IBM Tivoli Access Manager for e-business

Oracle9iAS Portal / Single Sign-On (Release2) Integration

I

Document Version Number: 1.0Document Creation Date: 3.11.02Document Update Date: 8.8.02Authors: Neil ReadshawStatus: Available Under NDA

Copyright Notice

© Copyright IBM Corporation 2001. All rights reserved. May only be used pursuant to a Tivoli Systems Software License Agreement, an IBM Software License Agreement, or Addendum for Tivoli Products to IBM Customer or License Agreement. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any computer language, in any form or by any means, electronic, mechanical, magnetic, optical, chemical, manual, or otherwise, without prior written permission of IBM Corporation. IBM Corporation grants you limited permission to make hardcopy or other reproductions of any machine-readable documentation for your own use, provided that each such reproduction shall carry the IBM Corporation copyright notice. No other rights under copyright are granted without prior written permission of IBM Corporation. The document is not intended for production and is furnished “as is” without warranty of any kind. All warranties on this document are hereby disclaimed, including the warranties of merchantability and fitness for a particular purpose.

U.S. Government Users Restricted Rights—Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corporation.

Trademarks

IBM, the IBM logo, Tivoli, the Tivoli logo, AIX, Cross-Site, NetView, OS/2, Planet Tivoli, RS/6000, Tivoli Certified, Tivoli Enterprise, Tivoli Enterprise Console, Tivoli Ready, and TME are trademarks or registered trademarks of International Business Machines Corporation or Tivoli Systems Inc. in the United States, other countries, or both.

Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both.

UNIX is a registered trademark of The Open Group in the United States and other countries.

Java and all Java-based trademarks are trademarks of Sun Microsystems, Inc. in the United States, other countries, or both.

Notices

References in this publication to Tivoli Systems or IBM products, programs, or services do not imply that they will be available in all countries in which Tivoli Systems or IBM operates. Any reference to these products, programs, or services is not intended to imply that only Tivoli Systems or IBM products, programs, or services can be used. Subject to valid intellectual property or other legally protectable right of Tivoli Systems or IBM, any functionally equivalent product, program, or service can be used instead of the referenced product, program, or service. The evaluation and verification of operation in conjunction with other products, except those expressly designated by Tivoli Systems or IBM, are the responsibility of the user. Tivoli Systems or IBM may have patents or pending patent applications covering subject matter in this document. The furnishing of this document does not give you any license to these patents. You can send license inquiries, in writing, to the IBM Director of Licensing, IBM Corporation, North Castle Drive, Armonk, New York 10504-1785, U.S.A.

II

Table of Contents

Table of Contents........................................................................................................................................ iii

Document History........................................................................................................................................ iv

Abstract....................................................................................................................................................... 1

About Oracle9i Application Server................................................................................................................2

About IBM Tivoli Access Manager for e-business..........................................................................................4

Integration Architecture................................................................................................................................ 6

Integration Diagram............................................................................................................................... 6

Software Versions................................................................................................................................. 6

Oracle............................................................................................................................................ 6

IBM Tivoli Access Manager for e-business.......................................................................................6

Configuration Procedure.............................................................................................................................. 7

IBM Tivoli Access Manager for e-business..............................................................................................7

Oracle9iAS............................................................................................................................................ 7

Testing the Configuration....................................................................................................................... 9

Troubleshooting..................................................................................................................................... 9

Appendix – Oracle-supported Database Modules.......................................................................................10

III

Document History

Version Date Description By

1.0 05/21/2002 Created from 9iAS Release 1 document. Neil Readshaw

IV

Abstract

IBM Tivoli Access Manager for e-business provides single sign-on and centrally managed authorization solutions to the Enterprise. This document describes how IBM Tivoli Access Manager can be configured to provide single sign-on to the suite of Oracle9iAS components. Oracle9iAS components authenticate through the Oracle9iAS Single Sign-On Server, which in turn can delegate authentication to a third-party single sign-on server, such as Tivoli Access Manager. By providing the integration of the Oracle9iAS Single Sign-On Server with Tivoli Access Manager, single sign-on access to Oracle’s suite of SSO-enabled web-based applications is automatically achieved. Oracle9iAS Portal is used as a specific example.

1

About Oracle9i Application Server

From the Oracle web site:

Oracle9i Application Server (Oracle9iAS) is the industry's fastest, most complete and integrated J2EE application server. Oracle9iAS can save you money with built-in portal software, wireless and voice, Web page caching, powerful business intelligence features, complete integration, and more, pre-integrated in a single product. Oracle9iAS supports all major J2EE, Web services and XML industry standards, and its open and integration-ready architecture ensures that your Web applications can integrate with your IT environment.

SINGLE SIG-ON IN ORACLE 9iAS

The Oracle9i Application Server (Oracle9iAS) provides a comprehensive, standard, and extensible set of security services for deploying business applications on the web, including single sign-on (SSO), directory, and Java security services. These services allow users to integrate custom business logic and third party products with Oracle web applications and tools in a single security framework.

DIRECTORY-ENABLED SECURITY VIA OID

Oracle has standardized on LDAP as the common mechanisam for Oracle products to manage enterprise information about users and services in the enterprise. To support this, Oracle has developed a highly scalable, reliable, and sec re LDAPv3-co pliant directory, Oracle Internet Directory (OID) based on Oracle9i’s proven database technology. OID provides LDAP directory services to Oracle products, and Oracle products in turn certify their LDAP implementation against OID.

JAVA SECURITY IN ORACLE 9IAS

The Oracle9iAS JAAS provider implements the Java2 Security Model, allowing application developers to obtain authenticated user (principal) identity fro a set of standard authentication services provided by JAAS, and to manage the privileges which principals have for accessing objects. It also supports privilege delegation, for managing privileges of methods invoked by principals.

JAAS AUTHENTICATION The Oracle9iAS JAAS provider supports a flexible authentication framework. It provides specific mechanisms for authentication, based on SSL and SSO, but also allows developers to integrate custom authentication modules through the standard JAAS Login Mod le API.

JAAS AUTHORIZATION In addition to providing a complete role-based access control model for authorization, the Oracle9iAS JAAS implementation provides developers with architectural flexibility when managing authorizations. Choices include managing authorization centrally using LDAP, and through the file system via an XML-based API.

2

About IBM Tivoli Access Manager for e-business

Under the Tivoli brand, IBM Software Group produces a suite of security management products. The full suite includes:

IBM Tivoli Access Manager

IBM Tivoli Identity Manager

IBM Tivoli Intrusion Manager

IBM Tivoli Privacy Manager

IBM Tivoli Access Manager is a robust and secure policy management tool for e-business and distributed applications. It addresses the challenges of escalating costs for e-business security, growing complexity of enterprise security solutions, and the inability to implement security policies across platforms. Through its highly available centralized authorization service, IBM Tivoli Access Manager enables better management of business-critical distributed information. It provides simple, secure access to critical information, and enhances communications with customers, business partners, and others.

Figure 1: IBM Tivoli Access Manager

IBM Tivoli Access Manager provides authentication and access control services for Web resources. The WebSEAL server, a component of IBM Tivoli Access Manager for e-business, manages access to all Web servers—regardless of their platforms. This allows an organization to centrally control their Web resources as a single, logical Web space.

IBM Tivoli Access Manager for Business Integration provides protection for MQSeries messages. It allows MQSeries applications to send data with confidentiality and integrity using keys associated with the sending and receiving users. The IBM Tivoli Access Manager authorization service provides access control to MQSeries based services,

3

restricting which users or processes can and cannot put messages on queues or get messages from queues.

IBM Tivoli Access Manager also provides application APIs to allow in-house developed applications to access IBM Tivoli Access Manager services. IBM Tivoli Access Manager supports the J2EE standard JAAS (Java Authentication and Authorization Service) to allow native Java applications to access IBM Tivoli Access Manager for authorization decisions. IBM Tivoli Access Manager also provides an implementation of the Open Group’s standard authorization C-language API (AznAPI) to allow applications that want to call out to a C API to use the IBM Tivoli Access Manager authorization and entitlements services.

IBM Tivoli Access Manager provides a robust web-based delegated security administration utility that allows delegate security administration to members of their eCommunity.

IBM Tivoli Access Manager is also the backbone for IBM Tivoli Privacy Manager, a product that helps implement e-business privacy policies.

4

Integration Architecture

Integration Diagram

Software Versions

Oracle

Oracle9iAS Portal Release 2

IBM Tivoli Access Manager for e-business

This integration will work with versions of IBM Tivoli Access Manager for e-business including Tivoli Policy Director WebSEAL 3.8 with e-Fix 7, Tivoli Access Manager WebSEAL 3.9 with e-Fix 1, and above. The lab work was performed with IBM Tivoli Access Manager for e-business Version 3.9 with WebSEAL e-Fix 1.

5

Configuration Procedure

IBM Tivoli Access Manager for e-business

After completing a standard installation and configuration of the WebSEAL component and its dependencies, the following additional configuration is required.

1. Create junctions to the various Oracle9iAS web server components. Those components (and default operating ports) are:

Component Default Port

Infrastructure Web Server 7777

Infrastructure Web Cache 7778

Portal Web Server 7779

2. For each junction, follow the notes below when selecting junction parameters.

a. It is important that the user id be passed to the application server by using the “-c iv_user” flag.

b. Ensure that the hostname supplied with the “-h” parameter is the fully-qualified DNS name of the application server machine.

c. If the server is running on a non-default HTTP port, add the “–v <fqdn>:<port>” parameter to the junction creation command.

d. Add “–j” to the junction options to ensure that JavaScript is filtered correctly.

e. Ensure that the “script-filter” parameter is set to “yes” in webseald.conf.

Oracle9iAS

Oracle provides an option for integrating with third-party single sign-on systems, with Oracle9iAS Single Sign-On Server. It provides an external authentication implementation for IBM Tivoli Access Manager for e-business.

It leverages the fact the WebSEAL will set the HTTP_IV_USER CGI environment variable after successfully authenticating the user. This module obtains the user's identity from this variable and sets it as the SSO user name for all Login Server (Oracle9iAS Single Sign-On) to partner application communication.

Installing this module requires these steps:

1. Ensure that Oracle9iAS Portal works in standalone mode, prior to integrating with Tivoli Access Manager.

6

2. Ensure that the HTTP_IV_USER CGI variable is passed to the PLSQL environment.

Note: this step must be repeated for both ORACLE_HOME environments – one for the Release 2 infrastructure, one for the Portal.

Edit the dads.conf file in $IAS_HOME/Apache/modplsql/cfg to include the following directive in all location stanzas:

PlsqlCGIEnvironmentList HTTP_IV_USER

This will add the HTTP_IV_USER CGI variable to the list of CGI environment variables passed by modplsql to the PLSQL environment to make it available to the Oracle9iAS Single Sign-On server's procedures, for inspection.

Restart the HTTP server to read the new configuration information:

# $ORACLE_HOME/dcm/bin/dcmctl stop c- ohs

# $ORACLE_HOME/dcm/bin/dcmctl start c- ohs

3. Verify ServerName (the name of the host on which Oracle9iAS is installed) is set correctly in $IAS_HOME/Apache/httpd.conf - ensure that it is correct, and lowercase (particularly on Windows 2000 systems). If a change was made, restart the HTTP server to read the new configuration information.

4. Install the Oracle9iAS Single Sign-On Server external auth module in place of the default.

$ sqlplus orasso/orasso

SQL> @ssowbsl.sql

Package body created.

No errors.

PL/SQL procedure successfully completed.

Commit complete.

No errors.

SQL> quit

7

$

Testing the Configuration

Use a URL similar to the one below to access the welcome page of the portal.

http[s]://<webseal-server>/<oracle-portal-junction>/pls/portal

Click on the Login link in the top right hand corner of the portal to gain access to the authenticated portal content.

Troubleshooting

1. Ensure that all Oracle patches are correctly applied as described in the Oracle Release Notes.

8

Appendix – Oracle-supported Database Modules

Load script and authentication module (Step 4 above)

9

10

© International Business Machines Corporation, 2001. IBM, the IBM logo, e(logo), DB2, and WebSphere are trademarks or registered trademarks of IBM Corporation in the United States, other countries, or both. Lotus is a trademark of Lotus Development Corporation and/or IBM Corporation in the United States, other countries, or both. Tivoli is a trademark of Tivoli Systems Inc. and/or IBM Corporation in the United States, other countries, or both. Pantone is a trademark of Pantone Inc. Other company, product and service names may be trademarks or service marks of others.