Using Security in ATMI Applications

     Previous  Next    Open TOC in new window  Open Index in new window  View as PDF - New Window  Get Adobe Reader - New Window
Content starts here

Implementing Single Point Security Administration

The following sections explain how to implement single point security administration for Tuxedo and WebLogic Server from the Tuxedo point of view:

Note: Before setting up single point security, be sure you are familiar with the Tuxedo security architecture and requirements. You may also want to coordinate this effort with your WebLogic or LDAP Administrator.

 


What Single Point Security Administration Means

If you have both Tuxedo and WebLogic Server deployed in your environment, then you have to manage two sets of security information. Single point security administration allows you to leverage the WebLogic Server security to manage your security database by eliminating user and group information from Tuxedo. You can use WebLogic Server as your security database to authenticate Tuxedo users.

Note: The Tuxedo ACL information will continue to reside in Tuxedo and is not currently integrated with WebLogic Server 7.0.
Note: If you are specifying SECURITY=ACL or SECURITY=MANDATORY_ACL in the RESOURCES section of the UBBCONFIG file, then you must continue to maintain tpgrp and tpacl files in Tuxedo.

The single point security administration feature leverages the enhanced WebLogic Server 7.0 security and the LDAP to allow single point security administration. You can maintain user security information in WebLogic Server embedded LDAP server and use the WebLogic Server Console to administer the security information from a single system. You must modify the UBBCONFIG file to enable single point security.

Single Point Security Administration Tasks

To set up single point security, you must provide the Tuxedo security information to the WebLogic Server-embedded LDAP server. This includes migrating or setting up the Tuxedo user (UID) and group (GID) information in WebLogic Server LDAP server so that authentication can be successful. For Tuxedo UID and GID values to be available to WebLogic Server, you must use the tpmigldap utility, modify the tpusr file manually with a text editor, or enter the user information via the WebLogic Administration Console.

Note: The WebLogic Administration Console may be the method used when adding one or two users after the security database is set up. For efficiency and time management, you may prefer using the tpmigldap utility or the tpusr file as a general rule.

Single point security administration consists of the following tasks:

See Also

 


Setting up LAUTHSVR as the Authentication Server

LAUTHSVR is a System /T provided server that offers the authentication service while the user security information is located in WebLogic Server. To enable the single security administration feature, you must configure LAUTHSVR as the authentication server. At runtime, the LAUTHSVR will retrieve the user information from the WebLogic Server-embedded LDAP and authenticate users. If the authentication is successful, an appkey is returned to the user, otherwise, authentication fails.

Note: Tuxedo 10 and greater allows you to configure WebLogic authentication using a more general authentication server, GAUTHSVR (which can be used along with LAUTHSVR or replace it).
Note: For more GAUTHSVR information, see Setting up GAUTHSVR as the Authentication Server and GAUTHSVR(5), in the Oracle Tuxedo File Formats, Data Descriptions, MIBs, and System Processes Reference.

To define LAUTHSVR as the authentication server, you must define the following parameters in the UBBCONFIG file:

LAUTHSVR Command Line Interface

The LAUTHSVR is the LDAP-based authentication server for Tuxedo. It requires a configuration file, that by default is $TUXDIR/udataobj/tpldap. You can create your own LAUTHSVR configuration file or use the default tpldap file that is available with the product.

The command line interface syntax for LAUTHSVR is as follows:

-f full_pathname

Specifies the full pathname of the LAUTHSVR configuration file.
Note: If -f option is omitted, the default LAUTHSVR configuration file tpldap is used.

The following example instructs LAUTHSVR to use the default configuration file, tpldap, in the $TUXDIR/udataobj directory.

LAUTHSVR SRVGRP=GROUP1 SRVID=2 CLOPT=”-A-”

In the following example, LAUTHSVR uses the myauthsvr.conf configuration file in the /home/tuxedo/bankapp directory.

LAUTHSVR SRVGRP=GROUP1 SRVID=2 
CLOPT=”-A-- -f/home/tuxedo/bankapp/myauthsvr.conf”

Setting Up the LAUTHSVR Configuration File

LAUTHSVR supports an input configuration file that contains information such as bind DN and an unencrypted password for bind DN. This configuration file is a plain text file and can be edited using any text editor and must be protected by the system using file permissions. By default the configuration file, named tpldap, is located in $TUXDIR/udataobj directory. You can overwrite this file in the command line for LAUTHSVR. The LAUTHSVR configuration file contains keyword and value pairs as defined in Table 4-1.

Syntax Requirements for LAUTHSVR Configuration File

Although the default values for the LAUTHSVR configuration file are usually sufficient, a system administrator may choose to configure it with different names. Therefore, you should be aware of the following requirements for the LAUTHSVR configuration file:

LAUTHSVR Configuration File Keywords

Table 4-1 defines the LAUTHSVR configuration file keywords.

Note: The only required keyword in the LAUTHSVR configuration file is PASSWORD, which specifies the password for bind DN. All other keywords are optional.

Table 4-1 LAUTHSVR Configuration File Keywords
Keyword
Value Type
Usage
FILE_VERSION
numeric
The configuration file version. This should always be 1. The default is 1.
LDAP_VERSION
numeric
The LDAP protocol version. Valid values are 2 or 3. The default is 3.
BINDDN
string
The DN used to bind to an LDAP server, usually the DN for the LDAP administrator. The default is “cn=admin”.
BASE
string
LDAP search base. The default is “ou=people, ou=myrealm, dc=mydomain”, where myrealm is the name of the security realm and mydomain is the name of the WebLogic Server domain.
UID
string
The userid attribute that is used to logon to WebLogic Server and Tuxedo. The default is uid.
PASSWORD
string
The password for bind DN. This is a required keyword and the password is in clear text format.
LDAP_ADDR
string
A comma separated list of WebLogic hostnames and ports. The syntax is [//]hostname[:port][,[//]hostname[:port]...]. The default value for port is 7001. If LDAP_ADDR is not specified, LAUTHSVR assumes localhost:7001 is the location to contact the LDAP server.
For more information about specifying multiple network addresses, refer to Using Multiple Network Addresses for High Availability.
EXPIRE
numeric
A numeric value that represents the number of seconds the cached entry is available in the local process memory. A value other than zero will enable caching. A value of zero specifies no caching. The default is zero.
For more information about enabling caching, refer to Using Multiple Network Addresses for High Availability.
SRCH_ORDER
string
Valid values are LDAP or LOCAL, or both separated by a comma. If you specify LOCAL, the search order will use the tpusr file. The default is LDAP.
For more information about database search order, refer to Configuring the Database Search Order.
LOCAL_FILE
string
The full pathname of the tpusr file to be used if LOCAL search order is enabled. The default value is $APPDIR/tpusr.
For more information about database search order, refer to Configuring the Database Search Order.

Note: If a directory path is specified other than the default $APPDIR/tpusr, the file must be generated using Tuxedo MIB or tpusradd command line utility. Failure to do this may cause authentication failure.

WLS_DOMAIN
string
The WebLogic Server domain name. The default value is mydomain.
WLS_REALM
string
The WebLogic Server security realm name. The default is myrealm.
ADM_GROUP
string
The WebLogic Server administrator group name. The default is Administrators.
OP_GROUP
string
The WebLogic Server operators group name. The default is Operators.
TUX_UID_KW
string
The keyword used in the description to identify the Tuxedo userid. The default is TUXEDO_UID.
TUX_GID_KW
string
The keyword used in the description to identify the Tuxedo group ID. The default is TUXEDO_GID.

Example LAUTHSVR Configuration File

Listing 4-1 shows an example of a LAUTHSVR configuration file.

Listing 4-1 Example LAUTHSVR Configuration File
#
# Tuxedo LDAP Authentication Server configuration file.
#
# created: Thu May 26 15:36:59 2002
#
FILE_VERSION         1
LDAP_VERSION         3
BINDDN               cn=Admin
BASE                 ou=people,ou=myrealm,dc=mydomain
UID                  uid
PASSWORD             secret
LDAP_ADDR             //PLUTO:7001,//Saturn:7001
EXPIRE               0
SRCH_ORDER            LDAP
WLS_DOMAIN            mydomain
WLS_REALM             myrealm
ADM_GROUP             Administrators
OP_GROUP             Operators
TUX_UID_KW           TUXEDO_UID
TUX_GID_KW            TUXEDO_GID
# end of file
WARNING: Because the PASSWORD for the LDAP administrator is in clear text, it is recommended that the system administrator guards this file with correct access permission.

Example UBBCONFIG Using LAUTHSVR

Listing 4-2 shows an example UBBCONFIG file with SECURITY set to ACL and LAUTHSVR defined.

Listing 4-2 Example UBBCONFIG File Using LAUTHSVR
*RESOURCES

IPCKEY        51002
MASTER        site1
MAXACCESSERS  50
MAXSERVERS    20
MAXSERVICES   20
MODEL        SHM
LDBAL        N
BLOCKTIME     10
SECURITY      ACL
AUTHSVC       "..AUTHSVC"

*MACHINES
DEFAULT:
       APPDIR="/home/tuxedo/application"
       TUXCONFIG="/home/tuxedo/application/TUXCONFIG"
       TUXDIR="/home/tuxedo/tux81"
Server1        LMID=site1
                     MAXWSCLIENTS=20

*GROUPS
GROUP1        LMID=site1 GRPNO=1
GROUP2        LMID=site1 GRPNO=2
GROUP3        LMID=site1 GRPNO=3
GROUP4        LMID=site1 GRPNO=4

*SERVERS
DEFAULT:
       CLOPT="-A" RESTART=N MAXGEN=5
LAUTHSVR       SRVGRP=GROUP1 SRVID=10
CLOPT="-A -- -F /home/tuxedo/application/lauthsvr.conf "
DMADM         SRVGRP=GROUP2 SRVID=20
GWADM         SRVGRP=GROUP3 SRVID=30
GWTDOMAIN      SRVGRP=GROUP3 SRVID=31
Simpserv       SRVGRP=GROUP4 SRVID=40
*SERVICES
TOUPPER

Using Multiple Network Addresses for High Availability

It is possible to configure more than one network address for a WebLogic Server domain. This may be a favorable configuration in order to provide high availability for user authentication. The user security information is replicated to all WebLogic Server-embedded LDAP servers in a WebLogic domain. LAUTHSVR can only connect to one server at a time; however, when a network error occurs, LAUTHSVR will try to connect to the next available address.

To configure multiple network addresses for LAUTHSVR, use the LDAP_ADDR keyword in the LAUTHSVR configuration file. The order in which the hostnames are specified is the order in which LAUTHSVR will try to connect. To use caching during authentication, specify the EXPIRE keyword. The value in this keyword will determine the number of seconds the cached entry is available in the local process memory.

Note: It is not required to have WebLogic Server available when you boot Tuxedo using tmboot; however, without the availability of at least one WebLogic Server, LAUTHSVRs ability to authenticate users is limited.
Note: Without the availability of WebLogic Server, you can boot Tuxedo and authenticate users using SRCH_ORDER LOCAL. In this case, the user authentication is verified against the tpusr file. For more information about search order, refer to Configuring the Database Search Order.

Example LAUTHSVR Configuration of Multiple Network Addresses

The following example specifies multiple network addresses in the LDAP_ADDR keyword.

LDAP_ADDR //Pluto:8000,//Saturn,Jupiter

The previous example specifies three WebLogic Server hostnames. The first server runs on Pluto and uses address 8000. The second server runs on Saturn and uses the default address 7001. The third server runs on Jupiter and also uses the default address 7001.

Configuring the Database Search Order

By default the LAUTHSVR authentication server will search the user information in the WebLogic Server-embedded LDAP server. To enable the use of the tpusr file in the database search, you must specify LOCAL in the SRCH_ORDER keyword. The order that the comma separated values are defined in the SRCH_ORDER keyword will specify the order in which LAUTHSVR searches for user information. LAUTHSVR will search the LDAP server or the tpusr file or both (according to the order of the values specified).

If there are two or more SRCH_ORDER entries specified in the LAUTHSVR configuration file, only the last entry takes effect. In this case a warning message is logged in USERLOG as well. A warning message also results if you specify a value other than LDAP or LOCAL in the SRCH_ORDER keyword. In this case, the invalid entry is discarded and the default value or a previous valid SRCH_ORDER entry is used.

Example LAUTHSVR Configuration for Database Search Order

The following example specifies that LAUTHSVR should search the WebLogic Server-embedded LDAP server first for user information. If the user information is not found in the LDAP server, then LAUTHSVR should look in the tpusr file.

SRCH_ORDER LDAP,LOCAL

The following example specifies that LAUTHSVR should search the tpusr file first for user information. If the user information is not found in the tpusr file, then LAUTHSVR should look in the WebLogic Server-embedded LDAP server for the information.

SRCH_ORDER LOCAL,LDAP

The following example specifies that LAUTHSVR should search the tpusr file only for user information.

SRCH_ORDER LOCAL

See Also

Using tpmigldap to Migrate User Information to WebLogic Server

You should use the tpmigldap command utility to migrate Tuxedo user and group information to WebLogic Server.

Assigning New Passwords for the tpusr File

Before migrating the user and group information, the administrator must assign new passwords for each user so the migration can be successful. This step is required because the passwords in the tpusr file are encrypted with one-way encryption; therefore, it is impossible to retrieve the original password from the file.

There are two ways to handle this password situation:

tpmigldap Command Line Options

Table 4-2 defines the command line options for the tpmigldap utility. The order of the command line options does not matter.

Note: The tpmigldap command requires the use of -w or -c so the user or group can be added to the WebLogic Server-embedded LDAP database.

Table 4-2 tpmigldap Command Line Options
Command Line Option
Option Argument
Default Value
Usage
-h
hostname
localhost
Hostname of WebLogic Server.
-p
port
7001
Port number for WebLogic Server Administration Console.
-d
domain
mydomain
WebLogic Server domain name.
-r
realm
myrealm
WebLogic Server security realm name.
-i
TUXEDO_UID keyword string
TUXEDO_UID
The keyword string for Tuxedo UID that the administrator wants to use in the WebLogic Server user “description” attribute.
-e
TUXEDO_GID keyword string
TUXEDO_GID
The keyword string for Tuxedo GID that the administrator wants to use in the WebLogic Server user “description”.
-f
user password
No default.
The default user password for every user in the tpusr file.
-b
binddn
cn=Admin
LDAP connection bind DN.
-w
password
No default.
The password for bind DN.
-c
Not applicable.
No default.
A prompt for entering a password for bind DN.
-u
full path name
$APPDIR/tpusr
The full directory path for the tpusr file.
-g
full path name
$APPDIR/tpgrp
The full directory path for the tpgrp file.

See Also

Adding New Tuxedo User Information

There are two methods for adding new user and group information to the single security LDAP database:

Adding New User Information in tpusr or tpgrp

To add new user information to the single point security LDAP database:

  1. Use your existing tpusr file and tpgrp file to add the new user and group information. Be sure to use the same format previously defined in the file. Be sure to use clear text passwords to add to the LDAP database.
  2. Run the tpmigldap utility using the -u option and specify the updated tpusr file and the -g option and specify the updated tpgrp file. For example:
  3. tpmigldap -u $APPDIR/tpusr -g $APPDIR/tpgrp

Adding New User Information Using the WebLogic Administration Console

To add new user information to the single point security LDAP database using the WebLogic Administration Console:

  1. Access the WebLogic Administration Console and select Security Arrow symbolRealmsArrow symbol myrealm where myrealm represents the LDAP security realm.


  2. Click Configure a new User... and access the General tab.


  3. Enter the user information:

    In the Name field specifies the user name.

    In the Description field specify the Tuxedo UID and GID values as a string in the following syntax:

    <TUXEDO UID KEYWORD>=<decimal value>
    <TUXEDO GID KEYWORD>=<decimal value>

    where by default, the TUXEDO UID KEYWORD is TUXEDO_UID and TUXEDO GID KEYWORD by default is TUXEDO_GID. For example:

    TUXEDO_UID=2504 TUXEDO_GID=601.

    In the Password field, specify the password for the user. Then confirm the password by entering the password again in the Confirm Password field.

  4. Click Apply to update the LDAP database with the new user information.

 


Setting up GAUTHSVR as the Authentication Server

GAUTHSVR is a System /T provided server usage is similar to LAUTHSVR, but with the following differences:

To enable the single security administration feature, GAUTHSVR must be configured as the authentication server. GAUTHSVR authenticates user security information against LDAP server. It returns appkey if SECURITY is set to ACL or MANDATORY_ACL when authentication success.

To configure GAUTHSVR as the authentication server, you must define the following parameters in the UBBCONFIG file:

GAUTHSVR Command Line Interface

GAUTHSVR is an LDAP-based authentication server for Tuxedo. It requires a configuration file, that by default is $TUXDIR/udataobj/tpgauth.

The command line interface syntax for GAUTHSVR is as follows:

-f config

Specifies the full pathname of the GAUTHSVR configuration file.

-o gaconfig.xml

Specifies the full pathname of the GAUTHSVR internal configuration file generated from customer configuration file specified by -f option. The default value is $APPDIR/gaconfig.xml.

-k gakey.dat

Specifies the full pathname of the GAUTHSVR internal configuration file generated from the configuration file (specified in the -f option). The default value is $APPDIR/gakey.dat.

-v

Verbose mode. Logs more detailed messages to ULOG.

The following example instructs GAUTHSVR to use the default configuration file, tpgauth, in the $TUXDIR/udataobj/tpgauth directory.

GAUTHSVR SRVGRP=GROUP1 SRVID=2 CLOPT=”-A --”

In the following example, GAUTHSVR use the myauthsvr.conf configuration file in the /home/tuxedo/bankapp directory.

GAUTHSVR SRVGRP=GROUP1 SRVID=2 
CLOPT=”-A -- -f/home/tuxedo/bankapp/myauthsvr.conf”

GAUTHSVR updates the generated XML file if tpgauth is newer than the generated XML and key files. Only changed or newly added tpgauth items are updated in the generated XML file.

Note: If the XML and key file are not present when GAUTHSVR is booted, GAUTHSVR creates them automatically.

Setting Up the GAUTHSVR Configuration File

GAUTHSVR supports an input configuration file that contains information such as bind DN and an unencrypted password for bind DN. This configuration file is a plain text file and can be edited using any text editor and must be protected by the system using file permissions. By default the configuration file, named tpgauth, is located in $TUXDIR/udataobj/tpgauth directory. You can overwrite this file in the command line for GAUTHSVR. Table 4-3 lists keywords and value pairs contained in the GAUTHSVR configuration file.

Syntax Requirements for GAUTHSVR Configuration File

Although the default values for the GAUTHSVR configuration file are usually sufficient, you can choose to configure it with different names. Therefore, you should be aware of the following requirements for the GAUTHSVR configuration file:

GAUTHSVR Configuration File Keywords

GAUTHSVR keywords are divided into three groups: basic, advanced, and LDAP schema. Table 4-3, Table 4-4, and Table 4-5 define the GAUTHSVR configuration file keywords accordingly.

Table 4-3 Basic GAUTHSVR Configuration File Keywords 
Configuration Keyword
Value Type
Description
UserCacheExpire
numeric
A numeric value that represents the number of seconds the cached entry is available in the local process memory. A value other than zero will enable caching. A value of zero specifies no caching.
The default value is 0.
UserCacheSize
numeric
Maximum number of entries for user cache where one entry is required for each user. A 0 value of zero specifies no limit.
The default value is 0 (indicating no limit).
SYSADM
string
The user name for the Tuxedo SYSADM.
SYSOP
string
The user name for the Tuxedo SYSOP.
Host
string
The host name or IP address of the LDAP server.
The default value is localhost.
Port
numeric
The port number on which the LDAP server is listening.
The default value is 389.
Principal
 
The Distinguished Name (DN) of the LDAP user that is used to connect to the LDAP server.
Credential
 
The credential (generally a password) used to authenticate the LDAP user that is defined in the Principal attribute.
RetrieveUIDAndGID
boolean
Specifies whether the UID and GID information are retrieved from the LDAP server. It must be set to true when SECURITY is ACL or MANDATORY_ACL.
The default value is false.

Table 4-4 Advanced GAUTHSVR Configuration File Keywords 
Configuration Keyword
Value Type
Description
TuxedoUIDKey
string
Used to identify the Tuxedo UID.
The default value is TUXEDO_UID.
TuxedoGIDKey
string
Used to identify the Tuxedo GID
The default value is TUXEDO_GID.
ConnectTimeout
numeric
The maximum number of seconds to wait for the LDAP connection to be established. If set to 0, there is no maximum time limit.
The default value is 0.
ConnectionRetryLimit
numeric
The number of times to attempt to connect to the LDAP server if the initial connection failed.
The default value is 1.
ResultsTimeLimit
numeric
The maximum number of milliseconds to wait for results before timing out. If set to 0, there is no maximum time limit.
The default value is 0.
SSLEnabled
boolean
Specifies that SSL is used to connect to the LDAP server.
The default value is false.
KeepAliveEnabled
boolean
Specifies whether to prevent LDAP connections from timing out or not.
The default value is false.
ParallelConnectDelay
numeric
The number of seconds to delay when making concurrent attempts to connect to multiple servers.
If set to 0, connection attempts are serialized. An attempt is made to connect to the first server in the list. The next entry in the list is tried only if the attempt to connect to the current host fails. This might cause your application to block for unacceptably long time if a host is down. If set to greater than 0, another connection setup thread is started after this number of delay seconds has passed.
The default value is 0.
FollowReferrals
boolean
Specifies whether referrals are automatically followed within the LDAP Directory or not.
If set to false, a referral exception is sent when referrals are encountered during LDAP requests.
The default value is true.
BindAnonymouslyOnReferrals
boolean
Specifies to anonymously bind when following referrals within the LDAP directory. If set to false, then the current Principal and Credential are used.
The default value is false.
UseZOSRACF
boolean
Specifies whether the LDAP server is z/OS RACF LDAP server.
The default value is false
ControlFlag
string
Specifies how Tuxedo LDAP Authentication provider fits into the login sequence.
The Control Flag determines how the login sequence uses the Authentication provider.
A REQUIRED value specifies this LoginModule must succeed. Even if it fails, authentication proceeds down the list of LoginModules for the configured Authentication providers. This setting is the default.
A REQUISITE value specifies this LoginModule must succeed. If other Authentication providers are configured and this LoginModule succeeds, authentication proceeds down the list of LoginModules. Otherwise, control is return to the application.
A SUFFICIENT value specifies this LoginModule need not succeed. If it does succeed, return control to the application. If it fails and other Authentication providers are configured, authentication proceeds down the LoginModule list.
An OPTIONAL value specifies this LoginModule need not succeed. Whether it succeeds or fails, authentication proceeds down the LoginModule list.
The default value is REQUIRED.

Table 4-5 LDAP Schema Configuration File Keywords 
Configuration Keyword
Value Type
Description
UserObjectClass
string
The LDAP object class that stores users
The default is person.
UserBaseDN
string
The base distinguished name (DN) of the tree in the LDAP directory that contains users.
The default value is ou=people, o=example.com
UserFromNameFilter
string
An LDAP search filter for finding a user given the name of the user.
The default value is (&(cn=%u)(objectclass=person))
UserSearchScope
string
Specifies how deep in the LDAP directory tree to search for users. Valid values are "subtree, onelevel".
The default value is subtree.
UserUIDAttrName
string
The attribute name of an LDAP user object that specifies the UID of the user or the UID and GID of the user in a fixed format.
The default value is userid.
UIDAttrValueType
string
Specifies the value type of the uid attribute for the LDAP user object. Legal values include "UID, UIDAndGID".
The default value is UID.
UserGroupAttrNames
string
The attribute names of an LDAP user object that specify the groups the user belongs to. This attribute can contain three types of values: GID, group CN and group DN. One type of value for each configuration. More names are separated by comma.
The default value is usergroups.
GroupAttrValueType
string
Specifies the value type of the group attributes for the LDAP user object. Legal values include "GID, group CN, and group DN".
The default value is GID.
GroupBaseDN
string
The base distinguished name (DN) of the tree in the LDAP directory that contains groups.
The default value is ou=groups, o=example.com.
GroupFromNameFilter
string
An LDAP search filter for finding a group given the name of the group.
The default value is (&(cn=%g)(objectclass=groupofuniquenames)).
StaticGroupObjectClass
string
The name of the LDAP object class that stores static groups
The default value is groupofuniquenames.
GroupSearchScope
string
Specifies how deep in the LDAP directory tree to search for groups. Valid values are "subtree, onelevel"
The default value is subtree.
GroupGIDAttrName
string
The attribute of a LDAP group object that specifies the GID of the group
The default value is groupid.

Example GAUTHSVR Configuration File

Listing 4-3 shows a GAUTHSVR configuration file for WebLogic Server example. Please refer to this example when configuring other LDAP servers.

Listing 4-3 Example WebLogic GAUTHSVR Configuration File
#
# Tuxedo LDAP Authentication Server configuration file.
#
# created: Thu May 26 15:36:59 2002
# end of file
# Tuxedo configuration
UserCacheExpire = 600
UserCacheSize = 16384
SYSADM = sysadm
SYSOP = sysop

# LDAP server configuration
Host = server.bea.com
Port = 7001
Principal = cn=Admin
Credential= weblogic

UserObjectClass = person
UserBaseDN = ou=people,ou=myrealm,dc=examples
UserFromNameFilter = (&(uid=%u)(objectclass=person))
UserUIDAttrName = description
UserGroupAttrNames=wlsMemberOf
RetrieveUIDAndGID = true
UIDAttrValueType = UIDAndGID
WARNING: Because the PASSWORD for the LDAP administrator is in clear text, it is recommended that the system administrator guards this file with correct access permission.

Example UBBCONFIG Using GAUTHSVR

Listing 4-4 shows an example UBBCONFIG file with SECURITY set to ACL and GAUTHSVR defined.

Listing 4-4 Example UBBCONFIG File Using GAUTHSVR
# UBBCONFIG
*SERVER
GAUTHSVR SVRGRP="SYSGRP" SVRID=100
              CLOPT="-A -- -f ${APPDIR}/tpgauth"
              ENVFILE="${APPDIR}/tpgauth.env"

See Also

Using tpmigldif to Migrate User Information

You can use the tpmigldif command utility to migrate Tuxedo user and group information to LDAP servers in LDAP Interchange Format (LDIF). In order to use tpmigldif, you must create a migration template.

Using tpmigldif Command Line Options

Table 4-6 lists the command line options for the tpmigldif utility. The order of the command line options does not matter.

Table 4-6 tpmigldif Command Line Options 
Command Line Option
Option Argument
Default Value
Usage
-t
user|group
user
Specifies migration type.
-f
template filename
tpusr-template (when type is user), or tpgrp-template(when type is group)
Specifies the template file name.
-o
o (output filename)
console/stdout
Specifies the output file name.
-u
full path name
tpusr
The full directory path for the tpusr file.
-g
full path name
tpgrp
The full directory path for the tpgrp file.

tpusr and tpgrp File Format

Listing 4-5 shows a tpusr file with five fields separated by a colon:

name:password(encrypted):user id:group id:client name::

Listing 4-5 Example tpusr File
user1:EI4xxxjrCc:16668:601:TPCLTNM,client::
user2:EI4xxxjrCc:16669:602:TPCLTNM,client::

Listing 4-6 shows a tpgrp file with three fields separated by a colon:

name::group id:

Listing 4-6 Example tpgrp File
group1::601:
group2::602:
Assigning New Passwords for the tpusr File (Optional)

Before migrating the user and group information, the administrator could assign new passwords for each user so the generated LDIF output contains correct password for each user. This step is required because the passwords in the tpusr file are encrypted with one-way encryption; therefore, it is impossible to retrieve the original password from the file.

Using a text-editor, there are two methods you can use to modify tpusr file passwords:

Creating a Migration Template

The migration template is a text file used by the tpmigldif command utility to translate the tpusr or tpgrp file into an LDIF output file.

Listing 4-7 shows a tpusr-template migration file example. <%n> refers to a tpusr file field, where n starts at 1.

Note: Use <%gn> for group field in tpgrp file for given user.
Listing 4-7 tpusr-template
dn: CN=<%1>,CN=Users,DC=tuxdev,DC=bea,dc=com
objectclass: top
objectclass: person
objectclass: organizationalPerson
objectclass: user
cn: <%1>
description: Tuxedo User, TUXEDO_UID=<%3> TUXEDO_GID=<%4>
password: <%7>

Listing 4-8 shows the LDIF output from the tpusr-template.

Listing 4-8 LDIF Output
dn: CN=user1,CN=Users,DC=tuxdev,DC=bea,dc=com
objectclass: top
objectclass: person
objectclass: organizationalPerson
objectclass: user
cn: user1
description: Tuxedo User, TUXEDO_UID=16668 TUXEDO_GID=601
password: pwd1

dn: CN=user2,CN=Users,DC=tuxdev,DC=bea,dc=com
objectclass: top
objectclass: person
objectclass: organizationalPerson
objectclass: user
cn: user2
description: Tuxedo User, TUXEDO_UID=16669 TUXEDO_GID=602
password: pwd2

Supported LDAP Server Template Example

Tuxedo provides an example template for supported LDAP servers. The files are listed in Table 4-7.

Table 4-7 Supported LDAP Server Template Example1
LDAP Server
GAUTHSVR
Configuration
User Migration Template
Group Migration Template
WebLogic Server
tpgauth
tpusr-template
tpgrp-template
Active Directory2
tpgauth-ad
tpusr-template-ad
tpgrp-template-ad
IPlanet
tpgauth-iplanet
tpusr-template-iplanet
tpgrp-template-iplanet
z/OS LDAP, with RACF backend3
tpgauth-racf
tpusr-template-racf
tpgrp-template-racf

1All files are available under $TUXDIR/udataobj;

2For Active Directory user’s password cannot be added on creation. For help on how to change or reset it, please refer to Microsoft support document, http://support.microsoft.com/kb/269190, http://support.microsoft.com/kb/263991, etc;

3Two things need to be done to activate z/OS RACF account after migration: i) reset the password by z/OS administrator; and ii) logon with the account to change its password.

See Also


  Back to Top       Previous  Next