ALES Integration Guide

     Previous  Next    Open TOC in new window    View as PDF - New Window  Get Adobe Reader - New Window
Content starts here

Securing AquaLogic Service Bus Runtime Resources

This section covers the following topics:

 

Overview

Using the WLS SSM, ALES can be used to manage access control to ALSB’s runtime resources, using the WLS SSM. AquaLogic Service Bus 3.0 (ALSB) is a configuration-based, policy-driven Enterprise Service Bus. It allows a loosely coupled architecture, facilitates enterprise-wide reuse of services, and centralizes management.

ALES secures only the runtime resources of ALSB, in general those resources that ALSB passes to isAccessAllowed(). It does not secure the resources used during ALSB configuration, such as the ALSB console.

 

Prerequisites

This document assumes the following:

 

Initial Configuration

Perform the following tasks to provide an SSM configuration and define an initial policy set for securing ALSB resources. At the conclusion of these steps, you can refine this information as described in the remaining sections of this document.

  1. Stop any running ALES and ALSB server/s.
  2. Start ALES Administration Server.
  3. Configure WLS SSM to protect ALSB domain as follows:
    1. Open a command window and chdir | cd to BEA_HOME/ales30-ssm/wls-ssm/adm.
    2. Make a copy of myssm_config.properties and name it alsb_ssm_config.properties.
    3. Open alsb_ssm_config.properties in an editor. Set ssm.type=wls-alsb-ssm and specify other entries as needed.
      4. Note: For a sample properties file, see
    4. Execute ConfigTool -process alsb_ssm_config.properties.
  4. Start ALSB domain server and access the ALSB console (typically, http://host:port/sbconsole).

    5. You can now use the facilities, including creating/managing projects.

Sample Properties File

This is a sample of the properties files used to establish the initial configuration for securing ALSB resources.

For instructions on completing this file, see the SSM Installation and Configuration Guide. 

### This file lists properties for the SSM configuration tool
### ConfigTool will interactively prompt for values which
### are commented out

### This is the weblogic domain directory
### Use / (and not \ ) for the path
wls.domain.dir = C:/BEAProducts/alsb300_wls100/user_projects/domains/alsb_domain_3

### SSM's config-id
### You can use the name of your application for this value
ssm.conf.id = SimpleApp2

### Database password
db.password = password

### ALES Admin password
ales.admin.password = weblogic

### SSM Username and password
### Note : This is the admin user's username/password of the domain being
### protected. In this case the target domain is the ALSB domain
ssm.admin.name = system
ssm.admin.password = weblogic

### The type of SSM defined by the type of domain against which it 
### is configured. The tool will load policies and configuration from 
### BEAHOME/ales*-ssm/wls-ssm/config/<ssm.type> where <ssm.type> is one of:
###       wls-ssm	 (for WebLogic Server domain)
###       wls-portal-ssm (for WebLogic Portal domain)
###       wls-alsb-ssm   (for AquaLogic Service Bus domain)
### Note : For ALSB domain this is'wls-alsb-ssm'.
ssm.type = wls-alsb-ssm

#############################################################
### If you have not installed ALES Admin and SSM in the same BEA-HOME, 
### specify the values below. The ConfigTool will interactively prompt for
### values that are commented out
#############################################################

### Database user name
# db.login = db_user

### ALES Admin username
# ales.admin.name = system

### name of the SSM instance directory
# ssm.instance.name = MySsm

### the ALES application node name
### This is like the root resource for the SSM
# ales.resource.root = //app/policy/MyApp

### ALES identity directory name
# ales.identity.dir = ALSBdir

### Database JDBC URL:
### Oracle -> jdbc:oracle:thin:@<server>:<port>:<sid> 
### Sybase -> jdbc:sybase:Tds:<server>:<port> 
### Sql Server -> jdbc:sqlserver://<server>:<port> 
### Pointbase -> jdbc:pointbase:server://<server>/ales 
### 
### values: 
### <server>: name or IP address of database machine 
### <port>: port where the database listener is running 
### <sid>: SID for oracle database 
# db.jdbc.url = jdbc:oracle:thin:@db_server:1521:db_sid

### Database JDBC Driver:
### Oracle: oracle.jdbc.driver.OracleDriver
### Sybase: com.sybase.jdbc3.jdbc.SybDriver
### Sql: com.microsoft.sqlserver.jdbc.SQLServerDriver
### Pointbase: com.pointbase.jdbc.jdbcUniversalDriver
### DB2: com.ibm.db2.jcc.DB2Driver 
# db.jdbc.driver = oracle.jdbc.driver.OracleDriver

### ARME's port number, by default this is 8000
# arme.port = 8000

 

Security Providers

Note: Providers for WebLogic 9.x/10.0 are defined using the WebLogic console. For details, see WebLogic 9.x/10.0 Security Providers

To secure Service Bus resources, create a security realm and define the following provider types:

When creating the realm, use the following settings:

 

ALSB Resources

Policy definitions include the ALSB resources to which the policy applies. These resources must be defined in ALES.

Regular Resource

To create a regular resource named abc:

  1. In the ALES Administration Console, open the resource tree.
  2. Right-click the parent of abc and select Add Resource.
  3. In the Name field, enter abc and click OK.

Virtual Resource

To create a virtual resource named xyz:

  1. Create a resource as described in Regular Resource.
  2. Right-click the xyz resource and select Configure Resource.
  3. Check the Allow Virtual Resources box and click OK.

ALSB Proxy Service Resources

Create resources in ALES corresponding to the ALSB Proxy Services. An ALSB Proxy Service has up to four key/value properties:

ALES resource definitions for ALSB use this format: 

//app/policy/<binding app>/<Proxy Service App name>/ProxyService/<Project Name>/[Folder name]/<Proxy Service Name>

Table 8-1 describes how ALSB Proxy Service reference elements map to ALES resource and privilege elements

Table 8-1 ALSB Proxy Service Elements Represented in ALES Resources and Privileges
Resource/Privilege Element
Description
binding app
The ALES binding node name.
Proxy Service app name
The default application name, shared.
ProxyService
The ALES resource type.
Folder name
The ALSB Proxy Service folder name.
//priv/<operation>
The operation field of the ALSB Proxy Service, representing one of the Web Services operations provided.

Here is an example of how to convert an ALSB transport level access control to an ALES policy. In ALSB: 

type=type=<alsb-proxy-service>, path=project/folder, proxy=myProxy, action=invoke

is converted in ALES to: 

//app/policy/<binding app node>/shared/ProxyService/project/folder/myProxy

with a default privilege of //priv/access, since with action=invoke, there is no operation defined.

Here is an example of how to convert ALSB access control during inbound web-service-security request processing: 

type=<alsb-proxy-service>, path=project/folder, proxy=myProxy, action=wss-invoke, operation=ProcessPO

is converted in ALES to: 

//app/policy/<binding app node>/shared/ProxyService/project/folder/myProxy

with a privilege of //priv/ProcessPO.

Resource Binding Application and Distribution Point

To make a resource binding application and distribution point named def:

  1. Right click the mouse on parent of def, and select Add Resource.
  2. In the Name field, enter def.
  3. From the Type dropdown field, select Binding and check the Distribution Point box.
  4. After the resource is created, right-click the resource and select Configure Resource.
  5. Select Binding application from the pull-down menu and click OK.

Resource Tree

Select Resources on the left pane and create a resource tree as shown in Listing 8-1:

  1. Make myrealm a resource binding application and distribution point.
  2. Make the consoleapp and ProxyService resources virtual.
    3. Listing 8-1 Resource Tree 
    myrealm
       |---- consoleapp
       |---- shared
             |----- adm
             |----- eis
             |----- ejb
             |----- jdbc
             |----- jms
             |----- jndi
             |----- ProxyService
             |       |----- MortgageBroker
             |               |----- ProxyService
             |                      |---- loanGateway1
             |                      |---- loanGateway2
             |                      |---- loanGateway3
             |----- svr
             |----- url
             |----- webservices
             |----- workcontext

Discovering Services

When developing policies for use with a Security Service Module, you can use the Discovery mode feature to help define your policy components. Instructions for using Discovery mode are provided in the Resource Discovery section in the Policy Managers Guide.

 

ALSB Identities

The ConfigTool will create an ALSB Identity directory and the ALSB administrative user. This user’s password is used to start the ALSB application. Assuming the ALSB Identity directory name is ALSDdir and the administrative user name is weblogic, follow these steps to maintain the password:

  1. In the Entitlements EUI, select ALSBdir in the left pane.
  2. In the right pane, select the weblogic user and click Modify User at the bottom of the pane.
  3. Specify the password as required and click OK.

Depending on the policy model used to secure ALSB resources, additional ALSB users and groups may be required. For background information, see Identities in the Policy Managers Guide.

 

Policies for ALSB

The ConfigTool will create an initial set of policies using the files located in BEA_HOME/ales30-admin/examples/policy/alsb_sample_policy. You may import and use them as a starting point for developing a full set of policies to secure ALSB resources. For information about how to import the sample policies, see the README file in the sample directory and see also Importing Policy Data in the Policy Managers Guide.

This section includes examples of policy creation:

Authorization Policies

The following policy grants any user with the role Admin all privileges over the resources adm and svr resources: 

grant(any, //app/policy/myrealm/shared/adm, //role/Admin)if true;
grant(any, //app/policy/myrealm/shared/svr, //role/Admin) if true;

To add this policy:

  1. Select Policy > Authorization Policies and click New.
  2. Check grant option the top of the window. Then select any from the list and click Add.
  3. Click Resources tab and expand myrealm > shared.
  4. Select adm and click Add, then select svr and click Add.
  5. Click the Policy Subjects tab, click Admin and then click Add.
  6. Make sure that the data is correct and click OK.
  7. Repeat steps 2-6 to create a policy that grants all users all privileges over the eis, ejb, jdbc, jms, jndi, url, webservices and workcontext resources:
    8. grant(any, //app/policy/myrealm/shared/eis, //role/Everyone) if true;
    grant(any, //app/policy/myrealm/shared/ejb, //role/Everyone) if true;
    grant(any, //app/policy/myrealm/shared/jdbc, //role/Everyone) if true;
    grant(any, //app/policy/myrealm/shared/jms, //role/Everyone) if true;
    grant(any, //app/policy/myrealm/shared/jndi, //role/Everyone) if true;
    grant(any, //app/policy/myrealm/shared/url, //role/Everyone) if true;
    grant(any, //app/policy/myrealm/shared/webservices, //role/Everyone) if true;
    grant(any, //app/policy/myrealm/shared/workcontext, //role/Everyone) if true;
  8. Repeat steps 2-6 to create a policy that grants all users access to the ProxyService resource:
    9. grant(access, //app/policy/myrealm/shared/ProxyService/MortgageBroker/ProxyService, 
    //role/Everyone)if true;

Role Mapping Policies

The following policy grants the user weblogic the role Admin over the resource myrealm: 

grant(//role/Admin, //app/policy/myrealm, //user/asi/weblogic/) if true;

To add this policy:

  1. Select Policy > Authorization Policies and click New.
  2. In the Available Roles list, select Admin and click Add.
  3. On the Resources tab, select myrealm in the Available Resource list and click Add.
  4. On the Policy Subjects tab, select Users from the Select Policy Subjects dropdown menu. Then select weblogic and click Add.
  5. Make sure that the data is correct and click OK.
  6. Repeat steps 1-5 to create a policy that grants the user anonymous the role Anonymous over the resource myrealm:
    7. grant(//role/Anonymous, //app/policy/myrealm, //user/asi/anonymous/) if true;
  7. Repeat steps 1-5 to create a policy that grants the group of all users the role Everyone over the resource myrealm:
    8. grant(//role/Everyone, //app/policy/myrealm, //sgrp/asi/allusers/) if true;

 

Distributing Changes

After you have made changes to the configuration and policies in the ALES console, follow these steps to distribute the changes.

  1. In the Administration Console’s left pane, select Click Deployment.
  2. Click Configuration in the right pane. Then select Security Configurations and click Distribute Configuration Changes. A message should indicate 100% distribution.
  3. Select Deployment in the left pane.
  4. Select Policy and click Distribute Policy. A message should indicate 100% distribution.

After the policies are distributed, start both the myrealm ARME instance used to protect the ALSB domain and the domain itself.

 

Verifying SSM Configuration Using PerfDBAuditor

It is possible to use the ALES performance auditing provider to verify that the SSM has been properly configured to protect ALSB. This provider collects statistics about requests routed through ALES.

To use the PerfDBAuditor to verify the SSM configuration, follow these steps:

  1. In the WebLogic Server Administration Console, select Security Realms > myrealm > Providers > Auditing and click New.
  2. In the Name field, enter PerfDBAuditor. Then select PerfDBAuditor from the Type field and click OK.
  3. On the Configuration: Provider-Specific page for the PerfDBAuditor security provider, enter the JDBC connection information. For Oracle databases, the JDBCDriver Class Name is oracle.jdbc.driver.OracleDriver and the JDBC Connection URL is jdbc:oracle:thin:@oracle-host:1521:listener-name, where oracle-host is the name or IP address of the system running the Oracle database and listener-name is the name of the database listener.

    4. Optionally, set the Performance Statistics Interval attribute to 1 to collect data at 1 minute intervals (instead of the default 5 minutes).

  4. Click on Save and then activate changes.
  5. Stop and restart the domain.
  6. Generate some data by:
    1. Opening (http://localhost:7021/examplesWebApp/index.jsp) and reloading the application.
    2. Under Run the AquaLogic Service Bus Examples, click Run the Example.
    3. Click Submit Loan Application.
  7. After a few minutes, check the PERF_ATZ_STAT database table. You should see a non-zero value under TOTALREQ. This indicates that the SSM is configured correctly to secure the application.

  Back to Top       Previous  Next