« A Good Morning for... | Main | Configuring Self... »
Wednesday Sep 23, 2009

A Look at Enabling Automatic OpenSSO Provisioning After Identity Manager Self-registration

Here's a look at the procedures to enable auto provisioning of OpenSSO Enterprise 8.0 with a user account created on-the-fly by a user accessing Identity Manager 8.1.0.5 (to be released sometime in October) for the first time. (They are being integrated into the OpenSSO Integration Guide as I type.) The configurations will allow an end user to create a personal account on Identity Manager and, following creation, this account data will be provisioned to OpenSSO automatically. The user account created would be the most basic account with the minimum privileges available.

In the Identity Manager WAR, /idm is the base context of the deployment. The architecture of this use case assumes there is a policy agent protecting Identity Manager.

Configuring OpenSSO

To configure OpenSSO, you will define Identity Manager URIs as not enforced for the policy agent. You will also need to modify the OpenSSO login page so that it will display a Register User button.

To Define Identity Manager URLs as Not Enforced

  1. Login to the OpenSSO console as administrator.
  2. Click the Access Control tab.
  3. Click the appropriate realm name and navigate to the Agents profile for the policy agent that protects Identity Manager.
  4. Under the agent profile, click the Application tab.
  5. Add the following URIs to the Not Enforced URIs property.
    • /idm/authutil/
    • /idm/authutil/*
    • /idm/authutil/*?*
  6. Click Save.
  7. Logout of OpenSSO.

Modifying the OpenSSO Login Page

There are two options to consider when deciding how to display a Register User button on the OpenSSO login page. You can manually change the deployed Login.jsp file, or you can use the sample Login.jsp included with the opensso.zip download. They are mutually-exclusive so choose only one of these procedures.
To Manually Modify a Deployed Login.jsp
  1. Change to the /web-container-deploy-base/opensso/config/auth/default/ directory to access the deployed Login.jsp page.
  2. Open Login.jsp in an editor and add the five (5) sections of code displayed in yellow in self_registration_login.html on the OpenSSO web site.
  3. Remove the web containers temporary, compiled JSP to ensure that the changes made are picked up.
    For example, if using Glassfish, the temporary, compiled classes can be found under glassfish-home/domains/your-domain/generated/.
  4. Restart the OpenSSO web container after making the changes.
To Use the Sample Login.jsp

  1. Change to the opensso/integrations/idm/jsps/ directory in the decompressed opensso.zip to access the sample Login.jsp.
  2. Change the Identity Manager URL embedded in the sample Login.jsp to reflect the Identity Manager system URL of your architecture.
    You can search for the string /idm to locate the URLs.
  3. Replace your deployed /web-container-deploy-base/opensso/config/auth/default/Login.jsp with the sample Login.jsp.
    If you replace your existing Login.jsp with the sample Login.jsp the following will occur.
    • You will lose any custom changes made to the existing Login.jsp.
    • You will inherit changes that might have been previously made to the sample Login.jsp to incorporate requirements for other use cases related to the OpenSSO integration with Identity Manager.
  4. Remove the web containers temporary, compiled JSP to ensure that the changes made are picked up.
    For example, if using Glassfish, the temporary, compiled classes can be found under glassfish-home/domains/your-domain/generated/.
  5. Restart the OpenSSO web container after making the changes.
Optionally, you can run diff between both files and make the necessary changes manually.

Configuring Identity Manager

To configure Identity Manager, you will change the registration work flow. There are two options to consider when deciding how to change the registration work flow. You can use the Identity Manager plug-in for NetBeans IDE or, use the Identity Manager Debug Pages. They are mutually-exclusive so choose only one of these procedures.

To Change the Registration Work Flow Using Netbeans IDE

This procedure assumes that you have downloaded and installed NetBeans IDE and downloaded and installed the Identity Manager Plug-in for NetBeans.
  1. Create (or open) an Identity Manager Project in NetBeans.
    There are two types of projects: integrated and remote. This procedure applies in either case. Use the online help available in NetBeans to create the Identity Manager project if necessary. The Identity Manager IDE website also has some pointers.
  2. From the NetBeans Project Window, right-click on the Custom Identity Manager Objects Node and select IDM > Open Object.
  3. In the Open Object dialog box, enter the object name End User Anonymous Enrollment and select OK.
  4. Right-click on the file in the Project Window and select IDM > Clone Object(s) to clone the object for safe keeping.
  5. Name the new object End User Anonymous Enrollment Orig.
  6. Click on the tab in the Editor window containing the file End User Anonymous Enrollment work flow.
    This will put the file in focus.
  7. Expand the tree in the Navigator Window to locate the Activity Assimilate User View.
  8. Add the OpenSSO resource to the map of options for the "assimilate" invocation.
    Refer to self_registration_idm_anon_enroll.html on OpenSSO for the changes to be made to the object. The name of the OpenSSO resource (OpenSSO in self_registration_idm_anon_enroll.html) is the name assigned when the resource was created. To verify the name, navigate to the "Resources | List Resources" tab in the Identity Manager administration console and expand the "Sun Access Manager Realm" branch.
  9. Save the changes.
  10. Right-click on the file and select IDM > Upload Object(s) to upload the file.

To Use the Identity Manager Debug Pages

  1. Login to the Identity Manager console as administrator.
  2. Go to the debug URL at protocol://IDM-host-machine:port/idm/debug.
  3. Select the object "Task Definition" in the list next to the "List Objects" button.
  4. Click on the "List Objects" button.
  5. Search for the object "End User Anonymous Enrollment" and click on its "edit" hyperlink.
    You might first export the existing definition and save it.
  6. Add the OpenSSO resource to the Activity "Assimilate User View".
    Refer to self_registration_idm_anon_enroll.html on OpenSSO for the changes to be made to the object. The name of the OpenSSO resource (OpenSSO in self_registration_idm_anon_enroll.html) is the name assigned when the resource was created. To verify the name, navigate to the "Resources | List Resources" tab in the Identity Manager administration console and expand the "Sun Access Manager Realm" branch.
  7. Logout of the console.

Testing The Configurations

Perform the tests in the order in which they are described to understand and verify the behavior for each stage of this use case.

A. User Self-Registration

  1. Go to the OpenSSO login URL at protocol://OSSO-host-machine:port/opensso/UI/Login.
  2. Click the "Register User" button to register a test user.
  3. Go through the registration process and click the "Register" button.
    A message is displayed signifying that the registration request is being processed.

B. Approval Of New User Account

  1. Login to the Identity Manager console as an administrator.
    The "Create User" pending task is displayed as "Create User ".
  2. Navigate to the "Work Items | Approvals" tab.
  3. Select the provisioning task for the new user-id and click the "Approve" button.
  4. Confirm the approval.
  5. Logout of the Identity Manager console.

C. Verify Provisioning Of New User Account

  1. Login to the OpenSSO console as administrator.
  2. Navigate to the "Access Control | realm | Subjects" tab.
    The approved user is displayed indicating that the profile was successfully registered and provisioned.

D. Verify Activation Of New User Account

  1. Go to the OpenSSO login URL at protocol://OSSO-host-machine:port/opensso/UI/Login and login as the new user.
    A successful login indicates that the new user is active.
  2. Logout of OpenSSO.
Now on to another look, Just One Look from Linda Ronstadt.

Posted at 09:06AM Sep 23, 2009 by Michael Teger in Sun  |  Comments[0]

Comments:

Post a Comment:
  • HTML Syntax: NOT allowed