Service Now integration with Forgerock OpenAM

1. create IDP metadata from Forgerock OpenAM make sure you have NameID Format same as Service Now. your metadata should have x509 certificate that is required by SAML to sign the request. If you are not using certificate make sure to select default certificate offered by forgerock AM

2. send metadata to Service Now.
3. import Service Now Metadata (SP) to forgerock AM servers. make changes to SP metadata. Click on Service Now metadata and go to Assertion Processing and at the Attribute Mapper put the attribute you have in Service Now at Advanced --> User Field (uid=user_name)


Service Now configuration:

Service now should have these below values

NameID Policy(SP) same as NameID Format (IDP)


Value in the User Field is same as what IDP have in Service Now Assertion processing --> Attribute Mapper --> Attribute MAP i.e(uid=user_name)


other points to consider is users who are not in SNOW wont be able to login to SNOW if that user does not exists in the SNOW.

foegerock openam error Unable to do sso or federation. com.sun.identity.saml2.common.SAML2Exception: Provider's signing certificate alias is missing.

debug log error
Unable to do sso or federation. com.sun.identity.saml2.common.SAML2Exception: Provider's signing certificate alias is missing.


your IDP is missing certificate that is required by server to sign SAMLrequest.

solution:
configure idp with x509 certificate
reconfigure idp with pre-configure "Signing Key"(option you will get when configuring IDP)

opends enabling replication opendj

to change server names follow below link
https://backstage.forgerock.com/knowledge/kb/book/b73824898#a87750034


to enable replication used below commands


./dsreplication configure --adminUid admin --adminPassword Passw0rd1 --baseDn dc=orasystemsusa,dc=com --host1 dsA.example.com --port1 5444 --bindDn1 "cn=Directory Manager" --bindPassword1 Password --replicationPort1 8989 --host2 dsB.example.com--port2 5444 --bindDn2 "cn=Directory Manager" --bindPassword2 Passwrd --replicationPort2 8989 --trustAll --no-prompt


./dsreplication initialize --baseDN dc=orasystemsusa,dc=com --adminUID admin --adminPassword Password --hostSource dsA.example.com --portSource 5444 --hostDestination dsB.example.com --portDestination 5444 --trustAll --no-prompt


./dsreplication status --adminUID admin --adminPassword Password --hostname dsA.example.com --port 5444 --trustAll

OpenIDM LDAP connector types (LiveSync, Implicit Sync)

1. LiveSync:
                    It sync changes from LDAP to OpenIDM  ( LDAP --> OpenIDM)

2. Implicit Sync:
                           It sync changes from IDM to LDAP (OpenIDM --> OpenDJ)

openidm error SEVERE: OpenICF connector test of SystemIdentifier{ uri='system/ldap/'} failed!

Error while configuring OpenAM with OpenDJ

SEVERE: OpenICF connector test of SystemIdentifier{ uri='system/ldap/'} failed!


Solution:

Issues could be IDM is unable to reach OpenDJ

check the following if ds server information is correct

1. DNS name resolution
2. openidm/db/ds/conf/repo.ds-external.json

forgerock OpenIDM and OpenAM integration error "accountClaiming" "Access Denied"

After integrating OpenIDM with OpenAM when you try login to OpenIDM admin console you get

accountClaiming at the url and "Access Denied" error.

Solution:

During integration you should have specified value of "Authorized OIDC SSO Clients"

if you missed this you will get his error. This property is located at


Services --> Oauth2 Provider --> Advanced OpenID Connect

enter value "openidm" at the value of  "Authorized OIDC SSO Clients"

and SAVE

Now if you try to login to the console. You should be able to login to the IDM console with openam username. Any user you are trying to login with should exist in OpenDJ

 

OpenIDM and OpenAM integration error redirect_uri_mismatch

During integration of OpenIDM and OpenAM, once you change the Directory services from local to OpenDJ you will get this error when you try to login.

Solution:

login to OpenAM
click on Top Level realm
from left side select Applications --> OAuth 2.0

on CORE tab go to Redirection URIs
enter the url you think you have put during "Configure Forgerock Identity Provider" section "Configure Access Management" property "Redirection URIs" value

correcting this value will fix this error