SSM Installation and Configuration Guide

Configuring a Remote SSM and Proxy

This chapter describes the necessary steps for securing an application using a remote SSM.

Overview

When OES security calls using the Java API have been implemented in a custom application, SSM proxy services can be set up on the application host and used to communicate with a remote SSM on another machine. The SSM proxy provides local security services, including caching, logging, and failover support.

RMI or SOAP can be used as the transport mechanism for communication between the SSM proxy and the remote SSM. (In XACML terminology, the SSM proxy and remote SSM are be analogous to PDP Proxy and PDP respectively.)

Creating the Remote SSM

To set up a remote SSM:

Configuring the SSM Proxy

To set up the SSM proxy on the client application:

Configuring Caching, Logging, and Failover

How caching, logging, and failover are configured depends on the whether it is the remote SSM or the SSM proxy.

Caching

Caching configuration on the remote SSM is determined by settings established on the authorization provider being used by the SSM. This is managed using the Administration Console.

The SSM proxy uses the same caching configuration established on the remote SSM. In addition, the SynchronizationIntervalMilliSecs setting in PDPProxyConfiguration.properties determines how often to poll the remote SSM to see if re-synchronization is necessary.

The cache on the SSM proxy cannot be flushed from the Administration Console. However, the SSM proxy cache is automatically flushed when whenever there is a new policy distribution on the SSM (subject to the SynchronizationIntervalMilliSecs parameter). In addition, if this is not sufficient, the ability to flush the cache may be added to the application client using the following methods of the AuthorizationService class:

These methods can be invoked from either the SSM or the SSM proxy. They will simultaneously flush both the client and server cache.

Logging

Logging configuration on the remote SSM is determined by settings established on the auditing provider being used by the SSM. This is managed using the Administration Console.

On the SSM proxy, logging can be implemented using the Apache Log4j package (log4j.jar) that is included in the pdpproxy directory that was copied from the SSM instance.

Failover

Failover support for an SSM proxy can be implemented by deploying one or more failover SSMs and then pointing to those SSMs using the PDPAddress setting in PDPProxyConfiguration.properties. The first specified SSM will be the primary SSM; the second will be the failover SSM.

Adding New Assertion Types (Web Services SSM)

To add support for new identity assertion types to the Web Services SSM:

When the Web Services SSM is started, it will use the new holder implementation and the mapping entries to convert back and forth between the token's XML and Java representations.

        public class TestCredHolderImpl implements CredentialHolder
        {
        private String m_cookie;
        public static final String m_Type = "TestIA";
        
        public void setCookie(String cookie)
        {
            m_cookie = cookie;
        }
        public String getCookie()
        {
            return m_cookie;
        }
        public Object getObject()
        {
            return getCookie();
        }
        public void setObject(Object cred)
        {
            setCookie((String)cred);
        }
        public String getType()
        {
            return TestCredentialHolderImpl.m_Type;
        }
        public String getAsString()
        {
            return m_cookie;
        }
        }