How To Use Libap With A Libap Server With A Mft Command Center And Internet Server

Transcription

1 MFT Command Center/Internet Server LDAP Integration Guide Ver sio n September 7, 2011

2 Documentation Information MFT LDAP Integration Guide Important Information SOME TIBCO SOFTWARE EMBEDS OR BUNDLES OTHER TIBCO SOFTWARE. USE OF SUCH EMBEDDED OR BUNDLED TIBCO SOFTWARE IS SOLELY TO ENABLE THE FUNCTIONALITY (OR PROVIDE LIMITED ADD-ON FUNCTIONALITY) OF THE LICENSED TIBCO SOFTWARE. THE EMBEDDED OR BUNDLED SOFTWARE IS NOT LICENSED TO BE USED OR ACCESSED BY ANY OTHER TIBCO SOFTWARE OR FOR ANY OTHER PURPOSE. USE OF TIBCO SOFTWARE AND THIS DOCUMENT IS SUBJECT TO THE TERMS AND CONDITIONS OF A LICENSE AGREEMENT FOUND IN EITHER A SEPARATELY EXECUTED SOFTWARE LICENSE AGREEMENT, OR, IF THERE IS NO SUCH SEPARATE AGREEMENT, THE CLICKWRAP END USER LICENSE AGREEMENT WHICH IS DISPLAYED DURING DOWNLOAD OR INSTALLATION OF THE SOFTWARE OR IF THERE IS NO SUCH SOFTWARE LICENSE AGREEMENT OR CLICKWRAP END USER LICENSE AGREEMENT, THE LICENSE(S) LOCATED IN THE LICENSE FILE(S) OF THE SOFTWARE. USE OF THIS DOCUMENT IS SUBJECT TO THOSE TERMS AND CONDITIONS, AND YOUR USE HEREOF SHALL CONSTITUTE ACCEPTANCE OF AND AN AGREEMENT TO BE BOUND BY THE SAME. This document contains confidential information that is subject to U.S. and international copyright laws and treaties. No part of this document may be reproduced in any form without the written authorization of TIBCO Software Inc. TIBCO, The Power of Now, TIBCO Managed File Transfer, TIBCO Managed File Transfer Command Center, TIBCO Managed File Transfer Internet Server, TIBCO Managed File Transfer Platform Server, TIBCO Managed File Transfer Platform Server Agent, Edge Server, RocketStream Accelerator, and Slingshot are either registered trademarks or trademarks of TIBCO Software Inc. or its subsidiaries in the United States and/or other countries. EJB, Java EE, J2EE, and all Java-based trademarks and logos are trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and other countries. All other product and company names and marks mentioned in this document are the property of their respective owners and are mentioned for identification purposes only. THIS SOFTWARE MAY BE AVAILABLE ON MULTIPLE OPERATING SYSTEMS. HOWEVER, NOT ALL OPERATING SYSTEM PLATFORMS FOR A SPECIFIC SOFTWARE VERSION ARE RELEASED AT THE SAME TIME. THIS DOCUMENT IS PROVIDED AS IS WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. THIS DOCUMENT COULD INCLUDE TECHNICAL INACCURACIES OR TYPOGRAPHICAL ERRORS. CHANGES ARE PERIODICALLY ADDED TO THE INFORMATION HEREIN; THESE CHANGES WILL BE INCORPORATED IN NEW EDITIONS OF THIS DOCUMENT. TIBCO SOFTWARE INC. MAY MAKE IMPROVEMENTS AND/OR CHANGES IN THE PRODUCT(S) AND/OR THE PROGRAM(S) DESCRIBED IN THIS DOCUMENT AT ANY TIME. THE CONTENTS OF THIS DOCUMENT MAY BE MODIFIED AND/OR QUALIFIED, DIRECTLY OR INDIRECTLY, BY OTHER DOCUMENTATION WHICH ACCOMPANIES THIS SOFTWARE, INCLUDING BUT NOT LIMITED TO ANY RELEASE NOTES AND "READ ME" FILES. TIBCO Managed File Transfer Internet Server with RocketStream Accelerator is entitled TIBCO Managed File Transfer Internet Server in certain other product documentation and in user interfaces of the product. Copyright TIBCO Software Inc. ALL RIGHTS RESERVED. TIBCO Software Inc. Confidential Information TIBCO welcomes your comments on this publication. Please address your comments to: TIBCO Software Inc. 200 Garden City Plaza Garden City, New York USA Web site: Technical Support [email protected] Technical Support Call Centers: North and South America: or ( TACS) EMEA (Europe, Middle East, Africa): +44 (0) Australia: or Asia: When you send information to TIBCO, you grant TIBCO a non-exclusive right to use or distribute the information in any way TIBCO believes appropriate without incurring any obligation to you. 2 Copyright TIBCO Software Inc All Rights Reserved.

3 MFT LDAP Integration Guide Document Information Using LDAP with MFT Command Center and Internet Server The MFT Command Center (MFTCC) and Internet Server (MFTIS) products support a standardized method of using LDAP for MFT User Authentication and Right Management. This guide lays out the proposed model for using the MFTCC or MFTIS enterprise applications with an LDAP server in conjunction with the MFTCC or MFTIS database. OVERVIEW Types of LDAP Integration... 5 AUTHENTICATION PRE-REQUISITES... 6 ADDING AN LDAP AUTHENTICATOR... 7 SYNCHRONIZATION SYNCHRONIZATION BY AN ADMINISTRATOR SYNCHRONIZATION BY USER LOGIN AUTOMATIC SYNCHRONIZATION MANAGE LDAP AUTHENTICATORS Copyright TIBCO Software Inc All Rights Reserved. 3

4 Overview MFT LDAP Integration Guide Overview J2EE Application Server Client Browser 1 User Registry 3 CFI Enterprise Application Firewall LDAP SERVER CFI DATABASE Figure 1 The above diagram is a high level overview of the utilization of the LDAP server for the MFTCC or MFTIS enterprise applications. Several proposed solutions corresponding to the diagram above diagram follow: 1. A client browser makes an HTTPS connection to the J2EE server hosting the MFTCC or MFTIS application. The J2EE server determines the authentication methods configured for this MFTCC or MFTIS installation and requests that the client s web browser ask the user for his credentials. The client browser collects the user s information and forwards it to the J2EE server. 2. The J2EE server uses its built-in or custom User Registry to match or reject a user s credentials against the configured LDAP server. 3. If a user has been successfully authenticated against LDAP server, the J2EE server initiates the appropriate MFTCC or MFTIS resource to handle the user s request and forwards it to the MFTCC or MFTIS enterprise application. 4. The MFTCC or MFTIS enterprise application will use the regular MFTCC or MFTIS database for all operations except Users and Rights functionalities. 5. If the MFTCC or MFTIS application will not be using the LDAP server solely for authentication purposes, all add/delete operations for MFTCC or MFTIS Users and Rights must be performed by an LDAP administrator, using LDAP server management fields. Since the default LDAP schema does not support all MFTCC or MFTIS fields, MFT extends the LDAP User and Group fields by using the MFTCC or MFTIS database. Back to Top 4 Copyright TIBCO Software Inc All Rights Reserved.

5 MFT LDAP Integration Guide Overview Authentication The J2EE server is responsible for performing the actual authentication of a user s credentials. All major J2EE servers provide various methods of integrating a custom user database into the server s security framework. Additionally, most J2EE servers can be configured to use the underlying operating system s user database. The J2EE server s authentication framework will utilize built-in or a provided custom registry class to communicate to the LDAP server and obtain the required user s information and the rights assigned to the user. After passing the authentication through the LDAP server, MFT will utilize the regular MFT database. Types of LDAP Integration MFTCC or MFTIS enterprise applications support the LDAP v3 protocol and have the following options for LDAP support: 1. LDAP User Synchronization and Authentication The MFT application uses LDAP for user synchronization and authentication purposes only. MFT determines that a user is a MFT user by their membership in an LDAP Sync Group. This group is specified in the field Sync Group DN within the LDAP Authenticator Properties in MFTCC or MFTIS. This manual will base its examples using an Active Directory group called MFT Users. (See Figure 2) MFT will synchronize user definitions from the directory server to the MFT Database. The MFT application cannot add or delete any users on the LDAP server. All LDAP sync d user fields are managed through the LDAP server. MFT will synchronize information from the directory server to the MFT database. The user will have a duplicate account in the MFT database matching that of the LDAP server entry. 2. LDAP Right Management (Optional) Under this configuration the MFT application uses an LDAP server for authentication as well as user right management. MFT determines that a user is assigned to a right by their membership in an LDAP Sync Group. This group is specified in the field Right Group Base DN within the LDAP Authenticator Properties in MFTCC or MFTIS. This manual will base its examples using an Active Directory group called Group Rights. (See Figure 3) The LDAP server must be pre-configured to contain the MFT Rights (specified as LDAP groups) and associate MFT users with those rights. Under this configuration, the MFT application will use the user definitions in the default MFTCC or MFTIS Database to extend the LDAP User and Group attributes. Rights that are not enabled to be managed through the LDAP server can still be granted and revoked from MFTCC or MFTIS. Back to Top Copyright TIBCO Software Inc All Rights Reserved. 5

6 Prerequisites MFT LDAP Integration Guide Pre-requisites MFT provides easy integration with LDAP which can be configured from the MFTCC or MFTIS Administrative screens. To allow MFT to Authenticate and Synchronize with an LDAP server you must configure a few items on the LDAP server and have certain information and credentials readily available. 1) You must know the Host information such as the IP and Port of the LDAP server(s) you will be authenticating to. 2) You must know the Bind User DN and Password. 3) You must have a container such as an OU, or group which contains the specific users to be sync d with the MFT database; for example OU=MFT Users would contain all users which will sync with MFT. (See Figure 2 below.) 4) You must know the User Base DN and Group Base DN where the Sync Group is located. Note: When using non-ad servers; groups must contain the object class groupofuniquenames, and users must contain the object class inetorgperson. Example Active Directory setup: Figure 2 Figure 3 Back to Top 6 Copyright TIBCO Software Inc All Rights Reserved.

7 MFT LDAP Integration Guide Adding an LDAP Authenticator Adding an LDAP Authenticator In order to synchronize the MFT database through LDAP, you must configure the LDAP authenticator from MFTCC or MFTIS. Navigate to Management > Authenticators > Add Authenticators. On the Add Authenticator page you will see the Authenticator Properties form. The first section that needs to be configured is Authenticator. The table below defines the parameters for the section. Figure 4 *Note: It is recommended to use a short name for the Authenticator. When LDAP user ids are synchronized they will be represented in the MFT Database in the format of xxxxx-userid where xxxxx is the Authenticator Name. End users will not need this portion of the userid to login to the system. Example: John Doe (jdoe) would login with jdoe and not AD162-jdoe. Parameter Name Type Enabled Definition This is the unique name of the LDAP Authenticator in MFT and is used as the prefix to the user id followed by a dash when it is pulled in from the LDAP server. Ex. LDAPServer-john.doe Warning: This field cannot be modified later. The type of directory where LDAP is pulling the user and role credentials from such as Active Directory, edirectory, Sun Directory Server and others. Enables or Disables this LDAP Authenticator. If this box is disabled all users connected to this LDAP server will no longer be able to connect to the MFT server. Disabled users will lose TransferRight and show LDAP status as Inactive on the User Properties page in MFTCC or MFTIS. The next section is LDAP Connectivity which defines the parameters necessary to connect to the directory server and pull in the user and role information for synchronizing. Figure 5 Parameter Host Name/IP Address Bind User DN Bind Password Confirm Password Port Use SSL Definition Host Name or IP Address of the LDAP server. The distinguished name (DN) required for authenticating to the LDAP Server. The password associated with the defined Bind User. Confirmation for the password associated with the defined Bind User. The default LDAP port used by the LDAP server. The default for Non-SSL requests is 389 and port 636 for SSL. If the LDAP server you are connecting to is using SSL you must enable this option. Copyright TIBCO Software Inc All Rights Reserved. 7

8 Adding and LDAP Authenticator MFT LDAP Integration Guide The next section which needs to be configured is the LDAP Search. This section defines the location of the sync group and the users which will be synced into the MFT Database. Figures 6, 7 and 8 demonstrate different configurations an Administrator may setup to search for LDAP users (Refer to Figures 2 and 3 as references.) The following example will result in 10 Active Directory users being added to the MFT database (Refer to Figure 2. Users are in orange text boxes): Figure 6 The following example will result in 2 Active Directory users being added to the MFT database (Refer to Figure 2. Accounting Properties window shows 2 users in the Accounting group): Figure 7 If you would prefer to use search filters we can accomplish the same results as in the above example using this setup (Refer to Figure 2. Accounting Properties window shows 2 users in the Accounting group): Figure 8 Below are some examples of search filters that could be used when searching for users becomes more detailed: Filter to sync multiple Security Groups in a single authenticator: ( (&(objectclass=user)(memberof=cn=accounting,ou=user Groups,ou=MFT Users,dc=QA,dc=com))(&(objectClass=user)(memberOf=cn=Finance,ou=User Groups,ou=MFT Users,dc=QA,dc=com))) Filter to sync all users with mail accounts: (&(objectclass=user)(mail=*)) 8 Copyright TIBCO Software Inc All Rights Reserved.

9 MFT LDAP Integration Guide Adding an LDAP Authenticator Parameter User Base DN Sync Group DN Search Filter Search Scope Definition The base in the directory tree where users are defined. The levels searched below this base depend on the Search Scope parameter The fully qualified name of the container on the directory server which will be used to associate the users with MFT. Only users who are inside this container will be synchronized with the Database. The LDAP Search Filter allows you to be more selective of the user objects returned during an LDAP search; it can be used instead of, or in addition to the Sync Group DN. Syncing unnecessary LDAP objects with the MFT Server can be avoided when using an appropriate search filter. For example to sync all users from Active Directory with mail accounts the filter string would be: (&(objectclass=user)(mail=*)) If you do not wish to use a specified filter to search for users you should change the value to read (objectclass=user) Contact your directory server administrator for more details on constructing LDAP Search Filters. The directory levels below the Base DN that LDAP will search. SUBTREE_SCOPE - defines that all levels below the Base DN will be searched. This is the default value and should be used by most users. ONELEVEL_SCOPE - defines that only the level defined by the Base DN will be searched. OBJECT_SCOPE - defines that only the object defined by the Base DN and the Search Filter will be searched. The next section is the LDAP attributes, these are the fields that LDAP reads from the directory datastore server in order to pull in the correct information. The predefined values in this section should be confirmed with the directory server administrator. In most cases no changes are necessary. The last section on the Add Authenticator page is Right Management. Here you can enable the rights you want to be managed using the LDAP server. MFTCC or MFTIS users can be assigned various rights which allow them different capabilities. The most popular of these rights is the TransferRight; without this right assigned to a user, they cannot perform file transfers. Some LDAP environments may want to control which users are assigned this right and other rights from the LDAP server. Once the right is enabled for management through the LDAP server it cannot be granted or un-granted from MFTCC or MFTIS. A group with the name which is specified on the LDAP Group Name field must exist on the directory server and the users granted this right must be members of the group. The following example will result in 2 Active Directory users being added to the MFT database (Refer to Figure 3. Users are pulled from the TransferRight group): Figure 9 Copyright TIBCO Software Inc All Rights Reserved. 9

10 Adding and LDAP Authenticator MFT LDAP Integration Guide Parameter Right Group Base DN Enable Right Name LDAP Group Name Definition The location in the directory tree of the OU which contains the MFT Rights When the Enable box is checked, that right will be managed on the defined LDAP server. The right as it is recognized by MFT. The name of the group on the LDAP server which will be associated with the right in MFT, this can be the same as the Right Name or be specified as a different group name. The LDAP Group Name specified in the field should match the group name on the directory server. Once the configurations have been completed click the Add button and the authenticator will be added to the system. You can now run a test to verify your configurations will connect successfully and pull the correct users into the database. To test your configurations navigate to: Management > Authenticators > Manage Authenticators (Figure 10 shows our example setup): Figure 10 Click on the link to verify connection settings and returned results with MFTCC or MFTIS. Figure 11 below shows 2 users will be synchronized with the MFT Database along with the TransferRight assignment (Refer to Figures 2 through 9 as a reference): Figure 11 Now that our test was successful it is possible to synchronize users and rights from the directory server through LDAP. If no rights are enabled for the authenticator, the users will be added to the MFT database without any rights when the LDAP sync is performed. It is then the responsibility of the MFT Administrator to assign rights to the users through the MFTCC or MFTIS Administration web pages. The next section describes the process of synchronizing with the LDAP Authenticator. Back to Top 10 Copyright TIBCO Software Inc All Rights Reserved.

11 MFT LDAP Integration Guide User Synchronization Synchronization In order to view and manage LDAP users from MFTCC or MFTIS; synchronization is necessary to add the users to the Database or update any LDAP managed fields that have changed. By default, synchronization to the MFT database will pull in the directory user s User Id, Full Name, and Address for those contained in the LDAP sync group, as well as any rights assigned to the user if Rights Management is enabled on the authenticator. MFT has three methods for a synchronization to take place. Synchronization by an Administrator: In this case, synchronization is manually executed by a Super Administrator. In order to synchronize, log into MFTCC or MFTIS Administration and navigate to: Management > LDAP Sync. This form gives two options for synchronizing. The administrator can sync a single user or all users across all active authenticators. (Figures 12 and 13 demonstrate synchronizing 2 users from our Authenticator configured in Figures 2 through 11.) Figure 12 Figure 13 Sync User: To synchronize a particular user, select the Sync User option, type in the user id you wish to sync with in the UserId field and then click the Sync button. Sync All Users: To synchronize all users, select Sync All Users and click the Sync button. All the users found in the sync groups across all active authenticators will be synchronized with the MFT Database. The total amount of LDAP users and rights (if enabled) synchronized will be displayed at the top of the screen. Once you have synchronized the LDAP users the Administrator can navigate to Users > Manage Users web page where they will see the new LDAP users added to the system. Figure 13 below shows our two LDAP users added to the system (Refer to Figures 2 through 12 as references): Copyright TIBCO Software Inc All Rights Reserved. 11

12 Manage LDAP Authenticators MFT LDAP Integration Guide Figure 14 *Note: When LDAP user ids are synchronized they will be represented in the MFT Database in the format of xxxxx-userid where xxxxx is the Authenticator Name. End users will not need this portion of the userid to login to the system. Example: John Doe (jdoe) would login with jdoe and not AD162-jdoe. The new users synchronized can now login to MFT using several different userid options. Let s look at John Doe from our example in Figure 14 he can login using the following user ids: jdoe QA\jdoe (This is using the LDAP domain) Note: If an end user has the same LDAP user id in multiple domains that will be synchronized the end user needs to always login with the specific domain\userid they want to connect with. Back to Top 12 Copyright TIBCO Software Inc All Rights Reserved.

13 MFT LDAP Integration Guide User Synchronization Synchronization by User Login: MFT has the capability to synchronize an LDAP userid during their log on process to the server. A user who has not yet been synchronized will be added or updated in the database when they login using their domain log on and password, for example: Domain\userid. If rights are being managed on the authenticator, the user will be assigned their corresponding rights when they login to the system. Note: This option does not require the Sync Server to be enabled as shown in the next section describing the Automatic Synchronization. Automatic Synchronization: The final way for a synchronization to take place is to be done automatically by configuring MFTCC or MFTIS built-in synchronization feature that allows the Administrator to setup daily synchronization. Automatic synchronization is managed from Management > System Configurations > Global Settings in the LDAP Settings section. Figure 15 Parameter Sync Server Host Name Sync Server Start Time Definition The name of the MFTCC or MFTIS hostname which will start the synchronization process. If this parameter is set to Disabled, synchronization will not be done automatically. The time of day the synchronization process will begin. *Note: Some changes made to the LDAP Settings section will not take effect until after the application server is restarted. If for any reason a user fails to be synchronized, you can find further information on the cause by reading the ldap_sync_report_messages-mft-xxxx-xx-xx.txt report that is located in <MFT_HOME>\logs\message directory where xxxx-xx-xx represents the date the synchronization took place. Back to Top Copyright TIBCO Software Inc All Rights Reserved. 13

14 Manage LDAP Authenticators MFT LDAP Integration Guide Manage LDAP Authenticators The manage authenticators page lists all LDAP authenticators that have been defined to the system. Navigate to Management > Authenticators > Manage Authenticators. From here you can delete, test, and edit the LDAP authenticators. To delete an authenticator, click on the box in the Delete column to select it and then click the Delete button. However, users from a deleted authenticator will: 1) Not be removed from the MFT database. 2) No longer be able to log into MFTCC or MFTIS. 3) Have their rights removed. 4) Have their LDAP Status set to Inactive. It is also possible to test the connectivity to an authenticator, do this by clicking on the Test link of the authenticator you want to test. To edit the properties of an authenticator click on the authenticator name and the update Authenticator page will display for you to make changes to the configuration. The Update Authenticator page is the same in format as the Add Authenticator page. After the desired changes have been made to the authenticator, select the Update button to save the changes. *Note: After updating an authenticator some changes may not be effective until after a sync takes place. Back to Top 14 Copyright TIBCO Software Inc All Rights Reserved.