|
| |
| Sun Java Enterprise System 2004Q2 Deployment Example Series: Evaluation Scenario | |
Chapter 4
User Management for the Evaluation DeploymentThis chapter shows you how to configure your LDAP organization and provision user accounts that can log in to Messaging Server, Calender Server, and Portal Server. This chapter contains the following sections:
About Java Enterprise System User ManagementThis chapter describes three aspects of user management:
- Configuring the User Management Utility. You configure the User Management Utility to operate on your default Directory Server instance.
- Managing your LDAP organization. You add the LDAP attributes and object classes needed to authenticate for messaging, calendar, and portal services.
- Provisioning user accounts. In your LDAP organization, you create LDAP entries that represent end user accounts. Since your organization uses Schema 2, a single user entry has all the LDAP attributes and object classes needed to log in to the messaging, calendar, and portal services you established.
Configuring the User Management UtilityThis section describes configuring the User Management Utility. Configuring the User Management Utility does the following:
To Configure the Identity Server User Management Utility
- Change directory to the User Management Utility directory:
cd /opt/SUNWcomm/sbin
- Run the command that starts the configuration wizard:
./config-iscli
The configuration wizard’s Welcome page is displayed.
- Click Next.
The Select Directory to Store Configuration and Data Files page is displayed.
- Click Next to accept the default configuration data directory.
The Create New Directory dialog box is displayed.
- Click Create Directory.
The Select Components to Configure page is displayed.
- Confirm that both components, Commcli Client and Commcli Server, are selected. Click Next.
The ISHostPort page is displayed.
- Confirm that the default values for Hostname and Port specify your Identity Server instance on your evaluation_host.
- Click Next to accept the default values.
The Default SSL Port for Commcli Client page is displayed.
- Click Next to accept the default value.
The Identity Server Base Directory page is displayed.
- Click Next to accept the default value.
The Directory (LDAP) Server page is displayed.
- Do the following to identify your default Directory Server instance:
- In the LdapURL text field accept the default value of ldap://evaluation_host:389.
- In the Bind As text field accept the default value of cn=Directory Manager. There must be a space between Directory and Manager.
- In the Password text field, type password.
Click Next. The Identity Server Top Level Administrator page is displayed.
- Do the following:
- Do the following:
- Confirm that the default value identifies the Web Server instance on your evaluation_host. You see a value similar to the following:
/opt/SUNWwbsvr/evaluation_host
Click Next. The Organization DN for the Default Domain.
- Confirm that the default organization DN specifies the LDAP organization created by the Messaging Server configuration wizard.
You see a value similar to the following:
o=example.com,dc=example,dc=com
Click Next. The Top Level Administrator for the Default Organization page is displayed.
- Do the following:
- Accept the default admin user ID.
- Type password for the admin password.
Click Next. The Ready to Configure page is displayed.
- Review the configuration summary.
Click Configure Now. The Starting Task Sequence page is displayed. When configuration is complete, the Sequence Complete page is displayed.
- Review the messages and confirm that the User Management Utility is successfully configured. You see the following message:
All Tasks Completed
Click Next. A Web Server Restart dialog box is displayed.
- Click OK.
The Installation Summary page is displayed.
- In the Installation Summary page, review the details of the configuration.
Click Close. The configuration wizard closes.
- Change directory to the Web Server default instance directory. The directory name includes the fully qualified name of the system on which you installed Web Server.
cd /opt/SUNWwbsvr/https-evaluation_host
- Run the command to stop Web Server:
./stop
- Run the command to start Web Server:
./start
The Web Server displays a sequence of startup messages. The startup process might take a few moments. When startup is complete, the following message is displayed:
startup: server started successfully
The User Management Utility is now configured to operate on your default Directory Proxy Server instance.
Configuring Your LDAP Organization for Mail, Calendar and Portal ServicesWhen a user attempts to log in to a Java ES service, the service performs LDAP authentication to determine whether the user is authorized to use the service. LDAP authentication examines the user’s LDAP data for the specific object classes and attributes that indicate that the user is authorized to access the service.
Each Java ES service has its own set of object classes and attributes for authentication.
The LDAP object classes and attributes used in authentication are added to the LDAP organization before user accounts are created in the organization. Adding attributes and object classes is known as extending the schema.
This section describes how to extend your LDAP organization’s schema with the object classes and attributes used to authenticate messaging, calendar, and portal services.
To Extend Your LDAP Organization’s Schema for Messaging and Calendar Services
- Change directory to the User Management Utility directory:
cd /opt/SUNWcomm/bin
- Use the commadmin domain modify command to extend your LDAP organization:
./commadmin domain modify -D admin -w password -S mail -H evaluation_host -S cal -B evaluation_host -P allowProxyLogin:yes -T America/Los_Angeles
- You might be prompted to Enter DNS Domain Name. If this happens, type your evaluation_domain and press Enter.
This command adds the LDAP attributes and object classes need for mail and calendar authentication to your LDAP organization.
To Extend Your LDAP Organization’s Schema for Portal Services
In this section, you use the Identity Server console to register Portal services with your LDAP organization.
- In a web browser, open the following URL:
http://evaluation_host/amconsole
The Identity Server console login page is displayed.
- Type your Administration User ID (amadmin) and password (password). Click OK.
The Identity Server administration console is displayed in the browser. By default, the Identity Management tab is selected, and the console displays information about your LDAP domain.
Figure 4-1 Sun Java System Identity Server Console
Figure 4-1 shows the administration console displaying information about the example domain.
- In the left pane, just below the Identity Management tab, the domain name is displayed and highlighted.
- The left pane also lists the LDAP organizations in the domain. In Figure 4-1 the example.com organization is listed.
- Click the name of your LDAP organization.
You see a display similar to Figure 4-2. The left pane’s title bar now shows your domain and your LDAP organization.
Figure 4-2 Selecting an Organization
- In the left pane, open the View drop-down menu and choose Services.
The left pane displays the list of services registered for your LDAP organization. You see a display similar to Figure 4-3. Initially, no services are registered for your LDAP organization.
Figure 4-3 Viewing Services for the LDAP Organization
- Click Add.
The right pane displays a list of services that can be registered.
- Register the Portal Server Configuration services. Select the following services:
- Leave the console window open.
You have added the LDAP attributes and object classes for messaging, calendar, and portal services use to your directory tree.
Provisioning an End User AccountThis section describes how to use the User Management Utility and the Identity Server console to provision a user account. You set up an LDAP user entry with a user ID and a password, and you give the user access to portal, mail, and calendar services.
In a production system, Java ES administrators manage users. User management tasks not demonstrated in this chapter include LDAP organizational planning, LDAP database management, and delegated administration.
To Create an End User Account
- Change directory to the User Management Utility directory:
cd /opt/SUNWcomm/bin
- Run the command that creates a user account and provisions it for messaging and calendar services:
./commadmin user create -D admin -w password -l TestUser -F Test -L User -W password -S mail -H evaluation_host -E test.user@evaluation_domain -S cal -B evaluation_host -J 0 -T America/Los_Angeles
To Provision the End User Account for Portal Services
- Return to the Identity Server console.
- In the left pane, open the View drop-down menu and choose Users.
The left pane displays a list of users in your LDAP organization. You see a display similar to Figure 4-4. The list should include the user you created in the preceding step.
Figure 4-4 Selecting Test User
- Select your new user.
By default, the Store Administrator user is selected. Locate Test User in the list of users. Click the arrow symbol (>) that follows the user’s name. If necessary, scroll the left pane to the right.
The right page displays user properties for Test User.
- Display the registered services for your new user.
In the right pane, open the View drop-down menu and choose Services.
The right pane displays a list of registered services for the user. You see a display similar to Figure 4-5. Initially, no services are registered for Test User.
Figure 4-5 Displaying Services for Test User
- Display a list of services you can add.
In the right pane, click Add. The right pane displays a list of services available in the LDAP organization but not yet registered for Test User.
- Add the portal services for your new user. Select the following:
- Log out of the console.
You have created a user account and provisioned it for the messaging, calendar, and portal services.
