Chapter 5. Accessing the IdM Web UI in a web browser

Procedure

1. If you experience problems accessing the IdM Web UI with a smart card, check the logs to see if your browser attempts to use TLS v1.3. The output might look similar to the following:

   [ssl:error] [pid 125757:tid 140436077168384] [client 999.999.999.999:99999] AH: verify client post handshake
   [ssl:error] [pid 125757:tid 140436077168384] [client 999.999.999.999:99999] AH10158: cannot perform post-handshake authentication
   [ssl:error] [pid 125757:tid 140436077168384] SSL Library Error: error:14268117:SSL routines:SSL_verify_client_post_handshake:extension not received

   Copy to Clipboard Toggle word wrap

2. Configure your specific browser to resolve the conflict:

   • For Mozilla Firefox 68 and later, enable TLS PHA:

     1. Enter about:config in the address bar to access the Mozilla Firefox preferences menu.
     2. Enter security.tls.enable_post_handshake_auth in the search bar.
     3. Click the toggle button to set the parameter to true.

   • For Chrome, which currently does not support PHA, disable TLS v1.3:

     1. Open the /etc/httpd/conf.d/ssl.conf configuration file.

     2. Add -TLSv1.3 to the SSLProtocol option:

        SSLProtocol all -TLSv1 -TLSv1.1 -TLSv1.3

        Copy to Clipboard Toggle word wrap

3. Restart the httpd service:

   service httpd restart

   Copy to Clipboard Toggle word wrap

   Note that IdM manages the ssl.conf file and might overwrite its contents during package updates. Verify custom settings after updating IdM packages.

Procedure

1. Type an IdM server URL into the browser address bar. The name will look similarly to the following example:

   https://server.example.com

   Copy to Clipboard Toggle word wrap

   You just need to change server.example.com with a DNS name of your IdM server.

   This opens the IdM Web UI login screen in your browser.

   

   • If the server does not respond or the login screen does not open, check the DNS settings on the IdM server to which you are connecting.

   • If you use a self-signed certificate, the browser issues a warning. Check the certificate and accept the security exception to proceed with the login.

     To avoid security exceptions, install a certificate signed by a certificate authority.

2. On the Web UI login screen, enter the administrator account credentials you added during the IdM server installation.

   For details, see Installing an Identity Management server: With integrated DNS, with an integrated CA.

   You can enter your personal account credentials as well if they are already entered in the IdM server.

   

3. Click Log in.

   After the successful login, you can start configuring the IdM server.