Installing the JMS-Audit Handler

The JMS-Audit Handler is not installed or updated automatically during standard setup. This section explains how to manually deploy and configure it.

Prerequisite: A working DirX Audit installation.

Deploying the JMS-Audit Handler

Until version 9.0.0, the JMS-Audit Handler was provided as a separate addon.

The JMS-Audit Handler is included with the DirX Identity installation. By default, it’s present in:

<DXI_INSTALL_PATH>/ids-j.template/extensions/com.siemens.idm.audit.jms

This means that it is deployed automatically to Ids-J servers created from this template during configuration.

To deploy manually into existing servers:

Copy the folder com.siemens.idm.audit.jms from the template location to each Ids-J server’s extensions directory:

<DXI_INSTALL_PATH>/ids-j-domain-Sn/extensions/com.siemens.idm.audit.jms.

Configuring the JMS-Audit Handler

Configure the handler using DirX Identity Manager:

  1. Navigate to:

    • Connectivity → Expert view

    • Select the LDAP entry for the DirX Identity Java-based server (IdS-J)

    • Open the Status and Auditing tab

  2. Settings:

    • Enable JMS-based Auditing – Activates JMS auditing and disables file-based auditing.

    • Message Broker URL – Must match the DirX Audit Configuration Wizard:

      • Non-SSL: tcp://host:30666

      • SSL: ssl://host:30667

    • JMS Queue – Matches the queue configured in DirX Audit Wizard:

      • Example: dxt.<tenantID>.dxi

    • User and Password – Use a broker user with write access:

      • Default writer: dxt-<tenantID>-writer

    • Audit Trail Folder – Temporary storage if JMS is unavailable:

      • Default: ${IDM_HOME}

      • Relative paths are based on <dxi_install_path>/ids-j-<domain>-S<n>/bin

If the JMS Audit handler cannot send audit records to the message server, it stores them temporarily in the Audit Trail Folder (one message per file). Once the connection is restored, the handler sends and deletes these files automatically.

SSL Configuration

To enable SSL, import the broker’s CA certificate into the Java VM truststore:

Default truststore location: <JRE_folder>/lib/security/cacerts

Command (Windows example):

%JAVA_HOME%bin\keytool -importcert -trustcacerts -keystore cacerts -storepass* cacerts-pwd -alias ca-alias *-file ca.crt

Fallback Behavior

If the handler cannot find its configuration in IdS-J, it falls back to server.xml in the extension folder.

  • Default LDAP configuration activates file-based auditing (multiple records per file).

  • Manage these files to prevent disk space issues.

Additional Recommendation

You can use the same ActiveMQ message broker for DirX Identity and DirX Audit to simplify installation and reduce the number of components.