Install a multi-node deployment

Create a Redhat Linux Enterprise 8 or CentOS Stream 8 virtual machine: N2 4 core and 16 GB. Verify your operating system.

sudo cat /etc/centos-release

Set the user for the target node to autoid. In this example, create user autoid:

sudo adduser autoid
sudo passwd autoid
echo "autoid  ALL=(ALL)  NOPASSWD:ALL" | sudo tee /etc/sudoers.d/autoid
sudo usermod -aG wheel autoid
su - autoid

Optional. Install yum-utils package on the deployer machine. yum-utils is a utilities manager for the Yum RPM package repository. The repository compresses software packages for Linux distributions.

sudo yum install -y yum-utils

Install the following packages needed in the Autonomous Identity deployment:

Repeat this procedure for the other nodes.

On the deployer machine, change to the ~/.ssh directory.

cd ~/.ssh

Run ssh-keygen to generate an RSA keypair, and then click Enter. You can use the default filename.

ssh-keygen -t rsa -C "autoid"

Copy the SSH key to the autoid-config directory.

cp id_rsa ~/autoid-config

Change the privileges to the file.

chmod 400 ~/autoid-config/id_rsa

Copy your public SSH key, id_rsa.pub, to each of your nodes.

ssh-copy-id -i id_rsa.pub autoid@<Node IP Address>

On the deployer machine, test your SSH connection to each target machine. This is a critical step. Make sure the connection works before proceeding with the installation.

ssh -i id_rsa autoid@<Node 1 IP Address>

Last login: Sat Oct 3 03:02:40 2020

If you can successfully SSH to each machine, set the privileges on your ~/.ssh and ~/.ssh/authorized_keys.

chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys

Enter Exit to end your SSH session.

Repeat steps 5–8 again for each node.

On the Analytics Spark Main node, install nfs-utils. This step may require that you run the install with root privileges, such as sudo or equivalent.

sudo yum install -y nfs-utils

Create the /data directory.

mkdir -p /data

Change the permissions on the /data directory.

chmod -R 755 /data
chown nfsnobody:nfsnobody /data

Start the services and enable them to start at boot.

systemctl enable rpcbind
systemctl enable nfs-server
systemctl enable nfs-lock
systemctl enable nfs-idmap

systemctl start rpcbind
systemctl start nfs-server
systemctl start nfs-lock
systemctl start nfs-idmap

Define the sharing points in the /etc/exports file.

vi /etc/exports

/data  <Remote IP Address 1>(rw,sync,no_root_squash,no_all_squash)
/data  <Remote IP Address 2>(rw,sync,no_root_squash,no_all_squash)

Start the NFS service.

systemctl restart nfs-server

Add the NFS service to the firewall-cmd public zone service:

firewall-cmd --permanent --zone=public --add-service=nfs
firewall-cmd --permanent --zone=public --add-service=mountd
firewall-cmd --permanent --zone=public --add-service=rpc-bind
firewall-cmd --reload

On each spark worker node, run the following:

Create the autoid-config directory.

mkdir autoid-config

Change to the directory.

cd autoid-config

Log in to the ForgeRock Google Cloud Registry using the registry key. The registry key is only available to ForgeRock Autonomous Identity customers. For specific instructions on obtaining the registry key, refer to How To Configure Service Credentials (Push Auth, Docker) in Backstage.

docker login -u _json_key -p "$(cat autoid_registry_key.json)" https://gcr.io/forgerock-autoid

Login Succeeded

Run the create-template command to generate the deployer.sh script wrapper and configuration files. Note that the command sets the configuration directory on the target node to /config. The --user parameter eliminates the need to use sudo while editing the hosts file and other configuration files.

docker run --user=$(id -u) -v ~/autoid-config:/config -it gcr.io/forgerock-autoid/deployer-pro:2022.11.11 create-template

Create a certificate directory for elastic.

mkdir -p autoid-config/certs/elastic

Copy the Opensearch certificates and JKS files to autoid-config/certs/elastic.

Create a certificate directory for MongoDB.

mkdir -p autoid-config/certs/mongo

Copy the MongoDB certificates and JKS files to autoid-config/certs/mongo.

Create a certificate directory for Cassandra.

mkdir -p autoid-config/certs/cassandra

Copy the Cassandra certificates and JKS files to autoid-config/certs/cassandra.

Update the hosts file with the IP addresses of the machines. The hosts file must include the IP addresses for Docker nodes, Spark main/livy, and the MongoDB master. While the deployer pro does not install or configure the MongoDB main server, the entry is required to run the MongoDB CLI to seed the Autonomous Identity schema.

[docker-managers]

[docker-workers]

[docker:children]
docker-managers
docker-workers

[spark-master-livy]

[cassandra-seeds]
#For replica sets, add the IPs of all Cassandra nodes

[mongo_master]
# Add the MongoDB main node in the cluster deployment
# For example: 10.142.15.248 mongodb_master=True

[odfe-master-node]
# Add only the main node in the cluster deployment

Update the vars.yml file:

Download images:

./deployer.sh download-images

Install Apache Livy.

On the Spark-Livy machine, run the following commands to install the python package dependencies:

Make sure that the /opt/autoid directory exists and that it is both readable and writable.

Run the deployer script:

./deployer.sh run

On the Spark-Livy machine, run the following commands to install the Python egg file:

Start the Cassandra shell, cqlsh, and define the autoid keyspace. Change the replication factor to match the number of seed nodes. The default admin user for Cassandra is zoran_dba.

bin/cqlsh -u zoran_dba

zoran_dba@cqlsh> desc keyspace autoid;
CREATE KEYSPACE autoid WITH replication = {'class':'SimpleStrategy','replication_factor':'2'} AND durable_writes=true;

CREATE TABLE autoid.user_access_decisions_history(
  user text,
  entitlement text,
  date_created timestamp,
  …​

Restart Cassandra on this node.

Repeat these steps on the other Cassandra seed node(s).

Configure your DNS servers to access Autonomous Identity dashboard on the target node. The following domain names must resolve to the IP address of the target node:

<target-environment>-ui.<domain-name>

If DNS cannot resolve target node hostname, edit it locally on the machine that you want to access Autonomous Identity using a browser.

<Docker Mgr Node Public IP Address>  <target-environment>-ui.<domain-name>

<IP Address>  autoid-ui.forgerock.com

If you set up a custom domain name and target environment, add the entries in /etc/hosts. For example:

<IP Address>  myid-ui.abc.com

Open a browser. If you set up your own url, use it for your login.

https://autoid-ui.forgerock.com/

Log in as a test user.

test user: bob.rodgers@forgerock.com
password: <password>

Make sure Cassandra is running in cluster mode. For example

/opt/autoid/apache-cassandra-3.11.2/bin/nodetool status

Make sure MongoDB is running. For example:

mongo --tls \
--host <Host IP> \
--tlsCAFile /opt/autoid/mongo/certs/rootCA.pem  \
--tlsAllowInvalidCertificates  \
--tlsCertificateKeyFile /opt/autoid/mongo/certs/mongodb.pem

SSH to the target node and open Spark dashboard using the bundled text-mode web browser

elinks http://localhost:8080

Click to display an example of the Spark dashboard