6. Server User Guide

6. Server User Guide

Configuring Your Application Server to Work with Process Server Security Roles

Configuring Your Application Server to Work with Process Server Security Roles

Setting up secure access to Process Server includes the following steps:
  • Run the Process Server
    config-deploy
    utility and select security options. When Process Server is deployed, it is configured to use its security roles.
  • Configure your application server to use Process Server security roles by mapping roles to users and groups (discussed below).
  • Configure the security details of your application server for authentication and authorization methods (discussed below).
Mapping Roles to Users and Groups
Each application server has a different set of steps for configuring security for deployed applications. You must familiarize yourself with your application server environment to understand how to configure the security methods you need. However, here are some general guidelines and links to documentation.
Application Server
Setup Guidelines
Tomcat
Add a
realm
to
server.xm
l, connecting to an existing "database" of usernames, passwords, and user roles.
See examples below.
For an LDAP-based database, add the Process Server security roles to your database and map them to groups.
Refer to
Realm Configuration HOW-TO
at the following URL (Tomcat 6.0):
http://tomcat.apache.org/tomcat-7.0-doc/realm-howto.html
JBoss
Refer to
https://docs.jboss.org/author/display/AS71/Admin+Guide
Add a security domain and login module to your chosen configuration file. The security domain must be named the same as what was selected in the Process Server
config-deploy
utility. If the name was not changed in the utility, it defaults to "ActiveVOS". Add roles to one of the following: a set of user/role files, LDAP-based database, or JDBC-based database.
WebLogic
Login to the WebLogic console and set up the LDAP provider, if you have not already done so: (Navigate to Security Realms. In the default realm, select
Providers > Authentication > Default Authenticator
and change the Control Flag from REQUIRED to OPTIONAL. Add and configure your LDAP provider.)
For details, see
Configuring Authentication Providers
at
http://download.oracle.com/docs/cd/E13222_01/wls/docs103/secmanage/atn.html
In your security realm, navigate to Roles and Policies. Expand Global Roles, select Roles, and enter the Process Server security roles.
For details, see
Users, Groups, and Security Roles
at
http://download.oracle.com/docs/cd/E12840_01/wls/docs103/secwlres/secroles.html
WebSphere
Login to the WebSphere console and follow the links similar to this example:
Applications > Application types > WebSphere enterprise applications > Process Server
Look for the
Security role to user/group mapping
group. Map the existing Process Server security roles to groups.
Note:
You must ensure that WebSphere application security is set up correctly. On the WebSphere Console navigation area, select
Security > Secure administration, applications, and infrastructure
. Then select the checkbox next to Enable Application Security and select
Apply
.
Tomcat Examples
tomcat\conf\server.xml
(
file-based configuration
)
<Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase"/>
tomcat\conf\tomcat-users.xml
file:    <role rolename="abTaskClient"/>    <role rolename="abServiceConsumer"/>    <role rolename="abAdmin"/>    <user username="admin" password="admin"   roles="abAdmin, abTaskClient, abServiceConsumer"/>
tomcat\conf\server.xml
(
LDAP-based configuration
)
<Realm className="org.apache.catalina.realm.JNDIRealm" debug="99"    connectionName="uid=ldapadmin,ou=system"    connectionPassword="password"    connectionURL="ldap://<LDAP_Server_name>:<Port>"    userSubtree="true"    userBase="ou=users,o=xyzuser"    userSearch="(uid={0})"    roleSubtree="true"    roleBase="ou=groups,o=xyzrole"    roleName="cn"    roleSearch="(uniqueMember={0})" />
JBoss Examples
Note
: The following two examples are specific to JBoss 7.1.1; other versions require different configurations. Also, what you see here is just to indicate how you might configure JBoss. What you will actually declare will almost certainly be different. For all JBoss versions, you must review the JBoss documentation.
[Path]
\configuration\
[file.xml]
(
file-based configuration
)
The file name you will enter will be unique to your installation. The only part of the name that will be there is “configuration”. Here is an example:
C:\servers\jboss-as-7.1.1.Final\standalone\configuration\standalone-full.xml
<security-domain name="ActiveVOS" >   <authentication>     <login-module code="RealmUsersRoles" flag="required">       <module-option name="usersProperties"              value="${jboss.server.config.dir}/application-users.properties"/>       <module-option name="rolesProperties"              value="${jboss.server.config.dir}/application-roles.properties"/>       <module-option name="realm" value="ApplicationRealm"/>       <module-option             name="unauthenticatedIdentity"> anonymous       </module-option>     </login-module>   </authentication> </security-domain> ${jboss.server.config.dir}/application-roles.properties admin=abTaskClient,abAdmin,abServiceConsumer ${jboss.server.config.dir}/application-users.properties admin=admin
[Path]
\configuration\
[Path]
(
LDAP-based configuration
)
The file name you will enter will be unique to your installation. The only part of the name that will be there is “configuration”. Here is an example:
C:\servers\jboss-as-7.1.1.Final\standalone\configuration\standalone-full.xml
.
<security-domain name="ActiveVOS">   <authentication>     <login-module code="org.jboss.security.auth.spi.LdapExtLoginModule"             flag="optional">       <module-option name="java.naming.provider.url"             value="ldap://myserver:3268"/>       <module-option name="bindDN"             value="CN=admin,CN=Users,DC=myDomain,DC=myCompany,DC=local"/>       <module-option name="bindCredential" value="admin"/>       <module-option name="baseCtxDN"             value="DC=myDomain,DC=myCompany,DC=local"/>       <module-option name="baseFilter"             value="(sAMAccountName={0})"/>       <module-option name="rolesCtxDN"             value="DC=myDomain,DC=myCompany,DC=local"/>       <module-option name="roleFilter" value="(member={1})"/>       <module-option name="roleAttributeID" value="memberOf"/>       <module-option name="roleAttributeIsDN" value="true"/>       <module-option name="roleNameAttributeID" value="cn"/>       <module-option name="roleRecursion" value="2"/>       <module-option name="searchScope" value="SUBTREE_SCOPE"/>       <module-option name="allowEmptyPasswords" value="true"/>       <module-option name="java.naming.referral"  value="follow"/>       <module-option name="unauthenticatedIdentity" value="aeadmin"/>     </login-module>   </authentication> </security-domain>


Updated March 13, 2020