Child pages
  • Amazon RDS as an Identity Management Repository
Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 11 Next »


Amazon Relational Database Service (Amazon RDS) makes it easy to set up, operate, and scale a relational database in the cloud.  With this value proposition in mind, customers want to leverage cloud databases such as RDS to become the ForgeRock Identity Management (IDM) repository.  This guide describes how to configure the Postgres flavor of RDS as an IDM repository.

Configuration guide

  1. Setup AWS RDS Postgres instance.
  2. Configure network and security.
  3. Modify ForgeRock Postgres script.
  4. Complete steps for Postgres as an IDM repo, as documented in Installation Guide.

Setup Amazon RDS Postgres

Before starting, some key configuration details are needed:


  • Port 5432
  • PubliclyAccessible (true or false)

Security Groups

  • Inbound add rules to accommodate the Postgres port (ie 5432) limited by IP addresses (optional)
  • Outbound rules  "CidrIp": ""

  1. Enter the RDS Console
  2. Create a PostgreSQL DB Instance that matches a version ForgeRock Identity Management supports per our release notes:
  3. Configure based upon

The above highlights changes from default settings.  These are to create new security groups, VPC, subnets and to make the instance publicly available.

In production tighter control over the network may be desired, but the scope of this paper is not to illustrate a hardened configuration, but rather provide an easy configuration example for understanding.

Ensure network connectivity is accessible from the Identity Management instance.  This includes settings in RDS setup that configure the specific, Amazon VPC, Availability Zones and Security Groups.

Configure network and security

In the ForgeRock Installation Guide regarding the topic of Postgres repository configuration, there is a step that details how to setup security related to client connections.  This step details how to edit the Postgres client authentication configuration file, pg_hba.conf.  This step can be ignored as a step in the configuration, as it cannot be performed in the AWS RDS service.  The functional equivalent is to setup an AWS Security Group configuration that allows remote clients (Identity Management process) to connect.  

Inbound rules should look like this:

Outbound rules should look like this:

Security Group / VPC Architecture

Note there is a relationship with the Amazon concept of Virtual Private Cloud (VPC) settings and the associated Amazon concept of a Security Group.  Both are key to connectivity to services, including RDS.

Modify ForgeRock Postgres script

There exist some RDS nuances, that require modification to the createuser.psql script.

edit this file in Identity Management (AKA OpenIDM) environment:

copy the createuser.pgsql to create-user-aws-rds.pgsql and edit as below.

create USER openidm with password 'openidm';
grant openidm TO postgres;
create database openidm encoding 'utf8' owner openidm;
grant all privileges on database openidm to openidm;

  • No labels