CA SiteMinder Tech Note

Transcription

1 CA SiteMinder Tech Note Configuring SiteMinder Agent for IBM WebSphere to Protect WebSphere Portal 6.1 r6.0

2 This documentation and any related computer software help programs (hereinafter referred to as the Documentation ) is for the end user s informational purposes only and is subject to change or withdrawal by CA at any time. This Documentation may not be copied, transferred, reproduced, disclosed, modified or duplicated, in whole or in part, without the prior written consent of CA. This Documentation is confidential and proprietary information of CA and protected by the copyright laws of the United States and international treaties. Notwithstanding the foregoing, licensed users may print a reasonable number of copies of the Documentation for their own internal use, and may make one copy of the related software as reasonably required for back-up and disaster recovery purposes, provided that all CA copyright notices and legends are affixed to each reproduced copy. Only authorized employees, consultants, or agents of the user who are bound by the provisions of the license for the Product are permitted to have access to such copies. The right to print copies of the Documentation and to make a copy of the related software is limited to the period during which the applicable license for the Product remains in full force and effect. Should the license terminate for any reason, it shall be the user s responsibility to certify in writing to CA that all copies and partial copies of the Documentation have been returned to CA or destroyed. EXCEPT AS OTHERWISE STATED IN THE APPLICABLE LICENSE AGREEMENT, TO THE EXTENT PERMITTED BY APPLICABLE LAW, CA PROVIDES THIS DOCUMENTATION AS IS WITHOUT WARRANTY OF ANY KIND, INCLUDING WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NONINFRINGEMENT. IN NO EVENT WILL CA BE LIABLE TO THE END USER OR ANY THIRD PARTY FOR ANY LOSS OR DAMAGE, DIRECT OR INDIRECT, FROM THE USE OF THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION, LOST PROFITS, BUSINESS INTERRUPTION, GOODWILL, OR LOST DATA, EVEN IF CA IS EXPRESSLY ADVISED OF SUCH LOSS OR DAMAGE. The use of any product referenced in the Documentation is governed by the end user s applicable license agreement. The manufacturer of this Documentation is CA. Provided with Restricted Rights. Use, duplication or disclosure by the United States Government is subject to the restrictions set forth in FAR Sections , , and (c)(1) - (2) and DFARS Section (b)(3), as applicable, or their successors. All trademarks, trade names, service marks, and logos referenced herein belong to their respective companies. Copyright 2009 CA. All rights reserved.

3 Contact CA Contact Technical Support For your convenience, CA provides one site where you can access the information you need for your Home Office, Small Business, and Enterprise CA products. At you can access the following: Online and telephone contact information for technical assistance and customer services Information about user communities and forums Product and documentation downloads CA Support policies and guidelines Other helpful resources appropriate for your product Provide Feedback If you have comments or questions about CA product documentation, you can send a message to techpubs@ca.com. If you would like to provide feedback about CA product documentation, complete our short customer survey, which is also available on the CA support website, found at Introduction This document supplements the SiteMinder Agent 6.0 for IBM WebSphere Guide and describes how to configure the SiteMinder Agent to protect WebSphere Portal 6.1

4 Software Requirements Before installing the SiteMinder Agent, install the following software: Note: Be sure to install the prerequisite software in the correct order. IBM WebSphere Application Server, Version 6.1 and any cumulative fixes. For WebSphere hardware and software requirements and installation directions, see the WebSphere documentation. IBM WebSphere Portal, Version 6.1 and any cumulative fixes. For WebSphere hardware and software requirements and installation directions, see the WebSphere documentation SiteMinder Policy Server For supported SiteMinder Policy Server and Agent versions and compatibility, go to the Technical Support site at and search for SiteMinder Platform Support Matrices. Configure WebSphere Portal to Use an LDAP User Registry In a typical deployment, the WebSphere Portal Server 6.1, WebSphere Application Server 6.1 and the SiteMinder Policy Server are configured to use the same LDAP user registry. Note: If you are not configuring WebSphere and the Policy Server to use the same LDAP user registry (typically because WebSphere is already configured with a custom user registry), ensure that the custom registry is properly configured (see the WebSphere documentation for information) and configure user mapping as described in the SiteMinder Agent r6.0 for IBM WebSphere Guide. To configure a SiteMinder LDAP user directory as a WebSphere Portal user registry 1. Prepare your LDAP user registry by following the appropriate platform-specific procedure in the WebSphere Portal 6.1 documentation. When the procedure is complete, you should have added wpsadmin and wpsbind administrative user IDs and a wpsadmins group of which wpsadmin and wpsbind are both members. 2. Start the Websphere Application Server and the Websphere Portal Server. 3. Navigate to wp_profile_root/config/cells/cell_name/wim/config/ and open wimconfig.xml in a text editor. Note: Be careful to use the correct XML syntax and not to change or remove any other elements when editing the wimconfig.xml file.

5 4. Find the config:supportedentitytypes defaultparent elements and edit the value of the default realm name (defaultwimfilebasedrealm) to a value appropriate for your environment. For example, change the following entry: <config:supportedentitytypes defaultparent="o=defaultwimfilebasedrealm" name="group"> to: <config:supportedentitytypes defaultparent="ou=groups,o=your_domain" name="group"> And change: <config:supportedentitytypes defaultparent="o=defaultwimfilebasedrealm" name="personaccount"> to: <config:supportedentitytypes defaultparent="ou=people,o=your_domain" name="personaccount"> wp_profile_root Specifies the WebSphere Portal profile directory. cell_name Specifies the cell to which the node belongs. your_domain Specifies your domain name. 5. Save and close the wimconfig.xml file. 6. Configure WebSphere Portal to use your LDAP user registry by following the appropriate platform-specific procedure in the WebSphere Portal 6.1 documentation. When the procedure is complete, you should have: a. Edited the wkplc.properties, entering values for all required parameters listed in the procedure. When editing wkplc.properties, also set appropriate values for the WasUserid, PortalAdminId, and PortalAdminGroupId parameters. For example: WasUserid=uid=wpsbind,ou=people,o=your_domain PortalAdminId=uid=wpsbind,ou=people,o=your_domain PortalAdminGroupId=cn=wpsadmins,ou=groups,o=your_domain For help on modifying these and other wkplc.properties values for different directory servers refer to the helper files in wp_profile_root/configengine/config/helpers/ b. Run the ConfigEngine script to validate your LDAP server settings. c. Run the ConfigEngine script to set the stand-alone LDAP user registry.

6 d. Stopped and restarted the WebSphere Application Server and WebSphere Portal Server to propagate the security changes. e. Run the ConfigEngine script to check that all defined attributes are available in the configured LDAP user registry. Install and Configure the SiteMinder Agent Follow the procedures in the SiteMinder Agent r6.0 for IBM WebSphere Guide to install and configure the SiteMinder Agent. Note: Only the SiteMinder TAI and SiteMinder JACC Agent modules must be configured to protect WebSphere Portal resources you need only configure the SiteMinder Login Module if you require it to authenticate Java client and system login requests to the WebSphere Application Server. Configure a Realm for the WebSphere Portal To support SiteMinder authorization policies to protect WebSphere Portal resources, configure a realm with the following properties: Property Name Resource Filter Agent Authentication Scheme Default Resource Protection Value A descriptive name for the realm. /wps The Agent Identity associated with the SiteMinder JACC Provider The authentication scheme to use to collect credentials from and authenticate user requests. Protected Configure Rules to Protect WebSphere Portal Resources A rule identifies specific resources within a realm and whether to allow or deny access to those resources. Rules are the parts of policies that determine precisely which resources are protected, and which types of actions should cause the rule to fire. A rule is required to allow resource requests to be passed to protected WebSphere Portal resources.

7 Configure one or more rules for the SiteMinder JACC Provider that identify the following: The specific resource or resources to protect. The Agent action that will cause the rule to fire (Any appropriate action, such as Post or Get for URL resources; the Get action for all other resource types). Whether to allow or deny access to the specified resource when the rule is fired. For example, a rule can specify that all resources in a realm are protected for Get Agent actions. When a client attempts to access these resources, the rule fires and the policy containing the rule determines whether the consumer application can access the protected resources. For more information about creating rules, see CA SiteMinder Policy Design Guide. Configure SiteMinder Policies for the WebSphere Portal Policies define how clients interact with your WebSphere Portal resources. They bind rules, users, and responses defined within a policy domain that define what should happen when requests are sent to resources defined in a realm. Configure policies to protect WebSphere Portal resources using the SiteMinder JACC Provider in the same way as you would policies to protect web resources. Note however, that the following features are not supported: Policy expressions Impersonation For more information about creating policies, see CA SiteMinder Policy Design Guide.

8 Verify SiteMinder Agent Configuration for WebSphere Portal To verify the SiteMinder Agent Configuration for WebSphere Portal Protection 1. Access the portal Admin page. The Siteminder TAI should challenge with the name of the Realm used in the protection of the "/wps" context root specified in the realm. 2. Login using the credentials of the WebSphere Portal Administrative user. If the policy contains the user, the portal will allow access. Otherwise it will show an unauthorized error page.