Install and Configure FIDO Server

The FIDO server can be deployed as a Single Node:

• Podman Deployment

• Docker Deployment

Podman

For the FIDO server deployment in the Podman environment, refer the following:

Prerequisites

Ensure you are using a system with a DNF-based package manager (for example, RHEL) and that you have sudo privileges.

1. Install Podman.

   sudo dnf install -y podman

2. Install Podman Compose.

   sudo dnf install -y python3-pip
pip3 install --user podman-compose

3. Install OpenSSL.

   • For RHEL/CentOS: sudo dnf install -y openssl
     
   • For Ubuntu: sudo apt-get install -y openssl

4. Verify if the podman installation is successful.

   podman --version

   

5. Verify if the podman compose installation is successful.

   podman-compose --version

   

   Note

   If the podman-compose command is not found after installation, you may need to add ~/.local/bin to your PATH environment variable.

Deployment steps

1. Ensure that the complete package named SafeNet Access Exchange v1.3.0.zip is downloaded/copied on the RHEL machine. This package includes the SAE and FIDO-server folders, which are required for deploying the SafeNet Access Exchange (SAE) and the FIDO server.

2. Unzip the package.

3. Create the FIDO network: Create a dedicated network for the FIDO containers to enable communication with each other using the following command:

   podman network create fido_network

   Verify it using the following command:

   podman network ls

4. Set up Bitnami MariaDB (FIDO server database):

   1. Navigate to the fido-mariadb folder under fido2-server-xxxxxx.xxxx.

   2. Run the following commands to set up the Bitnami MariaDB for your FIDO server:

      podman-compose up -d

   Note

   Do not change the default database name fido2-server, as it is referenced in multiple places throughout the deployment.

   Validate MariaDB container using the following command:

   podman ps

   To validate the creation of database for fido2-db, use the following command:

   podman exec -it <<ContainerID>> mariadb -u root -p
show databases

5. Load the FIDO-Server image:

   1. Navigate to the fido2-server-xxxxxx.xxxx folder.

   2. Unzip and load the FIDO-Server container image using the following command:

      podman load --input fido2-server-240916.0838.tar

6. Verify the loaded images using the following command:

   podman images

   You should see the MariaDB, FIDO server images in the output.

7. Ensure you are in the fido2-server-xxxxxx.xxxx directory and navigate to server > secrets. In this folder, open the application-secret.yaml file and update all the configurations marked as <> (as shown in the screenshot below) with the generated seed.

   To generate the seed, use the following command:

   openssl rand -base64 32

   Run the same command four times to generate random secret and copy each unique output to replace the following entries in the file.

   

8. Navigate back to the server > tenants folder. Open the tenants-config.yaml file and update the key-ids and key-value marked as <<Update Me>> (as shown in the screenshot below):

   • key-ids
     Replace <<Update Me>> with the Key ID obtained in the step Operator Realm setup for FIDO.

   • key-value
     Replace <<Update Me>> with the Key Value obtained in the step Operator Realm setup for FIDO.

   

9. Start Services: The deployment process is automated using a script that handles all necessary setup and execution steps. Follow the instructions below to start all FIDO server services:

   1. Make the Script Executable

      chmod +x Fido_SingleDeployment/start_deployment.sh

   2. Navigate to the fido2-server-xxxxxx.xxxx directory and execute the script to start all services:

      cd " fido2-server-xxx… "
./start_deployment.sh

   !!!note User must have all the privileges mentioned under start_deployment.sh or use sudo su to run the FIDO server.

   The script will perform the following actions:

   • Set the required execute permissions on the janitor's entry point script.

   • Ensure the server's temporary directory is writable.

   • Start all services in the correct order using podman-compose.

   • Display the status of all running containers.

   The services will start as follows:

   • dbschemamgr: Runs once to prepare the database schema and exits after completion.

   • fido2-server: Starts and runs continuously to handle FIDO operations.

   • fido2-janitor: Starts and runs continuously in the background, performing an initial cleanup on startup and repeating the task every 24 hours.

10. After the script runs successfully, the FIDO server will be up and running with http://<<Internal IP Address>>:9080/fido2 if FIDO-server is running on internal IP.

Docker

For the FIDO server deployment in the Docker environment, refer the following:

Prerequisites

Ensure you are using a system with a DNF-based package manager (for example, RHEL) and that you have sudo privileges.

1. Install Docker.

   sudo dnf install -y docker

2. Install Docker Compose.

   sudo dnf install -y python3-pip
pip3 install --user docker-compose

3. Install OpenSSL.

   • For RHEL/CentOS: sudo dnf install -y openssl
     
   • For Ubuntu: sudo apt-get install -y openssl

4. Verify if the docker installation is successful.

   docker --version

5. Verify if the docker compose installation is successful.

   docker-compose --version

   Note

   If the docker-compose command is not found after installation, you may need to add ~/.local/bin to your PATH environment variable.

Deployment steps

This section provides the instructions to deploy the FIDO server in the Docker environment:

1. Ensure that the complete package named SafeNet Access Exchange v1.3.0.zip is downloaded/copied on the RHEL machine. This package includes the SAE and FIDO-server folders, which are required for deploying the SafeNet Access Exchange (SAE) and the FIDO server.

2. Unzip the package.

3. Create the FIDO network: Create a dedicated network for the FIDO containers to enable communication with each other using the following command:

   docker network create fido_network

   Verify it using the following command:

   docker network ls

4. Set up Bitnami MariaDB (FIDO server database):

   1. Navigate to the fido-mariadb folder under fido2-server-xxxxxx.xxxx.

   2. Run the following commands to set up the Bitnami MariaDB for your FIDO server:

      docker-compose up -d

   Note

   Do not change the default database name fido2-server, as it is referenced in multiple places throughout the deployment.

   Validate MariaDB container using the following command:

   docker ps

   To validate the creation of database for fido2-db, use the following command:

   docker exec -it <<ContainerID>> mariadb -u root -p
show databases

5. Load the FIDO-Server image:

   1. Navigate to the fido2-server-xxxxxx.xxxx folder.

   2. Unzip and load the FIDO-Server container image using the following command:

      docker load --input fido2-server-240916.0838.tar

6. Verify the loaded images using the following command:

   docker images

   You should see the MariaDB, FIDO server images in the output.

7. Ensure you are in the fido2-server-xxxxxx.xxxx directory and navigate to server > secrets. In this folder, open the application-secret.yaml file and update all the configurations marked as <> (as shown in the screenshot below) with the generated seed.

   To generate the seed, use the following command:

   openssl rand -base64 32

   Run the same command four times to generate random secret and copy each unique output to replace the following entries in the file.

   

8. Navigate back to the server > tenants folder. Open the tenants-config.yaml file and update the key-ids and key-value marked as <<Update Me>> (as shown in the screenshot below):

   • key-ids
     Replace <<Update Me>> with the Key ID obtained in the step Operator Realm setup for FIDO.

   • key-value
     Replace <<Update Me>> with the Key Value obtained in the step Operator Realm setup for FIDO.

   

9. Start Services: The deployment process is automated using a script that handles all necessary setup and execution steps. Follow the instructions below to start all FIDO server services:

   1. Make the Script Executable

      chmod +x Fido_SingleDeployment/start_deployment.sh

   2. Navigate to the fido2-server-xxxxxx.xxxx directory and execute the script to start all services:

      cd " fido2-server-xxx… "
./start_deployment.sh

   !!!note User must have all the privileges mentioned under start_deployment.sh or use sudo su to run the FIDO server.

   The script will perform the following actions:

   • Set the required execute permissions on the janitor's entry point script.

   • Ensure the server's temporary directory is writable.

   • Start all services in the correct order using podman-compose.

   • Display the status of all running containers.

   The services will start as follows:

   • dbschemamgr: Runs once to prepare the database schema and exits after completion.

   • fido2-server: Starts and runs continuously to handle FIDO operations.

   • fido2-janitor: Starts and runs continuously in the background, performing an initial cleanup on startup and repeating the task every 24 hours.

10. After the script runs successfully, the FIDO server will be up and running with http://<<Internal IP Address>>:9080/fido2 if FIDO-server is running on internal IP.