Skip to main content
This section shows how to create a role and identity on the KMES Series 3 with the permissions IBM Db2 requires to generate the master encryption key. When IBM Db2 initiates a connection to the KMES through KMIP, authentication occurs through the TLS certificate. By matching a KMES identity name to the Common Name configured for the IBM Db2 client certificate, IBM Db2 can authenticate and assume the permissions granted to that identity.

​
Add an IdP

Perform the following steps to add a PKI Identity Provider (IdP):
1
Log in to the KMES Series 3 application interface with the default Admin identities.
2
Go to the Identity Management > Identity Providers menu.
3
Right-click anywhere in the window and select Add > Provider > PKI.
4
In the Info tab of the Identity Provider Editor window, specify a Name for the IdP and unselect Enforce Dual Factor.
5
On the PKI Options tab, select [ Select ]. In the Certificate Selector window, expand the certificate tree you created for this integration, select the CA certificate that signed the IBM Db2 client certificate and KMIP connection pair certificates, and select [ OK ].
6
Select [ OK ] to finish creating the PKI IdP.
7
Right-click the IdP you just created and select Add > Mechanism > TLS.
8
On the Info tab, specify a Name for the authentication mechanism.
9
On the PKI tab, leave all fields set to the default values.
10
Select [ OK ] to save.

​
Create a role

Perform the following steps to create a role:
1
Go to Identity Management > Roles, and select [ Add ].
2
In the Info tab of the Role Editor window, configure the following settings:
SettingRequired configuration
TypeApplication
NameIBM Db2
Application1
3
On the Permissions tab, enable the following permissions for the role:
PermissionSubpermission
Cryptographic OperationsEncrypt, Decrypt
Keys Add, Delete, Export, Modify
Secure Key FunctionsClear Export
4
On the Advanced tab, set Allowed Ports to KMIP only.
5
Select [ OK ] to finish creating the role.

​
Create an identity

Perform the following steps to create an identity:
1
Go to the Identity Management > Identities menu, right-click anywhere in the window, and select Add > Client Application.
2
On the Info tab of the Identity Editor window, select Application for the storage location and specify ibmdb2 as the identity name.
The identity name must match the Common Name of the client certificate.
3
On the Assigned Roles tab, select the role you created for IBM Db2.
4
On the Authentication tab, remove the default API Key mechanism and select [ Add ] to add a new credential.
5
On the Configure Credential window, select TLS Certificate in the Type drop-down menu and select the Provider and Mechanism you created. Select [ OK ] to finish configuring the credential.
6
Select [ OK ] to finish creating the identity.