OpenAM. 1 open source 1 community experience distilled. Single Sign-On (SSO) tool for securing your web. applications in a fast and easy way

OpenAM

Written and

tested with

_{OpenAM Snapshot}

9—the

Single Sign-On (SSO)

tool for

_securing

_your

web

applications

in

a

fast

and easy way

Indira

_Thangasamy

[

PUBLISHING BIRMINGHAM- MUMBAI

1

_open

source

Table of

Contents

Preface

1

Chapter

1:

Getting

Started

7

History

of

_OpenSSO

9

OpenSSO

vs.

OpenAM

10

OpenSSO—an

overview

11

OpenSSO

services 11

Federation services 12 Web Services

Security

and Secure Token Service 13

OpenSSO

Entitlements Service 15

What kind of

_problems

does

_OpenSSO

solve? 16

Access_management 16

Federation 16

Securingweb services 17

Entitlements 18

Summary

19

Chapter

2:

_{OpenSSO Deployment}

and

Configuration

21

Deployment

requirements

for

OpenSSO

web

_application

22

Containers and

_{operating systems support}

22

Java SDK

_support

23

Disk and memory

requirements

23

Browser

_requirements

24

Configuration

storeversus

_Identity

Store 24

Configuration

store 24

Embedded

_{configuration}

store 25 External Sun

_Directory

ServerEnterpriseEditionconfigurationstore 26

Identity

store 27

Howto obtain

_OpenSSO

28

Building OpenSSO

from source 28

Table

_of

Contents

Configuring

OpenSSO

31

Installing

and

_{configuring Apache}

Tomcat

6.0.20 31

OpenSSO

one click

configuration

34

Verifying

OpenSSO

configuration

37

What

_just

_happened?

₃₈

OpenSSO-configuration

choices 39

Single

server

_{configuration-using}

embedded

_{configuration}

store 40

Layout

of the

_{configuration directory}

46

Single

server

_{configuration-using}

external

_{configuration}

store

47

Multi-server

_{configuration-embedded}

_{configuration}

store

50

Prerequisites

for multi-server

_{configuration}

51

Adding

OpenSSOtoanexisting

deployment

52

Verificationofmulti-serverdeployment 55

Configuring using

command line

_configurator

56

Configuring OpenSSO

with SSL/TLS 58

Configuring

command line tools 58

Uninstalling

OpenSSO

61

OpenSSO

release and

_{support model}

₆₁

Summary

62

Chapter

3:

_{Administrating OpenSSO}

₆₃

Administration

interfaces

64

Accessing

the administrative console 65

Console views

and

_privileges

66

Console

_landing

page-common

tasks

69

Access

control tab 70

General 71 Authentication 71 Service ₇₂ Datastores ₇₃ Privileges 74 Policies ₇₇

Subjects

79 Agents 81

Configuration

83

Retrieving

all theserver

properties

₈₄

Updating server_{configuration properties} 84

Removing

propertiesfromserver

configuration

85

Sessions

tab

85

Managing

sessions usingssoadm 86

Customizing

the console

86

Extending

LDAP

schema 87

Customizing

OpenSSO

User Service 88

Table

_of

Contents

Removing

User Service schema 89

Adding

the

_updated

User Service schema 90

Adding

the labels 90

Addingthe custom attributesto data store

_{configurations}

91

Updating privileges

92

Testing

the

_changes

93

Summary

94

Chapter

4: Authentication and Session

Service

95

Authentication process

96

Cookies

in

_OpenSSO

97

Authentication

_types

and

URL

_parameters

98

Module 99 Level 100 Service 100 User 101 Role 101 Realm 101 Resource 102

Other authentication URL

_parameters

103

I DToken _parameter 103

goto

and

_{gotoOnFail parameters}

103

localeparameter 104

arg parameter 105

iPSPCookieparameter 106 ForceAuth

_parameter

106 PersistAMCookie parameter 107

Authentication

modules, instances,

and chains 107

LDAP authentication

108

Creating

anauthentication instance 108

Updatinganauthentication instance 109

Reading

anauthentication instance 109

Using

an authentication instance 110

Deletinganauthentication instance 110

Authentication chains

111

Creating

anauthentication chain 112

Updating

anauthentication chain 112

Reading

anauthentication chain 113

Using an authentication chain 113

Performing

auser-based authentication 113

Deleting

anauthentication chain 114

Authentication modules

114

LDAP 115 Active

_Directory

115

Data

store 115

Anonymous

116 Certificate

_(X.509)

116

Configuring

Tomcat in

SSL

_using

CA

_signed

_certificate

₁₁₇ HTTP basic

authentication

₁₂₀

Membership

120 JDBC ₁₂₀

HOTP

₁₂₁

SecurlD

₁₂₂

SafeWord

₁₂₂

RADIUS

₁₂₂

Unix

₁₂₃

Windows NT

₁₂₃

Windows

_Desktop

SSO

₁₂₄

Core ₁₂₄

User

_{profile requirement}

₁₂₄

Setting userprofileattributes inan SSO token 126

Adding

custom authentication modules ₁₂₈

Session Service

₁₂₉

Session Service

schema

₁₃₀

Updating

Session Service ₁₃₀

Session life

_cycle

₁₃₁

Session

_structuring

₁₃₁ Session state transition ₁₃₂ Session_{properties 133} Session

_change

notification and

_polling

₁₃₄ Session_persistenceandconstraints 135

Summary

136

Chapter

5: Password Reset and Account

_Management

137

Account lockout

138

Configuring

account lockout 138

Physical

lockout

140

In-memory

lockout

141

Applying

a

_password

reset 142

Prerequisites

142

Configuring

the

_password

reset service in

_OpenSSO

143

Assigning

service and

_update

service attributes 143

Creating and

_{assigning OpenDS password policy}

₁₄₉

Summary

153

Chapter

6:

_Protecting

a

Simple

Web

Application

to Provide SSO

155

OpenSSO

Policy

Framework

156

Protecting

a

_sample

_application

on Tomcat 158

Creating

the_agent

_profile

159

Table

of

Contents

Deploying

and _configuringtheJava

application

160

Creating policies

and associated identities 161

Testing

the SSO 164

Fetching userprofileattributes 167

Summary

168

Chapter

7:

Integrating

Salesforce and

Google

Apps

169

Integrating

OpenSSO

with Salesforce

_applications

170

Configuring

hosted

identity provider

and circle

of trust

171

Configuring OpenSSO

metadata

for Salesforce.com

172

Configuring

users for

Salesforce.com

174

Verifying

the SSO 176

Integrating

with

_Google

_Apps

177

Configuring

the

hosted

identity provider

178

Configuring

SSO

_parameters

at

Google Apps

179

Configuring

usersfor

_{Google Apps}

180

Verifying

SSO

181

Summary

183

Chapter

8:

_Identity

Stores

185

Identity

store

_types

186

Caching

and notification 188

Persistent search-based notification

189

Time-to-live based notification

191

TTL-specific

properties

for

_Identity

_Repository

cache

191

Supported identity

stores

192

User

schema 192

Access

_{Manager Repository plugin}

193

Creating

anAccess

Manager Repository

plugindata store 194

Displaying

the data store properties 195

Updating

data store

_properties

196

Deleting

data stores 196

Removingthe AccessManager Repository plugin 196

Oracle

_Directory

Server

_Enterprise

Edition

197

Creatingadata store for Oracle DSEE 197

Updating

the datastore 198

Deleting

the datastore 198

Data store for

_OpenDS

198

Data store for Tivoli DS

199

Data store for Active

Directory

199

Datastorefor

Active

_Directory

Application

Mode 199

Datastore

for

_OpenLDAP

200

Table_ofContents

Extending

the

schema

201

Preparing

the suffix with

necessary entries

202

Creating

an

_OpenLDAP

data

store

203

Testing

the data store

203

Multiple

data

stores

204

Summary

205

Chapter

9:

RESTful

Identity

Services

207

Prerequisites

208

Invoking

REST

interfaces

210

Authentication

210

Authenticating

with URL

_parameters

211

Validating

an

SSO

token

212

Invalidating

session

_(logout)

213

Creating

log

events

213

Authorization

214

Identity

CRUD

_operations

215

Searching

identities 215

Searchingforuseridentities 216

Searching

groups 216

Searching

for

_agents

216

Retrieving identity

attributes

217

Creating agent

identities 218

Creating

user identities

219

Creating

group identities

219

Updating

identities

220

Deleting

identities

221

Deleting

useridentities 221

Deleting

group identities 221

Deleting the_agentidentities 221

Other REST interfaces 222

Summary

222

Chapter

10:

_{Backup, Recovery,}

and

_Logging

223

Backing

up

_{configuration}

data 224

Backing

up the

OpenSSO

configuration

files

225

Backing

up

the

OpenSSO

configuration

data

226

Crash

_recovery

and restore

227

Test to

_production

228

Performing

the

_{configuration}

_change

229

Configuring

theexporttestserver 229

Configuring OpenSSO

ontheproduction server 230

Adapting

thetest

_{configuration}

data 231

Table ofContents

OpenSSO

audit and

_logging

232

Enabling debug

(trace) level

_logging

233

Audit

_logging

234 File-based

_logging

236

Database

_logging

237 Remote

_logging

240 Secure

_logging

240

Summary

243

Chapter

11:

_{Troubleshooting}

and

_Diagnostics

245

OpenSSO diagnostic

tools

245

Installing

and

_configuring

the

tool

246

Invoking

the tool 246

Troubleshooting

248

Installation and

_{configuration}

249

Scenario 1 249

Scenario 2 250

Scenario 3 250

Scenario4 251

Authentication and session

areas 252

Scenario 1 252

Scenario2 252

Scenario 3 252

Scenario 4 253

Identity repository

and

_password

reset 253

Scenario 1 253

Scenario 2 254

Scenario 3 254

Scenario4 255

Scenario 5 255

Policy

and

_agents

255

Scenario 1 255

Scenario 2 256

Scenario 3 257

Command line tools 257

Scenario 1 257

Scenario 2 258

Summary

259

Index

261