Configure SSO for WPM (WAS 6.0) and TAM WebSEAL using TAI ++

Transcription

1 Configure SSO for WPM (WAS 6.0) and TAM WebSEAL using TAI ++ Charles Ahart Strategic Computer Solutions These instructions were assembled from some of the configuration steps out of two IBM documents. I picked out only the items necessary for me to get SSO working between TAM WebSEAL and WPM for my environment. Two separate hosts are involved: tam I have installed Policy Server, Authorization Server, and WebSEAL web1 I have installed WAS 6 and WPM The two documents I used to compile these instructions: ) Create a user that WebSEAL will use to connect to the backend server (in this case WAS 6) I.e. user name sso. See following screen shot.

2 2.) Next, create a junction for the backend server. Note: My WPM server is installed on a separate machine from TAM and WebSEAL. Also, I chose to use the PDAdmin command line tool for this next step. I could have just as easily done this part from the WPM GUI like in step 1. Server task webseal_instance_name create b supply c iv-creds t tcp h was hostname p was app port number junction name server task default-webseald-tam create -b supply -c iv-creds -t tcp -h web1 -p 9080 /wpm Note: Do a server list to see the WebSEAL server instances. The was hostname is obviously the FQDN or something resolvable The was app port number depends on what app you are choosing to junction to. In this case it s WPM. Junction name can be whatever you want to call it. It must have a / in front of it. The b supply ensures that WebSEAL passes the HTTP basic Authentication header The c iv-creds ensures that WebSEAL passes the iv-creds header. 3.) Next you must do some WAS configuration. I did these steps from my WPM server (web1): A.) Source the setupcmdline to setup WAS environment wpm:/opt/ibm/websphere/appserver/bin #../setupcmdline.sh B.) Setup CLASSPATH to include PD.jar wpm:/opt/ibm/websphere/appserver/bin # CLASSPATH=${WAS_HOME}/java/jre/lib/ext/PD.jar:${WAS_CLASSPATH} C.) Run AMJrte configuration to be sure it is configured properly. Watch for success message at the end. wpm:/opt/ibm/websphere/appserver/bin # java -cp ${CLASSPATH} -Djava.ext.dirs - Dpd.home="/opt/IBM/WebSphere/AppServer/java/jre/PolicyDirector" com.tivoli.pd.jcfg.pdjrtecfg -action config -was -host "tam policy server host name" HPDBF0021E This Java Runtime Environment (/opt/ibm/websphere/appserver/java/bin/../jre) has already been configured. Unconfigure first then retry the command. Configuration of Access Manager Runtime for Java is in progress. This might take several minutes. Configuration of Access Manager Runtime for Java completed successfully.

3 D.) Run SSL Configuration. Again you should see success message at the end. wpm:/#java -cp $CLASSPATH -Dpd.cfg.home=$WAS_HOME/java/jre -Xnoargsconversion com.tivoli.pd.jcfg.svrsslcfg -action config -admin_id sec_master -admin_pwd ****** -appsvr_id sso -policysvr tam:7135:1 -port authzsvr tam:7136:1 -mode remote -cfg_file $WAS_HOME/java/jre/PdPerm.properties -key_file $WAS_HOME/java/jre/lib/security/PdPerm.ks -cfg_action replace Configuration of Access Manager Runtime for Java completed successfully. Note: after the admin_pwd you will need to specify the password for sec_master where I have shown asterisks.

4 4.) Web to the WAS server admin console. In my case 5.) Open the Security Tab and enable LTPA in the Active Authentication Mechanism drop down 6.) Click Apply, then Save the changes 7.) Next come back to this screen and twist open Authentication Mechanism, then click the LTPA Link. 8.) Click the Trust Association Link

5 9.) Click the enable trust association check box. 10.) Click Apply 11.) Then save the changes 12.) Now from that same screen click the Interceptors Link. 13.) Click the com.ibm.ws.security.web.tamtrustassociationinterceptorplus link. 14.) Click Custom Properties 15.) Click New to create each custom property and make sure to click apply after each property is configured. For WAS 6.0 the properties you need: com.ibm.websphere.security.webseal.checkviaheader = false com.ibm.websphere.security.webseal.loginid = sso com.ibm.websphere.security.webseal.id = iv-creds

6 16.) Click Save to apply the changes 17.) You should also navigate to the Security -> Authentication Mechanisms -> LTPA page and set a password. (Ref# )

7 18.) Click Apply, then Save Changes. 19.) Next you should set the password for the SSO user in webseald-default.conf. This file is located on the WebSEAL server. Look for the entry basicauth-dummypasswd 20.) If you want to access WebSEAL via HTTP instead of HTTPS edit the /opt/pdweb/etc/webseald-default.com and set the following lines: ba-auth=none forms-auth=none

8 21.) Now restart WebSEAL: pdweb restart 22.) You must also make some changes on the WPM server. My WPM server is a separate machine called web1. So I must edit the amconf.properties file at: web1: /opt/ibm/websphere/appserver/profiles/default/installedapps/web1node01cell/tamwpm.ear/classes #

9 23.) Set the authmethod to SSO as in the above screen shot. 24.) Now save your changes and restart WAS. To test this configuration you should now be able to web to your WebSEAL server and specify the WPM junction and login. This should take you all the way into WPM. You will have to specify pdadmin in the URL so in my case: I now have SSO working between TAM WebSeal and the WAS Server running WPM.