Troubleshooting WebSphere Process Server: Integration with LDAP systems for authentication and authorization

Transcription

1 Troubleshooting WebSphere Process Server: Integration with LDAP systems for authentication and authorization Dr. Stephan Volz Technical Teamlead BPC L2 support (EMEA) 24 August 2011

2 Agenda Introduction: What is LDAP? LDAP usage and basic tools Configuration of WAS/WPS with LDAP/VMM Troubleshooting examples Summary 2 of 45

3 Introduction: What is LDAP? What is a directory? A directory is a special-purpose database used to organize, secure, and manage users' profiles and network resources, based on sophisticated browsing and searching capabilities, and secure mechanisms to protect the data What is LDAP? LDAP (Lightweight Directory Access Protocol) An access interface to a directory Sucessor of DAP as an interface to X500 3 of 45

4 Introduction: Directories vs. Databases Directories: Focus on read operations, normally faster for reads than an ordinary database Common interface to all applications with LDAP protocol (e.g. Mail clients, browsers,...) Information is stored in one place and maintained at the source (e.g. User can change phone number) Databases: Designed for complex transaction handling Optimized for read/write operations in combinations 4 of 45

5 Introduction: Different directory designs Example University: dc=tu-darmstadt,dc=de ou=physik uid=profmeier ou=mathematik ou=maschinenbau uid=profmeier,ou=physik,dc=tu-darmstadt,dc=de 5 of 45

6 Introduction: Different directory designs (2) Example Worldwide company: o=example.com l=newyork New York server o=newyork.example.com l=hamburg Hamburg server l=beijing Beijing server o=beijing.example.com 6 of 45

7 Introduction: Schemas Schemas guarantee data consistency/handling Extract from NIS schema: # Attribute Type Definitions attributetype ( NAME 'uidnumber' DESC 'Integer uniquely identifying a user' EQUALITY integermatch SYNTAX SINGLE-VALUE)... # Object Class Definitions objectclass ( NAME 'posixaccount' SUP top AUXILIARY DESC 'Abstraction of an account with POSIX attributes' MUST ( cn $ uid $ uidnumber $ gidnumber $ homedirectory ) MAY ( userpassword $ loginshell $ gecos $ description ) ) 7 of 45

8 LDAP usage: LDAP Browsers ldapsearch Delivered with all supported operating systems Windows : rs=2307&q1=ldap+must+gather&uid=swg Graphical tools: Apache Directory Studio Jxplorer Softera LDAP Browser (Windows) PHPLDAP A number of other tools available as well 8 of 45

9 LDAP usage: Howto use ldapsearch ldapsearch -h p 389 -x -D "cn=root" -W -s base -b "cn=testuser2,ou=groups,ou=wps_support,l=munich,o=ibm,c=de" objectclass=* Enter LDAP Password: # extended LDIF # # LDAPv3 # base <cn=testusers2,ou=groups,ou=wps_support,l=munich,o=ibm,c=de> with scope baseobject # filter: objectclass=* # requesting: ALL # # TestUsers2, groups, wps_support, munich, ibm, de dn: cn=testusers2,ou=groups,ou=wps_support,l=munich,o=ibm,c=de objectclass: groupofuniquenames objectclass: top cn: TestUsers2 description: TestUsers user group uniquemember: uid=svolz,ou=people,ou=wps_support,l=munich,o=ibm,c=de uniquemember: uid=example2,ou=people,ou=wps_support,l=munich,o=ibm,c=de uniquemember: uid=example3,ou=people,ou=wps_support,l=munich,o=ibm,c=de # search result search: 2 result: 0 Success 9 of 45

10 LDAP usage: Apache Directory Studio 10 of 45

11 Config: Overview of different products On top of WebSphere Application Server products: Base for user registry integration: WebSphere Portal Server WebSphere Process Server WebSphere Application Server 11 of 45

12 Config: System Requirements WPS 7.0 Please be aware that the Business Space Component has more strict requirements: 12 of 45

13 Config: Standalone LDAP vs. VMM Standalone LDAP Simple VMM (Virtual Member Manager aka federated repositories/wim) Multiple repositories Failover Additional features which are not implemented in Standalone LDAP (e.g. for BPC substitution, business spaces) The future will rely on VMM 13 of 45

14 Config: Configuration example (1) 14 of 45

15 Config: Configuration example (1) 15 of 45

16 Config: Configuration example (2) 16 of 45

17 Config: Configuration example (3) 17 of 45

18 Config: Configuration example (4) 18 of 45

19 Troubleshooting: Where to start? WPS server LDAP server Firewall Host A Host B 19 of 45

20 Troubleshooting: Where to start? WPS server ldapsearch Host A LDAP server Firewall Host B 20 of 45

21 Trouble: Basic steps Check with a LDAP browser like ldapsearch, if it is possible to query the LDAP server from the application server with the credentials entered in WAS/WPS This is completely independent from the application server configuration and will narrow down possible root causes For example use a query like this: ldapsearch -h myhost -p 389 -x -D cn=mywasuser -b o=ibm,c=de -W (objectclass=*) (Syntax can differ depending on the ldapsearch version used) 21 of 45

22 Trouble: Basic steps (2) Another frequently used method is to export the LDAP server data to a ldif file Disadvantage: you will not see any network effects. The data may be fine, but the application server cannot reach the LDAP server A ldapsearch output also could be easily added into a different LDAP system In all cases it should be checked to obscure passwords for security reasons 22 of 45

23 Trouble: Capitalization The LDAP protocol is case insensitive It is possible to enable case sensitive checks in WAS and other products and this will work, if it can be configured on all ends (including LDAP server) If one end is not aware about this requirement LDAP queries will provide unexpected results Be aware: BPC is by default case sensitive for the people handling of human tasks, but there exists ifix IZ85270 ( ) and ifix IZ JR36398 ( ) with an option for case insensitivity. Also included in WPS of 45

24 Trouble: Firewall/network issues Some firewall products can drop a connection in a way that WPS does not get aware about it. The People Directory Provider will assume that the connection is still established, but this is not the case. This will result in hanging processes on WPS side. Hint: Be aware about any firewall or intelligent network devices and their configuration. They can influence the behaviour when used between application servers, databases or security products (like LDAP servers, TAM, etc.) Check firewall/network device logs as well when hangs occur. 24 of 45

25 Trouble: People Directory Provider Setup in a cluster (WPS) The configuration of the People Directory Provider (former Staff Plugin Provider) in a cluster must be done on the node level for each node separately Link to Infocenter: com.ibm.websphere.bpc.doc/doc/bpc/t4staff_ldap.html Screenshot, please see next page 25 of 45

26 Trouble: People Directory Provider Setup in a cluster (WPS) (2) 26 of 45

27 Trouble: Simplified overview of security parts of BPC LDAP Server Login BPC Explorer People Refresh Daemon WAS security BPEDB User workitems Security token Group workitems WORK_ITEM View User: uid=example1,dc=example,dc=com Groups: cn=testusers1,dc=example,dc=com of 45

28 Trouble: Performance issues observed when using BPC When running business processes as part of Business Process Choreographer of WPS there is a performance degradation observed for BPC Explorer queries, if large groups are combined with the Group Members staff verb Hint: If you use human tasks in your application consider the usage of the Group staff verb for the group assignments. Group workitems need to be explicitly enabled on the HTM container as well Alternatively it should be checked if all users need to be assigned as potential owners for such tasks 28 of 45

29 Trouble: Special settings to use LDAP server features for group workitems Some LDAP server products provide attributes which will allow a quicker group membership lookup, e.g. IBM Tivoli Directory Server: ibm-allgroups Sun One Directory Server: nsrole Microsoft Active Directory: memberof These attributes are not required, but can bring a performance benefit and also reduce the load on the LDAP server 29 of 45

30 Trouble: Nested groups The LDAP RFCs provide a construct called nested groups which will allow to have subgroups as part of a LDAP group When configuring the LDAP group membership in the admin console a direct lookup is needed, else members of the subgroup will not be found 30 of 45

31 Trouble: objectclasses used Search results of the LDAP server will depend on the filters which are used in the WAS configuration Different objectclasses in the WAS filter settings and the LDAP server will prevent any search results A corresponding screenshot is shown on the next page 31 of 45

32 Trouble: objectclasses used (2) 32 of 45

33 Trouble: Limits on LDAP server To guarantee a good performance, some LDAP server administrators limit the number of search results This may lead to applications failing or some people randomly not being assigned to human tasks (BPC) Hint Check the base for your LDAP queries or if an assignment change can be performed Increase the limit on the LDAP server to fulfill your needs (for example set in slapd.conf file) 33 of 45

34 Trouble: An application is not working on a specific system If the system configuration is correct, the most likely reason is that the deployed application is different than expected In one scenario a placeholder was used for the assigned users by the developers. The ear file which was deployed on the system did still include a dummy value with no corresponding users assigned The group of users which got assigned was not in the LDAP server which was configured for the failing system. Sometimes only some users are missing As a first step an export of the application from a working system could be used for a cross check 34 of 45

35 Trouble: BPC Explorer Users A user which is an administrative user does not see a task under My ToDo tasks even if he is a potential owner of the task This is working as designed. Normally an administrator is not intended to work on normal tasks. The administrator role will have preference over the potential owner role 35 of 45

36 Trouble: Query tables do not show human tasks in BPC Explorer With WPS version and 7.0 query tables are used for the BPC Explorer views. If corresponding tasks are not visible, this not necessarily means that query tables are not working Query tables provide filter functionality which should be checked if the used filters are too strict It is also necessary to check if corresponding tasks have been created. The easiest way is by a SQL query against the database: select * from TASK 36 of 45

37 Trouble: Security role mapping There is a change of the security role usage for BPC starting with WPS version 7 So far SCA security roles were tolerated to check if a user is allowed to start a process. This is no longer supported To control the process starter a potential starter could be defined on the receive activity There exists a variable for backward compatibility from BPC side to be set under custom properties for the human task manager: Compat.SCAMonitoringForBFMAPI=true For full functionality WPS or ifix JR39063 is required 37 of 45

38 Trouble: Performance problem after upgrade to WPS After a migration from WPS to WPS a slow performance is seen for queries which involve the WORK_ITEM view Root cause for this is in most cases a large number of entries in the RETRIEVED_USER_T table. Some entries in this table are not cleaned up, which leads over time to a large number of unused entries. The ifix IZ95651 and pre-requisites will address this issue 38 of 45

39 Trouble: BPC Change of staff Staff resolution templates have changed, but applications deployed before will use the old templates Hint: A redeploy of the application is necessary Alternative: Versioning is a feature which will allow changing an application in a production environment without downtime: 808_smolny/0808_smolny.html 39 of 45

40 Trouble: BPC Transformation files When configuring People Directory Provider configuration, some sample transformation files (xsl files) are provided under: <WPS Home>/ProcessChoreographer/Staff Hint: It is possible that the sample files will change with a future release and will be overwritten during upgrade It is best practice to copy the needed files when doing modifications and integrate them with their own name 40 of 45

41 Summary Introduction what is LDAP and what tools are available Howto integrate WAS/WPS with a LDAP system Troubleshooting examples 41 of 45

42 References Troubleshooting WebSphere Process Server Projects, Part 1: Integration with LDAP systems for authentication and authorization Authorization and staff resolution in Business Process Choreographer: Part 1: Understanding the concepts and components of staff resolution, Authorization and staff resolution in Business Process Choreographer: Part 2: Understanding the programming model for staff resolution, Authorization and staff resolution in Business Process Choreographer: Part 3: Customization options for staff resolution, Authorization and staff resolution in Business Process Choreographer: Part 4: Staff resolution specifications and reference guide, IBM WebSphere Developer Technical Journal: Expand your user registry options with a federated repository in WebSphere Application Server V6.1, Using nsrole attribute of Sun ONE Directory Server for Group staff verb of human tasks, 42 of 45

43 Additional WebSphere Product Resources Learn about upcoming WebSphere Support Technical Exchange webcasts, and access previously recorded presentations at: Discover the latest trends in WebSphere Technology and implementation, participate in technically-focused briefings, webcasts and podcasts at: Join the Global WebSphere Community: Access key product show-me demos and tutorials by visiting IBM Education Assistant: View a webcast replay with step-by-step instructions for using the Service Request (SR) tool for submitting problems electronically: Sign up to receive weekly technical My Notifications s: 43 of 45

44 Connect with us! 1.Get notified on upcoming webcasts Send an to with subject line wste subscribe to get a list of mailing lists and to subscribe 2.Tell us what you want to learn Send us suggestions for future topics or improvements about our webcasts to wsehelp@us.ibm.com 3.Be connected! Connect with us on Facebook Connect with us on Twitter 44 of 45

45 Questions and Answers 45 of 45