Using an LDAP Server for Repository User Management

You can configure the Java CAPS Repository to use an LDAP server for user management. When a user attempts to log into the Repository, the user name and password are checked against the user name and password that are stored in the LDAP server. In addition, the list of roles for the user is retrieved from the server to authorize the user’s access to various objects in the Repository.

To configure LDAP support with Java CAPS, you need to configure the LDAP server and then configure the Java CAPS Repository. See the appropriate section below to configure the LDAP server:

• Configuring Oracle Internet Directory for the Repository

• Configuring Oracle Virtual Directory for the Repository

• Configuring Oracle Directory Server Enterprise Edition for the Repository

• Configuring the Active Directory Service for the Repository

• Configuring the OpenLDAP Directory Server for the Repository

You configure the Repository so it can locate the LDAP server and find the appropriate information (such as the portion of the directory that contains users). For instructions, see Configuring the Repository for LDAP Support. If you want to encrypt communications between the Repository and the LDAP server, see Configuring the Repository for LDAP and SSL Support.

Managing Java CAPS Users provides basic information about Repository user management.

Configuring Oracle Virtual Directory for the Repository

Oracle Virtual Directory accesses information from multiple directories and databases, giving you a single entry point into the information stored in these directories. Oracle Virtual Directory does not store user and group entries, so instead of configuring Oracle Virtual Directory you configure the LDAP servers to which it connects.

You can perform most administrative tasks, such as configuring the schema and managing the LDAP directory entries, through the Oracle Directory Services Manager or using a set of command-line tools. Oracle Directory Services Manager is available from Oracle Enterprise Manager Fusion Middleware Control or directly from its own URL.

The Data Browser on the Oracle Directory Services Manager lets you browse, add, and modify entries using the Data Browser . Directory entries appear in the data tree in the left panel, which you can expand to see more information.

To Configure LDAP Servers Connected to Oracle Virtual Directory

Perform the following general steps to create the user and roles for each LDAP directory that will connect to Java CAPS through the Oracle Virtual Directory. More complete instructions are provided for certain LDAP directories in the following sections:

• Configuring Oracle Internet Directory for the Repository

• Configuring Oracle Directory Server Enterprise Edition for the Repository

• Configuring the Active Directory Service for the Repository

• Configuring the OpenLDAP Directory Server for the Repository

1. Create the admin user and the Administrator user under the directory where user entries are stored.
2. Create the roles all, administration, and management under the top node.
3. Assign the new roles you just created to the admin user and the Administrator user.
4. Go to Configuring the Repository for LDAP Support.

Configuring Oracle Internet Directory for the Repository

Oracle Internet Directory runs as an application on an Oracle database. It includes the following main components:

• Oracle directory server

• Oracle directory replication server

• Directory administration tools, including:

  • Oracle Directory Services Manager

  • Command-line tools

  • Oracle Internet Directory pages in Oracle Enterprise Manager Fusion Middleware Control

• Oracle Internet Directory Software Developer's Kit

As with Oracle Virtual Directory, you can perform administrative tasks, such as configuring the schema and managing the LDAP directory entries, using Oracle Directory Services Manager (described in Configuring Oracle Internet Directory for the Repository) or a set of command line tools. Oracle Directory Services Manager is available from Oracle Enterprise Manager Fusion Middleware Control or directly from its own URL.

To Configure Oracle Internet Directory

1. Connect to the Oracle Directory Services Manager (either through Oracle Fusion Middleware Control or directory through its URL).
2. Create the admin user and the Administrator user in the directory containing the LDAP users. Assign these users the following object classes:

   • person

   • top

   • organizationalPerson

3. Create a new organizational unit for Java CAPS roles in your domain, and assign it a unique name (for example, CAPSRoles). Assign the new unit the following object classes:

   • organizationalUnit

   • top

4. Under the new organizational unit, create the following groups: all, administration, and management. Assign the groups the following object classes:

   • organizationalRole

   • top

   • groupOfUniqueNames

5. Add the admin user and the Administrator user as unique members of all the groups that you created.
6. Go to Configuring the Repository for LDAP Support.

Configuring Oracle Directory Server Enterprise Edition for the Repository

Oracle Directory Server Enterprise Edition version 5.x includes the following primary components:

• Directory Server

• Administration Server

• Directory Server console

The Directory Server console enables you to perform most administrative tasks. The console contains four top-level tabs: Tasks, Configuration, Directory, and Status. The Directory tab displays the directory entries as a tree. You can browse, display, and edit all of the entries and attributes from this tab.

You can also perform administrative tasks manually by editing configuration files or by using command-line utilities.

Oracle Directory Server Enterprise Edition version 6.x provides the following ways for you to manage the entries in a directory:

• Directory Service Control Center (DSCC)

• Directory Editor

• ldapmodify and ldapdelete command-line utilities

DSCC is integrated into the Oracle Java Web Console. DSCC contains five top-level tabs: Common Tasks, Directory Servers, Proxy Servers, Server Groups, and Settings. To access the page where you can browse, add, and modify entries, click the Directory Servers tab, click the name of a server, and then click the Entry Management tab. The Directory Information Tree (DIT) appears on the left.

You can also use the Common Tasks tab to create a new entry or browse data.

To Configure Oracle Directory Server Enterprise Edition

1. Create the admin user and the Administrator user under the People directory.
2. Create the roles all, administration, and management under the top node.
3. Assign the roles that you created to the admin user and the Administrator user.
4. Go to Configuring the Repository for LDAP Support.

Configuring the Active Directory Service for the Repository

Active Directory is a key part of Windows 2003. It provides a wide variety of manageability, security, and interoperability features. The main administration tool is a snap-in called Active Directory Users and Computers.

Active Directory does not support the concept of roles. Therefore, you must simulate the Java CAPS roles in Active Directory using the concept of groups.

Rather than creating the groups within the Users directory, you create the groups in a new organizational unit called CAPSRoles.

To Configure the Active Directory Service

1. Start the Active Directory Users and Computers administration tool.
2. Create a new organizational unit for Java CAPS roles:
   1. Right-click the root node and select New > Organizational Unit.

      The New Object - Organization Unit dialog box appears.

   2. In the Name field, enter a value (for example, CAPSRoles).
   3. Click OK.
3. Under the organizational unit, create the following groups: all, administration, and management. To create a group, you right-click the organizational unit and select New > Group. Use the default values for Group scope and Group type.

   After you add the groups, they appear under the organizational unit.

4. Add the admin user and the Administrator user as members of all the groups that you created by double-clicking each group and selecting admin and Administrator from the dialog box.
5. Go to Configuring the Repository for LDAP Support.

Configuring the OpenLDAP Directory Server for the Repository

The OpenLDAP Project provides an open source implementation of the LDAP protocol. The LDAP server runs as a standalone daemon called slapd. The main configuration file is called slapd.conf. This file contains global information specific to the database and the back end. You can use various approaches to add entries to the database, such as using the slapadd program. To search the database, use the ldapsearch program.

For more information, see http://www.openldap.org.

To Configure the OpenLDAP Directory Server

1. Create the admin user and the Administrator user under the node where the users are located.
2. If you do not have a node for roles in your schema, then create a node for the Java CAPS-specific roles that you will create in the following step. For example:

   dn: ou=CAPSRoles, dc=oracle, dc=com
   objectClass: top
   objectClass: organizationalUnit
   ou: CAPSRoles

3. Create the roles all, administration, and management under the node where the roles are located. Add the admin user and the Administrator user as unique members of each role. For example:

   dn: cn=all, ou=CAPSRoles, dc=oracle, dc=com
   objectClass: top
   objectClass: groupOfUniqueNames
   cn: all
   ou: CAPSRoles
   uniqueMember: uid=admin, ou=People, dc=oracle, dc=com
   uniqueMember: uid=Administrator, ou=People, dc=oracle, dc=com
   
   dn: cn=administration, ou=CAPSRoles, dc=oracle, dc=com
   objectClass: top
   objectClass: groupOfUniqueNames
   cn: administration
   ou: CAPSRoles
   uniqueMember: uid=admin, ou=People, dc=oracle, dc=com
   uniqueMember: uid=Administrator, ou=People, dc=oracle, dc=com
   
   dn: cn=management, ou=CAPSRoles, dc=oracle, dc=com
   objectClass: top
   objectClass: groupOfUniqueNames
   cn: management
   ou: CAPSRoles
   uniqueMember: uid=admin, ou=People, dc=oracle, dc=com
   uniqueMember: uid=Administrator, ou=People, dc=oracle, dc=com

4. Add other users to one or more roles, as necessary. For example:

   dn: cn=all, ou=CAPSRoles, dc=oracle, dc=com
   objectClass: top
   objectClass: groupOfUniqueNames
   cn: all
   ou: CAPSRoles
   uniqueMember: uid=admin, ou=People, dc=oracle, dc=com
   uniqueMember: uid=Administrator, ou=People, dc=oracle, dc=com
   uniqueMember: uid=userA, ou=People, dc=oracle, dc=com
   uniqueMember: uid=userB, ou=People, dc=oracle, dc=com
   
   dn: cn=administration, ou=CAPSRoles, dc=oracle, dc=com
   objectClass: top
   objectClass: groupOfUniqueNames
   cn: administration
   ou: CAPSRoles
   uniqueMember: uid=admin, ou=People, dc=oracle, dc=com
   uniqueMember: uid=Administrator, ou=People, dc=oracle, dc=com
   uniqueMember: uid=userB, ou=People, dc=oracle, dc=com
   
   dn: cn=management, ou=CAPSRoles, dc=oracle, dc=com
   objectClass: top
   objectClass: groupOfUniqueNames
   cn: management
   ou: CAPSRoles
   uniqueMember: uid=admin, ou=People, dc=oracle, dc=com
   uniqueMember: uid=Administrator, ou=People, dc=oracle, dc=com

5. Go to Configuring the Repository for LDAP Support.

Configuring the Repository for LDAP Support

To use an LDAP server for Repository user management, you must add a <Realm> element to the Repository’s server.xml file, which is located in the JavaCAPS-install-dir/repository/repository/server/conf directory. The server.xml file contains a default <Realm> element that specifies a flat file implementation of the user database. The flat file implementation uses the tomcat-users.xml file in the JavaCAPS-install-dir/repository/repository/data/files directory.

The following table describes the attributes used by the LDAP versions of the <Realm> element. For a detailed description of all the possible attributes, see the Tomcat documentation for the org.apache.catalina.realm.JNDIRealm class.

To Configure the Repository

1. Open the server.xml file in the JavaCAPS-install-dir/repository/repository/server/conf directory.
2. Remove or comment out the default <Realm> element.
3. If you are using Oracle Internet Directory or Oracle Virtual Directory, add the following <Realm> element inside the <Engine> tag. Change the values shown below as necessary. The preceding table describes the attributes.

   <Realm className="org.apache.catalina.realm.JNDIRealm"
       connectionURL="ldap://localhost:3060"
       connectionName="cn=oracleadmin"
       connectionPassword="OpCT/AcQGL/ch+GN460Zcg="
       userBase="cn=People,dc=oracle,dc=com"
       userSearch="(cn={0})"
       userSubtree="true"
       roleBase="ou=CAPSRoles,dc=sun,dc=com"
       roleName="cn"
       roleSearch="(uniqueMember={0})"
       roleSubtree="true"
   />

   ---

   Note - For the connectionName property, enter the DN of the administrator user. The value of the connectionPassword property must be encrypted. You can use the encrypt utility provided with Java CAPS, located in JavaCAPS_Home\repository\repository\util. This utility uses the following syntax:

   encrypt passsword

   Where password is the unencrypted password for the user. The utility will display the encrypted version of the password.

   ---

4. If you are using Oracle Directory Server Enterprise Edition, add the following <Realm> element inside the <Engine> tag. Change the values shown below as necessary. The preceding table describes the attributes.

   <Realm className="org.apache.catalina.realm.JNDIRealm"
       connectionURL="ldap://localhost:489"
       userBase="cn=People,dc=oracle,dc=com"
       userSearch="(uid={0})"
       userSubtree="true"
       userRoleName="nsroledn"
       userRoleNamePattern="cn={0},dc=oracle,dc=com"
       roleSubtree="true"
   />

5. If you are using Active Directory, add the following <Realm> element inside the <Engine> tag. Change the values shown below as necessary. The preceding table describes the attributes.

   <Realm className="org.apache.catalina.realm.JNDIRealm"
       connectionURL="ldap://localhost:389"
       userBase="cn=Users,dc=oracle,dc=com"
       userSearch="(cn={0})"
       userSubtree="true"
       roleBase="ou=CAPSRoles,dc=oracle,dc=com"
       roleName="cn"
       roleSearch="(member={0})"
       roleSubtree="true"
   />

6. If you are using OpenLDAP Directory Server, add the following <Realm> element inside the <Engine> tag. Change the values shown below as necessary. The preceding table describes the attributes.

   <Realm className="org.apache.catalina.realm.JNDIRealm"
       connectionURL="ldap://localhost:389"
       userBase="ou=People,dc=oracle,dc=com"
       userSearch="(uid={0})"
       userSubtree="true"
       roleBase="ou=CAPSRoles,dc=oracle,dc=com"
       roleName="cn"
       roleSearch="(uniquemember={0})"
       roleSubtree="true"
   />

7. If your LDAP server is not configured for anonymous read access, add the connectionName and connectionPassword attributes to the <Realm> element. Set the first attribute to the DN of the Administrator user. Set the second attribute to the user’s encrypted password. Refer to the following examples.

   Oracle Directory Server Enterprise Edition:

   connectionName="cn=Directory Manager"
   connectionPassword="E451KDVb0OPcH+GN46OZcg=="

   Active Directory:

   connectionName="Administrator@oracle.com"
   connectionPassword="geEiVIbtO+DcH+GN46OZcg=="

   OpenLDAP Directory Server:

   connectionName="cn=Manager,dc=oracle,dc=com"
   connectionPassword="l/ZRt1cfNKc="

   To encrypt the password, use the encrypt utility in the JavaCAPS-install-dir/repository/repository/util directory. The file extension of the utility depends on your platform. This utility takes the unencrypted password as an argument. For example:

   C:\JavaCAPS6\repository\repository\util>encrypt mypwd
   LCUApSkYpuE

8. Save and close the server.xml file.
9. Start the LDAP server.
10. Shut down and restart the Repository.

Configuring the Repository for LDAP and SSL Support

By default, communications between the Repository and the LDAP server are unencrypted. To encrypt communications between the Repository and the LDAP server, make the following additions and modifications to the procedures described earlier in this topic.

Configuring SSL on the LDAP Server

Ensure that the LDAP server is configured to use the Secure Sockets Layer (SSL). For detailed instructions, see the documentation provided with the LDAP server. In preparation for the next step, export the LDAP server’s certificate to a file.

Importing the LDAP Server’s Certificate

You must add the LDAP server’s certificate to the Repository’s list of trusted certificates. The list is located in a file called cacerts. In the following procedure, you use the keytool program. This program is included with the Java SDK.

To Import the LDAP Server’s Certificate

1. Navigate to the JDK-install-dir/jre/bin directory.

   Use the JDK that was specified during the installation of the Repository.

2. Run the following command:

   keytool -import -trustcacerts -alias alias -file certificate_filename 
   -keystore cacerts_filename

   For the -alias option, you can assign any value.

   For the -file option, specify the fully qualified name of the LDAP server’s certificate. For example:

   C:\mycertificate.cer

   For the -keystore option, specify the fully qualified name of the cacerts file. The cacerts file is located in the JDK-install-dir/jre/lib/security directory. For example:

   C:\Java\jdk1.6.0_06\jre\lib\security\cacerts

3. When prompted, enter the keystore password. The default password is changeit.
4. When prompted to trust this certificate, enter yes.

   The following message appears:

   Certificate was added to keystore

Modifying the LDAP Server URL

To use the Repository with LDAP and SSL, you need to modify the Realm element you created when you performed the steps described in Configuring the Repository for LDAP Support.

To Modify the LDAP Server URL

1. Navigate to JavaCAPS_Home\repository\repository\server\conf.
2. Open server.xml in a text editor.
3. In the Realm element you created for the LDAP server, update the connectURL property by setting the protocol to ldaps and setting the port number to the port number that the LDAP server listens on for SSL requests.

   Typically, this number is 636. For example:

   <Realm className="org.apache.catalina.realm.JNDIRealm"
       connectionURL="ldaps://myldapserver:636"
       ...