Configuring authorization by using LDAP groups

Authorize roles in IBM® Integration Bus against a Lightweight Directory Access Protocol (LDAP) or Secure LDAP (LDAPS) server.

1. Locate the ldap.auth.yaml web administration server security file.
   A sample file is provided, the relative path to which is server/sample/configuration/ldap.auth.yaml from the root of the IBM Integration Bus installation directory.

   It is good practice to copy the sample file and then modify the copy to suit your requirements. The original might serve as useful syntax reference for future use.

2. Amend the RestAdminListener: and Security: sections in the ldap.auth.yaml file with the values that you need.
   1. Update the RestAdminListener: section with values that define the actions that are performed when IBM Integration Bus checks whether a user is authorized. For example:

      RestAdminListener:
      # ldapAuthorizeUrl: ldap[s]://server[:port]/baseDN[?[attr_name][?[base|one|sub]][?filter_expr]]
        ldapAuthorizeUrl: ldap://ibmexample1:10389/dc=example,dc=com?ou?sub?(uid={{username}})  
      

   2. Update the Security: section to map values of LDAP attributes on LDAP objects to names of roles in IBM Integration Bus. For example:

      Security:
        LdapAuthorizeAttributeToRoleMap:
          businessgroup1: adminRole
          businessgroup2: viewRole

      If you have existing LDAP attributes and existing roles in IBM Integration Bus with different names, you must map from one to the other. LDAP objects with attribute values that do not match names of defined roles in IBM Integration Bus results in access being denied unless the attributes and roles are explicitly mapped in the web administration server security YAML file. You do not need to map in the following cases:

      • If values of LDAP group attributes match the names of roles in IBM Integration Bus.
      • If you configure LDAP attribute values to match names of existing roles in IBM Integration Bus.
      • If you create roles in IBM Integration Bus with names identical to values of LDAP attributes.
   In this example:

   • ibmexample1 is the hostname of the LDAP server
   • 10389 is the port number of the LDAP server
   • dc=example,dc=com is the base DN
   • ou is the attribute name
   • sub indicates that a subset of the LDAP tree structure is to be searched
   • uid={{username}} is the filter expression

   This configuration means that the following actions are performed when IBM Integration Bus checks whether a user is authorized:

   • A subtree-scoped LDAP search without SSL is performed on server ibmexample1 that is listening on port number 10389 for objects that are in the search base dc=example,dc=com that match the search filter uid={{username}}.
   • For every object that is matched during the search, the value of its ou attribute is returned. This value is assumed to identify an LDAP group.
   • If any of the returned values case-sensitively match businessgroup1, the web user is granted the IBM Integration Bus role of adminRole if it exists.
   • Similarly, if any of the returned values case-sensitively match businessgroup2, the web user is granted the IBM Integration Bus role of viewRole if it exists.
3. Save the modified file.
4. Create roles in IBM Integration Bus and set administration security authorization file permissions for those roles by using the mqsichangefileauth command. For example, define the adminRole and viewRole roles and permissions:

   mqsichangefileauth IBNODE -e IBSERVER -r adminRole -p read+,write+,execute+

   mqsichangefileauth IBNODE -e IBSERVER -r viewRole -p read+,write-,execute-

5. Enable LDAP security by using the mqsichangeauthmode command. For example:

   mqsichangeauthmode IBNODE -s active -m ldap

6. Define the credentials to bind to the LDAP server by using the mqsisetdbparms command. For example:

   mqsisetdbparms IBNODE -n ldap::ibmexample1 -u “uid=admin,ou=system” -p password

   where password is the password that is associated with the LDAP server.
7. Define the configuration for LDAP authentication. Use the mqsichangeproperties command to specify the URI for the LDAP server. For example:

   mqsichangeproperties IBNODE -b webadmin -o server -n ldapAuthenticationUri -v \"ldap://localhost:10389/dc=example,dc=com\"

8. Optional: Use the mqsichangeproperties command to specify a wildcard value for all users.
   By specifying a wildcard value, the identity of a user that is attempting to log in to IBM Integration Bus is passed to LDAP for authentication and, as a result of the LDAP group authorization settings that you have specified, role mapping is overridden and all users are no longer assigned to the same role. For example:

   mqsichangeproperties IBNODE -c -u '*' -x -r roleisoveridden

9. Use the mqsichangeproperties command to specify the path to the web administration server security YAML configuration file. For example:

   mqsichangeproperties IBNODE -b webadmin -o server -n ldapYamlPath -v "C:\LDAPEXAMPLE\ldap.auth.yaml"

10. Restart the integration node or integration server for the changes to take effect.