WebSphere Application Server 6.1 Virtual member manager

Transcription

1 IBM Software Group WebSphere Application Server 6.1 Virtual member manager Richard Marshner WebSphere Support Technical Exchange

2 Agenda IBM Software Group Overview Admin Console - Configuration Admin Console - User/group management Command Line Interfaces Troubleshooting WebSphere Support Technical Exchange 2

3 Virtual member manager (VMM) Overview WebSphere Support Technical Exchange 3

4 VMM Overview Only single security realm supported in a cell Support multiple user repositories in the cell s security realm Built in file-based repository Multiple LDAP servers can be federated Data Base can be federated by CLI Federation creates a single name space for identities User/group Management WebSphere Support Technical Exchange 4

5 Federated repositories: introduction Federated repositories are Federation capabilities provided by the VMM Component Administrative utilities to manage users and groups through The administrative console Command line utilities Public APIs Integrated with WebSphere Application Server security As a user registry option Federated Repositories option To support authentication with the JAAS framework To support access control with a JACC extension provider (JACC++) WebSphere Support Technical Exchange 5

6 Federated Repositories: features Ability to use multiple repositories simultaneously in a realm Supports various types of repositories and brands File based, LDAP DB repositories are supported using the command line only Provides a single model for user/group information Repository-independent schema and API for managing users and groups Supports the logical joining of entries across multiple user repository Support for a property extension repository WebSphere Support Technical Exchange 6

7 Federated Repositories: architecture overview Application wsadmin Administrative Console Administrative Command Framework VMM User Management VMM Configuration Management Application Server Security Authentication (JAAS) VMM Runtime APIs VMM Configuration APIs CUR VMM UR LDAP Local OS User Registries Repository SPI Adaptor Adaptor Adaptor Adaptor File LDAP DB Custom Property Ext SPI Adaptor DB VMM = Virtual member manager WebSphere Application Server V6.1 WebSphere Support Technical Exchange 7

8 User repository options: comparison Supported Registries Simultaneous Multi- Repository Support Registry Read/Write Support Identity Profile Support Yes Both read/write support Yes Federated Repositories File LDAP DB Configuration available only with wsadmin and VMM APIs Local Operating System Standalone LDAP Standalone Custom No Only read support No Other User Registry Options WebSphere Support Technical Exchange 8

9 Compatibility User registries available in previous WebSphere Application Server releases are supported in the same way Options are Local OS Stand-alone LDAP registry Stand-alone custom registry Can not take advantage of federated repository features Users and Groups management Simultaneous multiple user repository support WebSphere Support Technical Exchange 9

10 Compatibility - continued Migration V6.0 & V 5.X WAS will keep the same user registry that is not migrated to VMM repository Support mixed version cell Only one LDAP can be configured in the VMM realm in Dmgr The previous version node has the same LDAP server. The LDAP information needs to be fill in the single LDAP registry panel manually. WebSphere Support Technical Exchange 10

11 Admin Console - Configuration WebSphere Support Technical Exchange 11

12 Panel: Secure administration, applications, and infrastructure Wizard simplifies security configuration steps for first-time users. Report displays security configuration attributes and settings in a table format Must enable administrative security before application security or Java 2 Security can be enabled. New Federated Repositories selection which allows multiple File-Based and LDAP registries to be searched. Configuration of LTPA or SWAM (deprecated). WebSphere Support Technical Exchange 12

13 Panel: Federated Repositories Configuration Single realm name for entire cell even though multiple repositories can be configured. Automatically generated server identity is an LTPA token protected identity for internal system calls. This is the default selection in v6.1. Must use this server ID and password choice for mixed-version Cells due to previous version requirements. Password is optional though for v6.1. Used to store attributes about users that cannot be stored in existing repositories. Supported entity types must be configured before you can write to this repository via Manage Users/Groups. Supports entry-level join of multiple repositories. List of File-based and LDAP registries configured. Custom and database may be configured through scripting. WebSphere Support Technical Exchange 13

14 Issues/Comments: About Previous Slide Federated repositories is a logical view of users from multiple repositories (LDAP and File-Based configurable through AdminConsole or scripting. Database configurable only via scripting). Configure connection properties for LDAP server separately from base DN subtrees. Supports a property-extension repository of additional attributes for users that cannot be added to existing repositories. Supports an entry-level join of multiple repositories. An entry-level join means that the federated repository configuration uses multiple repositories simultaneously and recognizes the entries in the different repositories as entries representing distinct entities. By configuring an entry mapping repository, a federated repository configuration can use both the LDAP and the database at the same time. You must configure the supported entity types before you can manage this account with Users and Groups in the administrative console. The supported entity types are Group, OrgContainer, and PersonAccount. WebSphere Support Technical Exchange 14

15 Panel: Repository reference WebSphere Support Technical Exchange 15

16 Panel: Supported entity types WebSphere Support Technical Exchange 16

17 Panel: Property extension repository WebSphere Support Technical Exchange 17

18 Panel: Entry mapping repository WebSphere Support Technical Exchange 18

19 LDAP configuration panels WebSphere Support Technical Exchange 19

20 Panel:Manage repository WebSphere Support Technical Exchange 20

21 Panel: LDAP Repository Failover support. Typical LDAP configuration attributes. LDAP performance settings. Whether to ignore or follow referrals to other LDAP servers. Centrally managed or direct selection for SSL configuration. Group attributes WebSphere Support Technical Exchange 21

22 Panel: Supported LDAP Server List WebSphere Support Technical Exchange 22

23 Admin Console User/Group Management WebSphere Support Technical Exchange 23

24 Users and groups management WebSphere Support Technical Exchange 24

25 Issues/Comments: About Previous Slide Can list all users/groups from all repositories that are configured in a VMM realm Can create users/groups into the default (primary) repository that is set by configuring Supported Entity Types only. The Command line supports to create users/groups in other repositories. WebSphere Support Technical Exchange 25

26 Command Line Interfaces WebSphere Support Technical Exchange 26

27 Command line interfaces Federated repositories (VMM component) configuration can be set/changed using wsadmin command tasks Run in local or client/server mode Provides additional functionality not provided in administrative console To list commands inside a command group or to get the command help $AdminTask help <command group name> $AdminTask help <VMM_command> wsadmin AdminTask Command Group Description IdMgrConfig IdMgrRealmConfig IdMgrRepositoryConfig WIMManagementCommands Commands used to perform general configuration tasks for Virtual member manager Commands used to configure Virtual member manager realms Commands used to configure federated repositories Includes CLIs for managing DB (and custom) type repositories Commands used to manage users and groups WebSphere Support Technical Exchange 27

28 Issues/Comments: About Previous Slide In additional to built-in file-based & LDAP repositories, DB repository can be configured by command line interface. The user/group command line supports to create users/groups in all repositories in the VMM realm. WebSphere Support Technical Exchange 28

29 Example Config a LDAP repository in VMM realm Set the default parent of the existing supported entity types $AdminTask updateidmgrsupportedentitytype {-name PersonAccount -defaultparent o=ibm,c=us} $AdminTask updateidmgrsupportedentitytype {-name Group - defaultparent o=ibm,c=us} $AdminTask updateidmgrsupportedentitytype {-name OrgContainer - defaultparent o=ibm,c=us} Create LDAP Repository with default setting and setup LDAP server configuration $AdminTask createidmgrldaprepository {-id LDAP1 -ldapservertype IDS6 -default true} $AdminTask addidmgrldapserver {-id LDAP1 -host localhost -port binddn cn=root -bindpassword rootpwd} WebSphere Support Technical Exchange 29

30 Example - continued Set the base entry of the LDAP Repository (if there are multiple base entries then use this command once for each base entry) $AdminTask addidmgrrepositorybaseentry {-id LDAP1 - name o=ibm,c=us -nameinrepository o=ibm,c=us} Rename the realm to new name $AdminTask renameidmgrrealm {-name defaultwimfilebasedrealm -newname WIMRealm} Or create a realm and set it as default realm $AdminTask createidmgrrealm {-name WIMRealm} $AdminTask setidmgrdefaultrealm {-name WIMRealm} WebSphere Support Technical Exchange 30

31 Example - continued Add base entry to realm (if there are multiple base entries then use this command once for each base entry) $AdminTask addidmgrrealmbaseentry {- name WIMRealm -baseentry o=ibm,c=us} Save the configuration $AdminConfig save WebSphere Support Technical Exchange 31

32 Example Create a user Command createuser Arguments: *uid - The UID of the PersonAccount *password - The password of the user confirmpassword - Used to guarantee and confirm that the confirmpassword is the same as the password *sn - The surname of the entity mail - The address of the PersonAccount parent - The parent of the entity *cn - The common name of the entity Example $AdminTask createuser {-uid wsdemo password wsdemo_pwd sn VMM cn wsdemo} WebSphere Support Technical Exchange 32

33 Troubleshooting WebSphere Support Technical Exchange 33

34 Key files Configuration key files security.xml & wimconfig.xml activeuserregistry should point to WIMUserRegistry, e.g activeuserregistry="wimuserregistry_1 <userregistries xmi:type="security:wimuserregistry" xmi:id="wimuserregistry_1 serverid="" serverpassword="{xor}" realm="defaultwimfilebasedrealm" ignorecase="true" useregistryserverid="false" primaryadminid="wasadmin" registryclassname="com.ibm.ws.wim.registry.wimuserregistry"/> in security.xml VMM configuration information is in wimconfig.xml that is in profiles/profile_name/config/cells/cell_name/wim/config/ File repository fileregistry.xml When the built-in file-based repository is used, it is in profiles/profile_name/config/cells/cell_name/ WebSphere Support Technical Exchange 34

35 Classes & trace setting VMM classes VMM classes in - com.ibm.ws.wim.*, com.ibm.websphere.wim.* and com.ibm.wsspi.wim.* JACC++ (Argus) classes com.ibm.sec.authz.* & com.ibm.sec.iauthz.* Trace setting com.ibm.ws.wim.*=all=enabled com.ibm.websphere.wim.*=all=enabled com.ibm.wsspi.wim.*=all=enabled WebSphere Support Technical Exchange 35

36 Common user errors Common user errors User attempts to run VMM user/group management wsadmin commands without administrative role While configuring Base entries, if "Distinguished name of a base entry in the repository" is left blank then it maps to root of the LDAP Directory Information Tree (DIT) Without of the box security user must use VMM user and group tools to create new users and groups The built-in file-based repository is not a localos registry. When the VMM realm has only the built-in file-based repository, all users/groups should be in the built-in filebased repository. WebSphere Support Technical Exchange 36

37 Additional WebSphere Product Resources Discover the latest trends in WebSphere Technology and implementation, participate in technically-focused briefings, webcasts and podcasts at: Learn about other upcoming webcasts, conferences and events: Join the Global WebSphere User Group Community: Access key product show-me demos and tutorials by visiting IBM Education Assistant: View a Flash replay with step-by-step instructions for using the Electronic Service Request (ESR) tool for submitting problems electronically: Sign up to receive weekly technical My support s: WebSphere Support Technical Exchange 37

38 Questions and Answers WebSphere Support Technical Exchange 38