Managing users on Jazz Authorization Server

1. Add a user ID.
2. Add an associated password by using either of the following methods.
   • Enter a password as cleartext.
   • Run the JazzAuthServer_install_dir/wlp/bin/securityUtility script to encode the password. After the script completes, copy the output to the password attribute associated with the user ID.
     Tip: To run the securityUtility script, use the following syntax:

     securityUtility encode userPassword

     where userPassword is the password to encode.

1. Comment out or delete the line that includes this content:

   <include location="localUserRegistry.xml" optional="true"/>

2. Uncomment the line that contains this content:

   <include location="ldapUserRegistry.xml" optional="true"/>

3. If the group name that is used for Jazz administrator access is not JazzAdmins, complete the next steps.
   1. In the <oauth-roles> element, edit the following line.

      <group name="JazzAdmins"/>

   2. Change the group name attribute value from JazzAdmins to the name of your Jazz administrator group. For example, in the following sample configuration, the clientManager role is granted to members of the YourJazzAdmins group.

      <oauth-roles>
        <authenticated>
          <special-subject type="ALL_AUTHENTICATED_USERS"/>
        </authenticated>
        <clientManager>
          <group name="YourJazzAdmins"/>
        </clientManager>
      </oauth-roles>

   For more information, see Configuring an OpenID Connect Provider to accept client registration requests.

4. Save your changes and close the file.

1. Modify the <ldapRegistry> element for your LDAP registry.
   For information about changes to the <ldapRegistry> element, see Configuring a user registry for the Liberty profile.

   Note: The configuration parameters are basically the same as the parameters that are used to configure LDAP for WebSphere Application Server, except that they must be entered into an XML file instead of specified in an administrative UI.
2. Save your changes and close the file.

1. Open the JazzAuthServer_install_dir/wlp/usr/servers/jazzop/server.xml file in an editor.
2. Locate the SAML xml section and follow the instructions between the <!-- SAML> and <!-- end of SAML> comments to enable the SAML and SSL features.
3. Open the JazzAuthServer_install_dir/wlp/usr/servers/jazzop/appConfig.xml file in an editor.
4. Locate the SAML xml section between the <!-- SAML> and <!-- end of SAML> comments. Uncomment the <samlWebSso2.0> and <authFilter> elements.
   Note: The mapTouserRegistry="User" property ensures that users are recognized by the Jazz Authorization Server. You need this property only if your deployment includes Rational® solution for Collaborative Lifecycle Management (CLM) clients that are based on Eclipse technology. If you are using CLM web clients only, which retrieve group information directly from SAML, you do not need to use the mapToUserRegistry="User" property.
   Example: The following sample code shows the SAML section of an appConfig.xml file that is edited to support SAML 2.0.

   <samlWebSso20 
      id="defaultSP" 
         spCookieName="jazzop_sso_cookie_idp"
         forceAuthn="true"
         authFilterRef="samlAuthFilter">
   </samlWebSso20>
   
   <authFilter id="samlAuthFilter">
      <requestUrl id="samlRequestUrl" urlPattern="/authorize" matchType="contains" />
      <userAgent id="samlUserAgent" agent="Mozilla|Opera" matchType="contains" />
   </authFilter>

5. Save your changes and close the file.

1. In a browser window, export the spmetadata.xml file by using the following URL:

   https://host_name:ssl_port/ibm/saml20/defaultSP/samlmetadata

   Note: The port number is defined in the appConfig.xml file.
2. Save the file and record the location.
   Important: If you are not prompted to save the file, then there is a problem with the SAML configuration in the Jazz Authorization Server and the spmetadata.xml file is not exported. Check the SAML settings in the appConfig.xml and server.xml files.

JazzAuthServer_install_dir/wlp/usr/servers/jazzop/resources/security/idpmetadata.xml

https://JazzAuthServer:port/oidc/endpoint/jazzop/authorize

If you configured the Jazz Authorization Server correctly, the SAML IdP login window opens.

• For instructions about using a file-based registry server, see Configuring the Jazz Authorization Server to use a file-based user registry.
  Important: The user passwords that are stored in the IdP supersede any user passwords that are defined in the Jazz Authorization Server.
  Note: Assign group roles to users by creating members in the JazzAdmins, JazzUsers, JazzGuests, and JazzProjectAdmins groups.
• For instructions about using an LDAP server, see Configuring the Jazz Authorization Server to use an LDAP user registry.

1. Open a browser window outside the Jazz Authorization Server host environment and go to the following URL:

   host_name:ssl_port/oidc/endpoint/jazzop/.well-known/openid-configuration

2. Verify that the user registry is configured correctly by going to the following URL:

   host_name:ssl_port/oidc/endpoint/jazzop/registration