Password Manager Using Luminis APIs

Transcription

1 SUNGARD SUMMIT 2007 sungardsummit.com 1 Password Manager Using Luminis APIs Presented by: Ron Romao Savannah College of Art and Design March, 2007 A Community of Learning

2 Password Manager Using Luminis APIs Web application using Java and JSP Uses Luminis Data Access API Uses CAS to protect parts of the application 2

3 SUNGARD SUMMIT 2007 sungardsummit.com 3 I Will Discuss What we did - Custom Password Change Application Why we did it - Reduce Help Desk Calls - Log Password Changes How we did it - Technologies Used - Process Explained - Challenges Encountered A Community of Learning

4 Password Manager Web Application Allows users to reset their passwords Using their Banner security question Allows Helpdesk staff to reset user passwords Extra logging capabilities Allow us to track more data 4

5 How : Process Explained : Forgot and Change Password Page 5

6 How : Process Explained : Help Desk Page 6

7 What : Custom Password Change Application Stand alone Web Application Written in Java and JSP Running on Tomcat Updates custom database tables Logs Password Changes CAS Protected 7

8 SUNGARD SUMMIT 2007 sungardsummit.com 8 Why we did it - Needs for this project - Benefits A Community of Learning

9 Why : Main Reasons Decrease Help Desk calls Users can reset their password Log password changes Auditing Purposes Who changed the password (HD or self change) When password was changed 9

10 Why : Benefits Increase productivity for end users By avoiding unnecessary calls to Help Desk Improves end user satisfaction User feels more in control of their password Easier password reset process Easy to use password page 10

11 SUNGARD SUMMIT 2007 sungardsummit.com 11 How We did it - Technologies used - Process explained - Challenges Encountered A Community of Learning

12 How : Technologies Used Java, JSP and Servlets Tomcat Luminis Data Access API CAS 12

13 How : Process Explained JSP Pages Forgot Password - Self help Change Password - Self help (link in Luminis) Help Desk Change Password Help Desk use only Logout (invalidates session) 13

14 How : Process Explained Forgot Password Page Reset password by answering Banner security question Future improvements Reset Luminis password by providing Novell login information 14

15 How : Process Explained : Help Desk Page Help Desk Page Help Desk use only User requesting password change Come to HD Show SCAD ID Call HD Staff verify user information HD save notes for the request Everything gets logged! 15

16 How : Process Explained CAS Protection All pages are CAS protected User need to be logged into Luminis portal valid CAS ticket Except Forgot Password page Unauthorized users sent to Luminis login page. 16

17 web-xml file </web-app> <!--start CAS stuff--> <filter> <filter-name>cas Filter</filter-name> <filter-class>edu.yale.its.tp.cas.client.filter.casfilter</filter-class> <init-param> <param-name>edu.yale.its.tp.cas.client.filter.loginurl</param-name> <paramvalue> /redirect.jsp</param-value> </init-param> <init-param> <param-name>edu.yale.its.tp.cas.client.filter.validateurl</param-name> <param-value> </init-param> <init-param> <param-name>edu.yale.its.tp.cas.client.filter.servername</param-name> <param-value>myscad.scad.edu:8080</param-value> </init-param> </filter> <filter-mapping> <filter-name>cas Filter</filter-name> <url-pattern>/cas/*</url-pattern> </filter-mapping> <!--end CAS stuff--> </web-app> 17

18 How : Process Explained : Luminis API Java class using Luminis Data Access API Create DAManager stub Call Web Service method modify PasswordModification class changes Luminis password ExternalSystemAccountModification class changes the password in Banner 18

19 How : Process Explained : Creating the Service System.setProperty("java.class.path", classpath); System.setProperty( "javax.xml.rpc.servicefactory "com.sct.pipeline.webservice.client.jaxrpcservicefactory" ); Service service = null; ServiceFactory sf = ServiceFactory.newInstance(); service = sf.createservice( QName.valueOf( "{urn:pipeline.sct.com:webservice:da:200306:soap}da" )); Stub stub = (Stub)service.getPort( DAManager.class ); stub._setproperty (javax.xml.rpc.stub.endpoint_address_property, " + host + "/ws/webservice/da/200306/soap/damanager" ); stub._setproperty ( "javax.xml.rpc.security.auth.username", username ); stub._setproperty ( "javax.xml.rpc.security.auth.password", password ); svc = (DAManager)stub; 19

20 How : Process Explained : Modifying the Password ModifyParams mp = new ModifyParams(); mp.setboid( new BOID( BusinessObjectTypeEnum.USER, userid ) ); PasswordModification pm = new PasswordModification( "PASSWORD", new PasswordPair(newPass, newpass), ModOperationTypeEnum.REPLACE ); Modification[] mods = new Modification[ 1 ]; mods[ 0 ] = pm; mp.setmodifications( mods ); svc.modify( mp ); // Modify Password ExternalSystemAccount[] esa = new ExternalSystemAccount[ 1 ]; esa[ 0 ] = new ExternalSystemAccount( "SCT", userid, pin); ExternalSystemAccountModification esamod = new ExternalSystemAccountModification( "EXTERNALSYSTEMACCOUNTS", esa, ModOperationTypeEnum.ADD ); mods[ 0 ] = esamod; mp.setmodifications( mods ); svc.modify( mp ); // Modify PIN fpass.setgobtpac(userid); // Updates gobtpac to trigger an event 20

21 How : Process Explained Password Rules Must be at least 8 characters long Must include at least one number and one alphabetic character Must NOT include spaces or any of the following characters: #,+"\<>;@&$~=*%!{}()/:[]'? Enforced on the server side 21

22 Challenges WSDL Issue Web Service WSDL not found Service could not be created Solution found Changed classpath inside application. Pointed to WSDL file location System.setProperty("java.class.path", classpath); 22

23 Challenges Issues with SSO to SSB Altered baseline trigger Update activity date on GOBTPAC Everybody is happy. 23

24 Summary Our Password Management Solution allows user to reset forgotten passwords securely, allowing us to implement stronger policies while reducing help desk calls. It also allows Help Desk to reset user passwords. 24

25 Summary Application built using Java, JSP and Web Services to provide an easy to use interface for users to maintain their own passwords. It uses Luminis Data Access API to change passwords in Luminis and Banner. It uses events to carry changes to external systems. Uses CAS to protect application from unauthorized users. 25

26 Questions? 26

27 Thank You! Ron Romao Web Programmer Savannah College of Art and Design Please complete the online class evaluation form SunGard, the SunGard logo, Banner, Campus Pipeline, Luminis, PowerCAMPUS, Matrix, and Plus are trademarks or registered trademarks of SunGard Data Systems Inc. or its subsidiaries in the U.S. and other countries. Third-party names and marks referenced herein are trademarks or registered trademarks of their respective owners SunGard. All rights reserved. 27