Configuring Your Application Server to Work with ActiveVOS Security Roles

ActiveVOS Server User’s Guide

Configuring Your Application Server to Work with ActiveVOS Security Roles

Setting up secure access to ActiveVOS includes the following steps:

Run the ActiveVOS config-deploy utility and select security options, as described in Securing ActiveVOS Server Components. When ActiveVOS is deployed, it is configured to use its security roles.
Configure your application server to use ActiveVOS security roles by mapping roles to users and groups (discussed below)
Configure the security details of your application server for authentication and authorization methods (discussed below)

Mapping Roles to Users and Groups

Each application server has a different set of steps for configuring security for deployed applications. You must familiarize yourself with your application server environment to understand how to configure the security methods you need. However, here are some general guidelines and links to documentation.

Application Server	Setup Guidelines
Tomcat	Add a realm to server.xml, connecting to an existing "database" of usernames, passwords, and user roles. See examples below. For an LDAP-based database, add the ActiveVOS security roles to your database and map them to groups. Refer to Realm Configuration HOW-TO at the following URL (Tomcat 6.0): http://tomcat.apache.org/tomcat-6.0-doc/realm-howto.html
JBoss	Add an application policy named ActiveVOS to the login-config.xml file and add roles to one of the following: a set of user/role files, LDAP-based database, or JDBC-based database. See examples below. For an LDAP-based database, add the ActiveVOS security roles to your database and map them to groups. Refer to: http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/5.0.0/html/Administration_And_Configuration_Guide/ch10s18.html
WebLogic	Login to the WebLogic console and set up the LDAP provider, if you have not already done so: (Navigate to Security Realms. In the default realm, select Providers>Authentication>Default Authenticator and change the Control Flag from REQUIRED to OPTIONAL. Add and configure your LDAP provider.) For details, see Configuring Authentication Providers at http://download.oracle.com/docs/cd/E13222_01/wls/docs103/secmanage/atn.html In your security realm, navigate to Roles and Policies. Expand Global Roles, select Roles, and enter the ActiveVOS security roles. For details, see Users, Groups, and Security Roles at http://download.oracle.com/docs/cd/E12840_01/wls/docs103/secwlres/secroles.html
WebSphere	Login to the WebSphere console and follow the instructions in the Enterprise Application section for mapping ActiveVOS security roles to groups.

Tomcat Examples

tomcat\conf\server.xml (file-based configuration)

<Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase"/>
tomcat\conf\tomcat-users.xml file:

   <role rolename="abTaskClient"/>

   <role rolename="abServiceConsumer"/>

   <role rolename="abAdmin"/>

   <user username="admin" password="admin" roles="abAdmin,

    abTaskClient, abServiceConsumer"/>

tomcat\conf\server.xml (LDAP-based configuration)

<Realm  className="org.apache.catalina.realm.JNDIRealm" debug="99"

connectionName="uid=ldapadmin,ou=system"

connectionPassword="password"

connectionURL="ldap://<LDAP_Server_name>:<Port>"

userSubtree="true"

userBase="ou=users,o=xyzuser"

userSearch="(uid={0})"

roleSubtree="true"

roleBase="ou=groups,o=xyzrole"

roleName="cn"

roleSearch="(uniqueMember={0})"

/>

JBoss Examples

[ActiveVOS server]\conf\login-config.xml (file-based configuration)

<application-policy name="ActiveVOS">

  <authentication>

   <login-module code=

     "org.jboss.security.auth.spi.UsersRolesLoginModule"

    flag="required">

    <module-option name="usersProperties">props/

      jbossws-users.properties</module-option>

    <module-option name="rolesProperties">props/

      jbossws-roles.properties</module-option>

    <module-option name="unauthenticatedIdentity">

      anonymous</module-option>

   </login-module>

  </authentication>

</application-policy>

[ActiveVOS server]\conf\props\jbossws-roles.properties

admin=abTaskClient,abAdmin,abServiceConsumer

[ActiveVOS server]\conf\props\jbossws-users.properties

admin=admin

[ActiveVOS server]\conf\login-config.xml (LDAP-based configuration)

<application-policy name="ActiveVOS">

  <authentication>

   <login-module code=

     "org.jboss.security.auth.spi.LdapExtLoginModule"

    flag="required">

    <module-option name="java.naming.provider.url">

      ldap://myServer:3268

    </module-option>

    <module-option name=="bindDN">CN=myAdmin,CN=Users,

       DC=myDomain,DC=myCompany,DC=local

    </module-option>

    <module-option name=="bindCredential">myAdmin

    </module-option>

    <module-option name="baseCtxDN">

     DC=myDomain,DC=myCompany,DC=local</module-option>

    <module-option name="baseFilter">(sAMAccountName={0})

    </module-option>

    <module-option name=

     "rolesCtxDN">DC=myDomain,DC=myCompany,DC=local

    </module-option>

    <module-option name="roleFilter">(member={1})

    </module-option>

    <module-option name="roleAttributeID">memberOf

    </module-option>

    <module-option name="roleAttributeIsDN">true

    </module-option>

    <module-option name="roleNameAttributeID">cn

    </module-option>

    <module-option name="roleRecursion">2</module-option>

    <module-option name="searchScope">SUBTREE_SCOPE

    </module-option>

   </login-module>

  </authentication>

</application-policy>