This section contains tasks describing how you can reconfigure the default authentication method in certain situations. For example, you can enable your organization to get user authentication data from an LDAPv3 directory as opposed to the default flat file. The procedures include:
Changing the Default Authentication Module from Flat File to LDAP
Changing the Default Authentication Module from Flat File to Active Directory
Changing the Default Administrator Authentication Module from a Flat File to LDAP
This procedure describes how to configure an authentication module for the organization using the Federation Manager Console.
In the Federation Manager Console, select the Organization tab.
Under Organization, select the Authentication tab.
Click Add.
A list of Authentication Modules is displayed.
Active Directory
Anonymous
Certificate
HTTP Basic
JDBC
LDAP
Membership
MSISDN
Password Playback
RADIUS
SafeWord
SecurID
Windows Desktop SSO
Windows NT
Select a module from the list and click Next.
Configure the attributes for the authentication module.
Click Assign.
By default, users are authenticated by Federation Manager using the flat file with which it is deployed. The authentication component can be reconfigured to retrieve data from most LDAPv3–compliant directory (including Sun Java System Directory Server) rather than the default flat file.
Although Microsoft Active Directory is an LDAPv3–compliant directory, the procedure has some differences. For more information, see Changing the Default Authentication Module from Flat File to Active Directory.
This section includes the following procedures:
To Set LDAP as the Default Authentication Module for an Organization
To Enable an Organization to Use the LDAP Authentication Module
Use the following template, modify ROOT SUFFIX to reflect that of the organization.
<?xml version="1.0" encoding="ISO-8859-1"?> <!-- Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved Use is subject to license terms. --> <!DOCTYPE Requests PUBLIC "-//iPlanet//Sun Java System Access Manager 2005Q4 Admin CLI DTD//EN" "jar://com/iplanet/am/admin/cli/amAdmin.dtd" <!-- CREATE REQUESTS --> <Requests> <OrganizationRequests DN="ROOT SUFFIX"> <ModifyServiceTemplate serviceName="iPlanetAMAuthService" schemaType="Organization"> <AttributeValuePair> <Attribute name="iplanet-am-auth-org-config" /> <Value><AttributeValuePair><Value>com.sun.identity. authentication.modules.ldap.LDAP REQUIRED</Value>< /AttributeValuePair></Value> </AttributeValuePair> </ModifyServiceTemplate> </OrganizationRequests> </Requests> |
Modify the following template to change the administrator's default authentication module to LDAP.
<?xml version="1.0" encoding="ISO-8859-1"?> <!-- Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved Use is subject to license terms. --> <!DOCTYPE Requests PUBLIC "-//iPlanet//Sun Java System Access Manager 2005Q4 Admin CLI DTD//EN" "jar://com/iplanet/am/admin/cli/amAdmin.dtd"> <!-- CREATE REQUESTS --> <Requests> <OrganizationRequests DN="ROOT SUFFIX"> <ModifyServiceTemplate serviceName="iPlanetAMAuthService" schemaType="Organization"> <AttributeValuePair> <Attribute name="iplanet-am-auth-admin-auth-module" /> <Value> <AttributeValuePair><Value>com.sun.identity. authentication.modules.ldap.LDAP REQUIRED</Value>< /AttributeValuePair> </Value> </AttributeValuePair> </ModifyServiceTemplate> </OrganizationRequests> </Requests> |
Load the modified XML files using amadmin and the format /FederationManager-base/fm/bin/amadmin —u amadmin —w password —i war—staging—directory -t name-of-XML-file.
In the Federation Manager Console, select the Organization tab.
Under Organization, select the Authentication tab.
Click Add.
A list of Authentication Modules is displayed.
Select LDAP from the list and click Next.
Configure the attributes for the LDAP authentication module and click Assign.
Under Organization, select the Authentication tab.
Click the Edit button next to the Core authentication service.
The Core attributes are displayed.
Add LDAP to the Organization Authentication Modules attribute by holding down the Control key and selecting LDAP.
Click Save.
LDAP is now enabled as an authentication module for the organization. To authenticate to Federation Manager through the LDAP module, use a URL in the format protocol://host:port/deploy_URI/something?module=LDAP.
Although Microsoft Active Directory is an LDAPv3–compliant directory, the procedure to change the default authentication module from Flat File to Active Directory is different from the procedure described in Changing the Default Authentication Module from Flat File to LDAP. The following sections describe the procedures:
To Set Active Directory as the Default Authentication Module for an Organization
To Enable an Organization to Use the Active Directory Authentication Module
Use ldapsearch in the following format to find values that begin with iplanet-am-auth-org-config.
/usr/bin/ldapsearch -b OU=default,OU=OrganizationConfig,OU=1.0, OU=iPlanetAMAuthService,OU=services,ROOTSUFFIX -D admin-dn -w admin-password -s base -h AD-host -p AD-port "(objectclass=*)" sunkeyvalue |
The search result would look like this:
sunkeyvalue=iplanet-am-auth-org-config=<AttributeValuePair> <Value>com.sun.identity.authentication.modules.flatfile. FlatFileREQUIRED</Value></AttributeValuePair> |
Save the search result as it will be used in the following step as the value for the Delete entry.
Save the following text as an Lightweight Directory Interchange Format (LDIF) file.
dn: OU=default,OU=OrganizationConfig,OU=1.0, OU=iPlanetAMAuthService,OU=services,ROOTSUFFIX changetype:modify delete:sunkeyvalue sunkeyvalue: iplanet-am-auth-org-config=<AttributeValuePair> <Value>com.sun.identity.authentication.modules. flatfile.FlatFileREQUIRED</Value> </AttributeValuePair> dn: OU=default,OU=OrganizationConfig,OU=1.0, OU=iPlanetAMAuthService,OU=services,ROOTSUFFIX changetype:modify add:sunkeyvalue sunkeyvalue: iplanet-am-auth-org-config=<AttributeValuePair> <Value>com.sun.identity.authentication.modules. ldap.LDAPREQUIRED</Value></AttributeValuePair> |
Type the found values from the previous step into the Delete section of the saved LDIF file.
Type the new values into the Add section of the saved LDIF file.
Run ldapmodify using the LDIF file as input.
/usr/bin/ldapmodify -h AD-host -p AD-port -D adminDN -w admin-password -f name-of-LDIF-file
In the Federation Manager Console, select the Organization tab.
Under Organization, select the Authentication tab.
Click Add.
A list of Authentication Modules is displayed.
Select Active Directory from the list and click Next.
Configure the attributes for the Active Directory authentication module and click Assign.
Under Organization, select the Authentication tab.
Click the Edit button next to the Core authentication service.
The Core attributes are displayed.
Add Active Directory to the Organization Authentication Modules attribute by holding down the Control key and selecting Active Directory.
Click Save.
Active Directory is now enabled as an authentication module for the organization. To authenticate to Federation Manager through the Active Directory module, use a URL in the format protocol://host:port/deploy_URI/something?module=AD.
After you have configured and enabled Federation Manager to retrieve data from an LDAPv3–compliant data store, you must also change the default method of authentication for the Federation Manager administrator from the flat file to the LDAPv3–compliant directory. This section contains the following procedures:
Make sure the super user (by default, amadmin) has read, write and search permission to the ou=services branch of the directory information tree (DIT).
Use the following template, modify ROOT SUFFIX to reflect that of the organization.
<?xml version="1.0" encoding="ISO-8859-1"?> <!-- Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved Use is subject to license terms. --> <!DOCTYPE Requests PUBLIC "-//iPlanet//Sun Java System Access Manager 2005Q4 Admin CLI DTD//EN" "jar://com/iplanet/am/admin/cli/amAdmin.dtd" <!-- CREATE REQUESTS --> <Requests> <OrganizationRequests DN="ROOT SUFFIX"> <ModifyServiceTemplate serviceName="iPlanetAMAuthService" schemaType="Organization"> <AttributeValuePair> <Attribute name="iplanet-am-auth-admin-auth-module" /> <Value><AttributeValuePair><Value>com.sun. identity.authentication.modules.ldap.LDAPREQUIRED< Value><AttributeValuePair></Value> </AttributeValuePair> </ModifyServiceTemplate> </OrganizationRequests> </Requests> |
Load the modified XML file using amadmin and the format FederationManager-base/fm/bin/amadmin —u amadmin —w password —i war—staging—directory -t name-of-XML-file.
Make the following changes in the AMConfig.properties file.
AMConfig.properties is located in /FederationManager-base/web-src/WEB-INF/. Multiple entries are pipe-separated.
Add the distinguished name (DN) of the administrator to the com.sun.identity.authentication.special.users property.
(Optional) Change the DN of the administrator in the com.sun.identity.authentication.super.user property.
This step is included if you want to use an administrator who already exists in your directory and not the default Federation Manager administrator amadmin. To use the default amadmin, create the user in Directory Server and make sure the user is given read, write and search permissions to the ou=services branch of the directory information tree (DIT).
Change the value of the admin.auth.classname property to com.sun.identity.authentication.internal.server.LocalLdapAuthModule.
In the serverconfig.xml file, change the value of the server group internalauthentication property to reflect the administrator DN, password and correct base DN.
serverconfig.xml is located in /FederationManager-base/web-src/WEB-INF/.
Regenerate and redeploy the WAR.
Restart the web container, if applicable.
Use ldapsearch in the following format to find values in Active Directory that begin with iplanet-am-auth-admin-auth-module.
/usr/bin/ldapsearch -b OU=default,OU=OrganizationConfig,OU=1.0, OU=iPlanetAMAuthService,OU=services,ROOTSUFFIX -D admin-dn -w admin-password -s base -h AD-host -p AD-port "(objectclass=*)" sunkeyvalue |
The search result would look like this:
sunkeyvalue=iplanet-am-auth-admin-auth-module= <AttributeValuePair><Value>com.sun.identity.authentication. modules.flatfile.FlatFileREQUIRED</Value></AttributeValuePair> |
Save the search result as it will be used in the following step as the value for the Delete entry.
Save the following text as a Lightweight Directory Interchange Format (LDIF) file.
dn: OU=default,OU=OrganizationConfig,OU=1.0, OU=iPlanetAMAuthService,OU=services,<ROOTSUFFIX> changetype:modify delete:sunkeyvalue sunkeyvalue: iplanet-am-auth-admin-auth-module=<AttributeValuePair> <Value>com.sun.identity.authentication.modules. flatfile.FlatFileREQUIRED</Value> </AttributeValuePair> dn: OU=default,OU=OrganizationConfig,OU=1.0, OU=iPlanetAMAuthService,OU=services,<ROOTSUFFIX> changetype:modify add:sunkeyvalue sunkeyvalue: iplanet-am-auth-admin-auth-module=<AttributeValuePair> <Value>com.sun.identity.authentication.modules. ldap.LDAPREQUIRED</Value></AttributeValuePair> |
Type the found values from the previous step into the Delete section of the saved LDIF file.
Type the new values into the Add section of the saved LDIF file.
Run ldapmodify using the LDIF file as input.
/usr/bin/ldapmodify -h AD-host -p AD-port -D adminDN -w admin-password -f name-of-LDIF-file
Make the following changes in the AMConfig.properties file.
AMConfig.properties is located in /FederationManager-base/web-src/WEB-INF/. Multiple entries are pipe-separated.
Add the distinguished name (DN) of the administrator to the com.sun.identity.authentication.special.users property.
(Optional) Change the DN of the administrator in the com.sun.identity.authentication.super.user property.
This step is included if you want to use an administrator who already exists in your directory and not the default Federation Manager administrator amadmin. To use the default amadmin, create the user in Directory Server and make sure the user is given read, write and search permissions to the ou=services branch of the directory information tree (DIT).
Change the value of the admin.auth.classname property to com.sun.identity.authentication.internal.server.LocalLdapAuthModule.
In the serverconfig.xml file, change the value of the server group internalauthentication property to reflect the administrator DN, password and correct baseDN.
serverconfig.xml is located in /FederationManager-base/web-src/WEB-INF/.
Regenerate and redeploy the WAR.
Restart the web container, if applicable.