Enabling LDAP authentication in eXtreme Scale catalog and container servers

Enable your WebSphere® eXtreme Scale servers and catalog servers for Lightweight Directory Access Protocol (LDAP) authentication with a Java™ Authentication and Authorization Service (JAAS) policy file used for authorization.

1. Create a wxs_ldap.config file; for example:

   LDAPLogin {      
   	com.ibm.websphere.objectgrid.security.plugins.builtins.SimpleLDAPLoginModule required      
   	providerURL=”ldap://yourldapserver.yourcompany.com:389/”      
   	factoryClass=”com.sun.jndi.ldap.LdapCtxFactory”;  
   }; 

2. Create a wxs_ldap.auth.config file.
   Replace the principal with the user that logs in to the data grid. Also replace YourGridName with the name of your data grid. Repeat this step as necessary for additional users and data grids. See the following example:

   grant codebase "http://www.ibm.com/com/ibm/ws/objectgrid/security/PrivilegedAction"
       principal javax.security.auth.x500.X500Principal "CN=manager,O=acme,OU=sample" {
       permission com.ibm.websphere.objectgrid.security.MapPermission "YourGridName.*", "all";
   
       permission com.ibm.websphere.objectgrid.security.ObjectGridPermission "YourGridName", "all";
   };
   

   Alternatively, you can grant permission to all data grids; for example:

   grant codebase “http://www.ibm.com/com/ibm/ws/objectgrid/security/PrivilegedAction”
       principal javax.security.auth.x500.X500Principal “CN=manager,O=acme,OU=sample” {
       permission com.ibm.websphere.objectgrid.security.MapPermission “*.*”, “all”;
   
       permission com.ibm.websphere.objectgrid.security.ObjectGridPermission “*”, “all”;
   };

3. Create a server-side security.xml file; for example:

   <?xml version=”1.0” encoding=”UTF-8”?>
   <securityConfig xmlns:xsi=”http://www.w3.org/2001/XMLSchema-instance”
       xsi:schemaLocation=”http://ibm.com/ws/objectgrid/config/security ../objectGridSecurity.xsd”
   xmlns=”http://ibm.com/ws/objectgrid/config/security”>
   <security securityEnabled=”true” loginSessionExpirationTime=”300” >     
           <authenticator className=
   					”com.ibm.websphere.objectgrid.security.plugins.builtins.LDAPAuthenticator”>
           </authenticator>
       </security>
   </securityConfig>

4. Edit your objectGridServer.properties file with the following properties.
   If you do not have an objectGridServer.properties file, you can use the sampleServer.properties file that is in the wxs_home/properties directory to create your properties file.

   securityEnabled=true
   
   credentialAuthentication=Required
   

5. Configure and start your catalog servers.
   1. To configure LDAP in WebSphere Application Server, open the WebSphere Application Server administrative console. Click Servers > WebSphere Application Servers > server_name > Java and process management > Java virtual machine > generic JVM arguments.
      Enter the following values:

      -Dobjectgrid.cluster.security.xml.url=file:///security/security.xml 
      -Dobjectgrid.server.props="/security/objectGridServer.properties" 
      -Djava.security.policy="/security/wxs_ldap_auth.config"
      -Djava.security.auth.login.config=”/security/wxs_ldap.config"

      You can alternatively configure the java.security.auth.login.config property using the following steps. In that case, you can omit the -Djava.security.auth.login.config property, which is referenced in the previous example. This change takes effect for all container and catalog servers that are running in WebSphere Application Server.

      Note: When you run in WebSphere Application Server use the -Djava.security.auth.policy property, not the -Djava.security.policy property.

      1. In the administrative console, click Security > Global Security > Java Authentication and Authorization Service > Application logins.
      2. Click New to add an entry with the alias, LDAPLogin, and click Apply.
      3. Under JAAS login modules, click New. Enter com.ibm.websphere.objectgrid.security.plugins.builtins.SimpleLDAPLoginModule and Sufficient as the Authentication strategy.
      4. Under Custom properties, enter the provider URL ldap://yourldapserver.yourcompany.com:389/, and for factory class, enter com.sun.jndi.ldap.LdapCtxFactory.
      5. Click OK and Save.

      Start your WebSphere Application Servers containing the catalog servers as you normally would.

   2. To configure LDAP in stand-alone environments, append the JVM arguments after the -jvmArgs flag; for example:

      startOgServer.[sh|bat] <catalog server arguments> \
                                 -jvmArgs -Dobjectgrid.cluster.security.xml.url=file:///security/security.xml \
                                 -Dobjectgrid.server.props="/security/objectGridServer.properties" \
                                 -Djava.security.policy="/security/wxs_ldap_auth.config" \
                                 -Djava.security.auth.login.config=”/security/wxs_ldap.config"
      
          startXsServer.[sh|bat] <catalog server arguments> \
                                 -jvmArgs -Dobjectgrid.cluster.security.xml.url=file:///security/security.xml \
                                 -Dobjectgrid.server.props="/security/objectGridServer.properties" \
                                 -Djava.security.policy="/security/wxs_ldap_auth.config" \
                                 -Djava.security.auth.login.config=”/security/wxs_ldap.config"

      Deprecated: The startOgServer and stopOgServer commands start servers that use the Object Request Broker (ORB) transport mechanism. The ORB is deprecated, but you can continue using these scripts if you were using the ORB in a previous release. The IBM eXtremeIO (XIO) transport mechanism replaces the ORB. Use the startXsServer and stopXsServer scripts to start and stop servers that use the XIO transport.
6. Configure and start your container servers.

   Configure and start your container servers in the way that you did with your catalog servers, except omit the objectgrid.cluster.security.xml.url JVM argument.

7. Edit your client-side objectGridClient.properties file.
   If WebSphere Application Server is the client, then the file that you update is was_profile_dir/properties.

      securityEnabled=true
   
      credentialAuthentication=Supported
   

8. Configure your client to pass the required LDAP login credentials.
   Load a client properties file. This file can contain the user ID and password. If the properties file does not include the user ID and password, add them to the configuration in the client program. In the following example, a client properties file is loaded, and then, the user ID and password are added to the configuration.

   Note: Some lines of code are displayed on multiple lines for publishing purposes only.

   String clientPropertiesFile = “/path/to/objectGridClient.properties”;
   String userid = “CN=manager,O=acme,OU=sample”;
   String pw=”password”;
   
   //Creates a ClientSecurityConfiguration object using the specified file
   ClientSecurityConfiguration clientSC =
      ClientSecurityConfigurationFactory.getClientSecurityConfiguration(clientPropertiesFile);
   
   //Creates a CredentialGenerator using the user and password.
   CredentialGenerator credGen = new UserPasswordCredentialGenerator(userid,password);
   clientSC.setCredentialGenerator(credGen);
   
   // Create an ObjectGrid by connecting to the catalog server
   ClientClusterContext ccContext = ogManager.connect(“cataloghostname:2809”, clientSC, null);
   ObjectGrid og = ogManager.getObjectGrid(ccContext, “YourGridName”);’

LDAPLogin {
       com.ibm.websphere.objectgrid.security.plugins.builtins.SimpleLDAPLoginModule required
       providerURL=”ldaps://yourldapserver.yourcompany.com:636/”
       factoryClass=”com.sun.jndi.ldap.LdapCtxFactory”;
};