Securent Entitlement Management Solution. v 3.1 GA. PEP Configurations. September Part No. PEPCONFIG-31GA-1

Transcription

1 Securent Entitlement Management Solution v 3.1 GA PEP Configurations September 2007 Part No. PEPCONFIG-31GA-1

2 Copyright Copyright Securent, Inc. All Rights Reserved. Restricted Rights This software and documentation is subject to and made available only pursuant to the terms of the Securent Inc. License Agreement and may be used or copied only in accordance with the terms of that agreement. It is against the law to copy the software except as specifically allowed in the agreement. This document may not, in whole or in part, be copied, photocopied, reproduced, translated, or reduced to any electronic medium or machine-readable form without prior consent, in writing, from Securent, Inc. THE SOFTWARE AND DOCUMENTATION ARE PROVIDED AS IS WITHOUT WARRANTY OF ANY KIND INCLUDING WITHOUT LIMITATION, ANY WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. FURTHER, Securent DOES NOT WARRANT, GUARANTEE, OR MAKE ANY REPRESENTATIONS REGARDING THE USE, OR THE RESULTS OF THE USE, OF THE SOFTWARE OR WRITTEN MATERIAL IN TERMS OF CORRECTNESS, ACCURACY,RELIABILITY, OR OTHERWISE.

3 Contents Introduction... 1 Password Encryption in Securent... 1 Case Sensitivity... 1 Elements of pep_config.xml file... 1 <cache>... 3 Sample <cache> element configuration... 4 <loadbalance>... 5 Sample <loadbalance> element configuration... 5 <pdps>... 5 Sample <pdps> element configuration... 6 <http-proxy>... 6 Sample <http-proxy> element configuration... 6 <apis>... 6 Sample <apis> element configuration... 7 <adapters>... 7 Sample <adapters> element configuration... 7 <record>... 8 iii

4 Introduction This document explains the various elements present in the PEP configuration file -pep_config.xml. This file should be placed in the appropriate location according to the type of application used, as explained below. J2EE web application: \WEB-INF\classes\.NET standalone application: \Application Name\bin\.NET web application: \Application Name\debug\ The pep_config.xml file contains the following PEP configurations. (click the hyperlink to navigate to the description of the related section). PEP Cache Load Balancing PDPs HTTP Proxy PAP Connection Details Protocol specific Adapters to access PDP Resource Discovery Password Encryption in Securent There are some elements in pep_config.xml file which require setting the password value. (Example: PDP authentication password, PAP authentication password, etc.). These password values need to be entered in encrypted format. Following is the procedure to encrypt the password value. To generate the encrypted password, run the encryptor.bat file which is located in the folder - \<SECURENT_HOME>\installer\bin\. Execute the following command at the console to generate the encrypted password. For Windows: encryptor.bat JAVA_HOME <password> For Solaris/Linux: encryptor.sh JAVA_HOME <password> Here, JAVA_HOME is the environment variable containing the location of the home directory of the Java Runtime (JRE). The <password> is the password of the user to be encrypted. When this command is executed, the encrypted password is displayed on the console. Copy it and paste this encrypted password as the value for the appropriate <password> element in the pep_config.xml file. Case Sensitivity The configuration values are not case sensitive (except for Java class names, user names, passwords and file paths). Example: The values: Oracle, oracle and ORACLE are considered the same by the PDP. Elements of pep_config.xml file Following is a sample pep_config.xml file. <pep_config version="3.0"> 1

5 <!-- Cache configuration --> <cache decisioncacheenabled="true" cacherefreshtype="onlyupdated" provider="net.securent.pep.cache.cacheprovider" implementor="net.securent.admin.sdk.cache.impl.jbosscache" eventprovider="net.securent.pep.event.eventprovider"> <type>ttl</type> <refresh enable="true">update</refresh> <interval>10</interval> <prefetch enable="true" type="user" bulkusersperrequest="10"> <prefetchforapis> <api>isuseraccessallowed</api> </prefetchforapis> </prefetch> <applicationgroup>prime group</applicationgroup> <application>prime portal</application> </cache> <!-- Load Balancing configuration --> <loadbalance enabled="false"> <algorithm>roundrobin</algorithm> <refreshtime>10</refreshtime> <timeout>1000</timeout> </loadbalance> <!-- PDPs Connection configurations --> <pdps> <pdp> <protocol>soap</protocol> <username>admin</username> <password>h1byu+lcwcm=</password> <url> <timeout>10</timeout> </pdp> </pdps> <!-- HTTP Proxy configuration --> <http-proxy> <host> </host> <port>80</port> </http-proxy> <!-- PAP Connection configuration --> <apis> <api> <url> <username>superuser</username> <password>h1byu+lcwcm=</password> <repositoryname>default Domain</repositoryname> </api> </apis> <!-- Protocol Specific Adapters to connect to PDP --> 2

6 <adapters> <soap>net.securent.pep.soap.soaptransportadaptor</soap> <rmi>net.securent.pep.rmi.rmitransportadaptor</rmi> <http>net.securent.pep.http.httptransportadaptor</http> <java>net.securent.pep.java.javatransportadaptor</java> </adapters> <!-- Resource discovery --> <record>false</record> <cache> </pep_config> This element contains the sub-elements related to cache and cache clustering of the PEP component. decisioncacheenabled attribute To enable the PEP cache mechanism, this attribute must be set to true. cacherefreshtype attribute This attribute value can be set to one of the two values onlyupdated or all. When set to onlyupdated, then during the cache refresh process, only the changed data is copied from PDP and is updated in PEP cache. When set to all, then during the cache refresh process, all the data from PDP cache gets copied to the PEP cache. <type> Set its value to TTL. <refresh> The enable attribute value can be set to either true or false. If set to false, then PEP will never refresh its cache (except during start-up if the <prefetch> element s enable attribute is set to true). If set to true, then the PEP refreshes its cache after every few second s time interval as specified in the <interval> element. (as explained below). Refresh operation can be of two types - invalidate or update, and can be set as the value for <refresh>element. Setting it to invalidate will totally clean up (erase) the cache during the refresh cycle. If set to update, then PEP cache will be updated according to the value set for cacherefreshtype attribute (as explained earlier). If PEP is deployed in the clustered cache mode, then if the <refresh>element s enable attribute value is set to true, the PEP acts as a Primary Cache for the other PEPs in the same cluster, that is this PEP takes the responsibility of refreshing its cache with the changed data and also refreshes all the PEP caches that are present in the same cache cluster. If this attribute value is set to false, then the PEP acts as a Secondary Cache and it never refreshes its own cache, but depends upon the Primary Cache PEP/PDP to refresh its cache. <interval> This element defines the periodicity (in seconds) of cache refresh activity. For example, if you want to refresh the cached data after every 60 seconds, then set <interval> value to 60. <prefetch> This element is configured to prefetch the policy information and store in the PEP cache, when the PEP component gets loaded in JVM. enable attribute The enable attribute value can be set to true or false. If set to true, all the data is refreshed during the PEP startup. If set to false, then the PEP does not refresh its data during startup. 3

7 type attribute The type attribute can be set to user or resource. If set to user, then all the resources pertaining to all the users are refreshed in the cache. The user value can be set when there is a fewer number of users compared to the number of resources, thus minimizing the number of API calls and reducing network traffic. If set to resource, then all the users pertaining to all the resources are refreshed in the cache. The resource value can be set when there are few number of resources compared to the number of users. bulkusersperrequest attribute The bulkusersperrequest attribute value is applicable only when the type attribute value (mentioned above) is set to user. The intention is to reduce the network traffic. The bulkusersperrequest attribute value specifies the batch size of the number of users for which the prefetch will be done. Example: If there are total of 100 users and the bulkusersperrequest attribute value is set to 20, then PDP will fetch the policy information (allowed/denied resources) of the 100 users in the batches of 20 users each. Thus the policy information will be fetched in 5 batches i.e. 5 requests. <prefetch> can have multiple <api> sub-elements. Each <api> sub-element contains a PEP API method name to call during prefetch operation as per the requirement. Note: PEP supports only one API method for prefetch operation, which is - isuseraccessallowed(), i.e. only user access permission for all the resources can be cached during the prefetch operation. <applicationgroup> Set this element value to the Application Group name for which the PEP is deployed. <application> Set this element value to the Application name for which the PEP is deployed. Sample <cache> element configuration <cache decisioncacheenabled="true" cacherefreshtype="onlyupdated" provider="net.securent.pep.cache.cacheprovider" implementor="net.securent.admin.sdk.cache.impl.jbosscache" eventprovider="net.securent.pep.event.eventprovider"> <type>ttl</type> <refresh enable="true">update</refresh> <interval>10</interval> <prefetch enable="true" type="user" bulkusersperrequest="10"> <prefetchforapis> <api>isuseraccessallowed</api> </prefetchforapis> </prefetch> <applicationgroup>prime group</applicationgroup> <application>prime portal</application> </cache> 4

8 <loadbalance> When enabled attribute value is set to true, the PEP component implements the load balancing mechanism while referencing various PDPs. If set to false, the load balancing mechanism is not implemented. Note: When multiple PDPs are associated with a single PEP, the mechanism of Load Balancing can be used. (Refer Securent EMS Developers Guide for more information about Load Balancing mechanism in PEP.) Following is the description for the sub-elements of <loadbalance> element. <algorithm> This element decides the type of algorithm to run while implementing load balancing mechanism. Set it to roundrobin. <refreshtime> This element decides the time interval (in seconds) after which PEP should check the status of all the PDPs configured in <pdps> element and refresh its cache with the individual PDP s status (that is active or inactive). <timeout> This element decides the time interval (in milliseconds) for which the PEP component should wait for the response after making a request to PDP, so as to assess PDPs status as active or inactive. Thus if the value is set to 1000, then when the PEP makes a request to PDP for status check and if the PEP does not receive response within 1000 milliseconds, then PEP sets the status of that PDP to inactive in its own cache. Sample <loadbalance> element configuration <pdps> <loadbalance enabled="false"> <algorithm>roundrobin</algorithm> <refreshtime>10</refreshtime> <timeout>1000</timeout> </loadbalance> This element contains the configuration details for all the PDPs that need to be referenced from this PEP component. Each PDP configuration needs to be provided in a separate <pdp> element. Following are the sub-elements of <pdps> element that should be configured for each PDP entry. <protocol> This element specifies the protocol for PEP-PDP communication. It can take one of the four protocol values http, soap, java or rmi. <username> This element contains the user name value to connect to PDP. <password> This element contains the encrypted password value for the above mentioned user name. For more details about password encryption, refer to the section - Password Encryption in Securent. <url> This element contains the URL of the PDP service. 5

9 <timeout> This element specifies the time interval (in seconds) for which PEP should wait for the response after making a request to PDP. If response is not received by PEP from the PDP in this configured time interval, then PEP considers it as an error request. Sample <pdps> element configuration <pdps> <pdp> <protocol>soap</protocol> <!-- SOAP Protocol --> <username>admin</username> <password>h1byu+lcwcm=</password> <url> <timeout>10</timeout> </pdp> <http-proxy> <pdp> <protocol>rmi</protocol> <!-- RMI Protocol --> <username>admin</username> <password>sdasdadh1by=</password> <url> <timeout>10</timeout> </pdp> </pdps> This element contains the configuration details for the proxy server. Note: If proxy server is not being used, then give the empty values for its child elements. Following are the sub-elements of <http-proxy> element that should be configured to connect to the proxy-server. <host> This element contains the machine IP address of the proxy server. <port> This element contains the port number for the proxy service. Sample <http-proxy> element configuration <apis> <http-proxy> <host> </host> <port>80</port> </http-proxy> This element contains the configuration details of the PAP server. These values are used by the PEP API to access the PAP application. Following are the sub-elements of <apis> element that contains the configuration details to access the PAP server. <url> 6

10 This element contains the URL of the PAP server. <username> This element contains the user name to connect to the PAP server. <password> This element contains the encrypted password for the above user. For more details about password encryption, refer to the section - Password Encryption in Securent. <repositoryname> This element contains the name of the repository to connect to in the PAP server. Sample <apis> element configuration <adapters> <apis> <api> <url> <username>superuser</username> <password>h1byu+lcwcm=</password> <repositoryname>default Domain</repositoryname> </api> </apis> This element contains the list of protocol specific adapters that can be used by the PEP application to access PDPs. PEP supports adapters for SOAP, RMI, HTTP and JAVA. Following are the sub-elements of <adapters> element that should be configured to use appropriate protocol specific adapter for accessing PDPs. <soap> This tag contains the name of SOAP Adapter. <rmi> This tag contains the name of RMI Adapter. <http> This tag contains the name of HTTP Adapter. <java> This tag contains the name of JAVA Adapter. Sample <adapters> element configuration <adapters> <!-- SOAP --> <soap>net.securent.pep.soap.soaptransportadaptor</soap> <!-- RMI --> <rmi>net.securent.pep.rmi.rmitransportadaptor</rmi> <!-- HTTP --> <http>net.securent.pep.http.httptransportadaptor</http> <!-- JAVA --> <java>net.securent.pep.java.javatransportadaptor</java> </adapters> 7

11 <record> PEP Configurations This element value can be set to either true or false. If set to true, then whenever a resource is accessed in the protected application, that resource gets automatically created in the PAP, under the configured Application Group and application. Set it to false, if you do not want to use the Resource Discovery functionality. 8