IBM Rational Automation Framework for WebSphere. Guided Activity: Configuring security for WebSphere Application Server

Transcription

1 IBM Rational Automation Framework for WebSphere Guided Activity: Contacts: IBM Corporation Level: Intermediate June 2009 Copyright 2009, IBM Corporation

2 Page 2 of 18 Contents 1.0 Audience Overview Information resources Actions Prerequisites Objectives Configure local OS user registry Configure LDAP user registry Configure custom user registry Configure SSL Configure SSO Configure TAI Enable global and administrative security Restarting servers in a cell Executing security actions in Rational Build Forge...15 Trademarks...17 Resources...17 About the authors...18

3 Page 3 of Audience The audience for this guided activity is WebSphere Application Server administrators and security administrators. You should have experience configuring security for WebSphere Application Server. 2.0 Overview Configure administrative security for WebSphere Application Server (WAS) using security actions provided by Rational Automation Framework for WebSphere (RAFW). This guided activity applies to a network deployment or standalone cell for WebSphere Application Server 6.0, 6.1, or Information resources For information about security features and configuring security for WebSphere Application Server, refer to the IBM information center for your product: 3.1 WebSphere Application Server c/info/ae/ae/welc6topsecuring.html 3.2 WebSphere Application Server c/info/ae/ae/welc6topsecuring.html 3.3 WebSphere Application Server c/info/ae/ae/welc6topsecuring.html For information about Rational Automation Framework for WebSphere (RAFW), refer to the product information center. 3.4 Rational Automation Framework for WebSphere

4 Page 4 of Guided activities Other guided activities can be found at IBM Software Support for Rational products: In the Search field, enter guided activities. 4.0 Actions RAFW provides the following actions to configure security. The was_common_configure_security_all action is a composite action that calls other security actions. Security actions support the import, compare, and execute modes of the rafw command. Action was_common_configure_ security_all was_common_configure_ security_custom_ur was_common_configure_ security_global Description Configures WebSphere security. Use this action to import, export, or compare security settings in the security.xml file for a cell. This action is a composite action that runs a set of security actions. Configures a custom user registry. Use this action to import, export, or compare the security settings for the custom user registry in the security.xml file for a cell. Included in the set of actions run by was_common_configure_security_all. Configures global security, which enables administrative and application security. Use this action to import, export, or compare the security settings for global security settings in the security.xml file for a cell. Included in the set of actions run by was_common_configure_security_all.

5 Page 5 of 18 was_common_configure_ security_ldap_ur was_common_configure_ security_local_ur was_common_configure_ security_ssl Configures an LDAP user registry. Use this action to import, export, or compare the security settings for the LDAP user registry in the security.xml file for a cell. Included in the set of actions run by was_common_configure_security_all. Configures a local OS user registry. Use this action to import, export, or compare the security settings for the local OS user registry in the security.xml file for a cell. Included in the set of actions run by was_common_configure_security_all. Configures Secure Sockets Layer (SSL) protocol for transport security. Use this action to import, export, or compare the security settings for the SSL protocol in the security.xml file for a cell. was_common_configure_ security_sso was_common_configure_ security_tai Included in the set of actions run by was_common_configure_security_all. Configures single sign-on (SSO) support. Use this action to import, export, or compare the security settings for single sign-on (SSO) support in the security.xml file for a cell. Included in the set of actions run by was_common_configure_security_all. Configures trust association and trust association interceptor (TAI). Use this action to import, export, or compare the security settings for the TAI interface in the security.xml file for a cell. was_common_configure_jaas Included in the set of actions run by was_common_configure_security_all. Configures and Java Authentication and Authorization Service (JAAS). Use this action to import, export, or compare the security settings for JAAS in the jaas.xml file for a cell.

6 Page 6 of Prerequisites 5.1 Create the WAS cell or cells that the security configuration is to be imported from or exported to. 5.2 Create the RAFW WAS cell definition for the WAS cells. Each WAS cell that is the target of a security export or import action must have a cell definition in the RAFW environment tree. Use the Environment wizard to create the cell definition. 5.3 To export and import security configurations, the target WAS cell must be running. Important: There is a one-to-one mapping between a RAFW cell definition and a WAS cell. The WAS cell and the RAFW cell definition must use the same cell name. 6.0 Objectives 6.1 Create the WAS security configuration that you want to export to a new or existing WAS cell. To do this, use one of the following options: Import the WAS security configuration (security.xml) from a working WAS cell. Configure security settings by using the WebSphere administration console and then import configuration settings (recommended option). Import the security.xml file from a WAS cell that does not have security configured and edit the security.xml to create a working security configuration. 6.2 Run one or more security export actions to: Create the security configuration for a new WAS cell. Update the security configuration for an existing WAS cell. 7.0 Configure local OS user registry In this example, the WebSphere security configuration for the local OS user registry is modified. 7.1 Import the local OS user registry configuration from the WAS cell to the RAFW cell definition. This action imports only the local OS user registry section of security.xml. [rafwadm@rafw ~]$ cd RAFW_HOME/bin [rafwadm@rafw bin]$./rafw.sh -c <cell_name> -e <env_name> -i was_common_configure_security_local_ur

7 Page 7 of Locate the security.xml file in the RAFW environment tree: RAFW_HOME/user/environments/env/<env_name>/cells/<cell_name>/security.xml Open security.xml and find the local OS user registry properties. Make updates and save the file. Sample property values are shown in the following example. <!-- BEGIN LocalOS --> <LocalOSUserRegistry ignorecase="false" limit="0" primaryadminid="" properties="" realm="" serverid="" serverpassword="" useregistryrealm="false" useregistryserverid="false"> </LocalOSUserRegistry> <!-- END LocalOS --> 7.3 To export changes to the WAS cell that corresponds to RAFW cell definition, run the action with the t option. [rafwadm@rafw bin]$./rafw.sh -c <cell_name> -e <env_name> -t was_common_configure_security_local_ur 8.0 Configure LDAP user registry In this example, the WebSphere security configuration for the LDAP user registry is modified. 8.1 Import the LDAP user registry configuration from the WAS cell to the RAFW environment tree. This action imports only the LDAP user registry section of security.xml. [rafwadm@rafw ~]$ cd RAFW_HOME/bin [rafwadm@rafw bin]$./rafw.sh -c <cell_name> -e <env_name> -i was_common_configure_security_ldap_ur

8 Page 8 of Locate the security.xml file in the RAFW environment tree. RAFW_HOME/user/environments/env/<env_name>/cells/<cell_name>/security.xml. Open security.xml and find LDAP user registry properties. Make updates and save the file. Sample property values are shown in the following example. Required values are shown in bold text. <!-- BEGIN LDAP --> <LDAPUserRegistry basedn="dc=prod,dc=research,dc=loc" binddn="uid=wpsbind,cn=users,dc=prod,dc=research,dc=loc" bindpassword="mybindpassword" ignorecase="true" limit="0" monitorinterval="0" primaryadminid="uid=wpsbind,cn=users,dc=prod,dc=research, dc=loc" properties="" realm="myldapserver:389" reuseconnection="true" searchtimeout="120" serverid="uid=wpsbind,cn=users,dc=prod,dc=research,dc=loc" serverpassword="myserverpassword" sslconfig="" sslenabled="false" type="ibm_directory_server" useregistryrealm="false" useregistryserverid="false" > <EndPoint WASKey="hosts" host="myldapserver" port="389" > </EndPoint> <LDAPSearchFilter WASKey="searchFilter" certificatefilter="" certificatemapmode="exact_dn" groupfilter="(&(cn=%v)(objectclass=groupofuniquenames))" groupidmap="*:cn" groupmemberidmap="ibm-allgroups:member;ibmallgroups:uniquemember" krbuserfilter="(&(uid=%v)(objectclass=inetorgperson))" userfilter="(&(uid=%v)(objectclass=inetorgperson))" useridmap="*:uid" > </LDAPSearchFilter> </LDAPUserRegistry> <!-- END LDAP -->

9 Page 9 of To export changes to the WAS cell that corresponds to RAFW cell definition, run the action with -t option. [rafwadm@rafw bin]$./rafw.sh -c <cell_name> -e <env_name> -t was_common_configure_security_ldap_ur 9.0 Configure custom user registry In this example, the WebSphere security configuration for a custom user registry is modified. 9.1 Import the custom user registry configuration from the WAS cell to the RAFW cell definition. This action imports only the custom user registry section of security.xml. [rafwadm@rafw ~]$ cd RAFW_HOME/bin [rafwadm@rafw bin]$./rafw.sh -c cell <cell_name> -e env <env_name> -i was_common_configure_security_custom_ur 9.2 Locate the security.xml file in the RAFW environment tree. RAFW_HOME/user/environments/env/<env_name>/cells/<cell_name>/security.xml Open security.xml and find custom user registry properties. Make updates and save the file. Sample property values are shown in the following example. Required values are shown in bold text. <!-- BEGIN CustomReg --> <CustomUserRegistry useregistryserverid="false" ignorecase="false" properties="" customregistryclassname="com.ibm.websphere.security. FileRegistrySample" primaryadminid="myadminid" useregistryrealm="false" limit="0" > </CustomUserRegistry> <!-- END LDAP -->

10 Page 10 of To export changes to the WAS cell that corresponds to RAFW cell definition, run the action with -t option. bin]$./rafw.sh -c <cell_name> -e <env_name> -t was_common_configure_security_custom_ur 10.0 Configure SSL In this example, the WebSphere security configuration for SSL is modified Import the SSL configuration from WAS cell to the RAFW cell definition. This action imports only the SSL configuration section of security.xml. ~]$ cd RAFW_HOME/bin bin]$./rafw.sh -c <cell_name> -e <env_name> -i was_common_configure_security_ssl 10.2 Locate the security.xml file in the RAFW environment tree. RAFW_HOME/user/environments/env/<env_name>/cells/<cell_name>/security.xml In security.xml, find SSL properties. Make updates and save the file. For sample property values, see the security.xml file included in the samples directory. RAFW_HOME/samples/xml/was/<version>/security.xml 10.3 To export changes to the WAS cell that corresponds to RAFW cell definition, run the action with -t option. bin]$./rafw.sh -c <cell_name> -e env <env_name> -t was_common_configure_security_ssl 11.0 Configure SSO In this example, the WebSphere security configuration for single sign on (SSO) is modified Import the SSO configuration from the WAS cell to the RAFW environment tree. ~]$ cd RAFW_HOME/bin bin]$./rafw.sh -c <cell_name> -e env <env_name> -i was_common_configure_security_sso

11 Page 11 of Locate the security.xml file in the RAFW environment tree. RAFW_HOME/user/environments/env/<env_name>/cells/<cell_name>/security.xml In security.xml, find SSO properties. Make updates and save the file. Sample property values are shown in the following example. Required values are shown in bold text. <!-- BEGIN SSO --> <SingleSignon domainname="" enabled="true" requiresssl="false" > </SingleSignon> <!-- END SSO --> 11.3 To export changes to the WAS cell that corresponds to RAFW cell definition, run the action with the -t option. bin]$./rafw.sh -c <cell_name> -e <env_name> -t was_common_configure_security_sso 12.0 Configure TAI In this example, the WebSphere security configuration for trust association and trust association interceptor (TAI) is modified Import the TAI configuration from the WAS cell to the RAFW cell definition. ~]$ cd RAFW_HOME/bin bin]$./rafw.sh -c <cell_name> -e <env_name> -i was_common_configure_security_tai 12.2 Locate the security.xml file in the RAFW environment tree. RAFW_HOME/user/environments/env/<env_name>/cells/<cell_name>/security.xml In security.xml, find TAI properties. Make updates and save the file. For sample property values, see the security.xml file included in the samples directory. RAFW_HOME/samples/xml/was/<version>/security.xml

12 Page 12 of To export changes to the WAS cell that corresponds to RAFW cell definition, run the action with the -t option. bin]$./rafw.sh -c <cell_name> -e <env_name> -t was_common_configure_security_tai 13.0 Enable global and administrative security In this example, the WebSphere security configuration is modified to enable global and administrative security. The active user registry is also modified to use the local OS user registry Import the global and administrative security configuration from the WAS cell to the RAFW cell definition. ~]$ cd RAFW_HOME/bin bin]$./rafw.sh -c <cell_name> -e <env_name> -i was_common_configure_security_global 13.2 Locate the security.xml file in the RAFW environment tree. RAFW_HOME/user/environments/env/<env_name>/cells/<cell_name>/security.xml In security.xml, find global and administrative security properties. Make updates and save the file. Sample property values are shown in the following example. Required values are shown in bold text. <!-- BEGIN GlobalSecurity --> <Security activeauthmechanism="#ref_obj_type#ltpa" activeprotocol="both" activeuserregistry="#ref_obj_type#localosuserregistry" additionalsecattrs="" allowallpermissionforapplication="false" allowbasicauth="true" appenabled="true" auditspecifications="" caclients="" cachetimeout="600" defaultsslsettings="#ref_obj_type#sslconfig" dynamicsslconfigselections="" dynamicallyupdatesslconfig="true" enablejava2secruntimefiltering="false" enabled="false" enforcefinegrainedjcasecurity="false" enforcejava2security="false"

13 Page 13 of 18 issuepermissionwarning="true" rolebasedauthorization="" usedomainqualifiedusernames="false" uselocalsecurityserver="true" > </Security> <!-- END GlobalSecurity --> Set the activeuserregistry attribute to one of the following values: #ref_obj_type#localosuserregistry (available in 6.0, 6.1, 7.0) #ref_obj_type#ldapuserregistry (available in 6.0, 6.1, 7.0) #ref_obj_type#customuserregistry (available in 6.0, 6.1, 7.0) #ref_obj_type#wimuserregistry (available in 6.1, 7.0) Set the activeauthmechanism attribute to one of the following values: #ref_obj_type#ltpa (available in 6.0, 6.1, 7.0) #ref_obj_type#swamauthentication (available in 6.1, deprecated in 7.0) #ref_obj_type#spnego (available in 7.0) #ref_obj_type#krb5 (available in 7.0) #ref_obj_type#rsatoken available in 7.0) 13.3 To export changes to the WAS cell that corresponds to RAFW cell definition, run the action with -t option. bin]$./rafw.sh -e env <env_name> -c cell <cell_name> -t was_common_configure_security_global 14.0 Restarting servers in a cell To use the updated security configuration, the network deployment or standalone WebSphere Application Server must be restarted Stop the processes running on the cell in the following sequence. Important: The old administrative user ID and password in the cell configure.properties file is required to stop running processes Stop the WAS cluster. [rafwadm@rafw bin]$./rafw.sh -e <env_name> -c <cell_name> -u <cluster_name> -t was_common_configure_stop_cluster

14 Page 14 of Stop the node agents. bin]$./rafw.sh -e <env_name> -c <cell_name> -n node01 -t was_common_configure_stop_nodeagent bin]$./rafw.sh -e <env_name> -c <cell_name> -n node02 -t was_common_configure_stop_nodeagent Stop the deployment manager. bin]$./rafw.sh -c <cell_name> -e <env_name> -t was_common_configure_stop_dmgr 14.2 Update the cell configure.properties file with the new administrative user ID and password Open the configure.properties file for the cell: RAFW_HOME/user/environments/env/cells/cell/configure.properties Update the WAS_USERNAME and WAS_PASSWORD properties to match the new security configuration Save the configure.properties file Start the processes running on the WAS cell in the following sequence Start the deployment manager. bin]$./rafw.sh -c <cell_name> -e <env_name> -t was_common_configure_start_dmgr Start the node agents. bin]$./rafw.sh -e <env_name> -c <cell_name> -n node01 -t was_common_configure_start_nodeagent bin]$./rafw.sh -e <env_name> -c <cell_name> -n node02 -t was_common_configure_start_nodeagent Start the WAS cluster. bin]$./rafw.sh -e <env_name> -c <cell_name> -u <cluster_name> -t was_common_configure_start_cluster

15 Page 15 of Executing security actions in Rational Build Forge Actions are added to Rational Build Forge as libraries. Security actions are added to the RAFW_was_common_configure_security library as steps. To execute security actions in Rational Build Forge, do the following: Add the RAFW_was_common_configure_security library to a project. Choose the security actions to run by selecting steps that correspond to the actions that you want to run. The following examples identify the basic procedure for using Rational Build Forge to: Import the working security configuration from a WAS cell Export the security configuration to the same WAS cell or another WAS cell in another environment Import a WAS security configuration Select the Libraries module and find the RAFW_was_common_configure_security action.

16 Page 16 of Add the RAFW_was_common_configure_security action to the RAFW_<env_name>_<cell_name> project as an inline step. Note: The Environment wizard created the RAFW_<env_name>_<cell_name> project Select the Environments module, open the RAFW_Global environment, and change the MODE variable to Import. Notes: The Environment wizard added the RAFW_Global environment to the RAFW_<env_name>_<cell_name> project environment. The inline library inherits the selector and environment of the calling project Run the RAFW_<env_name>_<cell_name> project by clicking the Start Project button. This start option displays the Job Steps tab. Clear all the steps in the project except the steps in RAFW_was_common_configure_security action.

17 Page 17 of Export an updated WAS security configuration Export the security configuration to the same WAS cell or to another WAS cell with the same configuration definition in another environment. For example, from the DEV environment to the QA environment Select the Environments module, open the RAFW_Global environment, and change the MODE variable value to Export Run the RAFW_<env_name>_<cell_name> project by clicking the Start Project button. This start option displays the Job Steps tab. Clear all the steps in the project. In the RAFW was_common_configure_security action, select the steps for the security actions that you want to configure, for example: configure the LDAP user registry SSL global and administrative security Trademarks IBM, the IBM logo, WebSphere Application Server, Rational Build Forge and Rational Automation Framework for WebSphere are trademarks of IBM Corporation in the United States, other countries, or both. Java and all Java-based trademarks are trademarks of Sun Microsystems, Inc. in the United States, other countries, or both. Also, if this article uses any of the product names from other companies that require trademarks, add the appropriate information here. See Special Attributions for details. Other company, product, or service names may be trademarks or service marks of others.. Resources Learn Share this article Digg this story Post to del.icio.us Visit the Rational software area on developerworks for Slashdot it! technical resources and best practices for Rational Software Delivery Platform products. Subscribe to the developerworks Rational zone newsletter. Keep up with developerworks Rational content. Every other week, you'll receive updates on the latest technical resources and best practices for the Rational Software Delivery Platform. Subscribe to the Rational Edge newsletter for articles on the concepts behind effective software development. Subscribe to the IBM developerworks newsletter, a weekly update on the best of developerworks tutorials, articles, downloads, community activities, webcasts and events. Browse the technology bookstore for books on these and other technical topics.

18 Page 18 of 18 Get products and technologies Download trial versions of IBM Rational software. Download IBM product evaluation versions and get your hands on application development tools and middleware products from DB2, Lotus, Rational, Tivoli, and WebSphere. Discuss Check out developerworks blogs and get involved in the developerworks community. About the authors Slobodan Bobby Nikolic specializes in software design and architecture, specifically Java/J2EE Web applications. He is an expert in several IBM WebSphere technologies, including Rational Application Developer for WebSphere Software, WebSphere Application Server, WebSphere Portal, and Lotus Web Content Manager. He was a member of the software development team that delivered the first release of Rational Automation Framework for WebSphere. Bobby has a B.S. in Computer Science, University of Belgrade, Serbia. Alden Taylor (ataylor@atech.com) is the architect and lead developer for the Rational Automation Framework for WebSphere. He is a consultant with Ascendant Technology. For the last 6 years Alden has specialized in WebSphere Application Server and WebSphere Portal architecture, infrastructure and development. Alden has a B.S. in Computer Science, University of Colorado. Jill Ackerman is a technical writer working with the Rational Automation Framework for WebSphere and Rational Build Forge teams at IBM in Austin, Texas.