WPS: Autenticando Usuarios - Configurando um LDAP Federado

From Wiki

Vamos configurar a consulta a um diretório LDAP ao repositório federado, para armazenar informações sobre as contas de usuários.

Obs. 1: Verifique que os servidores server1 e WebSphere_Portal estejam executando antes de iniciar está tarefa.

Obs. 2: Veja exemplos em /opt/IBM/WebSphere/wp_profile/ConfigEngine/config/helpers

Passos:

1. Backup dos arquivos de configuração

Vá para o diretório 

/opt/IBM/WebSphere/wp_profile/ConfigEngine/properties

faça um backup dos arquivos wkplc.properties 

cp wkplc.properties wkplc.properties_antesLDAP
cp wkplc_comp.properties wkplc_comp.properties_antesLDAP

2. Definições no arquivo wkplc.properties

Edite o arquivo wkplc.properties e defina o seguinte:

Na seção "VMM Federated LDAP Properties"

# The id specifies a unique identifier for the repository within the cell
# Characters that are not allowed in normal XML strings ( &  <   >  "   '   ) cannot be used in the repository ID.
federated.ldap.id=ldap1EmpresaX

# Specifies the host name of the primary LDAP server. This host name is either an IP address or a domain name service (DNS) name.
federated.ldap.host=ldapserver.empresax.com.br

# Specifies the LDAP server port.
federated.ldap.port=389

# Specifies the distinguished name for the application server to use when binding to the LDAP repository.
federated.ldap.bindDN=cn=wpsbind,o=empresax

# Specifies the password for the application server to use when binding to the LDAP repository.
federated.ldap.bindPassword=ReplaceWithYourPwd

# Specifies the type of LDAP server to which you connect
# This must be one of the following values: SECUREWAY,IDS4,IDS51,IDS52,IDS6,ZOSDS,DOMINO5,DOMINO6,
DOMINO65,DOMINO7,NDS,SUNONE,AD2000,AD2003,ADAM,CUSTOM
federated.ldap.ldapServerType=DOMINO7

# The LDAP base entry.
federated.ldap.baseDN=o=empresax

Na seção "LDAP entity types" - item "Entity type Group"

# Entity type Group 

# The search filter that you want to use to search the entity type.
# VMM uses this filter as an addition during search requests in your environment
# The syntax is like a standard LDAP searchfilter like (objectclass=dominoGroup)
# In general this value can be left blank
federated.ldap.et.group.searchFilter=

# One or more object classes for the entity type.
federated.ldap.et.group.objectClasses=dominoGroup

# The object class to use when an entity type is created. If the value of this parameter is the same as the objectClass parameter, you do not need to specify this parameter.
federated.ldap.et.group.objectClassesForCreate=

# The search base or bases to use while searching the entity type.
federated.ldap.et.group.searchBases=

Na seção "LDAP entity types" - item "Entity type PersonAccount"

# Entity type PersonAccount 

# The search filter that you want to use to search the entity type.
# VMM uses this filter as an addition during search requests in your environment
# The syntax is like a standard LDAP searchfilter like (objectclass=dominoPerson)
# In general this value can be left blank
federated.ldap.et.personaccount.searchFilter=

# One or more object classes for the entity type.
federated.ldap.et.personaccount.objectClasses=dominoPerson

# The object class to use when an entity type is created. If the value of this parameter is the same as the objectClass parameter, you do not need to specify this parameter.
federated.ldap.et.personaccount.objectClassesForCreate=

# The search base or bases to use while searching the entity type.
federated.ldap.et.personaccount.searchBases=

Na seção "Group member attributes"

# The name of the LDAP attribute that is used as the group member attribute. For example, member or uniqueMember.
federated.ldap.gm.groupMemberName=member

# The group object class that contains the member attribute. For example, groupOfNames or groupOfUnqiueNames.
# If you do not define this parameter, the member attribute applies to all group object classes.
federated.ldap.gm.objectClass=dominoGroup

# The scope of the member attribute. The valid values for this parameter include the following:
# direct - The member attribute only contains direct members.
# nested - The member attribute that contains the direct members and the nested members.
federated.ldap.gm.scope=direct

# If you create a group without specifying a member, a dummy member will be filled in to avoid creating an exception about missing a mandatory attribute.
federated.ldap.gm.dummyMember=uid=dummy

Salve e Feche o arquivo.

3. Definições no arquivo wkplc_comp.properties

Edite o arquivo wkplc_comp.properties e defina o seguinte: 

# WcmContentAuthorsGroupId: The group ID for the WCM Administrator group
# DEV (No security):  WcmContentAuthorsGroupId=<contentauthorsgroupid>,o=default organization
# See LDAP examples below:
# IBM Directory Server: { cn=<contentauthorsgroupid>,cn=groups,dc=yourco,dc=com }
# Domino:               { cn=<contentauthorsgroupid>}
# Active Directory:     { cn=<contentauthorsgroupid>,cn=groups,dc=yourco,dc=com }
# Active Directory AM:  { cn=<contentauthorsgroupid>,cn=groups,dc=yourco,dc=com }
# SunOne:               { cn=<contentauthorsgroupid>,ou=groups,o=yourco.com }
# Novell eDirectory     { cn=<contentauthorsgroupid>,ou=groups,o=yourco.com }
WcmContentAuthorsGroupId=cn=wcmContentAuthors

# WcmAdminGroupCN: The WCM admin group ID
WcmContentAuthorsGroupCN=contentAuthors


Salve e Feche o arquivo.

4. Validando a configuração

Vá para o diretório 

/opt/IBM/WebSphere/wp_profile/ConfigEngine

e execute o seguinte comando 

#./ConfigEngine.sh validate-federated-ldap -DWasPassword=<password>

Se no final do processo aparecer 

BUILD SUCCESSFUL
Total time: NN seconds

A configuração ocorreu corretamente


5. Realizando a configuração

Vá para o diretório 

/opt/IBM/WebSphere/wp_profile/ConfigEngine

e execute o seguinte comando 

#./ConfigEngine.sh wp-create-ldap -DWasPassword=<password>

Se no final do processo aparecer 

BUILD SUCCESSFUL
Total time: NN minutes and NN seconds

A configuração ocorreu corretamente

6. Pare e reinicie os servidores

Vá para o diretório 

cd /opt/IBM/WebSphere/AppServer/bin

e execute os seguintes comandos: 

# ./stopServer.sh WebSphere_Portal -user wpsadmin -password was_admin_password

aguarde ... 

# ./stopServer.sh server1 -user wpsadmin  -password was_admin_password

aguarde ... 

# ./startServer.sh server1 -user wpsadmin  -password was_admin_password

aguarde ... 

# ./startServer.sh WebSphere_Portal -user wpsadmin  -password was_admin_password

aguarde ...

(Opcional) 7. Criando entradas adicionais

Perform the following steps to create additional base entries within the LDAP user registry; repeat these steps for each base entry that you want to create for multiple realm support: 

1. Use a text editor to open the wkplc.properties file, located in the wp_profile_root/ConfigEngine/properties directory.
2. Enter a value for the following required parameters in the wkplc.properties file under the VMM repository base entry
configuration heading to create additional base entries within the LDAP user registry to use when creating realms:
         * id
         * baseDN
         * nameInRepository
3. Save your changes to the wkplc.properties file.
4. Run the ./ConfigEngine.sh wp-create-base-entry -DWasPassword=password task, from the wp_profile_root/ConfigEngine directory,
to create a base entry in a repository.
5. Stop and restart the deployment manager, the node agent(s), server1, and the WebSphere_Portal servers.

(Opcional) 8. Listando os Repositórios de Usuários

Vá para o diretório 

/opt/IBM/WebSphere/wp_profile/ConfigEngine

e execute o seguinte comando 

#./ConfigEngine.sh wp-query-repository -DWasPassword=<password>


9. Validando os atributos Repositórios de Usuários

Vá para o diretório 

/opt/IBM/WebSphere/wp_profile/ConfigEngine

e execute o seguinte comando 

#./ConfigEngine.sh wp-validate-federated-ldap-attribute-config -DWasPassword=<password>

10. Atualizando o Registro de usuários

  1. Perform the following steps to update the user registry where new users and groups are stored:
  1. Use a text editor to open the wkplc.properties file, located in the wp_profile_root/ConfigEngine/properties directory.
  2. Enter a value for the following required parameters in the wkplc.properties file under the VMM supported entity types configuration heading:
         * personAccountParent
         * groupParent
         * personAccountRdnProperties
         * groupRdnProperties
  3. Save your changes to the wkplc.properties file.
  4. Run the ./ConfigEngine.sh wp-update-entitytypes -DWasPassword=password task, from the wp_profile_root/ConfigEngine directory, to update the Group and PersonAccount entity types with the corresponding default parent and relative distinguished name (RDN).
  5. Stop and restart the deployment manager, the node agent(s), server1, and the WebSphere_Portal servers.

(Opcional) 11. Habilitando Login através do Full Distinguished Name

Perform the following steps to enable the full distinguished name login if the short names are not unique for the realm: 

1. Use a text editor to open the wkplc.properties file, located in the wp_profile_root/ConfigEngine/properties directory.
2. Enter a value for realmName or leave blank to update the default realm.
3. Save your changes to the wkplc.properties file.
4. Run the ./ConfigEngine.sh wp-modify-realm-enable-dn-login -DWasPassword=password task, located in the 
wp_profile_root/ConfigEngine directory, to enable the distinguished name login.
5. Stop and restart the deployment manager, the node agent(s), server1, and the WebSphere_Portal servers.

(Opcional) 12. Executando o Member Fixer Tool

Run the Member Fixer tool to update the member names used by Web Content Management with the corresponding members in the LDAP directory. This step ensures that access to the Web content libraries for the Intranet and Internet Site Templates for the contentAuthors group is correctly mapped to the appropriate group in the LDAP directory. Note: This step is only needed if you have installed the product with Web Content Management and intend to use the Intranet and Internet Site Templates provided with the product. 

  1. Edit the wp_profile_root/PortalServer/wcm/shared/app/config/wcmservices/MemberFixerModule.properties file.
  2. Update the contentAuthors_new property with the group name you used for the content authors group during LDAP configuration.
  3. Update the administrator_new property with the administrator user name you used for the administrator user during LDAP configuration. Note that the old administrator user value should be uid=xyzadmin,o=defaultWIMFileBasedRealm, which is the default administrator user used when the Intranet and Internet Site Templates are created.
  4. Save your changes and close the file.
  5. Run the ./ConfigEngine.sh action-express-memberfixer -DmemberfixerRealm=realm_name -DPortalAdminPwd=password task, located in the wp_profile_root/ConfigEngine directory.

     Note that realm_name indicates the realm where these users and groups are stored (for example, -DmemberfixerRealm=defaultWIMFileBasedRealm).

13. Executando o Member Fixer Tool

  1. Remove the file system repository if you do not use it. The federated file system user repository that was the default security setting might not be required after federating the user repository. If the file system repository is no longer needed, removing it can help prevent conflicts created by duplicate user identities existing in multiple repositories. Perform the following steps to remove the file system repository:
  1. From the Deployment Manager or WebSphere Application Server administrative console, 
  select Security > Secure administration, applications, and infrastructure.
  2. In the User account repository section, make sure that Federated repositories is set in the Available realm definitions.
  3. Click Configure.
  4. In the list of Repositories in the realm, select the repository with the identifier InternalFileRepository.
  5. Click Remove.
  6. Save your changes.
  7. Synchronize all nodes if you have a clustered environment.


(Opcional) 14. Substituindo o Administrador do Portal LOCAL pelo do LDAP

Perform the following steps to replace the WebSphere Application Server and WebSphere Portal administrator user ID with users that exists in the LDAP user registry: 

  1. Run the ./ConfigEngine.sh wp-change-was-admin-user -DnewAdminId=newadminid –DnewAdminPw=newpassword task, from the wp_profile_root/ConfigEngine directory, to replace the old WebSphere Application Server administrative user with the new user.
     Note: This task verifies the user against a running server instance. If the server is stopped, add the -Dskip.ldap.validation=true parameter to the task to skip the validation.
  2. Verify that the task completed successfully. In a clustered environment, restart the deployment manager, the node agent(s), server1, and WebSphere_Portal servers. In a stand-alone environment, restart the server1 and WebSphere_Portal servers.
  3. Run the ./ConfigEngine.sh wp-change-portal-admin-user -DnewAdminId=newadminid –DnewAdminPw=newpassword -DnewAdminGroupId=newadmingroup task to replace the old WebSphere Portal administrative user with the new user.
     Note: This task verifies the user against a running LDAP server instance when LDAP security is enabled. If the LDAP server is stopped, add the -Dskip.ldap.validation=true parameter to the task to skip the validation.
  4. Verify that the task completed successfully. In a clustered environment, restart the deployment manager, the node agent(s), server1, and WebSphere_Portal servers. In a stand-alone environment, restart the server1 and WebSphere_Portal servers.
Retrieved from "https://ebasso.net/wiki/index.php?title=WPS:_Autenticando_Usuarios_-_Configurando_um_LDAP_Federado&oldid=618"