Chapter 5. Accessing the IdM Web UI in a web browser The IdM (Identity Management) Web UI is a web application for IdM administration, a graphical alternative to the IdM command-line interface (CLI). 5.1. What is the IdM Web UI The IdM (Identity Management) Web UI is a web application for IdM administration. You can access the IdM Web UI as: IdM users: A limited set of operations depending on permissions granted to the user in the IdM server. Basically, active IdM users can log in to the IdM server and configure their own account. They cannot change settings of other users or the IdM server settings. Administrators: Full access rights to the IdM server. Active Directory users: A set of operations depending on permissions granted to the user. Active Directory users can now be administrators for Identity Management. For details, see Enabling AD users to administer IdM . 5.2. Web browsers supported for accessing the Web UI Identity Management (IdM) supports the following browsers for connecting to the Web UI: Mozilla Firefox 38 and later Google Chrome 46 and later Note You might experience problems accessing the IdM Web UI with a smart card if your browser attempts to use TLS v1.3: This is because the most recent versions of browsers do not have TLS Post-Handshake Authentication (PHA) enabled by default, or they do not support PHA. PHA is necessary to require a TLS client certificate for only a part of a web site, such as when accessing the IdM Web UI with smart card authentication. To resolve this issue for Mozilla Firefox 68 and later, enable TLS PHA: Enter about:config in the address bar to access the Mozilla Firefox preferences menu. Enter security.tls.enable_post_handshake_auth in the search bar. Click the toggle button to set the parameter to true. To resolve this issue for Chrome, which currently does not support PHA, disable TLS v1.3: Open the /etc/httpd/conf.d/ssl.conf configuration file. Add -TLSv1.3 to the SSLProtocol option: Restart the httpd service: Note that IdM manages the ssl.conf file and might overwrite its contents during package updates. Verify custom settings after updating IdM packages. 5.3. Accessing the Web UI The following procedure describes the first logging in to the IdM (Identity Management) Web UI with a password. After the first login you can configure your IdM server to authenticate with: Kerberos ticket For details, see Kerberos authentication in Identity Management . Smart card For details, see Configuring the IdM server for smart card authentication . One time password (OTP) - this can be combined with password and Kerberos authentication. For details, see One time password (OTP) authentication in Identity Management . Procedure Type an IdM server URL into the browser address bar. The name will look similarly to the following example: You just need to change server.example.com with a DNS name of your IdM server. This opens the IdM Web UI login screen in your browser. If the server does not respond or the login screen does not open, check the DNS settings on the IdM server to which you are connecting. If you use a self-signed certificate, the browser issues a warning. Check the certificate and accept the security exception to proceed with the login. To avoid security exceptions, install a certificate signed by a certificate authority. On the Web UI login screen, enter the administrator account credentials you added during the IdM server installation. For details, see Installing an Identity Management server: With integrated DNS, with an integrated CA . You can enter your personal account credentials as well if they are already entered in the IdM server. Click Log in . After the successful login, you can start configuring the IdM server.

Commands:
[ssl:error] [pid 125757:tid 140436077168384] [client 999.999.999.999:99999] AH: verify client post handshake [ssl:error] [pid 125757:tid 140436077168384] [client 999.999.999.999:99999] AH10158: cannot perform post-handshake authentication [ssl:error] [pid 125757:tid 140436077168384] SSL Library Error: error:14268117:SSL routines:SSL_verify_client_post_handshake:extension not received
SSLProtocol all -TLSv1 -TLSv1.1 -TLSv1.3
service httpd restart
https://server.example.com