Sun Java System Access Manager 7.1: Config and Custom

Transcription

1 Sun Java System Access Manager 7.1: Config and Custom Student Guide - Volume 1 AM-3480 Rev B D61828GC10 Edition 1.0 D62432

2 Copyright 2007, 2009, Oracle and/or its affiliates. All rights reserved. Disclaimer This document contains proprietary information, is provided under a license agreement containing restrictions on use and disclosure, and is protected by copyright and other intellectual property laws. You may copy and print this document solely for your own use in an Oracle training course. The document may not be modified or altered in any way. Except as expressly permitted in your license agreement or allowed by law, you may not use, share, download, upload, copy, print, display, perform, reproduce, publish, license, post, transmit, or distribute this document in whole or in part without the express authorization of Oracle. The information contained in this document is subject to change without notice. If you find any problems in the document, please report them in writing to: Oracle University, 500 Oracle Parkway, Redwood Shores, California USA. This document is not warranted to be error-free. Sun Microsystems, Inc. Disclaimer This training manual may include references to materials, offerings, or products that were previously offered by Sun Microsystems, Inc. Certain materials, offerings, services, or products may no longer be offered or provided.oracle and its affiliates cannot be held responsible for any such references should they appear in the text provided. Restricted Rights Notice If this documentation is delivered to the U.S. Government or anyone using the documentation on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS The U.S. Government s rights to use, modify, reproduce, release, perform, display, or disclose these training materials are restricted by the terms of the applicable Oracle license agreement and/or the applicable U.S. Government contract. Trademark Notice Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd.

3 This page intentionally left blank.

4 This page intentionally left blank.

5 Table of Contents About This Course...Preface-xv Course Goals... Preface-xv Course Map...Preface-xvi Topics Not Covered...Preface-xvii How Prepared Are You?...Preface-xviii Introductions... Preface-xix How to Use Course Materials... Preface-xx Conventions... Preface-xxi Icons... Preface-xxi Typographical Conventions... Preface-xxii Additional Conventions...Preface-xxiii Sun Java System Access Manager Objectives Relevance Additional Resources Identity Identity in a Single Domain Identity Across Multiple Domains Single Domain Identity Challenges Single Domain Identity Management Solution Federated Identity Cross-Domain Identity Challenges Cross-Domain Identity Management Solution Sun Java System Identity Management Suite Access Manager Identity Manager Directory Server Enterprise Edition Access Manager Components Access Manager Infrastructure Authentication Authorization Federation v

6 Policy Agent Types of Policy Agent Software Access Manager and Policy Agent Versions Additional Policy Agent Capabilities Configuring and Deploying Access Manager Objectives Relevance Additional Resources Deployment Components Clients in an Access Manager Deployment Servers in an Access Manager Deployment SDKs Other Components in Access Manager Deployments Basic Deployment Scenarios Legend for Diagrams Clients Deploying Access Manager in the Classroom Protecting a Web Application Protecting a Java Technology Application Supporting Portal Server Quick Deployment for Developers Java ES Installation Options That Impact Deployment Access Manager Configuration Instance Configuration File Configuration Service Configuration Policy Agent Configuration The AMAgent.properties File Location Differing Attribute Names for Web Policy Agents and J2EE Policy Agents Policy Agent Restart Requirement Policy Agent Properties Examples Configuring SSL With Access Manager Configuring SSL on the Access Manager Web Server or Application Server Configuring the Access Manager Instance for Secure Access Starting and Stopping Access Manager and Policy Agent Instances Access Manager Realms Objectives Relevance Additional Resources Access Manager Data Access Manager Information Tree Access Manager Identity Repositories vi Sun Java System Access Manager: Configuration and Customization

7 Authentication Repositories Realms Realms Example Identity Repository Authentication Configuration Policies Other Realm Configuration Realm Contents Example Realm and Legacy Modes Legacy Mode Directory Tree Realm Mode Directory Tree Data Stores Data Store Types AMSDK Data Store Legacy Mode AMSDK Data Store Realm Mode LDAPv3 Data Stores Choosing the Data Store Type Realm or Legacy Mode and Data Stores Configuring Data Stores Configuring an AMSDK Data Store Configuring LDAPv3 Data Stores Configuring LDAPv3 Data Stores Limitations and Issues Access Manager Management Tools Access Manager Console Access Manager Command-line Tools Creating and Configuring Realms Realm Creation Data Store Configuration Selecting the Data Store Type Data Store Configuration Defining an AMSDK Data Store Data Store Configuration Defining an LDAPv3 Data Store Service Configuration Objectives Relevance Additional Resources Services Example the Authentication Service Custom Services Service Configuration Types of Attributes in Service Configuration Location of Service Attributes Global Attributes vii

8 Location of Service Attributes Organization Attributes 4-17 Location of Service Attributes User and Dynamic Attributes Configuring Access Manager Services Using the Console Configuring Global Attributes Using the Configuration Tab Configuring Global Attributes Using the Federation Tab Configuring Global Attributes Using the Web Services Tab Services With Global Attributes That Are Not Configurable Using the Console Configuring Organization Attributes Using the Authentication Tab Configuring Organization Attributes Using the Services Tab Configuring Organization Attributes Using the Data Stores Tab Configuring User Attributes Using the Services Tab Configuring Access Manager Services Using the CLI XML Service Configuration Files Service.properties Files Commands for Modifying Service Configuration Service Configuration for New Realms Logging, Debugging, and Monitoring Objectives Relevance Additional Resources Access Manager Logging Service Logging Topology Configuring Logging Logging Service Output Additional Log Files Debug Files Configuring Debug Files Debug Output Policy Agent Logging Policy Agent Audit Logging Policy Agent Diagnostic Logging Java ES Monitoring Installing and Configuring the Monitoring Framework Software Installing the Monitoring Console and the Master Agent.5-36 viii Sun Java System Access Manager: Configuration and Customization

9 Configuring the Monitoring Console and the Master Agent to Monitor Access Manager Web Container Requirement Disabling Access Manager Monitoring Authentication and Single Sign-On Objectives Relevance Additional Resources Access Manager Authentication Resource Access Authentication Process Overview Web-based Clients Authentication Initiation Credential Collection and Validation Access Manager Session Validation Authentication Post-Processing Logout Configuring Authentication Authentication Module Instances Authentication Chains Additional Authentication Configuration Options Access Manager Sessions Access Manager Session Life Cycle Access Manager Session Validity Access Manager Session Constraints Single Sign-On (SSO) Generic SSO Access Manager SSO Cross-Domain Single Sign-On SSO for a Valid Session Configuring a Customized Authentication Interface Authentication Interface Customization Overview Callback Definition File Authentication Interface JSP Page Templates Authentication Interface File Lookup Customized Directory Paths Customized Client Detection Creating a Realm Customization Directory Authentication Interface Localization Look and Feel Customization Deploying a Customized Authentication User Interface Policy Configuration Objectives Relevance Additional Resources ix

10 Examining Policy Authentication and Authorization in Policy Different Policies for Sets of Users Policy Component Functionality Access Manager Policy Architecture Client-side APIs Server-side SPIs Policy Framework Policy Definition Policy Components Schema Types Normal Policy Rules Subjects Conditions Response Attributes Referrals Policy Storage Policy Administration Policy Configuration Service Policy Administration Using the Console Policy Administration Using the amadmin Command Configuring Policies Using the Console Creating the Referral Creating the Policy Delegating Administration Selecting Administrative Groups or Roles Administrative Privileges Assigning Administrative Privileges Policy Evaluation Objectives Relevance Additional Resources Policy Evaluation Principles Policy Agents Policy Enforcement Points Access Manager Policy Decision Point Policy Component Architecture Policy Request Operation Policy Decision Components Policy Decision Conflict Resolution Policy Evaluation Example Policy Request Referrals Normal Policy x Sun Java System Access Manager: Configuration and Customization

11 Policy Rules Policy Decision Document Example Policy Decision Interpretation Federated Identity Scenarios and Solutions Objectives Relevance Additional Resources Federated Identity Cross-Domain Identity Federation Defining Federated Identity Some Examples of Business Scenarios Addressed by Federated Identity Service Outsourcing Without Federation Supplier Network Without Federation Acquisition or Merger Without Federation Basic Federated Identity Technologies Trust Relationships Internet SSO Attribute Sharing Service Outsourcing With Federation Supplier Network With Federation Acquisition or Merger With Federation Other Business Scenarios Addressed by Federated Identity Federation Frameworks Federation Frameworks Supported by Access Manager Interoperability WS-Federation Framework SAML SAML Information Exchange SAML and Federation Frameworks SAML and Federation Frameworks (continued) SAML Version 1 SSO Objectives Relevance Additional Resources SAML 1 Assertions, Protocols, and Bindings SAML 1 Assertions SAML 1 Protocol SAML 1 Binding SAML 1 Terminology xi

12 SAML 1 SSO Profiles SAML Processing in Context Browser Artifact Profile Browser Post Profile Configuring SAML 1 Support on Access Manager Configuring a Trust Relationship Configuring Service Providers Mapping Class Usage Signing SAML Assertions Advanced Federation Frameworks Objectives Relevance Additional Resources Advanced Identity Federation Technologies Account Linking Single Logout Dynamic Identity Provider Proxying Web Services Framework Support Advanced Identity Federation Frameworks Liberty ID-FF SAML Federation Technologies by Framework Access Manager Implementation Liberty ID-FF Implementation in Access Manager SAML 2 Implementation in Access Manager Federation Technologies Implemented in Access Manager Provider and Circle of Trust Management Auto-Federation and Bulk Federation Common Domain Services Common Domain Services (continued) Federated Identity Process Authenticating With a Service Provider Federating a Service Provider Account Account Federation Process User s Federated Functionality Advanced Deployment Objectives Relevance Additional Resources CDSSO CDSSO Issue CDSSO Solution CDSSO Authentication Process xii Sun Java System Access Manager: Configuration and Customization

13 Distributed Authentication Authentication Deployment Problem Distributed Authentication UI Solution High Availability Load-Balanced Policy Agent Instances Access Manager Information Tree Replication Service Failover Configuring Multiple Access Manager Instances High Availability Using Load-Balanced Access Manager Instances Site Configuration Session Failover Advanced Configuration Persistent Searches Persistent Search Issues Session Caching Options Configuring Session Caching Options for Web Policy Agents Configuring Session Caching Options for J2EE Policy Agents Session Caching Issues Legacy Mode... A-1 Objectives... A-1 Relevance... A-2 Additional Resources... A-3 Legacy Mode Operation... A-4 Access Manager Compatible Console... A-6 Access Manager Console Administration in Legacy Mode... A-8 Glossary/Acronyms... Glossary-1 xiii

14