# Configuring ACME with DS Realm

## Overview

This document describes the process to configure ACME responder to use a DS database for authentication realm.
It assumes that the DS database has been installed as described in
link:https://github.com/dogtagpki/pki/wiki/DS-Installation[DS Installation].

## Initializing DS Realm

Prepare subtrees for ACME users and groups in DS.
A sample LDIF file is available at link:../../../base/acme/realm/ds/create.ldif[/usr/share/pki/acme/realm/ds/create.ldif].
This example uses `dc=acme,dc=pki,dc=example,dc=com` as the base DN.
Import the file with the following command:

----
$ ldapadd -h $HOSTNAME -x -D "cn=Directory Manager" -w Secret.123 \
    -f /usr/share/pki/acme/realm/ds/create.ldif
----

A sample realm configuration is available at
link:../../../base/acme/realm/ds/realm.conf[/usr/share/pki/acme/realm/ds/realm.conf].

To use the DS realm, copy the sample `realm.conf` into the `/etc/pki/pki-tomcat/acme` folder,
or execute the following command to customize some of the parameters:

----
$ pki-server acme-realm-mod --type ds \
    -DbindPassword=Secret.123
----

Customize the realm configuration as needed. In a standalone ACME deployment, the `realm.conf` should look like the following:

----
class=org.dogtagpki.acme.realm.DSRealm
url=ldap://<hostname>:389
authType=BasicAuth
bindDN=cn=Directory Manager
bindPassword=Secret.123
usersDN=ou=people,dc=acme,dc=pki,dc=example,dc=com
groupsDN=ou=groups,dc=acme,dc=pki,dc=example,dc=com
----

In a shared CA and ACME deployment, the `realm.conf` should look like the following:

----
class=org.dogtagpki.acme.realm.DSRealm
configFile=conf/ca/CS.cfg
usersDN=ou=people,dc=ca,dc=pki,dc=example,dc=com
groupsDN=ou=groups,dc=ca,dc=pki,dc=example,dc=com
----

## See Also

* link:Configuring_ACME_Realm.md[Configuring ACME Realm]
* link:../../admin/acme/Managing_DS_Realm.adoc[Managing DS Realm]
