Setting up secure access to Process Server includes the following steps:
Run the Process Server
config-deploy
utility and select security options. When Process Server is deployed, it is configured to use its security roles.
Configure your application server to use Process Server security roles by mapping roles to users and groups (discussed below).
Configure the security details of your application server for authentication and authorization methods (discussed below).
Mapping Roles to Users and Groups
Each application server has a different set of steps for configuring security for deployed applications. You must familiarize yourself with your application server environment to understand how to configure the security methods you need. However, here are some general guidelines and links to documentation.
Application Server
| Setup Guidelines
|
Tomcat
| Add a
realm to
server.xm l, connecting to an existing "database" of usernames, passwords, and user roles.
For an LDAP-based database, add the Process Server security roles to your database and map them to groups.
Refer to
Realm Configuration HOW-TO at the following URL (Tomcat 6.0):
http://tomcat.apache.org/tomcat-7.0-doc/realm-howto.html
|
JBoss
| Refer to
https://docs.jboss.org/author/display/AS71/Admin+Guide
Add a security domain and login module to your chosen configuration file. The security domain must be named the same as what was selected in the Process Server
config-deploy utility. If the name was not changed in the utility, it defaults to "ActiveVOS". Add roles to one of the following: a set of user/role files, LDAP-based database, or JDBC-based database.
|
WebLogic
| Login to the WebLogic console and set up the LDAP provider, if you have not already done so: (Navigate to Security Realms. In the default realm, select
Providers > Authentication > Default Authenticator
and change the Control Flag from REQUIRED to OPTIONAL. Add and configure your LDAP provider.)
For details, see
Configuring Authentication Providers at
http://download.oracle.com/docs/cd/E13222_01/wls/docs103/secmanage/atn.html
In your security realm, navigate to Roles and Policies. Expand Global Roles, select Roles, and enter the Process Server security roles.
For details, see
Users, Groups, and Security Roles at
http://download.oracle.com/docs/cd/E12840_01/wls/docs103/secwlres/secroles.html
|
WebSphere
| Login to the WebSphere console and follow the links similar to this example:
Applications > Application types > WebSphere enterprise applications > Process Server
Look for the
Security role to user/group mapping group. Map the existing Process Server security roles to groups.
Note: You must ensure that WebSphere application security is set up correctly. On the WebSphere Console navigation area, select Security > Secure administration, applications, and infrastructure . Then select the checkbox next to Enable Application Security and select
Apply .
|
tomcat\conf\server.xml
(
file-based configuration
)
<Realm className="org.apache.catalina.realm.UserDatabaseRealm"
resourceName="UserDatabase"/>
tomcat\conf\tomcat-users.xml
file:
<role rolename="abTaskClient"/>
<role rolename="abServiceConsumer"/>
<role rolename="abAdmin"/>
<user username="admin" password="admin"
roles="abAdmin, abTaskClient, abServiceConsumer"/>
tomcat\conf\server.xml
(
LDAP-based configuration
)
<Realm className="org.apache.catalina.realm.JNDIRealm" debug="99"
connectionName="uid=ldapadmin,ou=system"
connectionPassword="password"
connectionURL="ldap://<LDAP_Server_name>:<Port>"
userSubtree="true"
userBase="ou=users,o=xyzuser"
userSearch="(uid={0})"
roleSubtree="true"
roleBase="ou=groups,o=xyzrole"
roleName="cn"
roleSearch="(uniqueMember={0})"
/>
Note
: The following two examples are specific to JBoss 7.1.1; other versions require different configurations. Also, what you see here is just to indicate how you might configure JBoss. What you will actually declare will almost certainly be different. For all JBoss versions, you must review the JBoss documentation.
[Path]
\configuration\
[file.xml]
(
file-based configuration
)
The file name you will enter will be unique to your installation. The only part of the name that will be there is “configuration”. Here is an example:
C:\servers\jboss-as-7.1.1.Final\standalone\configuration\standalone-full.xml
<security-domain name="ActiveVOS" >
<authentication>
<login-module code="RealmUsersRoles" flag="required">
<module-option name="usersProperties"
value="${jboss.server.config.dir}/application-users.properties"/>
<module-option name="rolesProperties"
value="${jboss.server.config.dir}/application-roles.properties"/>
<module-option name="realm" value="ApplicationRealm"/>
<module-option
name="unauthenticatedIdentity"> anonymous
</module-option>
</login-module>
</authentication>
</security-domain>
${jboss.server.config.dir}/application-roles.properties
admin=abTaskClient,abAdmin,abServiceConsumer
${jboss.server.config.dir}/application-users.properties
admin=admin
[Path]
(
LDAP-based configuration
)
The file name you will enter will be unique to your installation. The only part of the name that will be there is “configuration”. Here is an example:
C:\servers\jboss-as-7.1.1.Final\standalone\configuration\standalone-full.xml
.
<security-domain name="ActiveVOS">
<authentication>
<login-module code="org.jboss.security.auth.spi.LdapExtLoginModule"
flag="optional">
<module-option name="java.naming.provider.url"
value="ldap://myserver:3268"/>
<module-option name="bindDN"
value="CN=admin,CN=Users,DC=myDomain,DC=myCompany,DC=local"/>
<module-option name="bindCredential" value="admin"/>
<module-option name="baseCtxDN"
value="DC=myDomain,DC=myCompany,DC=local"/>
<module-option name="baseFilter"
value="(sAMAccountName={0})"/>
<module-option name="rolesCtxDN"
value="DC=myDomain,DC=myCompany,DC=local"/>
<module-option name="roleFilter" value="(member={1})"/>
<module-option name="roleAttributeID" value="memberOf"/>
<module-option name="roleAttributeIsDN" value="true"/>
<module-option name="roleNameAttributeID" value="cn"/>
<module-option name="roleRecursion" value="2"/>
<module-option name="searchScope" value="SUBTREE_SCOPE"/>
<module-option name="allowEmptyPasswords" value="true"/>
<module-option name="java.naming.referral" value="follow"/>
<module-option name="unauthenticatedIdentity" value="aeadmin"/>
</login-module>
</authentication>
</security-domain>
