ADMINISTERING ADOBE LIVECYCLE MOSAIC 9.5

Transcription

1 ADMINISTERING ADOBE LIVECYCLE MOSAIC 9.5

2 Legal notices Copyright 2011 Adobe Systems Incorporated and its licensors. All rights reserved. Administering Adobe LiveCycle Mosaic 9.5 March 31, 2011 This administering guide is licensed for use under the terms of the Creative Commons Attribution Non-Commercial 3.0 License. This License allows users to copy, distribute, and transmit the user guide for noncommercial purposes only so long as (1) proper attribution to Adobe is given as the owner of the user guide; and (2) any reuse or distribution of the user guide contains a notice that use of the user guide is governed by these terms. The best way to provide notice is to include the following link. To view a copy of this license, visit Adobe, the Adobe logo, Flex, and LiveCycle are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States and/or other countries. Java is a trademark or registered trademark of Oracle and/or its affiliates. All other trademarks are the property of their respective owners. Adobe Systems Incorporated, 345 Park Avenue, San Jose, California 95110, USA.

3 iii Contents Chapter 1: Overview Chapter 2: Configuring Mosaic access for custom roles Create and assign a custom role for Mosaic Chapter 3: Configuring single sign-on (SSO) Configuring Mosaic for enterprise SSO Single Sign On (SSO) Product Sample Chapter 4: Configuring WebDAV security Configuring WebDAV authentication Chapter 5: Configuring the repository File system repository Custom File Repository

4 1 Chapter 1: Overview Welcome to Administering Adobe LiveCycle Mosaic 9.5. Mosaic is a tool for developing composite rich Internet applications and delivering intuitive, personalized workspaces to end users. This document provides detailed information about how to perform the following tasks: Creating custom roles for Mosaic Configuring Mosaic to work within a single sign-on (SSO) security infrastructure Configuring WebDAV security for non-production environments Implementing Mosaic with a file system repository More Help topics Configuring Mosaic access for custom roles on page 2 Configuring single sign-on (SSO) on page 4 Configuring WebDAV security on page 7 Configuring the repository on page 9

5 2 Chapter 2: Configuring Mosaic access for custom roles Mosaic user accounts control access to both Mosaic application development resources and the applications themselves. Mosaic provides a default set of users and roles, but you can also define custom roles. For information on default users, see Mosaic users and roles in Getting Started with LiveCycle Mosaic 9.5. To define Mosaic access for the custom role, modify the default Mosaic system XACML policy or create and deploy custom policies. In addition, ensure that assets that are controlled by the policies reference the custom policies. You give users access to the Mosaic server by assigning them roles. An XACML file provided with the Mosaic installation defines access rules and assigns roles to each rule. By default, the file defines access to Mosaic using the following entries: RuleID Allow_Everyone_to_Read_these_Resources Allow_Designers_to_Write_these_Resources Allow_Anyone_to_Write_Saved_Views Allow_PolicyAdmins_to_Read_and_Write_Policy_Resources DenyAllOthers Description Allows all users to access applications, tiles, and other application resources, including saved views provided as a link. Allows any designer (ROLE_MOSAIC_DESIGNER) to deploy or remove Mosaic catalogs (including all associated assets) and applications (including associated saved views) to the server. Allows all users to save and delete views, including views shared as a link. Allows any user assigned the role of ROLE_MOSAIC_POLICY_ADMINISTRATOR, such as the user padmin, to read, write (deploy) and delete policies (other than the default system policy). Denies access to all other users or resources. For XACML policy file standards, go to the OASIS consortium website at Create and assign a custom role for Mosaic 1 In the mosaic.war file for your application server, define a policy for the role in the default system policy file, mosaic_default_asset_policy.xml, located in the WEB-INF/classes/conf/mosaic/xacml folder. When finished, install or reinstall Mosaic (for instructions, see Getting Started with LiveCycle Mosaic 9.5). 2 Do one of the following: For a standalone Tomcat server, assign the role to a user in the file [Mosaic install directory]\standalone\webapps\mosaic\meta-inf\spring\mosaic-context.xml. For an Adobe LiveCycle ES2.5 server, use the LiveCycle Administration Console to assign the role to a user. See Installing and Configuring the Production Environment in Getting Started with LiveCycle Mosaic 9.5.

6 ADMINISTERING LIVECYCLE MOSAIC 9.5 Configuring Mosaic access for custom roles 3 More Help topics Configuring single sign-on (SSO) on page 4 Configuring WebDAV security on page 7 Configuring the repository on page 9

7 4 Chapter 3: Configuring single sign-on (SSO) The default Mosaic security configuration provides single sign-on (SSO) functionality for simple scenarios. For example, users who log in to an application using a web browser can also access other applications that are: Configured to allow access using the same credentials as the application they have already logged in to Deployed on the same Mosaic server Accessed during the same web browser session More complex SSO scenarios require additional security configuration. For example, a Mosaic application may include a tile that accesses a LiveCycle data service or utility (such as AssemblerService) that accept the same credentials as the application. In these cases, you independently configure Mosaic and LiveCycle ES2.5 to work within an enterprise SSO security infrastructure. For Mosaic, you configure Spring Security to use an external authentication provider. For LiveCycle ES2.5, you configure the User Management service to work with the same authentication provider. For information on configuring LiveCycle ES2.5 for enterprise SSO, in LiveCycle ES2.5 Administration Help, under Configuring User Management, see Enabling single sign-on in LiveCycle ES2. Configuring Mosaic for enterprise SSO Mosaic uses the Spring Security framework for authentication and access-control. To configure Mosaic to work with an external authentication provider, change the default authentication providers in the Spring Security configuration. The Mosaic Spring Security configuration is located in the file mosaic-context.xml at the following location in the mosaic.war file: /META-INF/spring/. The following example illustrates a customized security configuration that integrates Mosaic with SiteMinder using the default Mosaic users and roles:

8 ADMINISTERING LIVECYCLE MOSAIC 9.5 Configuring single sign-on (SSO) 5 <security:http realm="adobe LiveCycle Mosaic"> <security:intercept-url pattern="/about/**" method="get" access="is_authenticated_fully" /> <security:intercept-url pattern="/applications/**" access="is_authenticated_fully" /> <security:intercept-url pattern="/catalogs/**" access="is_authenticated_fully" /> <security:intercept-url pattern="/policies/**" access="is_authenticated_fully" /> <security:intercept-url pattern="/user/**" access="is_authenticated_fully" /> <security:form-login login-page="/login.jsp" authentication-failureurl="/login.jsp?login_error=1" /> <security:http-basic /> <security:logout logout-url="/logout" /> <security:custom-filter position="pre_auth_filter" ref="siteminderfilter" /> </security:http> <security:authentication-manager alias="authenticationmanager"> <security:authentication-provider ref="mosaicauthenticationprovider"/> <security:authentication-provider ref="preauthauthprovider"/> <security:authentication-provider ref="daoauthprovider"/> </security:authentication-manager> <bean id="inmemoryuserdetailsservice" class="org.springframework.security.core.userdetails.memory.inmemorydaoimpl"> <property name="usermap"> <value> user=password,role_mosaic_end_user designer=password,role_mosaic_designer padmin=password,role_mosaic_policy_administrator broker=password,role_mosaic_broker advisor=password,role_mosaic_advisor </value> </property> <bean id="preauthauthprovider" class="org.springframework.security.web.authentication.preauth.preauthenticatedauthenticatio nprovider"> <property name="preauthenticateduserdetailsservice"> <bean id="userdetailsservicewrapper" class="org.springframework.security.core.userdetails.userdetailsbynameservicewrapper"> <property name="userdetailsservice" ref="inmemoryuserdetailsservice"/> </property>

9 ADMINISTERING LIVECYCLE MOSAIC 9.5 Configuring single sign-on (SSO) 6 <bean id="mosaicauthenticationprovider" class="com.adobe.livecycle.mosaic.springsecurity.integration.authentication.mosaicauthentica tionprovider"> <property name="authenticationservice"><ref bean="mosaicauthenticationservice" /></property> <property name="userroleprovider"><ref bean="mosaicuserroleprovider" /></property> <bean id="daoauthprovider" class="org.springframework.security.authentication.dao.daoauthenticationprovider"> <property name="userdetailsservice" ref="inmemoryuserdetailsservice"/> <bean id="siteminderfilter" class="org.springframework.security.web.authentication.preauth.requestheaderauthenticationfi lter"> <property name="principalrequestheader" value="sm_user" /> <property name="exceptionifheadermissing" value="false" /> <property name="authenticationmanager" ref="authenticationmanager" /> Note that the configuration includes a custom-filter definition for the security:http element and defines the authentication-provider preauthauthprovider. To complete this configuration, replace inmemoryuserdetailsservice with the corporate LDAP server or User Repository. For more information, see the Spring Security configuration documentation. Single Sign On (SSO) Product Sample The Single Sign On sample provides instructions on how to configure both the Mosaic Tile SDK and LiveCycle ES2.5 to create a single-sign-on environment. It uses the following three applications: LCRemotingSSO Uses the Mosaic Actionscript Tile SDK with Flex Remoting to talk to a LiveCycle Service (Repository Service). LCSoapSSO Uses the Mosaic ActionScript Tile SDK with SOAP Web Services to talk to a LiveCycle Service (Repository Service). LCHtmlSSO Uses the Mosaic Javascript Tile SDK with http to talk to a sample web application. It also supplies a sample SSO filter and servlet that is used to accomplish web app authentication. For more information, see LiveCycle ES2 Product Samples. More Help topics Configuring Mosaic access for custom roles on page 2 Configuring WebDAV security on page 7 Configuring the repository on page 9

10 7 Chapter 4: Configuring WebDAV security By default, Mosaic WebDAV security is configured for production environments, which need stronger security to protect enterprise content and assets. However, Mosaic also allows you to customize its security features for development environments, which are self-contained and independent of a wider enterprise. You can also configure Mosaic to use a remote LiveCycle ES2.5 instance to authenticate users instead of an instance located within the same J2EE container. Configuring WebDAV authentication By default, Mosaic uses a single user for WebDAV authentication. This configuration allows a Mosaic user to access Mosaic content in the LiveCycle ES2.5 Repository, but not other Repository content. By default, the WebDAV authentication user and password are the default ones used for logging in to LiveCycle ES2.5 Administration Console. For greater security, or if you have changed the LiveCycle ES2.5 administration user and password, you can configure Mosaic to use values you provide. If your Mosaic server environment does not use WebDAV authentication, you can prevent Mosaic from submitting authentication credentials that are not needed. You change the WebDAV authentication configuration using Mosaic s WebDAV properties. The WebDAV properties also allow you to perform authentication using individual Mosaic users instead of the specified WebDAV authentication user. This configuration allows you to track the Repository activity of specific Mosaic users. However, to use this method, Mosaic users need additional permissions. Create a WebDAV security user 1 Open a web browser and enter the URL for the LiveCycle Administration Console. For example, for a JBoss server the URL is (local deployment using the default port). 2 Enter your user name and password and click Login. For example, the default user name and password are administrator and password. 3 In LiveCycle Administration Console, click Settings > User Management > Users and Groups. 4 Click New User. 5 Under General Settings, provide the user information, and then click Finish. For example: First Name: Mosaic Last Name: WebDAV User Id: mosaicwebdav Password: password Confirm password: password 6 Click Settings > User Management > Role Management. 7 Click New Role.

11 ADMINISTERING LIVECYCLE MOSAIC 9.5 Configuring WebDAV security 8 8 Under General Settings, for Role Name, type the role name, and then click Next. An example of a role name is ROLE_MOSAIC_WEBDAV. 9 Under Find Permissions, select the following values, and then click OK. Repository Read Repository Traverse Repository Write Service Invoke 10 Click Next. 11 Under Role Users, click Find Users/Groups. 12 Under Find Users and Groups, click Find, and then select the user you created for WebDAV authentication (for example, Mosaic WebDAV). 13 Click OK, and then click Finish. Change the WebDAV authentication settings If you are using the default security configuration, no changes to the WebDAV authentication settings are required. 1 Using a text editor, open the mosaic-context.xml file. For example, on the standalone server, the file is located in the folder [Mosaic install directory]/standalone/webapps/mosaic/meta-inf/spring. 2 Under the section WebDAV Repository Configuration Beans, ensure that the WebDAV configuration you want to enable is not commented out of the file. The possible configurations are: Basic Username/Password Authentication Use this configuration if the WebDAV server requires authentication. The credentials provided represent the only account Mosaic uses for communicating with the WebDAV server. This repository configuration is the default configuration for Mosaic. Username/Password Authentication with an external WebDAV server Use this configuration if the WebDAV server requires authentication and exists on another server or another port of the same server. SAML Authentication Use this configuration if Mosaic is running in LiveCycle ES2.5 and WebDAV calls maintain the user's identity and credentials. This configuration is used to accommodate environments where the account accessing the WebDAV repository is the same account as the user making the request. Without Authentication Use this configuration if the WebDAV server is located on a secure, private subnetwork, or for development/testing environments. A best practice is to use this configuration in combination with a remote WebDAV server. 3 Ensure that you specify appropriate property values for the WebDAV configuration bean you select. The mosaiccontext.xml file is distributed with default values configured, which you must update for your production server environment (if necessary). 4 Save your changes. More Help topics Configuring Mosaic access for custom roles on page 2 Configuring single sign-on (SSO) on page 4 Configuring the repository on page 9

12 9 Chapter 5: Configuring the repository Mosaic stores and retrieves tiles and other assets used by Mosaic applications in a repository. By default, the repository is implemented using WebDAV. Both the Apache Tomcat standalone server provided with Mosaic and the LiveCycle ES2.5 integrated repository use WebDAV. However, you can also configure Mosaic to use a simple file system repository or a custom implementation of the repository. File system repository The file system repository provided with Mosaic is a simple file input/output (I/O)-based implementation. When you enable this version of the repository, Mosaic stores assets at a local or network location that you specify. To implement the file system repository, edit the appropriate bean definitions in the Mosaic Spring configuration. This configuration is located in the file mosaic-context.xml at the following location in the mosaic.war file: /META- INF/spring/. You can set two file system repository properties: filesystemrootpath Specifies the root path on the file system where Mosaic stores assets. This location can be on a local disk or on a mounted network share directory. It is created if it does not exist. pathcomponentseparator An optional property that specifies the character to use between the path components for the applicable platform. For example, the backslash (/) in /tmp/mosaic/repositoryroot. If not specified, java.io.file.separator is used. Configure Mosaic to use the file system repository 1 In a text or XML editor, open mosaic-context.xml from the following location in the file mosaic.war. /META-INF/spring/ 2 Under Mosaic System Repository Configuration Beans, disable the WebDAV-managed repository by commenting out the following element: <alias name="mosaicwebdavrepository" alias="mosaicstoragerepository"/> 3 Enable the file system repository by removing the comment tags from the following element: <alias name="mosaicfilesystemrepository" alias="mosaicstoragerepository"/> 4 Under File-System Repository Configuration Beans, remove the comment tags from the following bean element: <bean id="mosaicfilesystemrepository" class="com.adobe.livecycle.mosaic.repository.filesystem.filesystemrepository"> <property name="filesystemrootpath" value="/tmp/mosaicfsroot" /> 5 If necessary, set the pathcomponentseparator property. For example: <bean id="mosaicfilesystemrepository" class="com.adobe.livecycle.mosaic.repository.filesystem.filesystemrepository"> <property name="filesystemrootpath" value="c:\\tmp\\mosaicfsroot" /> <property name="pathcomponentseparator" value="\\ " />

13 ADMINISTERING LIVECYCLE MOSAIC 9.5 Configuring the repository 10 6 For the property element value attribute, replace /tmp/mosaicfsroot with the location of the file system repository. 7 Save your changes and recompile the mosaic.war file. 8 Redeploy the new mosaic.war file to the Mosaic application server. 9 To populate the new repository, redeploy your assets to the server. For more information, see Deploying assets to the server in Developing Applications for LiveCycle Mosaic 9.5. Custom File Repository Mosaic provides documentation and source code that you can use to create your own implementation of the Mosaic repository. Javadocs that describe the IRepository interface and related interfaces can be found at the following location: [Mosaic installation directory]/sdk/java/javadoc The source code for the file system repository can be found at the following location: [Mosaic installation directory]/sdk/java/samples More Help topics Configuring Mosaic access for custom roles on page 2 Configuring single sign-on (SSO) on page 4 Configuring WebDAV security on page 7