DocTeger

OpenSSO Technical Information

And a Spoonful of Music

To Make the Medicine Go Down

Give Him OpenSSO Resource-based Authentication

Policy agents deployed to web containers and web proxy servers protect content from unauthorized intrusions. Access to this content (services, for example) are controlled through policies configured with OpenSSO. Here is a description of the interactions that occur when a policy agent interacts with OpenSSO.

1. A policy agent intercepts the user's request and validates any authentication credentials contained within it. If the existing authentication level is insufficient, the OpenSSO Authentication Service will present a login page for an authentication upgrade. The login page prompts the user for the credentials appropriate to the configured module.
2. The Authentication Service verifies that the user credentials are valid. For example, the LDAP authentication module verifies that the user name and password are the same as those stored in the LDAP identity data store. If other authentication modules are passed to the user (such as RADIUS or Certificate), the credentials are verified with the appropriately configured identity data store.
3. Assuming the user's credentials are properly authenticated, the policy agent examines the policies assigned to the user.
4. Based on the aggregate of the user's configured policies, the individual is either allowed or denied access to the resource.

NOTE: In this scenario, if the user attempts access to a web resource without authentication credentials, the agent redirects the user to the login page of the default authentication module. (Even if the resource is protected by a different authentication module, the user must first authenticate using the default authentication module.)

Because some customers require a scenario in which the user authenticates against a particular module based on the resource being accessed, the Gateway servlet provides resource-based authentication; there is no need for the user to authenticate to the default authentication module to access the protected web resource. When using the Gateway servlet:

• A web resource can not be defined in more than one policy. For example, if abc.html is defined in a policy definition as requiring LDAP authentication, abc.html can not be defined in a second policy definition as requiring Certificate authentication.
• You can use the level and scheme conditions only when defining policies that the servlet will examine.

Additionally, the Gateway servlet does not work across internet domains. Use the following list to configure your deployment to use the Gateway Servlet.

1. Configuring the Web Container
2. Configuring OpenSSO
3. Configuring the Policy Agent
4. Testing the Servlet

Configuring the Web Container

Generically speaking, you must ensure the following configurations on your web container. Check your container's documentation for information on how to do them.

1. Check that the following certificates are installed:
   • A certificate for the server (Server-Cert).
   • A certificate for the trusted Certificate Authority.
2. Add a listen socket for simple Secure Sockets Layer (SSL) and one for SSL client authentication.
3. Ensure that the listener port configuration requires SSL for client authentication.

Configuring OpenSSO

1. Log in to the OpenSSO console as the administrator.
2. Click the Configuration tab and the Authentication tab under it.
3. Click the Certificate Service Name link.
4. Enable Match Certificate in LDAP by checking the box.
5. Select Subject UID as the value for Certificate Field Used to Access User Profile.
6. Enter 54430 as a value for SSL Port Number.
   This port number must match the port number used for the web container's SSL client authentication listener port in the previous procedure.
7. Type 2 as the value for the Authentication Level attribute.
   The value used must be greater that the level defined for LDAP authentication.
8. Click Save.
9. Click Back to Service Configuration.
10. Under the appropriate realm, add policies for three URL resources:
    1. policy1 has a condition of LDAP authentication only for http://agent-machine.domain/banner.html.
    2. policy2 has a condition of Cert authentication only for http://agent-machine.domain/banner2.html.
    3. policy3 has a condition of LDAP authentication and a level of Certificate authentication for http://agent-machine.domain/banner3.html.

See the OpenSSO Enterprise 8.0 Administration Guide for the official documentation on configuring OpenSSO Enterprise 8.0 for resource-based authentication.

Configuring the Policy Agent

1. Go to the installation directory for the agent protecting the resource on the web container host machine. For example, on Application Server, change to AppSvr-Directory/agents/j2ee_agents/appserver_v9_agent/Agent_001/config/.
2. Change the value for com.sun.am.policy.am.loginURL from http://machine-name.domain:port/opensso/UI/Login to http://machine-name.domain:port/opensso/gateway in OpenSSOAgentBootstrap.properties. It is the only change to the policy agent configuration.

Testing the Servlet

After these configurations, the test results are:

• Access to resource A is permitted only after successful LDAP authentication.
• Access to resource B is permitted only after successful Certificate-based authentication.
• Access to resource C is permitted only after both successful LDAP and Certificate-based authentication.

Now that you've configured and tested resource-based authentication, the Shangri-Las are gonna give you a great big kiss with Give Him a Great Big Kiss. I was reminded of this song when it was used in a movie I saw this weekend called Stonewall, an account of the Stonewall riots of 1969. Worth checking out!

Posted at 08:53AM Jan 12, 2009 by Michael Teger in Sun  |  Comments[4]