OpenSSO Monitoring Euro User Groups Winter 2010 Victor Ake Identity Architect ForgeRock.com
Agenda What is new in OpenSSO Express 9 Monitoring OpenSSO Express 9
What is new in OpenSSO Expresss 9 Web container additions and changes Beta Administration Web Console Fedlet new features Monitoring OpenSSO New WSS features New Data Stores The Entitlement Services New Authentication features Additional goodies
Web container additions and changes Express 9 addition Session fail-over on the IBM AIX platform Already from the Express 7 & 8 JBoss AS 5.1 Glassfish Enterprise Server 2.1 IBM WAS 7.0 Oracle Web Logic Server 10g R 3 Glassfish prelude 3 Deprecated WebLogic Server 9.2 MP2 IBM WAS 6.1
Alternate Administration Console Entitlement Services New work flows New Federation New WSS tasks WebEx SSO
Fedlet new features SAML2 Assertion Query/Request Profile ASP.NET Version of the Fedlet The Fedlet now supports SAML2 Single Log-Out The Fedlet, Best Innovation Award winner at the European Identity Conference Authentication Request can be signed XACML query profile Fedlet: A small application that allows the integration to a SAML2 CoT Without using the entire OpenSSO
More enhancements on OpenSSO Express 9 Express 9 OpenDS-2.2 as Data Store Microsoft AD 2008 as Datastore OpenSSO Express 9 Express 8 MySQL as Data Store (Beta) Entitlment Services as a new Authorization and Policy component for Express 8 HMAC Based One-Time Password Authentication Resource Authentication
More enhancements in OpenSSO Express 9 More on Entitlment Enforcement Monitoring using HTTP now supports user/password Multi-protocol Federation Flow (UI Improvements) Virtual Federation Flow (UI Improvments) Success in Open Source requires you to serve: 1. Those who spend time to save money 2. Those who spend money to save time Marten Mickos CEO, MySQL May 2007 OAuth Reverse Proxy with Password Replay (like ESSO)
Agenda What is new in OpenSSO Express 9? Monitoring OpenSSO Express 9
OpenSSO Monitoring OpenSSO Server A OpenDS A A Application container (e.g. GlassFish) Monitoring Tool User Store A OpenSSO Agent A A A A OpenSSO Monitoring Agent Other Monitoring Agent (Not OpenSSO) Coming soon A Application container
The OpenSSO monitoring service Uses the Java Dynamic Management kit (JDMK) Collects Configuration Data and Statistics Maintains the information in MBeans MBeans are available to Network Management tools Access to the OpenSSO monitoring data through: HTTP: A web browser RMI: Through Jconsole SNMP: Any SNMP network manager
How to configure OpenSSO monitoring Log in to the OpenSSO console as amadmin Go to Configuration>System and you will see the Monitoring service
The OpenSSO monitoring service Define the ports where the service will be listening for each protocol: HTTP, RMI or SNMP Express 9 HTTP interface supports authentication
What data is monitored Configuration data: ServerID Server Port SiteID Server Protocol Hostname Server URL Deployment configuration data List of realms List of sites Servers in the site List of policy and security agents and agent groups Logging service
What data is monitored Federation Configuration data: SAML1.x trusted partners list SAMLv2 Circle of Trust list SAMLv2 Circle of Trust members lists WS-Federation entities Liberty ID-FF entities
What data is monitored OpenSSO Service Statistics Authentication service Identity Repository Service Logging Service SAMLv2 Service Policy Service Session Service SAML1.x artifact and assertion cache Liberty ID-FF
How to use the JMX interface Star ting the JMX monitoring application locally Example start the Jconsole in the same server where OpenSSO is installed Star ting the JMX monitoring application remotely Example: Start Jconsole in a different server than the one where the OpenSSO is installed
The JMX through Jconsole Star ting the Jconsole remotely bash-3.00# /opt/sunwappserver/bin/asadmin start-domain Starting Domain domain1, please wait.... [/web1 / wstx-services opensso ]. Standard JMX Clients (like JConsole) can connect to JMXServiceURL: [service:jmx:rmi:///jndi/rmi://sol10u5-idp-3.akefranco.com:8686/jmxrmi] for domain management purposes. Domain listens on at least following ports for connections: [80 443 4848 3700 3820 3920 8686 ]. Domain does not support application server clusters and other standalone instances. This is an example when OpenSSO has been installed in Glassfish. When starting the Application Server GF has the JMX service available
Jconsole to access the jmx:rmi remotely Start the jconsole: Example: $ /usr/jdk/jdk1.6.0_16/bin/jconsole Specify the Remote process you want to connect to. This is the URL from GF. Username is glassfish administrator
Jconsole
SNMP access OpenSSO MIB Located under the source distribution: /opensso/products/amserver/resources/mib Any SNMP monitoring tool can be used to pull the OIDs Example: $ snmpget -v 2c -c public 10.0.2.54:8085 -m SUN-OPENSSO-SERVER-MIB 1.3.6.1.4.1.42.2.230.3.1.1.2.1.10.1.0 SUN-OPENSSO-SERVER-MIB::ssoServerAuthSuccessCount.0 = Counter64: 11
Monitoring OpenSSO Express 8 Demo
Q&A
OpenSSO Monitoring Euro User Groups Winter 2010 Victor Ake Identity Architect ForgeRock.com