changememory

Change the maximum amount of memory that can be used by the Analyzer server.

Format

changememory
     {-set memory-size [-auto] | -status}

Options

set memory-size: Specify the maximum amount of memory (in GB) that can be used by the Analyzer server. You can specify a value in the range from 1 to 256. Note that the specified value must be less than the total memory of the OS.
auto: Automatically stops and starts Analyzer server services.
status: Displays the setting status for the maximum amount of memory that can be used by the Analyzer server.

Execution Permission

root permission

Location

Analyzer-server-installation-directory/Analytics/bin

Notes

If you run this command without specifying the auto option, you must restart the product by running the hcmds64srv command on the host where you ran the changememory command.

Return values

Return value	Description
0	The command ran normally.
1	The argument is invalid.
2	Command running was interrupted.
4	Another command is currently running.
13	An attempt to write to the file failed.
14	You do not have permission to run this command.
16	An attempt to start or stop the services of the Analyzer server failed.
18	An attempt to read the file failed.
255	Command running was interrupted because of another error.

Example

To change the maximum amount of memory that can be used by the Analyzer server to 32 GB:

changememory -set 32 -auto

To check the setting status for the maximum amount of memory that can be used by the Analyzer server:

changememory -status

Configuring SSL communications

After installation, run the SSL Setup tool (cssslsetup command) or manually perform the required procedures to configure SSL communications. By default, Common Services uses SSL/TLS communications by using a self-signed certification. So, you must set up SSL communications to use a valid server certificate.

You can use either of the following methods to configure SSL communications:

To use the SSL setup tool (the cssslsetup command) for each product, perform the procedure described in Configuring SSL communications by using the SSL Setup tool.
To configure SSL communications manually or use both RSA and Elliptic Curve Digital Signature Algorithm (ECDSA) as the public key encryption algorithms, perform the procedure described in Configuring SSL communications without using the SSL Setup tool.

Configuring SSL communications by using the SSL Setup tool

The following figure shows the workflow for configuring SSL communications by using the SSL Setup tool (cssslsetup command).

The following Hitachi Ops Center products can be configured for SSL communications by using the cssslsetup command:

Hitachi Ops Center Common Services
Hitachi Ops Center Automator
Hitachi Ops Center Analyzer
Hitachi Ops Center Analyzer detail view
Hitachi Ops Center Analyzer viewpoint
Hitachi Ops Center Analyzer probe server
Hitachi Ops Center Analyzer Virtual Storage Software Agent
Hitachi Ops Center Administrator
Hitachi Ops Center Protector (Master)
Hitachi Ops Center API Configuration Manager

Note:

You can use the SSL Setup tool for products for which a supported version is installed. If the installed version is not supported, upgrade the product and then use the tool. For details on the versions of each product supported by the SSL Setup tool, see the Hitachi Ops Center Release Notes.
If API Configuration Manager is installed by a user other than the root user, it is not displayed in the list and SSL communications cannot be configured. Configure the settings manually as described in the Hitachi Ops Center API Configuration Manager REST API Reference Guide.
When specifying a certificate for the cssslsetup command, specify the certificate in the X.509 PEM format. Make sure that the certificate file specified for the cssslsetup command contains only text between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----. If the file contains any other text, attempts to set the certificate might fail.

You can run the cssslsetup command on each management server. For a management server where Common Services is not installed or the Analyzer probe server, obtain the cssslsetup command from the installation media. The locations of the cssslsetup command are as follows:

If Common Services is installed on the management server:
installation-directory-of-Common-Services/utility/bin
If Common Services is not installed on the management server:
Expand utility.tar from the installation media.

The utility.tar is located in the following directory:
- root-directory-of-the-Common-Services-installation-media
- root-directory-of-the-Server-Express-installer-media/COMMONSERVICES
- root-directory-of-the-Client-Express-installer-media/COMMONSERVICES
The cssslsetup command is stored in the following directory after the files are extracted from utility.tar:

directory-where-utility.tar-is-extracted/utility/bin

The following settings are not configured by the cssslsetup command:

Settings using both RSA and Elliptic Curve Digital Signature Algorithm (ECDSA) as public key encryption algorithms
For details on how to set up such a configuration, see the procedure described in Configuring SSL communications without using the SSL Setup tool.
Settings for storage systems and Active Directory, LDAP, and identity provider servers
Settings for the Protector clients
Configure these settings as necessary by referring to the manual for Protector.

SSL Setup tool functionality

The SSL Setup tool provides the following functions.

Creating a private key and a certificate signing request (CSR)

The cssslsetup command creates a common private key and CSR that can be used by all products.

Note: This command only supports the RSA encryption algorithm. If you want to use both RSA and the Elliptic Curve Digital Signature Algorithm (ECDSA), perform the procedure described in Configuring SSL communications without using the SSL Setup tool.

Configuring the SSL server settings

The cssslsetup command configures the SSL server settings for the following:

Product	Settings
Common Services	Registers the server certificate and private key.
Automator	Registers the server certificate and private key. Enables SSL communications.
Analyzer	Registers the server certificate and private key. Enables SSL communications.
Analyzer detail view	Imports the server certificate (in the PKCS#12 format) into the keystore.
Analyzer viewpoint	Registers the server certificate and private key.
Analyzer probe server	Imports the server certificate (in the PKCS#12 format) into the keystore. Registers the server certificate and private key (for on-demand real time monitoring and RAID Agent).
Analyzer Virtual Storage Software Agent	Imports the server certificate (in the PKCS#12 format) into the keystore.
Administrator	Registers the server certificate and private key.
Protector	Registers the server certificate and private key.
API Configuration Manager	Registers the server certificate and private key. Configures notifications for storage system configuration changes.

Configuring the SSL client settings and enabling certificate verification

The cssslsetup command configures the SSL communication settings and enables certificate verification.

Product	Settings
Common Services	Imports the root certificate into the truststore. Imports the root certificate of the server certificate for the Active Directory, LDAP, or an identity provider server into the truststore. Enables certificate verification.
Automator	Imports the root certificate into the truststore. Imports the root certificate of the server certificate for the Active Directory server into the truststore. Enables certificate verification.
Analyzer	Imports the root certificate into the truststore. Imports the root certificate of the server certificate for the Active Directory server into the truststore. Enables certificate verification.
Analyzer detail view	Imports the root certificate into the truststore. Imports the Active Directory server certificate into the truststore. Note: To link with Active Directory, you must add an active directory user by using Analyzer detail view. Enables certificate verification. Note: If you want to use a certificate issued by a certificate authority for SSL communication for real time data collection, you must set the following Analyzer detail view server parameters in the hosts file on the management server to enable certificate verification: `IP-address` `hostname` For `hostname`, specify the value obtained by running the hostname -f command. Imports the server certificate of the RAID Agent server into the truststore (for on-demand real time monitoring).
Analyzer viewpoint	Registers the trusted certificate into Analyzer viewpoint. Enables certificate verification.
Analyzer probe server	Imports the root certificate and the target product's server certificate into the truststore. Imports the Active Directory server certificate into the truststore. Imports the root certificate into the Analyzer probe server truststore (for RAID Agent). Imports the storage system certificate into the truststore of the instance environment (for RAID Agent). Changes the permissions of the client.truststore.jks file, which was copied from the Analyzer detail view server (for real time data collection). Enables certificate verification.
Analyzer Virtual Storage Software Agent	Imports the root certificate of VSP One SDS Block or the storage system into the truststore. Enables certificate verification.
Administrator	None Note: You must use the setupcommonservice command for the following tasks: Importing the root certificate into the truststore Enabling certificate verification If you want to link with Active Directory, you must import the certificate of the Active Directory server into the truststore and register an Active Directory domain that uses the DNS server. For the configuration procedure, see the Administrator documentation.
Protector	Imports the root certificate into the truststore. Note: You must use the setupcommonservice command to enable certificate verification.
API Configuration Manager	Enables certificate verification for SSL communications with the storage system. Enables SSL communications.

Enabling or disabling certificate verification

You can enable or disable certificate verification for SSL communications maintenance.

Creating a private key and a certificate signing request (SSL Setup tool)

Use the SSL Setup tool to create a private key and a certificate signing request (CSR) for use with all Hitachi Ops Center products.

Note:

If the certificate has expired or has been revoked by the certificate authority, you must renew it. Follow the procedure in this section to request a new certificate and overwrite the existing one. You must also perform the procedures in Configuring SSL server settings (SSL Setup tool) and Configuring SSL client settings and enabling certificate verification (SSL Setup tool).
Do not set a passphrase for the created private key. If you use a private key for which a passphrase is set, you cannot start product services.

Log in to the management server as the root user.
If you log in as an ordinary user, use the sudo command to complete the following procedure as the root user.
Run the cssslsetup command, which is in the following directory:

If Common Services is installed on the management server:

installation-directory-of-Common-Services/utility/bin

If Common Services is not installed on the management server:

directory-where-utility.tar-is-extracted/utility/bin
The main menu is displayed:
```
Main menu   Ver:cssslsetup-command-version
1. Create certificate signing request and private key.
2. Set up SSL server.
3. Set up SSL client.
4. Enable/disable certificate verification(optional).
5. Restart services for each product.
Enter a number or q to quit:
```
Enter 1. You are prompted to provide the required certificate information:
- Absolute path to the file where the shared private key is output
- Absolute path to the file where the CSR is output
- Signature algorithm for RSA
- Key size
- Host name (CN)
- Organizational unit (OU)
- Organization name (O)
- Name of the city or locality (L)
- Name of the state or province (ST)
- 2-letter country code (C)
- Host name (or FQDN), IP address or both of SubjectAltName
Note: When you use the certificate for enabling SSL encryption for real time data collection in the Analyzer detail view server, enter the IP address of SubjectAltName and issue a certificate that includes the IP address specified in the SubjectAltName field.
Make sure that the settings are correct. If they are correct, enter 1. Yes.
If you want to specify the settings again, enter 2. No (Cancel) to return to the main menu.
When the CSR is successfully created, the results are displayed and the main menu reappears. To exit, enter q.
Access the CSR from the directory that you specified when creating the request and submit the CSR to the certificate authority requesting that they issue a signed certificate.
For details, follow the procedure provided by the certificate authority.
After obtaining the server certificate signed by the certificate authority, run the following command to check the results:
If Common Services is installed on the management server:
```
installation-directory-of-Common-Services/openssl/bin/openssl x509 -text -in full-path-of-the-certificate-file
```
If Common Services is not installed on the management server:
```
directory-where-utility.tar-is-extracted/utility/lib/openssl/bin/openssl x509 -text -in full-path-of-the-certificate-file
```

Configuring SSL server settings (SSL Setup tool)

Use the SSL Setup tool to specify the server certificate and the private key for the Hitachi Ops Center products on the management server.

Note: When configuring SSL server settings on multiple management servers, use the SSL Setup tool on each management server.

Log in to the management server as the root user.
If you log in as an ordinary user, use the sudo command to complete the following procedure as the root user.
Run the cssslsetup command, which is in the following directory:
If Common Services is installed on the management server:

installation-directory-of-Common-Services/utility/bin

If Common Services is not installed on the management server:

directory-where-utility.tar-is-extracted/utility/bin

The main menu is displayed:
```
Main menu   Ver:cssslsetup-command-version
1. Create certificate signing request and private key.
2. Set up SSL server.
3. Set up SSL client.
4. Enable/disable certificate verification(optional).
5. Restart services for each product.
Enter a number or q to quit:
```
Enter 2.
A list of installed products appears.
Specify the target products for which you want to configure the SSL server.
Use commas to specify multiple products.
Enter an absolute path to the file where the shared private key is located.
Enter an absolute path to the file where the shared server certificate is located.
Specify whether the server certificate specified is issued by an intermediate certificate authority.

Note: If you specified a server certificate issued by an intermediate certificate authority, create a certificate file by appending -chained to the file name. Do not delete this file.
If you specified yes in step 7, specify the absolute path of the certificate of the intermediate certificate authority.
To specify settings for Analyzer detail view, Analyzer probe server, or API Configuration Manager, use an absolute path for the root certificate of the server certificate for use with all Hitachi Ops Center products.
In the following cases, enter the host name specified when creating the CSR:
- If you specify settings for Automator
- If you specify settings for Analyzer
- If you specify settings for the RAID Agent on the Analyzer probe server
To specify settings for Administrator, enter the port number.
To specify settings for Administrator, enter the Virtual Appliance Manager credentials.
The default credentials of the Virtual Appliance Manager are described in the Hitachi Ops Center Administrator Getting Started Guide.
To specify settings for Analyzer detail view or Analyzer probe server, enter a common password for the truststore, keystore, and key manager.
To specify settings for real time data collection of Analyzer detail view, select 1. Yes.
1. To specify settings, enter a common password for the truststore and keystore.
  The default password is changeit. To set a password other than changeit, specify a password using the following characters:
  A-Z, a-z, 0-9, !, #, $, %, &, (, ), *, +, -, ., /, :, ;, <, >, ?, @, ^, _, {, |, }, ~, `
2. When entering the password, if you entered a password other than the default, select 1. Yes.
  If you selected 1. Yes, in order to set the password, real time data collection services of Analyzer detail view will be stopped.
In the following cases, when ECC encryption certificate settings are enabled, specify whether to leave these settings enabled:
- If you specify settings for Automator
- If you specify settings for Analyzer
- If you specify settings for the RAID Agent on the Analyzer probe server
If you are using an ECC certificate, leave the settings enabled. In the SSL Setup Tool, even if ECC encryption certificate settings are enabled, an RSA certificate will be configured.
If you specify settings for the Analyzer Virtual Storage Software Agent, import the server certificate to be shared.
1. Specify an absolute path to the file where the keystore that imports the server certificate is located.
2. Specify the password for the keystore.
3. Enter the alias name (server identification name).
To implement the SSL server settings, enter 1. Yes.

After the settings are implemented, a message is displayed and the main menu reappears.
Enter 5 to restart the services for each product.
Note: If you want to use the real time data collection of Analyzer detail view, restart the Analyzer detail view services. You must also configure the SSL client settings for the Analyzer probe server. For details, see the Configuring SSL client settings and enabling certificate verification (SSL Setup tool).

Configuring SSL server settings for an Active Directory or LDAP server

To use LDAPS for communication with an Active Directory or LDAP server, configure SSL server settings on the Active Directory or LDAP server. For details on how to configure these settings, see the Active Directory or LDAP server documentation.

Configuring SSL communication settings for an identity provider server

To link with an identity provider, configure SSL communication settings on the identity provider server. For details on how to configure these settings, see the identity provider documentation.

Note: If you want to use the Relying Party Trust Monitoring function of AD FS, import the root certificate of the certificate authority that signed the Common Services server certificate into the Trusted Root Certification Authorities Certificate Store of the AD FS server.

Configuring SSL client settings and enabling certificate verification (SSL Setup tool)

Use the SSL Setup tool to configure the required SSL client settings on the management server and enable certificate verification.

Note: When configuring SSL client settings on multiple management servers, use the SSL Setup tool on each management server.

To configure real time data collection for the Analyzer probe server, create the client.truststore.jks file on the Analyzer detail view server in advance, and then copy it to /usr/local/megha/conf/kafka on the Analyzer probe server. For details, see the Analyzer manual.
To configure SSL communications between the RAID Agent on the Analyzer probe server and your storage systems, create an instance environment in advance. For details, see the Analyzer manual.

Log in to the management server as the root user.
If you log in as an ordinary user, use the sudo command to complete the following procedure as the root user.
Run the cssslsetup command, which is in the following directory:
If Common Services is installed on the management server:

installation-directory-of-Common-Services/utility/bin

If Common Services is not installed on the management server:

directory-where-utility.tar-is-extracted/utility/bin

The main menu is displayed:
```
Main menu   Ver:cssslsetup-command-version
1. Create certificate signing request and private key.
2. Set up SSL server.
3. Set up SSL client.
4. Enable/disable certificate verification(optional).
5. Restart services for each product.
Enter a number or q to quit:
```
Enter 3.
Specify the target products for which you want to configure SSL client settings.
Use commas to specify multiple products.
Import the root certificate for common use.
If you only want to configure the settings for linking with Active Directory, LDAP, or an identity provider server, press Enter without specifying anything.
Note: You must import the root certificate of the server certificate for Common Services.
1. Specify an absolute path to the file where the root certificate is located.
2. When the truststore file name is displayed, enter the truststore password. However, the truststore file name is not displayed for Analyzer viewpoint.
3. Enter the alias name (server identification name).
  
  If you specify an alias name that is already used for the truststore, you are asked whether you want to re-register the alias name. Alias names are not case-sensitive.
Import the server certificate or the root certificate of the product that establishes SSL communication with the Analyzer probe server.
1. Specify an absolute path to the file where the server certificate or the root certificate of the target product is located.
2. When the truststore file name is displayed, enter the truststore password.
3. Enter the alias name (server identification name).
  
  If you specify an alias name that is already used for the truststore, you are asked whether you want to re-register the alias name. Alias names are not case-sensitive.
4. If you have other certificates to import, enter 1. Yes, and repeat the steps from the one that specifies the file name of a certificate. At this time, you do not need to enter the truststore password. After importing all the certificates of the target products, enter 2. No.
If you are configuring settings for Analyzer Virtual Storage Software Agent, import the root certificate of VSP One SDS Block.
1. Specify an absolute path to the file where the root certificate of VSP One SDS Block is located.
2. When the truststore file name is displayed, enter the truststore password.
3. Enter the alias name (server identification name).
  
  If you specify an alias name that is already used for the truststore, you are asked whether you want to re-register the alias name. Alias names are not case-sensitive.
If you want to link with Active Directory, LDAP, or an identity provider server, import the certificate associated with the server.
If you do not want to link with Active Directory, LDAP, or identity provider server, just press Enter.
1. Enter, as an absolute path, the file name of the certificate for the Active Directory, LDAP, or identity provider server.
2. When the truststore file name is displayed, enter the truststore password.
3. Enter the alias name (server identification name).
  
  If you specify an alias name that is already used for the truststore, you are asked whether you want to re-register the alias name. Alias names are not case-sensitive.
For API Configuration Manager, configure SSL communications with your storage systems.
To configure the settings, perform the following steps:
1. Enter 1. Yes.
2. Enter the storage device ID of the target storage system and use an absolute path for the server certificate.
3. To configure SSL communications for additional storage systems, enter 1. Yes, and repeat the steps from the one that specifies the storage device ID. After configuring SSL communications for all the storage systems, enter 2. No.
If you use the on-demand real time monitoring of Analyzer detail view, configure SSL communications for the Analyzer detail view server and the RAID Agent server.
To configure the settings, perform the following steps:
1. Enter 1. Yes.
2. When the truststore file name is displayed, specify the truststore password.
3. Enter the alias name (server identification name).
  
  If you specify an alias name that is already used for the truststore, you are asked whether you want to re-register the alias name. Alias names are not case-sensitive.
4. Enter the file name of the server certificate of the target RAID Agent server by using the absolute path.
5. To configure SSL communications for an additional RAID Agent server, enter 1. Yes, and repeat the steps from the one that specifies the alias name. After configuring SSL communications for all the RAID Agent servers, enter 2. No.
Configure SSL communications between the RAID Agent on the Analyzer probe server and your storage systems. Create a truststore file for the instance environment of the RAID Agent, and then import the root certificate of the server certificate for the storage system into the truststore.
If a truststore file already exists in the instance environment, it is deleted and a new truststore file is created.
1. Select the instance environment to configure.
  To specify multiple instance environments, separate the instance environments with commas.
  Note: If the KAOP64020-W or KAOP64021-I message is displayed, proceed to the next step without configuring the RAID Agent. If you need to configure SSL client settings for the RAID Agent, follow the instructions in the message to configure the necessary settings, then run the cssslsetup command again.
2. Specify the absolute path for the root certificate of the server certificate for the storage system.
3. The truststore file name for the instance environment will be displayed, so enter the truststore password.
4. Enter the alias name.
  For the alias name, specify a name that can identify which storage system's server certificate it is.
5. Repeat this procedure of specifying the truststore password and alias name until you finish registering all the certificates for the selected instance environments.
If you are configuring real time data collection for the Analyzer probe server, enter 1. Yes.
Specify whether to enable certificate verification.

Note: If you want to enable certificate verification, you must import the certificate. Perform steps 5 to 12.
Even if you disable certificate verification, if you are using Common Services to link with Active Directory, an LDAP, or an identity provider server, you must import the root certificate of the server to which you are linking to perform authentication.
To implement the SSL client settings, enter 1. Yes.

After the settings are implemented, a message is displayed and the main menu reappears.
Enter 5 to restart the services for each product.

The SSL communication configuration is complete.

Configuring SSL communications without using the SSL Setup tool

The following figure shows the workflow for configuring SSL communications without using the SSL Setup tool:

Workflow showing the steps for setting up SSL communications. The steps are: Prepare a Common Services certificate. Specify the SSL server settings for Common Services. Specify the SSL server settings for each product. Specify the SSL server settings for Active Directory. Import certificate into each product. Import certificates into the Common Services truststore. Finally, enable the certificate verification function.

Preparing the server certificate for Common Services

Prepare the server certificate for Common Services. Make sure the certificate has not expired. For details on how to check this, see Checking the validity period of the server certificate. Common Services supports both RSA and Elliptic Curve Digital Signature Algorithm (ECDSA). You cannot configure ECDSA alone. Prepare secret keys and server certificates for RSA only or for both RSA and ECDSA.

Log in to the management server as the root user.
If you log in as an ordinary user, use the sudo command to complete the following procedure as the root user.
Run the following command to create a private key (in X.509 PEM format) and a certificate signing request (CSR).
Note: When you use the certificate for enabling SSL encryption for real time data collection in the Analyzer detail view server, enter the IP address of SubjectAltName and issue a certificate that includes the IP address specified in the SubjectAltName field.
Example of the command for RSA:
```
installation-directory-of-Common-Services/openssl/bin/openssl req -new -newkey rsa:4096 -nodes -keyout privateRSA.pem -sha256 -out serverRSA.csr -subj "/C=ww/ST=xx/L=yy/O=zz/CN=host-name-or-IP-address" -addext 'subjectAltName = {DNS:host-name|IP:IP-address|DNS:host-name,IP:IP-address}' -config installation-directory-of-Common-Services/openssl/openssl.cnf
```
Example of the command for ECDSA:
```
installation-directory-of-Common-Services/openssl/bin/openssl req -new -newkey ec:<(installation-directory-of-Common-Services/openssl/bin/openssl ecparam -name secp384r1) -nodes -keyout privateECDSA.pem -sha256 -out serverECDSA.csr -subj "/C=ww/ST=xx/L=yy/O=zz/CN=host-name-or-IP-address" -addext 'subjectAltName = {DNS:host-name|IP:IP-address|DNS:host-name,IP:IP-address}' -config installation-directory-of-Common-Services/openssl/openssl.cnf
```
When running the command, specify parameters according to the Cipher Suite supported by Common Services. For details on the Cipher Suite supported by Common Services, see the Hitachi Ops Center Release Notes.

Specify /C=ww/ST=xx/L=yy/O=zz according to your environment. For CN, specify a host name (or FQDN) or IP address that can be used to access the Hitachi Ops Center Portal.

If you specify a host name for CN, specify DNS:host-name for subjectAltName. If you specify an IP address for CN, specify IP:IP-address for subjectAltName. If you specify a host name for CN, and specify that an IP address can also be used to access the Hitachi Ops Center Portal, specify DNS:host-name,IP:IP-address for subjectAltName.

To create a CSR by using the openssl command in the Common Services installation directory, you must specify the -config option to load the settings file.

Note: Do not set a passphrase for the created private key. If you use a private key for which a passphrase is set, you cannot start product services.

Run the following command to check the results of creating the CSR:

installation-directory-of-Common-Services/openssl/bin/openssl req -text -in CSR-file -config installation-directory-of-Common-Services/openssl/openssl.cnf

Access the CSR from the directory that you specified when creating the request and submit the CSR to the certificate authority requesting that they issue a signed certificate.
For details, follow the procedure provided by the certificate authority.
After obtaining a server certificate signed by the certificate authority, run the following command to check the results of creating the server certificate:
```
installation-directory-of-Common-Services/openssl/bin/openssl x509 -text -in server-certificate-signed-by-certificate-authority
```

Setting the path information for the server certificate and private key

In the Common Services properties file, specify the settings for the signed server certificate obtained from the certificate authority and the settings for the private key.

Concatenate the signed server certificate obtained from the certificate authority and the certificate from the intermediate certificate authority into a single file as follows. If there are multiple certificates from intermediate certificate authorities, concatenate all certificates in a chain.

awk 1 server-certificate-signed-by-certificate-authority certificate-from-an-intermediate-certificate-authority [certificate-from-an-intermediate-certificate-authority ...] > chained-server-certificate

Log in to the management server as the root user.
If you log in as an ordinary user, use the sudo command to complete the following procedure as the root user.
Transfer the signed server certificate obtained from the certificate authority and the private key to the management server in a secure manner.
Store the server certificate and the private key in the following directory:
/var/installation-directory-of-Common-Services/tls/

In the following properties file, specify the absolute paths to the server certificate file and private key file, and then save the file.

Properties file location

/var/installation-directory-of-Common-Services/userconf/config_user.properties

Settings

RSA settings:

CS_GW_SSL_CERTIFICATE=absolute-path-of-the-certificate-(RSA)-file
CS_GW_SSL_CERTIFICATE_KEY=absolute-path-of-the-private-key-(RSA)-file

ECDSA settings:

CS_GW_SSL_CERTIFICATE_ECDSA=absolute-path-of-the-certificate-(ECDSA)-file
CS_GW_SSL_CERTIFICATE_KEY_ECDSA=absolute-path-of-the-private-key-(ECDSA)-file

If this is the first time configuring SSL, restart the Common Services service.

Note: In an environment where SSL communication settings have already been configured: if you want to change the settings in config_user.properties by adding ECDSA settings or reissuing a server certificate, complete the following procedures and then restart the Common Services service. If you restart the Common Services service before configuring the settings, a communication error might occur.

Specifying SSL server settings for each product

Configure SSL communications for each product that links with Common Services. As you did with Common Services, you must prepare the signed certificate from the certificate authority, and specify the SSL server settings.

For details on how to specify the SSL server settings, see the documentation for each product.

Configuring SSL server settings for an Active Directory or LDAP server

Configuring SSL communication settings for an identity provider server

To link with an identity provider, configure SSL communication settings on the identity provider server. For details on how to configure these settings, see the identity provider documentation.

Importing certificates into each product

Import the root certificate of the server certificate for Common Services into each product that links with Common Services. In addition, if you import the Common Services metadata into an identity provider over the network when linking with an identity provider, import the root certificate of the server certificate for Common Services into the identity provider server. In some cases, the certificate might already be imported.

For details on how to import a certificate, see the documentation for each product.

Importing certificates into the Common Services truststore

Import the root certificate of the server certificate for Common Services and for each product into the Common Services truststore. If the system is linked with an Active Directory, LDAP, or identity provider server, you can also import the root certificates of these server certificates.

Transfer the certificates to the management server in a secure manner.

Log in to the management server as the root user.
If you log in as an ordinary user, use the sudo command to complete the following procedure as the root user.
Run the following command to import the root certificate of the server certificate for Common Services into the truststore.
In some cases, the certificate might already be imported.
Format
```
keytool -importcert -alias alias-name -keystore path-to-truststore-file -file path-of-the-certificate-to-be-imported
```
Options

-alias alias-name

Specify the name so that the certificate can be identified in the truststore.

-keystore path-to-truststore-file

Specify the following absolute path as the path to the truststore file:

/var/installation-directory-of-Common-Services/tls/cacerts

Note: When you run the command, you will be asked to enter a password. The default password for the truststore is changeit. We recommend that you change the password.

-file path-of-the-certificate-to-be-imported

Specify the absolute path of the certificate to import.
In the same way, import the root certificate of the server certificate for each product into the truststore.
When you use LDAPS for communication with the Active Directory or LDAP server, import the root certificate of the server certificate for the Active Directory or LDAP server.
If you link Common Services with an identity provider, import the root certificate of the server certificate for the identity provider server.
Restart the Common Services service and the services for each product.
For details on how to restart the Common Services service, see Starting or stopping the Common Services service. For details on how to restart the service of each product, see the documentation for each product.

Enabling server certificate verification

After the initial installation of Common Services, there is no verification for server certificates from communication partners when Common Services is the SSL client. Therefore, to strengthen security, enable certificate verification immediately so that all server certificates are verified and your environment is protected from threats such as spoofing.

Log in to the management server as the root user.
If you log in as an ordinary user, use the sudo command to complete the following procedure as the root user.
Change the following property file to enable server certificate verification:
Property file location

/var/installation-directory-of-Common-Services/userconf/config_user.properties

Setting
```
CS_PORTAL_SSL_CERTIFICATE_CHECK=true
```
Restart the Common Services service.

The SSL communication configuration is complete.

Configuring a link to an Active Directory or LDAP server

By linking Hitachi Ops Center with an external Active Directory or LDAP server, you can perform centralized user authentication on the Active Directory or LDAP server. To link with an Active Directory or LDAP server, configure the settings on the Hitachi Ops Center Portal.

Configuring Active Directory as a directory service for Ops Center

You can add a directory service and configure authentication for the Ops Center portal so that AD groups can access portal functions and products with a single sign-in.

For LDAP configurations, verify you completed the procedure described in Importing certificates into the Common Services truststore.
For Kerberos configurations, see Setting up Kerberos authentication for Ops Center before following this procedure.

About using multiple Active Directory servers

You can configure a maximum of four Active Directory servers.
The Users screen of the Ops Center portal is designed to display up to 1100 users. If the total number of local users and Active Directory users exceeds 1100, the additional users will be able to log in to Ops Center, but will not be displayed on the Users screen.
User names and email addresses must be unique and not duplicated across multiple Active Directory servers.
If the BIND password is invalid on one of several Active Directory servers registered with Common Services, or if a connection cannot be made to an Active Directory server, the following operations are not possible:
- Create new local user
- Display local user list
- Update user profile

Note: Whenever you make changes to existing Active Directory settings, you must do the following:

Click Sync groups to apply the changes to Active Directory groups configured in Ops Center.
Click Test connection and Test authentication.

If any errors are reported, confirm the changes are valid.

Log in to the Ops Center portal as sysadmin or a user with opscenter-administrators membership.
From the navigation bar, click Manage users and select User directories from the Asset type list.
Click the + (plus) icon.
The Add user directory service window opens.
Enter a name for the service.
Select Active directory for the Directory service type.
Select the Authentication protocol.
LDAP is the default protocol. If you choose Kerberos, select the Realm name from the displayed list.
Enter the Connection URL (for example: ldaps://ldaps.example.com) and then click Test connection.

Note: Specify the same host name as the CN or SANs in the Active Directory server certificate.
Enter the BIND user DN (for example: CN=bind-user,OU=foo,OU=bar,DC=example,DC=com) and the password and then click Test authentication.

Note: The BIND User DN only requires read permissions (not admin or modify).
Enter the User base DN (for example: OU=foo,OU=bar,DC=example,DC=com).

Note: To have portal access, users must be included in the subtree of the DN specified in the User base DN.
You can import a maximum of 1000 AD users. Click Pre-check the number of imported users. If you exceed this limit, you can decrease the number of users to be imported by using a Custom user LDAP filter. For best results, use a filter to specify a user or group. Here are some examples:
Note: The following search conditions are set automatically and cannot be changed:
```
objectclass="person,organizationalPerson,user"
scope=2(subtree)
```
To select the sAMAccountName t_brady:
```
(sAMAccountName=t_brady)
```
To select multiple sAMAccountName instances:
```
(|(sAMAccountName=t_brady)(sAMAccountName=p_manning)(sAMAccountName=a_rodgers))
```
To select users belonging to group1:
```
(memberOf=cn=group1,ou=example)
```
To select users belonging to group1 or group2:
```
(|(memberOf=cn=group1,ou=example)(memberOf=cn=group2,ou=example))
```
For information on how to query a user or group DN from Active Directory, see Using dsquery to obtain user or group DN.
By default, the Add all users under User base DN to opscenter-users group option is not available. This means that only members of groups (next step) are permitted to log in to the portal. If you enable this option, all users under the User base DN are assigned to the opscenter-users group and can also log in.
Provide entries for the Group entry list. For example, if you created AD groups named sanadmin and sanoperator, you can eventually assign roles and permissions appropriate to each group, as in this example:
```
"CN=sanadmin,CN=Users,DC=home,DC=us"
"CN=sanoperator,CN=Users,DC=home,DC=us"
```
Click +Add Group DN to add entries.
Note: The group DN must be included in the subtree of the DN specified in the Group base DN.
Click Submit when the settings are complete. If the "Number of users outside of range" error is still displayed, change the Custom user LDAP filter to reduce the number of users to be added. You can use the Pre-check the number of users (filter) to confirm the results before resubmitting.

Note: If a group name collides with an existing group name, a KAOP20008-E error is displayed, possibly including "Failed to sync groups" along with name of the directory service. If this occurs, change the name of the existing user group on the Groups screen.

The Active Directory entries are added to Manage users > Groups and are displayed with the DN designation.
AD users cannot be added to local (non-AD) groups.

By default, AD group users are assigned the opscenter-user role, which permits them to log in to the Ops Center portal and access the Inventory tab, but not start Ops Center products. To assign a role to an AD group that permits users access to administrative functions outside the Inventory tab and log in to all Ops Center products with full admin privileges, you can assign the opscenter-system-administrator role. See Assigning portal-level roles to Ops Center groups for more information.
To assign product-level roles to an AD group that permit members to access individual Ops Center products, see Assigning product-level roles from the Ops Center portal for more information.
Confirm the Active Directory entries appear in Manage users > Groups.
Verify Active Directory users can log in. AD users must log in using the sAMAccoutName (no domain).

Using dsquery to obtain user or group DN

You can use the following PowerShell commands to obtain the DN for a user or group.

To get the user DN:

dsquery user

To retrieve the user details (all attributes):

dsquery * user_DN -scope base -attr *

To get the group DN:

dsquery group

To retrieve the group details (all attributes):

dsquery * group_DN -scope base -attr *

Setting up Kerberos authentication for Ops Center

You can configure Kerberos authentication for the Ops Center directory service.

Note: Whenever you make changes to Kerberos authentication, make sure to retest the authentication for the Directory service (in Manage users > User directories).

Log in to the Ops Center portal as sysadmin or a user with opscenter-administrators membership.
From the navigation bar, click Manage users and select User directories from the Asset type list.
Click Kerberos connection settings.
To use DNS instead of KDC to look up the Kerberos server, enable DNS lookup KDC.
Use Clock skew to control the maximum time difference between the system clocks on the Ops Center server and the Kerberos server (default: 300 seconds). When this value is exceeded, an authentication error occurs.
Enter the Realm name that identifies the Kerberos domain. The Realm name is case-sensitive and must match the realm to which you are linking. Although the realm can be any ASCII string, the convention is to make it the same as the domain name in upper-case letters (such as EXAMPLE.COM).
If you are not using DNS, click +Add KDC to provide a list of Kerberos KDC server entries.
Click Submit when the settings are complete.

Configuring a non-AD directory service for Ops Center (LDAP server)

You can configure any directory service that supports the LDAP authentication protocol (such as Tivoli) for the Ops Center portal and import users from the server. This permits the users to access portal functions and products with a single sign-in. (Only LDAP is supported for non-AD directory services.)

Verify you completed the procedure described in Importing certificates into the Common Services truststore.

Note: Whenever you make changes to LDAP server settings, you must do the following:

Click Sync users to apply the changes to the users configured in Ops Center.
Click Test connection and Test authentication.
Click Pre-check the number of imported users.

If any errors are reported, confirm the changes are valid.

Log in to the Ops Center portal as sysadmin or a user with opscenter-administrators membership.
From the navigation bar, click Manage users and select User directories from the Asset type list.
Click the + (plus) icon.
The Add user directory service window opens.
Enter a name for the service.
Select Other for the Directory service type.
The LDAP Authentication protocol is automatically selected.
Enter the Connection URL (for example: ldaps://ldaps.example.com) and then click Test connection.

Note: Specify the same host name as the CN or SANs in the LDAP server certificate.
Enter the BIND user DN (for example: CN=bind-user,OU=foo,OU=bar,DC=example,DC=com) and the password and then click Test authentication.

Note: The BIND User DN only needs read permissions (not admin or modify).
Enter the User base DN (for example: OU=foo,OU=bar,DC=example,DC=com).

Note: To have portal access, users must be included in the subtree of the DN specified in the User base DN.

Configure the following LDAP settings:

Item	Description	Default value
User object classes	Object class of the imported user	Examples: inetOrgPerson, organizationalPerson Note: Use commas to separate entries.
Search scope	One level (flat), or Subtree.	Subtree
Custom user LDAP filter (optional)	Search filter to narrow results. (Must be specified in rfc2254 format.) The filter only applies to user entry attributes (not DN objects).	Examples: (\|(cn=t_brady)(cn=j_smith)(cn=orion_admin)) (ou=Storage management)
LDAP attribute for username	Attribute that uniquely identifies the imported user.	uid

You can import a maximum of 100 users. Click Pre-check the number of imported users. If you exceed the limit, you can decrease the number of users by using the Custom user LDAP filter.

Configure the following attributes to be used when importing the users:

Item	Description	Default value
LDAP attribute for first name	Imported user's first name. Select Full name or First name.	For Full name, cn is the default value. For First name, givenName is the default value.
LDAP attribute for last name	Imported user's last name	sn
LDAP attribute for email	Imported user's email address	mail
LDAP attribute for RDN	Attribute used as RDN (top attribute) of typical user DN (usually the same as Username LDAP attribute).	uid
LDAP attribute for UUID	Attribute used for UUID	entryUUID

By default, the Add all users under User base DN to opscenter-users group option is not available. If you enable this option, all users under the User base DN are automatically assigned to the opscenter-users group and can also log in. If the option is not available, you have to add the imported users to a local group manually and assign the opscenter-user role to permit them to log in.
Click Submit when the settings are complete.
When you are returned to the User directories window, click Sync users. The LDAP server users are then imported into the Ops Center portal.

The imported LDAP server users are added to Manage users > Users and are displayed with the DN designation.

If you enabled the Add all users under User base DN to opscenter-users group option, the imported LDAP server users can log in to the Ops Center portal and access the Inventory tab. To assign a role to a group that permits access to administrative functions outside the Inventory tab and log in to all Ops Center products with full admin privileges, you can assign the opscenter-system-administrator role. See Assigning portal-level roles to Ops Center groups for more information.
To assign product-level roles to a group that permits members to access individual Ops Center products, refer to Assigning product-level roles from the Ops Center portal for more information.
Confirm the LDAP server entries appear in Manage users > Users.
Verify the LDAP server users can log in.

Determining the parameters for LDAP server registration

If you want to link with an LDAP server, when you register the link with the LDAP server in Common Services, you must set parameters to import users.

Run the ldapsearch command, and then determine the parameters based on the information returned by the search.

From the management server, run the ldapsearch command.

Example of the command syntax:

ldapsearch -h host-name-or-IP-address-of-the-LDAP-server -b user-base-DN-to-be-found -D bind-dn -w password-of-the-bind-DN -L -s scope-of-the-search ["ldap-filter"]

For details, see the LDAP server documentation.

Example of running command:

ldapsearch -h example.com -b "CN=Users,DC=example,DC=com" -D "CN=admin,CN=Users,DC=example,DC=com" -w sysadmin -L -s sub "(objectclass=*)"

Example of LDIF data:

dn: CN=John Smith,CN=Users,DC=example,DC=com
objectClass: person
objectClass: organizationalPerson
uid: j_smith
cn: John Smith
sn: Smith
givenName: John
distinguishedName: CN=John Smith,CN=Users,DC=example,DC=com
whenCreated: 20200710022002.0Z
whenChanged: 20210603075422.0Z
memberOf: CN=opscenter_users,CN=Users,DC=example,DC=com
mail: j_smith@example.com
objectGUID:: hMekv/PMMkyVnykQ5AeMyQ==
description: type1

dn: CN=Tom Brady,CN=Users,DC=example,DC=com
objectClass: person
objectClass: organizationalPerson
uid: t_brady
cn: Tom Brady
sn: Brady
givenName: Tom
distinguishedName: CN=Tom Brady,CN=Users,DC=example,DC=com
whenCreated: 20200710022057.0Z
whenChanged: 20210601074245.0Z
memberOf: CN=hcs_users,CN=Users,DC=example,DC=com
mail: t_brady@example.com
objectGUID:: pZtOMo29j0CSoFnJrkL3EQ==
description: type2

Based on the displayed LDIF data, determine the parameter information to set in Common Services.

The following table shows an example of the correspondence between the settings in Common Services and the LDAP attributes.

Setting in Common Services	LDAP user attribute
LDAP attribute for username	`uid`
LDAP attribute for email	`mail`
LDAP attribute for last name	`sn`
Full name^*	`cn`
First name^*	`givenName`
LDAP attribute for RDN	`cn`
LDAP attribute for UUID	`objectGUID`
User object classes	`organizationalPerson`
Custom user LDAP filter	`(description=type1)`
*: Set one of these settings.

You can specify a search filter in Custom User LDAP Filter to narrow down the users to be imported. (The syntax must conform to RFC 2254.)

Configuring a link to an AD FS identity provider

By linking Common Services with an identity provider, you can delegate Hitachi Ops Center Portal authentication. You can also use the Multi Factor Authentication (MFA) functionality provided by the identity provider.

The procedure for configuring a link differs depending on the type of identity provider. You can configure a link to AD FS by following the steps listed in the Workflow for linking with AD FS to workflow topic. For details on the procedure for configuring a link to an identity provider other than AD FS, see Configuring a link to a non-AD FS identity provider.

Supported AD FS

Common Services supports the following for AD FS.

Item	Description
Identity provider	Active Directory Federation Services (AD FS)
Protocol	OpenID Connect (OIDC) Security Assertion Markup Language (SAML)
OS	The supported AD FS must support the following operating systems: Windows Server 2016 Datacenter Windows Server 2019 Datacenter Windows Server 2022 Datacenter Windows Server 2025 Datacenter
Maximum number of linked providers	1 If a link is already established with AD FS, you cannot configure links to other identity providers.

Workflow for linking with AD FS

Use the following workflow to specify settings for AD FS:

The workflow for specifying settings depends on the protocol being used.

If you want to use OIDC:

Register Common Services in AD FS as an application group.
Set up an issuance transform rule for AD FS.
Check the OpenID Connect Discovery endpoint of AD FS.
Register AD FS with Common Services.
Log in to the Hitachi Ops Center Portal as an AD FS user.

If you want to use SAML:

Check the AD FS metadata endpoint.
Register AD FS with Common Services.
Export Common Services metadata.
Register Common Services in AD FS as a relying party.
Set up a claim issuance policy.
Log in to the Hitachi Ops Center Portal as an AD FS user.

Before using Common Services to specify the settings to link with AD FS, you must install and configure AD FS.

To link with AD FS, you must specify SSL communication settings in advance for the route from Common Services to the AD FS server. For details, see Configuring SSL communications.

Note: If you are using a host name for the Common Services access URL, the host name of the management server must be resolvable by the AD FS server.

Configuring settings to link with AD FS (OIDC)

To link with AD FS by using the OIDC protocol, configure settings as follows.

Registering Common Services in AD FS as an application group

By registering Common Services in AD FS as an application group, you can transfer authentication for the Hitachi Ops Center Portal to AD FS.

The following settings are also necessary for registering AD FS in Common Services and must be determined in advance:

AD FS alias name

The alias name is an identifier that uniquely identifies AD FS in Common Services. You can specify up to 64 characters consisting of halfwidth alphabetic characters (lowercase only), numeric characters, hyphens, and underscores. You cannot change the registered value later.

Example:

adfs_oidc_ad5
URI of the Web API identifier

The Web API identifier is an identifier that AD FS uses to uniquely identify Common Services. Although you can specify any valid character string, a good practice is to use a name that is easy to identify (such as the host name of the Common Services management server).

Example:

https://common_services_host

Log in to the AD FS server.
Select Start > Windows Administrative Tools > AD FS Management.
From the tree on the left side, select AD FS > Application Groups. In the pane on the right side, click Application Groups > Add Application Group.
In the Welcome window, complete the following information, and then click Next:

Name

A name of your choice.

Template

Select Server application accessing a web API.
In the Server application window, complete the following information, and then click Next:

Client Identifier

Record this information for when you register AD FS in Common Services.

Redirect URI

Specify the host name and port number of the Common Services management server, along with the AD FS alias name:
https://host-name:port-number/auth/realms/opscenter/broker/alias-name/endpoint
For alias-name, specify the AD FS alias name that you determined in advance.
In the Configure Application Credentials window, select the Generate a shared secret check box.
Make a note of the Secret for when you register AD FS in Common Services.
Click Next.
In the Configure Web API window, for Identifier, specify the URI of the Web API identifier that you determined in advance, click Add, and then click Next.
In the Choose Access Control Policy window, specify an access control policy, and then click Next.
In the Configure Application Permissions window, select the following check boxes for Permitted scopes, and then click Next.
- allatclaims
- email
- openid
- profile
In the Summary window, make sure that the settings are correct, and then click Next.
In the Finish window, click Close.

Setting up an issuance transform rule for AD FS

Set up an issuance transform rule for the Common Services instance registered as an application group in AD FS. The login information for the Hitachi Ops Center Portal is transmitted to Common Services based on these settings.

Log in to the AD FS server.
Select Start > Windows Administrative Tools > AD FS Management.
From the tree on the left, select AD FS > Application Groups. In the middle pane, select the application group for Common Services, and then in the right pane, click Properties.
The properties window for the application group appears.
For Applications, select application-group-name- Web API and then click Edit.
The properties window for the Web API appears.
On the Issuance Transform Rules tab, click Add Rule.
The Add Transform Claim Rule Wizard dialog box opens.
In the Select Rule Template window, select Send LDAP Attributes as Claims for Claim rule template, and then click Next.

In the Configure Rule window, complete the following information, and then click Finish.

Claim rule name

A name of your choice

Attribute store

Select Active Directory.

Mapping of LDAP attributes to outgoing claim types

Set the following values.

Value to specify for LDAP Attribute	Value to specify for Outgoing Claim Type
Either of the following LDAP attributes for which an email address is registered in the system: User-Principal-Name E-Mail-Addresses	E-Mail Address
Given-Name	Given Name
Surname	Surname
Token-Groups - Qualified by Domain Name	Group

Note: For the Active Directory user for the Hitachi Ops Center Portal, make sure that the email address, surname, and given name are set for the LDAP attributes that you specify. If this information is not set, the user cannot log in.

Verify that the Claim rule has been added to the Issuance Transform Rules tab, and then click OK.

Checking the OpenID Connect Discovery endpoint of AD FS

Obtain the OpenID Connect Discovery endpoint needed to register AD FS in Common Services.

Log in to the AD FS server.
Select Start > Windows Administrative Tools > AD FS Management.
Check the OpenID Connect Discovery endpoint of AD FS.

From the tree on the left side, select AD FS > Service > Endpoints. From the displayed endpoint information, check the value of URL Path in the row where the Type is OpenID Connect Discovery.

To obtain the endpoint, simply append the base URI of AD FS to the displayed URL.

Example:

https://adfs.example.com/adfs/.well-known/openid-configuration

Make a note of the OpenID Connect Discovery endpoint because you will need it when you register AD FS in Common Services.

Registering AD FS with Common Services

You must register AD FS with Common Services as an identity provider.

Log in to the Hitachi Ops Center Portal as the sysadmin user or as a user who belongs to the opscenter-administrators group.
From the navigation bar, click Manage users.
In the Users window, from the Asset type, click Identity providers.
In the Identity Providers window, click ＋.

In the wizard, enter and register the following information.

Item	Value
Provider type	Active Directory Federation Services
Federation protocol	OpenID connect 1.0
Display name	Name of the identity provider (up to 64 characters).
Alias	Alias name that was decided on in Registering Common Services in AD FS as an application group
OpenID connect discovery endpoint	The endpoint that was verified in Checking the OpenID Connect Discovery endpoint of AD FS.
Enabled	If you specify Enable, the identity provider is enabled and the Log in using external identity provider link appears in the login window.
Client ID	The AD FS client identifier that was displayed in Registering Common Services in AD FS as an application group.
Client secret	The AD FS secret name that was displayed in Registering Common Services in AD FS as an application group.
Web API identifier	URI of the Web API identifier used in Registering Common Services in AD FS as an application group.
Allowed clock skew	Acceptable time difference between the management server where Common Services is installed and the AD FS server. If the time difference between the servers exceeds this value, you cannot use AD FS to log in. Valid values are 0 to 300 (seconds). Default: 300
Default group mappers	Local user group used as the default. (Optional) When AD FS user authentication succeeds, the user is imported into Common Services as a local user, and the local user group specified for this item is assigned. Maximum number of groups is 10.
Custom group mappers	A pair consists of an AD FS user group and a local user group. (Optional) When AD FS user authentication succeeds, the user is imported into Common Services as a local user. If the user belongs to an AD FS user group specified in the Custom group mappers, the corresponding local user group is assigned. Maximum number of pairs is 10. Specify the AD FS user group name in Windows Domain Qualified Name format. Example: `domain\cs_admin_group`

Tip: When the default group mapper is defined, all users that belong to AD FS are assigned to that group when they log in.

By contrast, the custom group mapper requires that each AD FS user be assigned to the group before they can log in.

AD FS users are assigned whatever privileges belong to the local group to which they are mapped. For this reason, you should not use the opscenter-administrators as the default group mapper.

An Ops Center administrator can assign group membership individually to AD FS users instead of depending on the group mappers.

Logging in to the Hitachi Ops Center Portal as an AD FS user

After completing the settings for linking with the AD FS, confirm that you can log in to the Hitachi Ops Center Portal from a browser as an AD FS user.

In a web browser, access the following URL:

https://host-name-or-IP-address-of-Portal:port-number/portal
In the login window, click Log in using external identity provider.
The AD FS login window opens.
Log in as an AD FS user.
When the AD FS user is successfully authenticated, you are logged in to the Hitachi Ops Center Portal.
Log in again as the sysadmin user or as a user who is a member of the opscenter-administrators group. Then, select Manage users > Users, and check whether the following items of the AD FS user are set correctly: the username, last name, first name, email address, and the user group specified for Default group mappers and Custom group mappers.

This completes the settings for linking with the AD FS.

Configuring settings to link with AD FS (SAML)

To link with AD FS by using the SAML protocol, configure settings as follows.

Checking the AD FS metadata endpoint

Check the metadata endpoint required to register AD FS in Common Services.

Log in to the AD FS server.
Select Start > Windows Administrative Tools > AD FS Management.
Check the AD FS metadata endpoints.
From the tree on the left side, select AD FS > Service > Endpoints. From the displayed endpoint information, check the value of URL Path in the row where the Type is Federation Metadata.

The string obtained by adding the AD FS base URI to the above URL is the AD FS metadata endpoint.

Example:

https://adfs.example.com/FederationMetadata/2007-06/FederationMetadata.xml

Make note of the endpoint because you need it for registering AD FS with Common Services.

Registering AD FS with Common Services

You must register AD FS with Common Services as an identity provider.

Log in to the Hitachi Ops Center Portal as the sysadmin user or as a user who is a member of the opscenter-administrators group.
From the navigation bar, click Manage users.
In the Users window, from the Asset type, click Identity providers.
In the Identity Providers window, click ＋.

In the wizard, enter and register the following information.

Item	Value
Provider type	Active Directory Federation Services
Federation protocol	SAML 2.0
Display name	Name of the identity provider (up to 64 characters).
Alias	Alias name used to uniquely identify the identity provider (up to 64 characters). Valid character types are half-width alphabetical characters (lowercase only), numbers, hyphens, and underscores. You cannot change the registered value later.
AD FS endpoint metadata URI	Endpoint defined in Checking the AD FS metadata endpoint.
Enabled	If you specify Enable, the identity provider is enabled and the Log in using external identity provider link appears in the login window.
NameID Policy Format	Format used for the username when the AD FS user is imported as a Common Services local user: Windows Domain Qualified Name Email Unspecified
Allowed clock skew	Acceptable time difference between the management server where Common Services is installed and the AD FS server. If the time difference between the servers exceeds this value, you cannot use AD FS to log in. Valid values are 0 to 300 (seconds). Default: 300
Default group mappers	Local user group used as the default. (Optional) When AD FS user authentication succeeds, the user is imported into Common Services as a local user, and the local user group specified for this item is assigned. Maximum number of groups is 10.
Custom group mappers	A pair consists of an AD FS user group and a local user group. (Optional) When AD FS user authentication succeeds, the user is imported into Common Services as a local user. If the user belongs to an AD FS user group specified in the Custom group mappers, the corresponding local user group is assigned. Maximum number of pairs is 10. Specify the AD FS user group name in Windows Domain Qualified Name format. Example: `domain\cs_admin_group`

Tip: When the default group mapper is defined, all users that belong to AD FS are assigned to that group when they log in.

By contrast, the custom group mapper requires that each AD FS user be assigned to the group before they can log in.

AD FS users are assigned whatever privileges belong to the local group to which they are mapped. For this reason, you should not use the opscenter-administrators as the default group mapper.

An Ops Center administrator can assign group membership individually to AD FS users instead of depending on the group mappers.

Exporting Common Services metadata (AD FS)

To link with AD FS, you must register Common Services metadata into AD FS. From the Hitachi Ops Center Portal, output the metadata to a file, and then send the file to the AD FS server.

Log in to the Hitachi Ops Center Portal as the sysadmin user or as a user who is a member of the opscenter-administrators group.
In the navigation bar, click Manage users.
In Asset type in the Users window, click Identity providers.
In the Identity Providers window, click the target AD FS.
In the Identity provider details window, click Download metadata.
The Common Services metadata file is downloaded. Transfer this file to the AD FS server.

Registering Common Services in AD FS as a relying party

By registering Common Services in AD FS as a relying party, you can transfer authentication for the Hitachi Ops Center Portal to AD FS.

Log in to the AD FS server.
Select Start > Windows Administrative Tools > AD FS Management.
From the tree on the left side, select AD FS > Relying Party Trusts. In the pane on the right side, click Relying Party Trusts > Adding Relying Party Trust.
In the Welcome window, select Claims aware, and then click Start.
In the Select Data Source window, select Import data about the relying party from file. For Federation metadata file location, specify the file to which the Common Services metadata was exported, and then click Next.
In the Specifying Display Name window, specify a display name, and then click Next.
In the Choose Access Control Policy window, specify an access control policy, and then click Next.
In the Ready to Add Trust window, make sure that the settings are correct, and then click Next.
In the Finish window, select the Configure claims issuance policy for this application check box, and then click Close.

Setting up a claim issuance policy

Set up a claim issuance policy for the Common Services instance registered as a relying party in AD FS. The user attribute information imported when the user logs in to the Hitachi Ops Center Portal is transmitted to Common Services based on the claim issuance policy settings.

Log in to the AD FS server.
Select Start > Windows Administrative Tools > AD FS Management.
From the tree on the left, select AD FS > Relying Party Trusts. In the middle pane, select the relying party trust for Common Services, and then in the right pane, click Edit Claim Issuance Policy....
The Edit Claim Issuance Policy dialog box opens.
On the Issuance Transform Rules tab, click Add Rule.
The Add Transform Claim Rule Wizard dialog box opens.
Select Transform an Incoming Claim for the claim rule template, and then click Next.

Specify the following items:

Claim rule name

A name of your choice

Outgoing claim type

The Name ID

Incoming claim type and Outgoing name ID format

Depending on the value specified for NameID Policy Format in Registering AD FS with Common Services, specify the values as follows:

Value specified for NameID Policy Format	Value to specify for Incoming claim type	Value to specify for Outgoing name ID format
Windows Domain Qualified Name	Windows account name	Windows Qualified Domain Name
Email	Either of the following LDAP attributes for which an email address is registered in the system: UPN (User-Principal-Name) E-Mail Address	Email
Unspecified	UPN	UPN

Value specified for NameID Policy Format

Value to specify for Incoming claim type

Value to specify for Outgoing name ID format

Windows Domain Qualified Name

Windows account name

Windows Qualified Domain Name

Either of the following LDAP attributes for which an email address is registered in the system:

UPN (User-Principal-Name)
E-Mail Address

Unspecified

UPN

Pass through all claim values

Select this item to turn it on.

Click Finish.
The claim rule is added to the Edit Claim Issuance Policy dialog box. The values specified here are transmitted to Common Services upon the following claim:
```
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
```
In the Edit Claim Issuance Policy dialog box, click Add Rule again.
The Add Transform Claim Rule Wizard dialog box opens.
Select Send LDAP Attributes as Claims for the claim rule template, and then click Next.

Specify the following items:

Claim rule name

A name of your choice

Attribute Store

Active Directory

Mapping of LDAP attributes to outgoing claim types

Specify values for the following attributes:

LDAP Attribute	Value
Either of the following LDAP attributes for which an email address is registered in the system: User-Principal-Name E-Mail-Addresses	E-Mail Address
Given-Name	Given Name
Surname	Surname
Token-Groups - Qualified by Domain Name	Group

Note: Make sure that the email address, surname, and given name of the Active Directory user for the Hitachi Ops Center Portal are set for the LDAP attributes that you specify. If this information is not set, the user cannot log in.

Click Finish.

The claim rule is added to the Edit Claim Issuance Policy dialog box. The values specified are transmitted to Common Services through the following claims:

E-Mail Address:

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

Given Name:

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname

Surname:

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname

Group:
```
http://schemas.xmlsoap.org/claims/Group
```

In the Edit Claim Issuance Policy dialog box, change the order of priority to the following, and then click OK.
1. The rule specified for the Send LDAP Attributes as Claims
2. The rule specified for the Transform an Incoming Claim
To make sure the specified information is correct, select AD FS > Service > Claim Descriptions.

Logging in to the Hitachi Ops Center Portal as an AD FS user

After completing the settings for linking with the AD FS, confirm that you can log in to the Hitachi Ops Center Portal from a browser as an AD FS user.

In a web browser, access the following URL:

https://host-name-or-IP-address-of-Portal:port-number/portal
In the login window, click Log in using external identity provider.
The AD FS login window opens.
Log in as an AD FS user.
When the AD FS user is successfully authenticated, you are logged in to the Hitachi Ops Center Portal.
Log in again as the sysadmin user or as a user who is a member of the opscenter-administrators group. Then, select Manage users > Users, and check whether the following items of the AD FS user are set correctly: the username, last name, first name, email address, and the user group specified for Default group mappers and Custom group mappers.

This completes the settings for linking with the AD FS.

Note: If you link with AD FS by using the SAML protocol, you must periodically update the certificate used for user authentication. For details, see Updating the authentication certificates used with an AD FS (SAML).

Updating an identity provider configuration

You can update the identity provider configuration in the Hitachi Ops Center Portal.

Log in to the Hitachi Ops Center Portal as sysadmin or a user with opscenter-administrators membership.
From the navigation bar, click Manage users.
In the Users window, from the Asset type, click Identity providers.
Click the edit icon (pencil) for the identity provider.
Update the information and then click Next to proceed through all the entry windows.
Click Submit when you reach the last window and your changes are complete.

Removing an identity provider

You can remove an identity provider from Ops Center.

Log in to the Hitachi Ops Center Portal as sysadmin or a user with opscenter-administrators membership.
From the navigation bar, click Manage users.
In the Users window, from the Asset type, click Identity providers.
Click the delete icon (trash can) for the identity provider.
Click Submit in the Delete dialog box.

Updating the authentication certificates used with an AD FS (SAML)

This section explains how to check the date of the next update of a certificate, update a certificate, and change the number of days set as the update interval of the Common Services authentication key and AD FS Token certificates that are used with AD FS.

If you link with AD FS by using the OIDC protocol, you do not need to perform this procedure.

Overview of updating authentication certificates (AD FS)

For AD FS, Common Services and AD FS certificates are used during user authentication.

Common Services certificates are called authentication keys, and AD FS certificates are called Token certificates.

Each certificates has an expiration date and certificates are automatically updated according to a defined interval (in days).

However, when a certificate is automatically updated, a discrepancy arises between the new certificate and the certificate that was registered when the link with AD FS was configured. For this reason, you will no longer be able to log in to Common Services by using the AD FS user account. To prevent this problem, you must check the date of the next update of the certificate and update the certificate before the expiration date.

If it is inconvenient to update the authentication key of Common Services immediately, you can temporarily suppress the update by increasing the number of days set as the update interval. Although you can also change the update interval of AD FS Token certificates, the change is not applied to the certificates currently used. The new update interval is applied to the certificates that will be updated next time.

Tip: If you manually update the Common Services certificate, we recommend that you specify the same update interval for the Common Services authentication key and for the AD FS Token certificates, because this enables you to update both on the same day. Update certificates during a time when no user is logged in (such as on a holiday or during the night).

Checking the next update for the Common Services certificates

Check the date of the next update of the authentication key for Common Services.

Log in to the Hitachi Ops Center Portal as the sysadmin user or as a user who is a member of the opscenter-administrators group.

Note: If the date of the next update of the authentication key will occur within 30 days, a message to that effect is displayed when you log in.
Select Settings > Authentication key, and then check the value displayed for Authentication key next update date (UTC).

Checking the dates of the next update of the AD FS certificates

Check the dates of the next update of the Token certificates of AD FS.

Log in to the AD FS server.
Select Start > Windows Administrative Tools > AD FS Management.
From the tree on the left side, select AD FS > Service > Certificates.
Check the value of Expiration Date for Token-decrypting and Token-signing in the middle pane.

Updating the Common Services certificates (AD FS)

Common Services certificates are automatically updated to prevent revocation due to expiration. When a certificate is automatically updated, you need to update the Common Services certificate registered on the AD FS server. There are two ways to update certificates: automatically or manually.

Automatically updating the Common Services certificates

To automatically update Common Services certificates, perform the following procedure. Use the Relying Party Trust Monitoring function of AD FS to ensure that Common Services metadata is updated automatically.

Note: After the certificate is automatically updated in Common Services, it might take up to 24 hours until the certificate is updated by the AD FS Monitoring function. Until it is updated, you will not be able to log in to the Hitachi Ops Center Portal as an AD FS user.

Verify that the following settings are configured:

If the Windows Server version is 2019 or earlier, verify that Common Services certificates are signed with ECDSA.
Verify that TLS 1.2 or higher is enabled in the .NET Framework settings of the AD FS server.

Log in to the Hitachi Ops Center Portal as the sysadmin user or as a user who is a member of the opscenter-administrators group.
From the navigation bar, click Manage users.
In Asset type in the Users window, click Identity providers. In the target identity provider details window, check the value of SAML SP metadata URI.
Log in to the AD FS server.
Select Start > Windows Administrative Tools > AD FS Management.
From the tree on the left side, select AD FS > Relying Party Trusts. In the middle pane, select the target Relying Party Trust, and then in the right pane, click Properties.
In the properties window, select the Monitoring tab, and enter the value of SAML SP metadata URI that you checked in the identity provider details window of the Hitachi Ops Center Portal in Relying party's federation metadata URL.
Click Test URL to confirm. If an error occurs, review the SSL/TLS settings of Windows.
Select the check box for Monitoring relying party.
Select the check box for Automatically update relying party.
Click Apply.

Manually updating the Common Services certificates

To manually update Common Services certificates, perform the following procedure. If the date of the next update of the authentication key of Common Services is approaching, update the authentication key and the metadata. You can also change the update interval of the authentication key without actually updating the key.

Log in to the Hitachi Ops Center Portal as the sysadmin user or as a user who is a member of the opscenter-administrators group.
Select Settings > Authentication key.

The Authentication key window appears.
To change the update interval of the authentication key, change the value of Authentication Key update interval (days).

The default value is 180 days (with a range of 90 to 3,650). From a security standpoint, we recommend 90-180 days.
For Update Authentication key now, select Yes.

If you want to change the update interval without updating the authentication key, select No.
Click Submit.

If you selected No for Update Authentication key now, skip the remaining.
Export the metadata of Common Services.
For details, see Exporting Common Services metadata (AD FS).
Log in to the AD FS server.
Select Start > Windows Administrative Tools > AD FS Management.
From the tree on the left side, select AD FS > Relying Party Trusts.
In Relying Party Trusts, check the value of Identifier for the Common Services instance that is registered.

Run the following command in PowerShell:

Update-AdfsRelyingPartyTrust -MetadataFile absolute-path-of-the-metadata-file -TargetIdentifier ID-of-the-relying-party

For ID-of-the-relying-party, specify the value of Identifier for Common Services (checked in the previous step).

Example of running the command:

Update-AdfsRelyingPartyTrust -MetadataFile C:\temp\metadata.xml -TargetIdentifier https://www.example.com:8443/auth/realms/opscenter

For details on the command, see the AD FS documentation.

Updating the AD FS certificates

Run the AD FS command Update-AdfsCertificate to update the Token certificates. After updating the certificates, you must specify the metadata endpoint for AD FS from the Hitachi Ops Center Portal, and then update the information about AD FS registered in Common Services.

Note: For details about Token certificates and the command, see the AD FS documentation.

Log in to the AD FS server.
To change the update interval of Token certificates, run the following command in PowerShell:
```
Set-AdfsProperties -CertificateDuration update-interval-(number-of-days)
```
The change will take effect the next time the Token certificates are updated after you change the update interval.
Example of 3 years:
```
Set-AdfsProperties -CertificateDuration 1095
```
If you want the change to take effect immediately, run the following command in PowerShell to update the Token certificates:
```
Update-AdfsCertificate -CertificateType Token-Decrypting -Urgent
Update-AdfsCertificate -CertificateType Token-Signing -Urgent
```
Log in to the Hitachi Ops Center Portal as the sysadmin user or as a user who is a member of the opscenter-administrators group.
In the navigation bar, click Manage users.
In Asset type in the Users window, click Identity providers.
Click the Edit identity provider icon for the registered identify provider.
For AD FS endpoint metadata URI, set the metadata endpoint for AD FS.
For details on how to check the metadata endpoint, see Checking the AD FS metadata endpoint.
Click Next without changing any other values.
In the Edit identity provider - confirmation window, click Submit.

If you cannot sign on with an identity provider (AD FS)

If you cannot sign on using AD FS, there are two possibilities:

Certificates for Common Services were updated.
In this scenario, if you cannot log in using AD FS, the following message is output to Applications and Services Logs > AD FS > Admin in the AD FS event log:

ID6013: The signature verification failed

For details on what to do when this message is output, see Updating the Common Services metadata by using AD FS.
Certificates for AD FS were updated.
In this scenario, if you cannot log in using AD FS, the following message is output Common Services log file (default: /var/log/hitachi/CommonService/idp/log/server.log):

ERROR [org.keycloak.broker.saml.SAMLEndpoint] (default task-14) validation failed

For details on what to do when this message is output, see Specifying the AD FS metadata endpoint by using Common Services.

Updating the Common Services metadata by using AD FS

You can update the Common Services metadata by using AD FS.

Export the metadata of Common Services.
For details, see Exporting Common Services metadata (AD FS).
Log in to the AD FS server.
Select Start > Windows Administrative Tools > AD FS Management.
From the tree on the left side, select AD FS > Relying Party Trusts.
In Relying Party Trusts, check the value of Identifier for the Common Services instance that is registered.

Run the following command in PowerShell:

Update-AdfsRelyingPartyTrust -MetadataFile absolute-path-of-the-metadata-file -TargetIdentifier ID-of-the-relying-party

For ID-of-the-relying-party, specify the value of Identifier for Common Services (checked in the previous step).

Example:

Update-AdfsRelyingPartyTrust -MetadataFile C:\temp\metadata.xml -TargetIdentifier https://www.example.com:8443/auth/realms/opscenter

For details on the command, see the AD FS documentation.

Specifying the AD FS metadata endpoint by using Common Services

You can specify the AD FS metadata endpoint by using Common Services.

Log in to the Hitachi Ops Center Portal as the sysadmin user or as a user who is a member of the opscenter-administrators group.
In the navigation bar, click Manage users.
In Asset type in the Users window, click Identity providers.
Click the Edit identity provider icon for the registered identity provider.
For AD FS endpoint metadata URI, set the metadata endpoint for AD FS.
For details on how to check the metadata endpoint, see Checking the AD FS metadata endpoint.
Click Next without changing any other values.
In the Edit identity provider - confirmation window, click Submit.