Configuring ILMT/TAD4d security to use Active Directory.

Transcription

1 Configuring ILMT/TAD4d security to use Active Directory. Warning: Please bear in mind that this is a technical note, and it is not a part of the official documentation. The described procedure may work in your environment, or may not. Also there is no guarantee that it'll work with other than or x versions of the product. This document has been developed based on a DeveloperWorks article: IBM WebSphere Developer Technical Journal: Expand your user registry options with a federated repository in WebSphere Application Server V6.1. It is available under the following link: If you accidentally locked (wrong permissions, wrong passwords, etc.) your ILMT console and you are not able to log in, you can disable the security mechanism, login to ILMT with no password, and then make corrections to the configuration. In order to disable the security, please refer to the following technical note: The objectives: We are going to configure Federated repositories and add a new one to be used with Active Directory server. This way we will be able to define the access to ILMT application using user accounts and groups defined in your Active Directory. Prerequisites: Before you begin, make sure that the user who runs the ILMT Server process has the local administrator privileges. If your ILMT Server instance is running on a domain user account, with no local administrator privileges, the configuration could not succeed and you will have to reinstall the ILMT Server using the local administrator account. After that, the server can be added to the domain and you can proceed with the procedure below. The procedure: 1. Login to the ILMT UI. 2. Go to 'Security' > 'Secure administration, applications, and infrastructure'. 3. In the 'Available realm definitions' field, select 'Federated repositories' from a drop-down list and click Configure :

2 4. Click on the 'Manage repositories': 5. Click the 'Add' button. 6. Enter the required fields: Repository identifier a name for the repository. It is for your reference, so it can be any value. Directory type for Microsoft Active Directory it will be either 'Microsoft Windows Server 2000 Active Directory', 'Microsoft Windows Server 2000 Active Directory' or 'Microsoft Active Directory Application Mode'. Primary host name it could be either an IP address or a hostname of the Active Directory Server. Bind distinguished name a distinguished name (DN) to use when binding to the AD Server. In my example I am going to use the Administrator as a DN. The server is LMT.TEST, the user is located in the Users container, so the desired DN is: cn=administrator,cn=users,dc=lmt,dc=test Bind password the password for the DN defined above. Important: Please notice that the Bind Distinguish Name and Bind Password are used to query the Active Directory server, and if they are not correct, you won't be able to complete the security configuration. Please contact your AD administrator to get that information. Below you can find a screen shot from a sample configuration:

3 7. Click 'OK' and then 'Save'. You have added a new repository. 8. Go back to the 'Federated repositories' panel (click on the link): 9. Click on 'Add Base entry to the Realm':

4 10. Select the repository you have just added and enter information required by the two next fields: Distinguished name of a base entry that uniquely identifies this set of entries in the realm this is a distinguished name used by the repository within the application realm. Can consists of the same value as the field below. Distinguished name of a base entry in this repository this field is a crucial one because it is used to do a search for users and groups in Active Directory repository. It is a search base of your user and groups within your Active Directory schema. Please see three examples below: Example 1: The AD server is LMT.TEST. All the users are located in the Users container. The DN would be: cn=users,dc=lmt,dc=test Example 2: The AD server is LMT.TEST. Your users are located in two different containers: Users and Dev. The DN we need should provide a way to search for users and groups in these two containers. It will look as follow: dc=lmt,dc=test Example 3: The AD server is LMT.TEST. Your users are located in Dev container. However you would also like to grant ILMT access for all members of DB2ADMNS group (it is just an example). In effect, you need to be able to query both Users and Dev containers. The DN in effect is the same as for the Example 2: dc=lmt,dc=test. Below you can find a screen shot from ILMT UI taken for the example 1:

5 11. Click 'OK' and 'Save' changes. In effect you should see the new repository in the list: 12. Still on the 'Federated repositories' panel, provide the administrative username (in my example, ilmtadmin) and select 'Automatically generated server identity': 13. Click 'OK', and provide a password for the Primary administrative user. 'Save' the changes. 14. Now, on the 'Secure administration, applications, and infrastructure' panel, select 'Enable administrative security'. Java 2 security will be enabled automatically, however with Java 2 security you won't be able to save the PVU reports to PDF files. If you want that functionality, you have to disable the 'Use Java 2 security to restrict application access to local resources' checkbox. In the 'Available realm definitions' drop-down menu, please select 'Federated repositories', and click 'Set as current'. Then click 'Apply' and 'Save'. Below you can find a screen shot with the selections.

6 15. You've just enabled the security and configured the user repository. Restart the ILMT Server, using 'Stop server' and 'Start server' shortcuts. 16. Login to the ILMT UI using the account you have defined in the step 12 (in my example, the ilmtadmin). 17. Go to User and Groups > Manage Users to verify if the configuration succeeded. You can search for the user you are interested in. The user must exist in the Active Directory.

7 18. Similarly, you can verify if you can query the AD groups. To do this, go to the User and Groups > Manager Groups. 19. Now, you can assign ILMT Roles to users or groups using either 'User and Groups' > 'Administrative User Roles' or 'User and Groups' > 'Administrative Group Roles' panels. For example: After clicking 'OK' and then 'Save', you will see the new user defined in the application:

8 In effect, the '72fp1' user can login to the ILMT now and will be assigned with 'Administrator', 'invenrotyadministrator' and 'softwareassetmanager' roles. Assigning the ILMT roles to an Active Directory group looks very similar: Click 'OK' and 'Save' changes'. You will see a similar view:

9 From now on, every member of DB2ADMNS group can login to the ILMT and will get the 'inventoryadministrator' role. 20. If you are not able to find a user or a group you would like to add roles to, it means that most likely the 'Distinguished name of a base entry in this repository' you has defined in step 10 is wrong. You can modify the DN and try to find the user or group again. To make corrections to the DN, go to 'Security' > 'Secure administration, applications, and infrastructure' and click on the repository you've added. More information on user management can be found under the following link: _conf_perm_users.html