Configuring a basic authentication in WebSEAL to access SmartCloud Control Desk

Transcription

1 Configuring a basic authentication in WebSEAL to access SmartCloud Control Desk IBM Tivoli Access Manager WebSEAL is a resource manager responsible for protecting web-based resources. It is a high-performance multi-threaded web server which applies security policies defined by the administrator user to the web-based resources. You can use WebSEAL to enhance security in SmartCloud Control Desk. In this article we will show how to configure a basic authentication in WebSEAL. No security policies will be defined. The following products should be installed and configured in order to use IBM Tivoli Access Manager WebSEAL: - Access Manager Runtime - Access Manager Policy Server - Access Manager WebSEAL For this article two servers were used, one for WebSEAL and one for IBM SmartCloud Control Desk. See the structure below: On the server where the SmartCloud Control Desk 7.5 was deployed, the middleware installer was used to install IBM Tivoli Directory Server 6.3 before the installation of SmartCloud Control Desk 7.5. On the SmartCloud Control Desk server, make sure that a suffix domain exists.

2 Go to IBM Tivoli Directory Server 6.3 and select Manage:

3 Verify that a Suffix DN to be used in the configuration exists. In this case the Default will be used.

4 On the server for WebSEAL, the following configuration was done: Access Manager Runtime: The Access Manager Runtime contains runtime libraries and supporting files that applications can use to access Tivoli Access Manager servers. It should be configured in the following way: Select LDAP for Registry: Enter the LDAP host name information:

5 In this case, the SSL will not be used.

6 Select the option, "Enable Tivoli Directory for logging":

7 Click Finish: Access Manager Policy Server: The Access Manager Policy Server maintains the master authorization database for the management domain as well as the policy databases associated with other secure domains that you might decide to create. This server is key to the processing of access control, authentication, and authorization requests. It also updates authorization database replicas and maintains location information about other Tivoli Access Manager servers. The Access Manager Policy Server can be configured in the following way.

8 Enter the Domain created previously in the Directory Server Configuration:

9 Enter the password for the LDAP server: Enter a password for sec_master user:

10 Select Minimal:

11 Use the default SSL connection parameter values and click OK: Configuration is complete. The following dialog displays:

12 Access Manager WebSEAL: Access Manager WebSEAL is a robust and secure centralized policy management solution for e-business and distributed applications. It is a high performance, multithreaded Web server that applies fine-grained security policy to the Tivoli Access Manager protected Web object space. It can be configured using the following options. Click Configure: Enter an instance name:

13 Enter the host name for Tivoli Access Manager Policy. In this case, it is on the same server. Enter the Domain name and password for sec_master:

14 The SSL option will not be used in this case:

15 Select the option Allow HTTP access and select Finish. Create a junction point in WebSEAL: Go to Start > Programs > IBM Tivoli Access Manager Administration Command Prompt. At the pdadmin prompt, enter: login At the Enter User ID prompt, enter: sec_admin For Enter Password, type the password defined in the policy manager configuration.

16 Verify the WebSEAL server name: At the pdadmin sec_master prompt, enter: server list Create a junction point: At the pdadmin sec_master prompt, enter: server task "WebSEAL_server_name" create -b supply -c iv-creds -t tcp -h "websphere_hostname" -p "websphere_app_port_number" /"junction_name" (It should be maximo) Create a user: user create -no-password-policy webtest cn=webtest,o=ibm,c=us webtest webtest webtest user modify webtest account-valid yes Edit WebSEALd-default.conf: (C:\Program Files\Tivoli\PDWeb\etc) [ba] ba-auth = both [junction] basicauth-dummy-passwd = webtest (user created previously) [script-filtering] script-filter = yes [filter-content-types] add the following types type = text/html type = text/vnd.wap.wml type = text/xml type = text/* [filter-url] add the following:

17 PARAM = VALUE It should be in alphabetical order. Re-start WebSEAL as follows: pdadmin sec_master> server task default-webseald-.ibm.com server restart Use the same authentication for Maximo and WebSEAL In Maximo, change the following xml:...applications\maximo\maximouiweb\webmodule\web-inf\web.xml Uncomment the following: <login-config> <auth-method>basic</auth-method> <realm-name>maximo Web Application Realm</realm-name> </login-config> And comment the following: <!-- <login-config> <auth-method>form</auth-method> <realm-name>maximo Web Application Realm</realm-name> <form-login-config> <form-login-page>/webclient/login/ login.jsp?appservauth=true</form-login-page> <form-error-page>/webclient/login/loginerror.jsp</formerrorpage> </form-login-config> </login-config> --> Create a new ear file and deploy it. Then in WebSEAL, change the WebSEALd-default.conf file as follows: basic-auth-realm = MAXIMO Web Application Realm Re-start WebSEAL.

18 Log in to the SmartCloud Control Desk Start Center: Verify that you can access SmartCloud Control Desk through the WebSEAL server. Transparent junction point