User Registry Configuration in WebSphere Application Server(WAS)

Transcription

1 2012 User Registry Configuration in WebSphere Application Server(WAS) By Geetha Kanra, Sanjay Singh, and Yogendra Srivastava [Abstract: This article provides step by step procedure to configure various types of user registries in WAS with user friendly screen shots. This would help all developers, testers and client facing technical staff that needs to use authentication mechanism of WAS to perform their activities.] Geetha has joined ISL in 2006 and worked for Content Services team with ISL, for Information Management team as L3 quality assurance, support of IBM Filenet Content services. She has been certified for Filenet content services, P8 system administration. She is currently working in MCB, Industry accelerators Team as a GUI Developer. Reach out to her at geetha.karna@in.ibm.com Sanjay Singh has around twelve years of experience in designing and developing high performance scalable enterprise software in Content Management, Telecom and Finance domains. He is with IBM for last Six years and is a senior member of ECM team in ISL. Sanjay has a B. Tech. degree from IIT Kanpur. Reach out to him at sksingh6@in.ibm.com Yogendra Srivastava is a Software engineer around 10 years of experience in Healthcare and information management domain, He is currently responsible for IBM Case Manager for Healthcare design and development at IBM - India Software Lab. prior to this work he was architect and technical lead of DB2 Health Advisor Service and worked on various IBM products namely Cognos, SPSS, IBM Content Analytics, DB2, FileNet. He has delivered several technical sessions to Customers and Universities on IBM technologies. Reach out to him at ysrivastava@in.ibm.com

2 Table of Contents: a. Configuration of local operating system user registry in WAS b. Configuration of LDAP user registry in WAS c. Configuration of Federated Repository in WAS 1. Configuration of File Repository in Federated Repository 2. Configuration of LDAP Repository in Federated Repository d. Conclusion e. Reference 2

3 Introduction: The Web Sphere Application (WAS) supports authentication for WAS users as well as users of the applications deployed on it. For example WAS needs to authenticate users logging into its admin console as well as provide support for users of a J2EE application through JAAS login module. The Web Sphere Application Server security model is based on the services provided in the operating system and the Java EE security model. To enable authentication mechanism in WAS, we need to configure user registries which contain authentication data of users. The user registries supported on WAS are of four types: Local operating system user registry LDAP user registry Federated user registry Custom Registry To configure an Application with different types of user registries in WAS, user has to refer several links to collect the required information. So in order to help other users who would need to go through this process in future, we have compiled the information gathered from different sources into one article. This article elaborates procedure and provides screenshots to configure User Registries in WAS. a. Configuration of local operating system user registry in WAS: To enable local operating system authentication mechanism in WAS follow the steps provided below. 1. Login to WAS admin console with Administrator credentials, if administrative security is enabled else login without credentials 2. Go to Security->Click Global Security 3. Check Enable administrative Security and Enable application security and Apply. 4. Select Local operating system from Available realm definitions 3

4 Figure: 1 Click set as current and then click configure Figure: 2 Enter "Primary Administrative user name" (for example "db2admin"). 4

5 Note: db2admin should belong to Administrator group in the operating system. 1. Click Apply, Save and click OK. 2. Restart WAS 3. Login to WAS using db2admin user (currently added user). Login should be successful. b. Configuration of LDAP user registry in WAS: To enable LDAP authentication mechanism in WAS follow the steps provided below. (In this example we are configuring IBM Tivoli Directory Server) 1. Login to WAS admin console with Administrator credentials 2. Go to Security->Click Global Security 3. Check Enable administrative Security and Enable application security and Apply. 4. Select Standalone LDAP Registry from Available realm definitions. Click set as current Figure: 3 Click Configure and provide username> enter other details as shown below> click Test Connection. WAS displays a message, Connection to LDAP successful> Click on Save Note: Ensure that the user name filled in the Primary administrative user name box and base dn exist in the LDAP, and hostname of ldap and port are correct. 5

6 Figure: 4 Click Advanced Lightweight Directory Access Protocol (LDAP) user registry settings and do changes. Please put in appropriate filter details as entries in your ldap. The following screenshot shows user filter tab with entries of objectclass and login attribute as "cn". 6

7 Figure: 5 1. Apply and Save. 2. Restart WAS 3. Login with LDAP User credentials configured as Primary administrative user name in earlier steps. Login should be successful. This Completes the configuration of LDAP with WAS. c. Configuration of Federated Repository in WAS: 1. Configuration of File Repository in Federated Repository To enable File Repository in Federated Repository authentication mechanism in WAS follow the steps provided below: 1. Login to WAS admin console with Administrator credentials, if administrative security is enabled else login without credentials 2. Go to Security->Click Global Security 3. Select Federated repositories from Available realm definitions, Click set as current 4. Check Enable administrative Security and Enable application security >Apply. 7

8 Figure: 6 5. Click Configure Figure: 7 8

9 6. Provide Primary administrative user name >click Apply > provide the password for Administrator. 7. Restart WAS. 8. Login to WAS using Administrator and password. Steps for creation of additional user entries in File Repository: Figure: 8 Expand Users and Groups>select Manage Users>fill in user entry details >click on create button to create user as shown below. Figure: 9 9

10 If required you can now replace the Primary administrative user name with the new user in the user registry configuration screen. Refer Fig 7. The screenshot which shows all users: Figure: Configuration of LDAP Repository in Federated Repository To enable LDAP Repository in Federated Repository authentication mechanism in WAS, follow the steps provided below: (In this example we are configuring IBM Tivoli Directory Server) 1. Login to WAS admin console with Administrator credentials, if administrative security is enabled else login without credentials 2. Go to Security->Click Global Security 3. Select Federated repositories from Available realm definitions, Click set as current 4. Check Enable administrative Security and Enable application security and Apply. 10

11 Figure: Click Configure Figure: 12 11

12 6. Provide Primary administrative user name >click Apply > provide the password for Administrator. Note: Administrative user provided here should not exist in any of the repositories to be configured in this federated repository 7. Click on Add Base entry to Realm Figure: Click on Add Repository and enter the values of your Tivoli LDAP repository. There are many variations in configuring LDAP s into Federated repository in WAS. For details please look into the reference links provided at the end of the article. In this example we have user entry object class as inetorgperson in tivoli and "login attribute" is cn. In the screen shot below we are providing uid as the "login property" and then shall map notional "uid" login property to actual login attribute "cn" in wimconfig.xml. 12

13 Figure: Click on Apply. 10. Enter the Distinguished name as shown below. In the text box below label "Distinguished name of a base entry that uniquely identifies this set of entries in the realm" add a logical base DN by which the entries of LDAP currently being configured would be identified in the federated repository. Here we can put any value (like o=isl or what ever as long as it does not conflict with logical base DN of any other repository configured in this federated repository). In the text "below distinguished name of a base entry in this repository" put in the actual base "dn" existing in ldap. Figure: 15 13

14 11. Click on Apply 12. Click on OK. 13. Save it. 14. Change the Realm name and primary administrative username of LDAP. 15. Save the configuration. Figure: Open wimconfig.xml (C:\Program Files\IBM\WebSphere\AppServer\profiles\AppSrv01\config\cells\My Node01Cell\wim\config\wimconfig.xml) 17. Insert an entry as marked in bold below: <config:attributeconfiguration> <config:attributes name="userpassword" propertyname="password"/> <config:attributes name="krbprincipalname" propertyname="kerberosid"> <config:entitytypes>personaccount</config:entitytypes>i </config:attributes> <config:attributes name="cn" propertyname="uid"> <config:entitytypes>personaccount</config:entitytypes> </config:attributes> Now Tivoli Directory server has been added to Federated Repositories. Restart WAS. Login with LDAP user credentials, WAS should allow the LDAP user to Login. 14

15 d. Conclusion The article has guided you through the various ways of configuration of user registries in WAS. We have elaborated each step with a screenshot to provide user friendly environment while configuring the user registries in WAS. e. Reference IBM Web sphere Application Server Info center. tml ons.25.help/t_inst_federated_repositories.html 8.install.doc%2Fp8pin310.htm 15