Sun Java logo     Previous      Contents      Index      Next     

Sun logo
Sun Java System Access Manager 6 2005Q1 Developer's Guide 

Chapter 13
Client Detection Service

The Sun Java™ System Access Manager 6 2005Q1 Authentication Service has the capability of being accessed from many client types, whether HTML-based, WML-based or other protocols. In order for this function to work, Access Manager must be able to identify the client type. The Client Detection Service is used for this purpose. This chapter offers information on the service, and how it can be used to recognize the client type. It contains the following sections:

Overview

The Access Manager Authentication Service has the capability to process requests from multiple browser type clients. Thus, the service can be used to authenticate users attempting to access applications based in HTML, WML or other protocols.

Caution

The Access Manager console though can not be accessed from any client type except HTML.

The client detection API can be used to determine the protocol of the requesting client browser and retrieve the correctly formatted pages for the particular client type.

Note

Out of the box, Access Manager only defines client data for supported HTML client browsers. A list of supported browsers can be found in Chapter 1, "Introduction" under the section Client Browser Support.

Client Detection Process

Since any user requesting access to Access Manager must first be successfully authenticated, browser type client detection is accomplished within the Authentication Service. When a client’s request is passed to Access Manager, it is directed to the Authentication Service. Within this service, the first step in user validation is to identify the browser type using the User-Agent field stored in the HTTP request.

Note

The User-Agent field contains product tokens which contains information about the browser type client originating the HTTP request. The tokens are a standard used to allow communicating applications to identify themselves. The format is software/version library/version.

The User-Agent information is then matched to browser type data defined and stored in the amClientData.xml file.

Caution

User-Agent information is defined in amClientData.xml but this information is stored in Directory Server under Client Detection Service.

Based on this Client Data, correctly formatted browser pages are sent back to the client for authentication (for example, HTML or WML pages). Once the user is validated, the client type is added to the session token (as the key clientType) where it can be retrieved and used by other Access Manager services. (If there is no matching client data, the default type is returned.)

Note

The userAgent must be a part of the client data configured for all browser type clients. It can be a partial string or the exact product token.

Enabling Client Detection

By default, the client detection capability is disabled; this then assumes the client to be of the genericHTML type (For example Access Manager will be accessed from a HTML browser). The preferred way to enable the Client Detection Service is to use the Access Manager console and select the option in the Client Detection Service itself. For more information, see the Sun Java System Access Manager Administration Guide. To enable client detection using the amClientDetection.xml, the iplanet-am-client-detection-enabled attribute must be set to true. amClientDetection.xml must then be deleted from Directory Server and reloaded using amAdmin. The following procedure illustrates the complete enabling process.

  1. Import client data XML file using the amadmin command /IdentityServer_base/SUNWam/bin/amadmin -u amadmin_DN -w amadmin_password -t name_of_XML_file

    2. This step is only necessary if the client data is not already defined in amClientData.xml. The XML file is based on the The sms.dtd Structure of Chapter 8, "Service Management."

  2. Restart Access Manager.
  3. Login to Access Manager console.
  4. Go to Service Configuration and click the ClientDetectionproperties.
  5. Enable Client Detection.
  6. Make sure the imported data can be viewed with Access Manager console.

    7. Click on the Edit button next to the Client Data attribute.

  7. Create a directory for new client type and add customized JSPs.

    8. Create a new directory in /IdentityServer_base/SUNWam/web-src/services/config/auth/default/ and add JSPs for the new client type. Code Example 13-1 is a login page written for a WML browser.

    Code Example 13-1  Login.jsp Written In WML

    <?xml version="1.0"?>

    <!DOCTYPE wml PUBLIC "-//WAPFORUM//DTD WML 1.1//EN" "http://www.wapforum.org/DTD/wml_1.1.xml">

    <!-- Copyright Sun Microsystems, Inc. All Rights Reserved -->

    <wml>

    <head>

    <meta http-equiv="Cache-Control" content="max-age=0"/>

    </head>

    <card id="authmenu" title="Username">

    <do type="accept" label="Enter">

    <go method="get" href="/wireless">

    <postfield name="TOKEN0" value="$username"/>

    <postfield name="TOKEN1" value="$password"/>

    </go>

    </do>

    <p>

    Enter username:

    <input type="text" name="password"/>

    </p>

    <p>

    Enter password:

    <input type="text" name="username"/>

    </p>

    </card>

    </wml>

Client Data

In order to detect client types, Access Manager needs to recognize their identifying characteristics. These characteristics identify the features of all supported types and are defined in the amClientData.xml service file. The full scope of client data available is defined as a schema in amClientData.xml. The configured Access Manager client data available for HTML-based browsers is defined as sub-configurations of the overall schema: genericHTML and its parent HTML.

Note

Parent profiles (or styles, as they are referred to in the Access Manager console) are defined with properties that are common to its configured child devices. This allows for the dynamic inheritance of the parent properties to the child devices making the device profiles easier to mange.

HTML

HTML is a base style containing properties common to HTML-based browsers. It might have several branches including web-based HTML (or genericHTML), cHTML (Compact HTML) and others. All configured devices for this style could inherit these properties which include:

genericHTML

genericHTML is a configured device that inherits properties from the HTML style as well as defining its own properties. It refers to a HTML browser (Netscape Navigator™, Microsoft® Internet Explorer, or Mozilla™). Its properties include:

Client Detection API

Access Manager is packaged with a Java API which can implement the client detection functionality. The client detection API are in a package called com.iplanet.services.cdm. This package provides the interfaces and classes needed to retrieve client properties. The client detection procedure would include defining the client type characteristics (as stated in Client Data) as well as implementing the client detection API within the external application.

The client detection capability is provided by ClientDetectionInterface, a pluggable interface (not an API invoked by a regular application). It provides a getClientType method. The getClientType method extracts the client data from the browser’s incoming HttpRequest, matches the user agent information and returns the ClientType as a string. Upon successful authentication, the client type is added to the user’s session token. The ClientDetectionException handles any error conditions.



Previous      Contents      Index      Next     

Part No: 817-7649.   Copyright 2005 Sun Microsystems, Inc. All rights reserved.