:\Fujitsu\ROR\SVROR\Manager\runtime\jre6\bin\keytool.exe -list -alias Another_name -keystore " C:\Fujitsu\ROR\IAPS\JDK5\jre\lib\security\cacerts"<RETURN> |
[Linux]
# /opt/FJSVrcvmr/runtime/jre6/bin/keytool -list -alias Another_name -keystore /opt/FJSVrcvmr/runtime/jre6/lib/security/cacerts <RETURN> # /opt/FJSVrcvmr/runtime/jre6/bin/keytool -list -alias Another_name -keystore /opt/FJSVawjbk/jdk5/jre/lib/security/cacerts <RETURN> |
Import the CA certificate of the individually configured directory service to the keystore of Resource Orchestrator.
When using a directory service other than OpenDS that comes with ServerView Operations Manager, import the CA certificate of the directory service to the keystore of Resource Orchestrator.
The CA certificate format is the DER encoded binary X.509 (CER) format.
Example
When Using Active Directory
>C:\Fujitsu\ROR\SVROR\Manager\runtime\jre6\bin\keytool.exe -importcert -alias rcve_ldap -trustcacerts -file c:\myserver.serverview.local_svsca.crt -keystore "C:\Fujitsu\ROR\SVROR\Manager\runtime\jre6\lib\security\cacerts" >C:\Fujitsu\ROR\SVROR\Manager\runtime\jre6\bin\keytool.exe -importcert -alias rcve_ldap -trustcacerts -file c:\myserver.serverview.local_svsca.crt -keystore "C:\Fujitsu\ROR\IAPS\JDK5\jre\lib\security\cacerts" |
When Using OpenDS
>C:\Fujitsu\ROR\SVROR\Manager\runtime\jre6\bin\keytool.exe -importkeystore -srckeystore "C:\win32app\OpenDS-2.2.0\config\keystore" -destkeystore C:\Fujitsu\ROR\SVROR\Manager\runtime\jre6\lib\security\cacerts >C:\Fujitsu\ROR\SVROR\Manager\runtime\jre6\bin\keytool.exe -importkeystore -srckeystore "C:\win32app\OpenDS-2.2.0\config\keystore" -destkeystore C:\Fujitsu\ROR\IAPS\JDK5\jre\lib\security\cacerts |
Import the server certificate to ServerView Operations Manager. For details, refer to "6.3.5 Importing a Certificate to ServerView SSO Authentication Server".
Check if the connection information of the directory service to be used has been correctly registered in Resource Orchestrator.
Execute the following command:
rcxadm authctl show <RETURN> |
The connection information registered in Resource Orchestrator is displayed.
Check the displayed connection information.
The information is displayed as follows:
ip address: 127.0.0.1 |
Check if the directory service settings and the displayed connection information are the same. In particular, note the following information:
If port is the port for SSL communications
If bind is the directory service administrator
(Check if the administrator is a directory service administrator, not a privileged user of Resource Orchestrator)
For details on how to check the connection settings of the OpenDS provided with ServerView Operations Manager, refer to the following manuals.
"Configuring directory service access" and "ServerView user management with OpenDS" in "ServerView Suite User Management in ServerView"
When there is an error in the connection information, use the following procedure to register the correct information:
Stop the manager.
Execute the rcxadm authctl modify command and configure the correct information.
Start the manager.
For details on the rcxadm authctl command, refer to "1.7.10 rcxadm authctl" of the "Reference Guide (Resource Management) CE".
