WPS: Autenticando Usuarios - Configurando um LDAP Federado
Vamos configurar a consulta a um diretório LDAP ao repositório federado, para armazenar informações sobre as contas de usuários.
Obs. 1: Verifique que os servidores server1 e WebSphere_Portal estejam executando antes de iniciar está tarefa.
Obs. 2: Veja exemplos em /opt/IBM/WebSphere/wp_profile/ConfigEngine/config/helpers
Passos:
1. Backup dos arquivos de configuração
Vá para o diretório
/opt/IBM/WebSphere/wp_profile/ConfigEngine/properties
faça um backup dos arquivos wkplc.properties
cp wkplc.properties wkplc.properties_antesLDAP cp wkplc_comp.properties wkplc_comp.properties_antesLDAP
2. Definições no arquivo wkplc.properties
Edite o arquivo wkplc.properties e defina o seguinte:
Na seção "VMM Federated LDAP Properties"
# The id specifies a unique identifier for the repository within the cell # Characters that are not allowed in normal XML strings ( & < > " ' ) cannot be used in the repository ID. federated.ldap.id=ldap1EmpresaX # Specifies the host name of the primary LDAP server. This host name is either an IP address or a domain name service (DNS) name. federated.ldap.host=ldapserver.empresax.com.br # Specifies the LDAP server port. federated.ldap.port=389 # Specifies the distinguished name for the application server to use when binding to the LDAP repository. federated.ldap.bindDN=cn=wpsbind,o=empresax # Specifies the password for the application server to use when binding to the LDAP repository. federated.ldap.bindPassword=ReplaceWithYourPwd # Specifies the type of LDAP server to which you connect # This must be one of the following values: SECUREWAY,IDS4,IDS51,IDS52,IDS6,ZOSDS,DOMINO5,DOMINO6, DOMINO65,DOMINO7,NDS,SUNONE,AD2000,AD2003,ADAM,CUSTOM federated.ldap.ldapServerType=DOMINO7 # The LDAP base entry. federated.ldap.baseDN=o=empresax
Na seção "LDAP entity types" - item "Entity type Group"
# Entity type Group # The search filter that you want to use to search the entity type. # VMM uses this filter as an addition during search requests in your environment # The syntax is like a standard LDAP searchfilter like (objectclass=dominoGroup) # In general this value can be left blank federated.ldap.et.group.searchFilter= # One or more object classes for the entity type. federated.ldap.et.group.objectClasses=dominoGroup # The object class to use when an entity type is created. If the value of this parameter is the same as the objectClass parameter, you do not need to specify this parameter. federated.ldap.et.group.objectClassesForCreate= # The search base or bases to use while searching the entity type. federated.ldap.et.group.searchBases=
Na seção "LDAP entity types" - item "Entity type PersonAccount"
# Entity type PersonAccount # The search filter that you want to use to search the entity type. # VMM uses this filter as an addition during search requests in your environment # The syntax is like a standard LDAP searchfilter like (objectclass=dominoPerson) # In general this value can be left blank federated.ldap.et.personaccount.searchFilter= # One or more object classes for the entity type. federated.ldap.et.personaccount.objectClasses=dominoPerson # The object class to use when an entity type is created. If the value of this parameter is the same as the objectClass parameter, you do not need to specify this parameter. federated.ldap.et.personaccount.objectClassesForCreate= # The search base or bases to use while searching the entity type. federated.ldap.et.personaccount.searchBases=
Na seção "Group member attributes"
# The name of the LDAP attribute that is used as the group member attribute. For example, member or uniqueMember. federated.ldap.gm.groupMemberName=member # The group object class that contains the member attribute. For example, groupOfNames or groupOfUnqiueNames. # If you do not define this parameter, the member attribute applies to all group object classes. federated.ldap.gm.objectClass=dominoGroup # The scope of the member attribute. The valid values for this parameter include the following: # direct - The member attribute only contains direct members. # nested - The member attribute that contains the direct members and the nested members. federated.ldap.gm.scope=direct # If you create a group without specifying a member, a dummy member will be filled in to avoid creating an exception about missing a mandatory attribute. federated.ldap.gm.dummyMember=uid=dummy
Salve e Feche o arquivo.
3. Definições no arquivo wkplc_comp.properties
Edite o arquivo wkplc_comp.properties e defina o seguinte:
# WcmContentAuthorsGroupId: The group ID for the WCM Administrator group
# DEV (No security): WcmContentAuthorsGroupId=<contentauthorsgroupid>,o=default organization
# See LDAP examples below:
# IBM Directory Server: { cn=<contentauthorsgroupid>,cn=groups,dc=yourco,dc=com }
# Domino: { cn=<contentauthorsgroupid>}
# Active Directory: { cn=<contentauthorsgroupid>,cn=groups,dc=yourco,dc=com }
# Active Directory AM: { cn=<contentauthorsgroupid>,cn=groups,dc=yourco,dc=com }
# SunOne: { cn=<contentauthorsgroupid>,ou=groups,o=yourco.com }
# Novell eDirectory { cn=<contentauthorsgroupid>,ou=groups,o=yourco.com }
WcmContentAuthorsGroupId=cn=wcmContentAuthors
# WcmAdminGroupCN: The WCM admin group ID
WcmContentAuthorsGroupCN=contentAuthors
Salve e Feche o arquivo.
4. Validando a configuração
Vá para o diretório
/opt/IBM/WebSphere/wp_profile/ConfigEngine
e execute o seguinte comando
#./ConfigEngine.sh validate-federated-ldap -DWasPassword=<password>
Se no final do processo aparecer
BUILD SUCCESSFUL Total time: NN seconds
A configuração ocorreu corretamente
5. Realizando a configuração
Vá para o diretório
/opt/IBM/WebSphere/wp_profile/ConfigEngine
e execute o seguinte comando
#./ConfigEngine.sh wp-create-ldap -DWasPassword=<password>
Se no final do processo aparecer
BUILD SUCCESSFUL Total time: NN minutes and NN seconds
A configuração ocorreu corretamente
6. Pare e reinicie os servidores
Vá para o diretório
cd /opt/IBM/WebSphere/AppServer/bin
e execute os seguintes comandos:
# ./stopServer.sh WebSphere_Portal -user wpsadmin -password was_admin_password
aguarde ...
# ./stopServer.sh server1 -user wpsadmin -password was_admin_password
aguarde ...
# ./startServer.sh server1 -user wpsadmin -password was_admin_password
aguarde ...
# ./startServer.sh WebSphere_Portal -user wpsadmin -password was_admin_password
aguarde ...
(Opcional) 7. Criando entradas adicionais
Perform the following steps to create additional base entries within the LDAP user registry; repeat these steps for each base entry that you want to create for multiple realm support:
1. Use a text editor to open the wkplc.properties file, located in the wp_profile_root/ConfigEngine/properties directory.
2. Enter a value for the following required parameters in the wkplc.properties file under the VMM repository base entry
configuration heading to create additional base entries within the LDAP user registry to use when creating realms:
* id
* baseDN
* nameInRepository
3. Save your changes to the wkplc.properties file.
4. Run the ./ConfigEngine.sh wp-create-base-entry -DWasPassword=password task, from the wp_profile_root/ConfigEngine directory,
to create a base entry in a repository.
5. Stop and restart the deployment manager, the node agent(s), server1, and the WebSphere_Portal servers.
(Opcional) 8. Listando os Repositórios de Usuários
Vá para o diretório
/opt/IBM/WebSphere/wp_profile/ConfigEngine
e execute o seguinte comando
#./ConfigEngine.sh wp-query-repository -DWasPassword=<password>
9. Validando os atributos Repositórios de Usuários
Vá para o diretório
/opt/IBM/WebSphere/wp_profile/ConfigEngine
e execute o seguinte comando
#./ConfigEngine.sh wp-validate-federated-ldap-attribute-config -DWasPassword=<password>
10. Atualizando o Registro de usuários
- Perform the following steps to update the user registry where new users and groups are stored:
Vá para o diretório
cd /opt/IBM/WebSphere/wp_profile/ConfigEngine/properties
Edite o arquivo wkplc.properties e na seção "VMM supported entity types" entre com o seguintes valores:
###############################################################################
## wp-update-entitytypes - updates the defaultParent of the entity types Group and PersonAccount
## and adds the RDN attributes
###############################################################################
# The default parents of the entity types PersonAccount and Group
personAccountParent=o=empresax
groupParent=
# The RDN attribute names for the entity types PersonAccount and Group
# To reset all the values of the rdnProperties parameter, specify a blank string ("").
personAccountRdnProperties=cn
groupRdnProperties=cn
Salve e feche o arquivo e vá para o diretório
cd /opt/IBM/WebSphere/wp_profile/ConfigEngine/
e execute o seguinte comando
#./ConfigEngine.sh wp-update-entitytypes -DWasPassword=password
Reinicie os servidores server1 e WebSphere_Portal.
(Opcional) 11. Habilitando Login através do Full Distinguished Name
Perform the following steps to enable the full distinguished name login if the short names are not unique for the realm:
1. Use a text editor to open the wkplc.properties file, located in the wp_profile_root/ConfigEngine/properties directory. 2. Enter a value for realmName or leave blank to update the default realm. 3. Save your changes to the wkplc.properties file. 4. Run the ./ConfigEngine.sh wp-modify-realm-enable-dn-login -DWasPassword=password task, located in the wp_profile_root/ConfigEngine directory, to enable the distinguished name login. 5. Stop and restart the deployment manager, the node agent(s), server1, and the WebSphere_Portal servers.
(Opcional) 12. Executando o Member Fixer Tool
Obs.: Este passo é somente necessário se você estiver utilizando o WCM e quiser utilizar os Templates de Intranet e Internet.
Execute o Member Fixer tool para atualizar o nome dos membros usados pelo WCM, passos:
Vá para o diretório
cd /opt/IBM/WebSphere/wp_profile/PortalServer/wcm/shared/app/config/wcmservices
Edite o arquivo MemberFixerModule.properties e defina o seguinte:
1. Edite o arquivo wp_profile_root/PortalServer/wcm/shared/app/config/wcmservices/MemberFixerModule.properties file. 2. Update the contentAuthors_new property with the group name you used for the content authors group during LDAP configuration. 3. Update the administrator_new property with the administrator user name you used for the administrator user during LDAP configuration. Note that the old administrator user value should be uid=xyzadmin,o=defaultWIMFileBasedRealm, which is the default administrator user used when the Intranet and Internet Site Templates are created.
Salve e feche o arquivo
Vá para o diretório
/opt/IBM/WebSphere/wp_profile/ConfigEngine
e execute o seguinte comando
#./ConfigEngine.sh action-express-memberfixer -DmemberfixerRealm=<realm_name> -DPortalAdminPwd=<password>
Note: that realm_name indicates the realm where these users and groups are stored (for example, -DmemberfixerRealm=defaultWIMFileBasedRealm).
13. Removendo o Repositório Federado em Arquivo
Após a integração com o LDAP a segurança default pode ser removida, evitando conflitos por usuários com identidades duplicadas.
1. Vá no console administrativo do Servidor
https://wps1.empresax.com.br:10041/ibm/console
2. No Console Administrativo do WebSphere Application Server, selecione
Em Inglês: Security > Secure administration, applications, and infrastructure > User Registry > Custom > Custom Properties Em Português: Segurança > Segurança Global > Registro do Usuário > Customizar > Propriedades Customizadas
From the Deployment Manager or WebSphere Application Server administrative console, select Security > Secure administration, applications, and infrastructure. 2. In the User account repository section, make sure that Federated repositories is set in the Available realm definitions. 3. Clique em Configure. 4. In the list of Repositories in the realm, select the repository with the identifier InternalFileRepository. 5. Click Remove.
4. Salve suas alterações.
5. Sincronize todos os nós se você estiver em cluster
(Opcional) 14. Substituindo o Administrador do Portal LOCAL pelo do LDAP
Perform the following steps to replace the WebSphere Application Server and WebSphere Portal administrator user ID with users that exists in the LDAP user registry:
1. Run the ./ConfigEngine.sh wp-change-was-admin-user -DnewAdminId=newadminid –DnewAdminPw=newpassword task, from the wp_profile_root/ConfigEngine directory, to replace the old WebSphere Application Server administrative user with the new user.
Note: This task verifies the user against a running server instance. If the server is stopped, add the -Dskip.ldap.validation=true parameter to the task to skip the validation.
2. Verify that the task completed successfully. In a clustered environment, restart the deployment manager, the node agent(s), server1, and WebSphere_Portal servers. In a stand-alone environment, restart the server1 and WebSphere_Portal servers.
3. Run the ./ConfigEngine.sh wp-change-portal-admin-user -DnewAdminId=newadminid –DnewAdminPw=newpassword -DnewAdminGroupId=newadmingroup task to replace the old WebSphere Portal administrative user with the new user.
Note: This task verifies the user against a running LDAP server instance when LDAP security is enabled. If the LDAP server is stopped, add the -Dskip.ldap.validation=true parameter to the task to skip the validation.
4. Verify that the task completed successfully. In a clustered environment, restart the deployment manager, the node agent(s), server1, and WebSphere_Portal servers. In a stand-alone environment, restart the server1 and WebSphere_Portal servers.