RACF TLS Configuration

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi All,

Has anyone successfully implemented TLS for RACF Source? The documentation seems unclear and leaves several steps open to interpretation. Here are my questions for clarification:

  • The documentation at Configure TLS Between SailPoint and the Connector Gateway mentions using the API endpoint /api/source/update/sourceID, but it appears this endpoint has been deprecated. Therefore, the documentation needs to be updated to reflect the current API endpoints.

  • Additionally, the documentation discusses the use of a file called encryptionKeyFile but does not provide instructions on how to generate this file.

  • Regarding enabling Mutual TLS Authentication, Step 3 requires keystore information, but it’s unclear whether this refers to a custom keystore that needs to be created or the default keystore.jks file, which only the root user can access.

  • Furthermore, in Step 5, the documentation mentions exporting a certificate from VA, but it doesn’t specify which certificate this refers to or how to export it.

2

Hi Sunny

I’ve only recently been getting involved on this forum hence the late response on this - If you’ve managed to resolve this already, please post your findings too as I’m curious if anything has changed.

I had implemented RACF at a client some time back with TLS: this is what I recall in response to your questions:

Yes - the documentation does seem outdated and I imagine you will need to use the new either PUT or PATCH update source API calls. put-source | SailPoint Developer Community
update-source | SailPoint Developer Community

The encryptionKey needs to be produced within the Mainframe and exported as a key file which will be referenced here. The RACF team should be able to do this but this document might help, though I am not 100% certain:
https://www.ibm.com/docs/it/om-shared?topic=SSAUBV/com.ibm.itm.doc_6.2.3/zconfigtems87.html

The keystore will be a custom keystore file that needs to be generated using a keytool utility, I believe this is also done on the Mainframe: https://www.ibm.com/docs/en/semeru-runtime-ce-z/11?topic=guide-ibmzsecurity

The keystore will need to be exported from RACF and then imported on the VA to the /home/sailpoint/certificates folder.

Hope that helps

1 Like
3

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.