Applies to:

All version of on-premises Centrify Privilege Service

How to:

How to configure default IWA root cert for on-premises Centrify Privilege Service to perform cjoin and Https IWA?

Answer:

1) Trust the “root_ca_public_certificate” on the Linux Box:

• On the on-premises CPS server, get the "root_ca_public_certificate.cer" from location: “<installdir>/config”

• Place the certificate to the Linux box and convert the certificate format from “der” to “pem” by running the following command

• Place the pem-format certificate to the following location by running the following command:
  #sudo cat root_ca_public_certificate.pem >> /etc/pki/tls/certs/ca-bundle.crt

2) Create role for computers to perform cjoin:

• On Cloud manager portal, create a new role

• Under Member > Check the “Computer” filter and look up the Linux machine that has been configured with steps above, then add them as member of the role

• Under Administrative Rights > Assign the “Privilege Management” Rights for this role then save

3) Once completed all the steps mentioned above, the Linux machine should be able to perform cjoin successfully using the command below:

#cjoin –a <IP of the Linux Box> -V

(#cjoin –help for all the options that are available)

 
4) For Https IWA, trust the “IwaTrustRoot” certificate on the machines:

• Enable CLI Toolkit to support Https IWA by performing the following KB article:
  KB-7307: How to use https for IWA connection for CLI toolkit

• On Cloud Manager portal, download the “IWA root CA Certificate” from the following location:
  Cloud Manager portal -> Settings -> Network -> Cloud Connectors -> Select the Cloud Connector to connect -> Download your IWA root CA certificate

• Place the IWA root CA certificate to the trusted certificate store:
  For RedHat:
  #sudo cp IwaTrustRoot.cer /usr/share/ssl/certs/ca-bundle.crt

• Https IWA should be working afterwards. If you still run into other problem, please feel free to contact us by emailing to support@centrify.com.