> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a role and identity on the KMES Series 3

> Instructions for setting up KMES roles and identities to support IBM Db2 KMIP authentication.

This section shows how to create a role and identity on the KMES Series 3 with the permissions IBM Db2 requires to generate the master encryption key. When IBM Db2 initiates a connection to the KMES through KMIP, authentication occurs through the TLS certificate. By matching a KMES identity name to the **Common Name** configured for the IBM Db2 client certificate, IBM Db2 can authenticate and assume the permissions granted to that identity.

## Add an IdP

Perform the following steps to add a PKI Identity Provider (IdP):

<Steps>
  <Step>
    Log in to the KMES Series 3 application interface with the default Admin identities.
  </Step>

  <Step>
    Go to the **Identity** **Management** > **Identity** **Providers** menu.
  </Step>

  <Step>
    Right-click anywhere in the window and select **Add** > **Provider** > **PKI**.
  </Step>

  <Step>
    In the **Info** tab of the **Identity** **Provider** **Editor** window, specify a **Name** for the IdP and unselect **Enforce Dual Factor**.
  </Step>

  <Step>
    On the **PKI** **Options** tab, select **\[ Select ]**. In the **Certificate** **Selector** window, expand the certificate tree you created for this integration, select the CA certificate that signed the IBM Db2 client certificate and KMIP connection pair certificates, and select **\[ OK ]**.
  </Step>

  <Step>
    Select **\[ OK ]** to finish creating the PKI IdP.
  </Step>

  <Step>
    Right-click the IdP you just created and select **Add** > **Mechanism** > **TLS**.
  </Step>

  <Step>
    On the **Info** tab, specify a **Name** for the authentication mechanism.
  </Step>

  <Step>
    On the **PKI** tab, leave all fields set to the default values.
  </Step>

  <Step>
    Select **\[ OK ]** to save.
  </Step>
</Steps>

## Create a role

Perform the following steps to create a role:

<Steps>
  <Step>
    Go to **Identity** **Management** > **Roles**, and select **\[ Add ]**.
  </Step>

  <Step>
    In the **Info** tab of the **Role** **Editor** window, configure the following settings:

    <table>
      <thead>
        <tr>
          <th><em><strong>Setting</strong></em></th>
          <th><em><strong>Required configuration</strong></em></th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td><strong>Type</strong></td>
          <td>Application</td>
        </tr>

        <tr>
          <td><strong>Name</strong></td>
          <td>IBM Db2</td>
        </tr>

        <tr>
          <td><strong>Application</strong></td>
          <td>1</td>
        </tr>
      </tbody>
    </table>
  </Step>

  <Step>
    On the **Permissions** tab, enable the following permissions for the role:

    <table>
      <thead>
        <tr>
          <th><em><strong>Permission</strong></em></th>
          <th><em><strong>Subpermission</strong></em> </th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td><strong>Cryptographic Operations</strong></td>
          <td>Encrypt, Decrypt</td>
        </tr>

        <tr>
          <td><strong>Keys</strong> </td>
          <td>Add, Delete, Export, Modify</td>
        </tr>

        <tr>
          <td><strong>Secure Key Functions</strong></td>
          <td>Clear Export</td>
        </tr>
      </tbody>
    </table>
  </Step>

  <Step>
    On the **Advanced** tab, set **Allowed Ports** to **KMIP only**.
  </Step>

  <Step>
    Select **\[ OK ]** to finish creating the role.
  </Step>
</Steps>

## Create an identity

Perform the following steps to create an identity:

<Steps>
  <Step>
    Go to the **Identity** **Management** > **Identities** menu, right-click anywhere in the window, and select **Add** > **Client** **Application**.
  </Step>

  <Step>
    On the **Info** tab of the **Identity** **Editor** window, select **Application** for the storage location and specify `ibmdb2` as the identity name.

    <Note>
      The identity name must match the Common Name of the client certificate.
    </Note>
  </Step>

  <Step>
    On the **Assigned** **Roles** tab, select the role you created for IBM Db2.
  </Step>

  <Step>
    On the **Authentication** tab, remove the default API Key mechanism and select **\[ Add ]** to add a new credential.
  </Step>

  <Step>
    On the **Configure** **Credential** window, select **TLS Certificate** in the **Type** drop-down menu and select the **Provider** and **Mechanism** you created. Select **\[ OK ]** to finish configuring the credential.
  </Step>

  <Step>
    Select **\[ OK ]** to finish creating the identity.
  </Step>
</Steps>