Setting up Weblogic SAML 1.1 SSO for WebCenter Spaces * 11g R1 ( )

Transcription

1 An Oracle White Paper December 2009 Setting up Weblogic SAML 1.1 SSO for WebCenter Spaces * 11g R1 ( ) * WebCenter Spaces is a pre-built application available as a part of WebCenter Suite 11g

2 Disclaimer The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described for Oracle s products remains at the sole discretion of Oracle.

3 Introduction... 2 SAML Components... 3 SAML Credential Mapper... 3 Inter Site Transfer Service (ITS)... 3 SAML Identity Asserter... 3 Assertion Consumer Service (ACS)... 3 SAML Relying party... 3 SAML Asserting Party... 3 SAML Topology and Flow... 3 Configuring SAML-based Single Sign-on... 7 Pre-requisites... 7 Steps to Configure SAML Single Sign-on... 8 Script to Configure Single Sign-on... 8 Script Overview... 8 Instructions for Using the Scripts Instructions After Using the Scripts Testing and Troubleshooting Limitations Conclusion... 15

4 Introduction This white paper describes how to set up Weblogic SAML 1.1 SSO between Oracle WebCenter Spaces, related applications, and service backends by using scripts provided to simplify this configuration. Security Assertion Markup Language (SAML) enables cross-platform authentication between Web applications or Web Services running in a WebLogic Server domain and Web browsers or other HTTP clients. WebLogic Server supports single sign-on (SSO) based on SAML. When users are authenticated at one site that participates in a single sign-on (SSO) configuration, they are automatically authenticated at other sites in the SSO configuration and do not need to log in separately. Oracle recommends that Weblogic SAML-based SSO be used only for smaller deployments when other enterprise-class SSO solutions like Oracle Access Manager (OAM) and Oracle SSO (OSSO) may not be available. It is important to note that OAM is the recommended solution for larger production deployments. Detailed (manual) steps to set up SAML 1.1-based single sign-on between Oracle WebCenter Spaces and the Wiki, Discussions, and Worklist services running on different managed servers across different domains are documented in the Security chapter of the Oracle Fusion Middleware Administrator's Guide for Oracle WebCenter. 2

5 SAML Components A SAML-based single sign-on solution consists of the following components: SAML Credential Mapper The SAML Credential Mapping provider acts as a producer of SAML security assertions, allowing WebLogic Server to act as a source site for using SAML for single sign-on. The SAML Credential Mapping provider generates valid SAML 1.1 assertions for authenticated subjects based on the configuration of the target site or resource. Inter Site Transfer Service (ITS) The Inter Site Transfer Service is an addressable component that generates identity assertions and transfers the user to the destination site. SAML Identity Asserter The SAML Identity Assertion provider acts as a consumer of SAML security assertions, allowing WebLogic Server to act as a destination site for using SAML for single sign-on. The SAML Identity Assertion provider processes valid SAML 1.1 assertions for authenticated subjects obtained from the source site or resource. Assertion Consumer Service (ACS) The Assertion Consumer Service is an addressable component that receives assertions and/or artifacts generated by the ITS and uses them to authenticate users at the destination site. SAML Relying party A SAML Relying Party is an entity that relies on the information in a SAML assertion produced by the SAML source site. You can configure how WebLogic Server produces SAML assertions separately for each Relying Party or use the defaults established by the Federation Services source site configuration for producing assertion. SAML Asserting Party A SAML Asserting Party is a trusted SAML Authority (an entity that can authoritatively assert security information in the form of SAML Assertions). SAML Topology and Flow SAML SSO can be set up using two profiles: 3

6 Browser/POST profile This represents a push model. An assertion is POSTed, using the HTTP POST command, directly to the relying party. Browser/Artifact profile This represents a pull model. A special form of reference to the authentication assertion (called an artifact) is sent to the relying party, which can use this reference to obtain (or pull) the assertion from the Asserting Party. WebCenter is certified against the SAML 1.1 POST profile. Figure 1 below illustrates various interactions between a WebCenter Spaces application hosted on the WLS_Spaces Managed Server and the OWC Wiki application hosted on the WLS_Services Managed Server in the same domain. Figure 1: Interactions in a SAML SSO setup The steps in the flow are: 1. The user's browser accesses WebCenter Spaces (source site), hosted on a WebLogic Managed Server (WLS_Spaces) in the WebCenter domain (wc_domain), by supplying user credentials. 2. WebCenter Spaces passes the user credentials to the authentication service provider. 3. If authentication is successful, the authenticated session is established, and the WebCenter Spaces welcome page is displayed. 4. From the welcome page, the user then clicks on a link on the page to access a secured Web page of the Wiki service (destination site), hosted on a different 4

7 WebLogic Managed Server (WLS_Services) in the same domain. This triggers a call to the Inter-Site Transfer Service (ITS) servlet configured. In this case, the ITS servlet is hosted within the source site (that is, on the WebCenter Spaces application on the WLS_Spaces Managed Server) that will share the same JSESSIONID cookie as WebCenter Spaces. 5. The ITS servlet calls the SAML Credential Mapper configured in the WebCenter domain (wc_domain) to request a caller assertion. The SAML Credential Mapper returns the assertion. It also returns the URL of the destination site application Web page (a secured Web page of the Wiki service) and path to the appropriate POST form (if the source site is configured to use the POST profile). 6. The SAML ITS servlet generates a SAML response containing the generated assertion, signs it, base-64 encodes it, embeds it in the HTML form, and returns the form to the user's browser. 7. The user's browser POSTs the form to the destination site's Assertion Consumer Service (ACS). In this case, the ACS Servlet is hosted in destination site (the Wiki service) and shares its login cookie. 8. The assertion is validated. 9. If the assertion is successful, the user is redirected to the target (the secured Web page of the Wiki service). 10. The user is logged in on the destination site Wiki service without having to reauthenticate. Figure 2 shows a detailed view of SAML single sign-on components and topology for WebCenter Spaces and all the related applications. 5

8 Figure 2: SAML single sign-on components and topology for WebCenter Spaces and related applications SSO may be required between WebCenter Spaces and the following applications and/or services: RSS typically hosted on the same server as the WebCenter Spaces application OWC Wiki typically hosted on the WLS_Services Managed Server in the WebCenter domain (wc_domain) OWC Discussions typically hosted on the WLS_Services Managed Server in the WebCenter domain (wc_domain) Worklist Integration hosted on the SOA server in the SOA domain (soa_domain) configured in the Worklist connection setup for WebCenter Spaces Worklist SDP hosted on the SOA server in the SOA domain (soa_domain) configured in the Worklist connection setup for WebCenter Spaces Worklist Community Detail hosted on the SOA server in the SOA domain (soa_domain) configured in the Worklist connection setup for WebCenter Spaces The interactions between WebCenter Spaces and these applications and services are shown in Figure 2. 6

9 Configuring SAML-based Single Sign-on Pre-requisites WebCenter Installation and Setup Follow the Oracle Fusion Middleware Installation Guide for Oracle WebCenter and install WebCenter Spaces and related applications as required for your environment. If you have the Wiki service installed, refer to Working with Wikis and Blogs in the Oracle Fusion Middleware User's Guide for Oracle WebCenter Spaces. This chapter covers how to expose Wikis and Blogs in WebCenter Spaces. If you have installed the Oracle Discussions service, you will need to set a system property on the discussion server s Admin page and create a discussion forum connection for use in WebCenter Spaces. You will also need to deploy the version of the discussions application that supports SAML SSO. Follow the steps in Deploying the Discussions Server for SAML SSO and Configuring the Discussions Server for SAML SSO in the Security chapter of the Oracle Fusion Middleware Administrator's Guide for Oracle WebCenter. You can access the Discussions service application using the Forum Administration link in WebCenter Spaces from Group Space Settings > Services > Discussions (assuming this service is provisioned for the group space). If you have installed SOA and subsequently configured Worklist for use in WebCenter Spaces, you can access Worklist applications from the Worklist taskflow in Personal Space or the sidebar. To test RSS access from WebCenter Spaces, click the RSS link from Recent Documents or Lists. Generating and Registering Certificates To secure communication between the SAML source and destination sites, communication between the source site and destination site should be encrypted. Additionally, certificates should be used to verify the identity of the other party during a SAML interaction. Follow the steps in Generating and Registering Certificates to create and configure a custom key store in the Security chapter of the Oracle Fusion Middleware Administrator's Guide for Oracle WebCenter. Be sure to export the certificate you have chosen to use for the SAML configuration. This is required for the certificate to be registered in the certificate registry maintained by the SAML Identity Assertion provider configured on the destination domains. SSL Setup 7

10 If the WebCenter installation is configured to use SSL for providing transport-level security, then SSL should be configured prior to configuring single sign-on. Note that setting up SSL is not related to enabling SSO. Steps to Configure SAML Single Sign-on The following must typically be configured to set up SAML-based single sign-on in a WebLogic environment: SAML Credential Mapping Provider Necessary relying parties Source Site Federation Services SAML Identity Asserter Necessary asserting parties Destination Site Federation Services Each of the above configuration steps are documented in detail in the Security chapter of the Oracle Fusion Middleware Administrator's Guide for Oracle WebCenter. Script to Configure Single Sign-on The script to configure SAML Single Sign-on automates the six steps listed in the section Steps to configure SAML Single Sign-on. Refer to the supporting script zip file (saml_scripts.zip) along with the link to the white paper. Script Overview The ZIP file contains the scripts to configure SAML 1.1 SSO for WebCenter Spaces and related applications. The following files are available in the ZIP file: wcsamlsso.properties This properties file encapsulates the necessary configuration information for the SAML SSO setup. The properties file has the following sections: spaces_config This section captures the login information, admin URL, WebCenter Spaces server and URL, etc., of the WebCenter domain required for the Credential Mapper and Source Site Federation Services configuration. All properties in this section is must be completed. configfile - Config file containing the weblogic user account and password for the WebCenter domain 8

11 keyfile - Key file to decrypt the weblogic user account and password for the WebCenter domain adminurl - WebLogic Admin URL to connect to WLST usesssl - Indicates whether WebCenter Spaces is configured to use SSL url - WebCenter URL. If usesssl is "true", then change "http" to "https" servername - Server where WebCenter Spaces is deployed, typically WLS_Spaces certalias - Alias of certificate to sign SAML assertions certpassword Encrypted password of certificate to sign SAML assertions services_config This section captures the login information, admin URL, certificate file path, etc., of the Services domain required for the Identity Asserter and Destination Site Federation Services configuration. You need to complete this section only if your setup has Wiki and/or Discussions configured. configfile - Config file containing weblogic user account and password for the Services domain keyfile - Key file to decrypt weblogic user account and password for the Services domain adminurl - WebLogic Admin URL to connect to WLST usesssl - Indicates whether Wiki/Forum is configured to use SSL servername - Server where Wiki and Discussions are deployed (typically the WLS_Services Managed Server) certalias - Alias of certificate to verify SAML assertions certpath - Path to exported certificate to verify SAML assertions soa_config This section captures the login information, admin URL, certificate file path, etc., of the SOA domain required for the Identity Asserter and Destination Site Federation Services configuration. You need to complete this section only if your setup has SOA configured. configfile - Config File containing the weblogic user account and password for the SOA domain 9

12 keyfile - Key File to decrypt the weblogic user account and password for the SOA domain adminurl - WebLogic Admin URL to connect to WLST usesssl - Indicates whether SOA applications are configured to use SSL servername - Server where SOA applications are deployed (typically soa_server1) certalias - Alias of certificate to verify SAML assertions certpath - Path to exported certificate to verify SAML assertions wiki_config Specify whether your configuration has Wiki installed. url OWC Wiki URL. If usesssl in services_config is "true", then change "http" to "https" rss_config This section must be completed. url RSS URL. If usesssl in spaces_config is "true", then change "http" to "https" forum_config Specify whether your configuration has Discussions installed. url OWC Discussions URL. If usesssl in services_config is "true", then change "http" to "https" worklist_config Specify whether SOA is installed and Worklist is configured for WebCenter Spaces. worklist_detail - Worklist Detail application URL. If usesssl in soa_config is "true", then change "http" to "https" worklist_sdp - Worklist SDP application URL. If usesssl in soa_config is "true", then change "http" to "https" worklist_integration - Worklist Integration application URL. If usesssl in soa_config is "true", then change "http" to "https" wcsamlsso.py Script file that contains utility functions invoked by rest of the configuration scripts 10

13 configurespaces.py Executable script to configure SAML 1.1 Credential Mapper, SAML 1.1 Identity Asserter and Source and Destination site federation services on the WebCenter domain configureservices.py Executable script to configure SAML 1.1 Identity Asserter and Destination site federation services on the Services domain configuresoa.py Executable script to configure SAML 1.1 Identity Asserter and Destination site federation services on the SOA domain configuresso.py Executable script to configure asserting and relying parties for all related applications used in WebCenter Spaces (i.e., RSS, Wiki, Forum, and Worklist) If your setup does not have one or more of the six applications, then Oracle recommends that you run the specific scripts to configure individual applications described below. configurerss.py Executable script to configure asserting and relying parties for the RSS application configurewiki.py Executable script to configure asserting and relying parties for the Wiki application configureforum.py Executable script to configure asserting and relying parties for the Discussions application configureworklistintegration.py Executable script to configure asserting and relying parties for the Worklist Integration application configureworklistdetail.py Executable script to configure asserting and relying parties for the Worklist Community Detail application configureworklistsdp.py Executable script to configure asserting and relying parties for the Worklist SDP application 11

14 Instructions for Using the Scripts 1. Unzip the contents of the zip file into $ORACLE_HOME. This will extract the contents into $ORACLE_HOME/wlserver_10.3/common/bin and $ORACLE_HOME/wlserver_10.3/common/wlst 2. Ensure that the Administration server for all the domains used in this configuration are up and running. 3. Generate the config and key files containing the connection information for the various domains using the storeuserconfig WLST command. See help('storeuserconfig') for usage and syntax details. a. Connect using WLST to the WebCenter domain using the admin username and password, and run the following command: storeuserconfig('spacesconfig.secure', 'spaceskey.secure') This creates a user configuration file and an associated key file. The user configuration file contains an encrypted username and password. The key file contains a secret key that is used to encrypt and decrypt the username and password. The above command will store the config and key files in directory from where WLST was invoked, or you can optionally specify a more secure path. b. Repeat step 3a. after connecting to the services domain using the admin username and password. Even if Wiki and Discussions are installed on the same domain as WebCenter Spaces (wc_domain), you need to connect to the WebCenter domain and run this command: storeuserconfig('servicesconfig.secure', 'serviceskey.secure') c. Repeat step 3a. after connecting to the SOA domain using the admin username and password. Even if SOA is installed on the same domain as WebCenter Spaces, you need to connect to the WebCenter domain and run this command: storeuserconfig('soaconfig.secure', 'soakey.secure') 4. Launch WLST and run the WLST encrypt command to encrypt the certificate password. See help( encrypt ) for usage and syntax details. print encrypt(obj= <certificatepassword>, domaindir= <full path to the Spaces domain directory> ) This will display the encrypted certificate password. The encrypt command uses the encryption for a specified WebLogic Server domain root directory. The encrypted output needs to be set as certpassword value in wcsamlsso.properties mentioned 12

15 in the next step. Since this password will be set onto the credential mapper and source site federation services in the WebCenter domain, so be sure to run this encryption utility using the WebCenter domain. 5. Edit $ORACLE_HOME/wlserver_10.3/common/bin/wcsamlsso.properties to fill out sections applicable to your setup. Refer to the Script Overview section for a detailed description of the sections in this properties file. 6. Launch WLST from $ORACLE_HOME/wlserver_10.3/common/bin and execute the scripts in the order shown below. Note: Run the scripts in the WLST offline mode as the scripts include an explicit connect command. a. execfile('configurespaces.py') Restart the Administration server and the WLS_Spaces Managed Server in the WebCenter domain. b. If you have a Wiki or Discussion Forums setup, execute the configureservices.py script: execfile('configureservices.py') If the Wiki and Forum belong to the same domain as WebCenter Spaces, then only restart the WLS_Services Managed Server. Otherwise, restart the Administration server and the WLS_Services Managed Server in the Services domain. c. If you have Worklist configured for WebCenter Spaces, execute the configuresoa.py script: execfile('configuresoa.py') Restart the Administration server and the SOA server in the SOA domain. 7. Follow either step a. or b. below depending on whether you have installed all related applications along with WebCenter Spaces, or have only selected some applications in your setup. a. If you have all applications installed RSS, Wiki, Forum, Worklist Integration, Detail and SDP, then you can run this single command to configure asserting and relying parties for all applications: execfile('configuresso.py') No restart is required after executing this script. 13

16 b. If you don t have all applications installed, run the individual commands below as required. Instructions After Using the Scripts i. execfile('configurerss.py') - No restart is required. ii. execfile('configurewiki.py') - Do this if you have Wiki installed in your setup. No restart is required. iii. execfile('configureforum.py') - Do this if you have Discussions installed in your setup. No restart is required. iv. execfile('configureworklistintegration.py') - Do this if you have Worklist installed in your setup. No restart is required. v. execfile('configureworklistdetail.py') - Do this if you have Worklist installed in your setup. No restart is required. vi. execfile('configureworklistsdp.py') - Do this if you have Worklist installed in your setup. No restart is required. IMPORTANT: Since the properties file contains sensitive information, please delete it after you have configured and verified the SAML SSO setup. Also delete the config and key files you generated in Step 3 above. Testing and Troubleshooting Using a new browser window, log in to WebCenter Spaces and access the SSO enabled applications listed below and ensure that you are not challenged to log in again: RSS From Recent Activities or Lists Wiki Blog or Wiki from Group Space Discussions Forum Administration link on the Group Space Settings Service tab Worklist Worklist taskflow in Personal Space If you see that you are still challenged to log in, or see a 401 or 403 error code, check the configuration in the Administration Console and compare it with the documented configuration in the Administrator s Guide. Limitations SAML 1.1 does not support global logout. So if you log out of source site, you will still remain logged in the destination site. Oracle recommends that you set a short session time 14

17 out for the target applications. Additionally, you can log out of each target application or close the browser and clear the cache after use. If you set up SSO by using SAML SSO with WebCenter Spaces as the source application and Oracle WebCenter Discussions as the destination application, then you can access the administration pages of the Discussions application from the WebCenter Spaces Manage Group Space Services screen or Configure WebCenter Services screen. However, the administration pages of Oracle WebCenter Discussions do not participate in SSO. Therefore, if you access administration pages directly, then you are required to log in to Oracle WebCenter Discussions again. Conclusion This White paper described how to leverage accompanying scripts for simplifying WebLogic SAML-based SSO configuration for WebCenter Spaces. 15

18 Setting up Weblogic SAML 1.1 SSO for WebCenter Spaces 11g R1 ( ) December 2009 Author: Preeti Yarashi Oracle Corporation World Headquarters 500 Oracle Parkway Redwood Shores, CA U.S.A. Worldwide Inquiries: Phone: Fax: oracle.com Copyright 2009, Oracle and/or its affiliates. All rights reserved. This document is provided for information purposes only and the contents hereof are subject to change without notice. This document is not warranted to be error-free, nor subject to any other warranties or conditions, whether expressed orally or implied in law, including implied warranties and conditions of merchantability or fitness for a particular purpose. We specifically disclaim any liability with respect to this document and no contractual obligations are formed either directly or indirectly by this document. This document may not be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without our prior written permission. Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners. 0109