Most of the LDAP connections from IBM WebSphere Application Server are configured with TLS. So you need to have the root certificate in the WebSphere truststore to connect.
In the past I had several issues where MS Active Directory certificates for LDAPS are only valid for one year. They were automatically recreated on the AD side, and the certificate is not using the domain root certificate but a self-signed one.
Like https://help.claritysecurity.com/docs/enable-ldaps-on-an-ad-domain-controller , the instructions create a certificate template.
I couldn’t reproduce in my demo servers the issue that some customers have with only self-signed certificates for AD LDAPS which are only valid for one year, but I tested certificates with and without templates.
So the certificate which is used for LDAPS after just installing the Certificate Authority looks like this:
The certificate created with the described LDAPS Template (inherited from Kerberos):
From my point of view, the certificate with the template has no server name in the certificate, while the one without touching templates looks promising and works as expected.
You need to reimport the certificate every 11-12 months to have a trusted connection.
There is one setting in WebSphere which can help you, ensuring that the filebased user (for example wasadmin) is always able to login.
Allow operations if some of the repositories are down
This option is disabled by default and you can enable it in ISC (https://websphere-fqdn:9043/ibm/console) or wsadmin.sh.
ISC
- Open Security > Global Security > Federated Repositories (Configure)
- Enable
Allow operations if some of the repositories are down
wsadmin.sh
cd /opt/IBM/WebSphere/AppServer/profiles/Dmgr01/bin
./wsadmin.sh -lang jython
AdminTask.updateIdMgrRealm('[-name defaultWIMFileBasedRealm -allowOperationIfReposDown true]')
AdminConfig.save()
To activate the setting you need to restart the Deployment Manager.
Now at least the file-based WebSphere admin user (e.g. wasadmin) can always login, even when the LDAP connection is down or fails because of missing certificates.
Disable Security to update truststore
If it is already too late to set this option, you can disable the WebSphere security with wsadmin:
cd /opt/IBM/WebSphere/AppServer/profiles/Dmgr01/bin
./wsadmin.sh -lang jython -conntype NONE
securityoff()
AdminConfig.save()
Restart the Deployment Manager and open the login page on https://dmgr-fqdn:9043/ibm/console - it will just ask for a username.
Login with any username.
Now you can change any setting.
To finish the thoughts from above, import the new LDAP certificate for example.
SSL certificate and key management > Key stores and certificates > CellDefaultTrustStore > Signer certificates > Retrieve from port
In the end, enable application security again:
and restart the Deployment Manager.
