Enabling single sign on - Web applications in WebSphere 6.0
Recently I came across a requirement to enable single sign on between two different Web applications running on different machines but on the same domain. WebSphere does provide out of the box support of single sign on, but figuring it out took a lot of time for me. So I have written this step by step guide so that you don’t have to go through the torture again!
All the screenshots in this guide are taking from Rational Application Developer (RAD). I could configure everything except “roles to groups mapping” directly from RAD’s console. For configuring “roles to group mapping” I had to export and deploy the application from an EAR file.
1. Enabling WebSphere security
Check out the following screenshot which shows the settings I have selected under Security->Global Security.
a) LTPA is required when the Web applications are on the different machines but on same domain.
b) I used a custom user registry which checked the users against a database. A more common approach is to use LDAP.
2. Click on the “custom” link under user registries in Security->Global Security. Following settings were selected on this page.
a) userid and password given is a valid user id in the database.
b) MyUserRegistry implements com.ibm.websphere.security.UserRegistry interface and is copied to the “classes” folder inside WAS home folder.
3. Click on “LTPA” under authentication mechanisms. Single sign on can be enabled by clicking on the “Single Sign On” link on the right.
The above three steps completes the “Global Security” setup on WAS. Now we will configure JAAS for applying this security at the Web application level.
1. Configure web.xml of the application. This involves protecting Web resources using security-constraint entry. Following is a sample entry,
<security-constraint>
<web-resource-collection>
<web-resource-name>Protected Area</web-resource-name>
<url-pattern>*.do</url-pattern>
<http-method>DELETE</http-method>
<http-method>GET</http-method>
<http-method>POST</http-method>
<http-method>PUT</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>operator</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<realm-name>MyApp</realm-name>
<form-login-config>
<form-login-page>/logon.jsp</form-login-page>
<form-error-page>/logonError.jsp</form-error-page>
</form-login-config>
</login-config>
2. Implement a login page for application which conforms to WAS standards. Following is a sample page,
<html>
<title>Login</title>
<body>
<form method=”post” action=”j_security_check”>
Enter user ID and password:
User ID: <input type=”text” size=”20″ name=”j_username”>
Password: <input type=”password” size=”20″ name=”j_password”>
<input type=”submit” name=”login” value=”Login”>
</form>
</body>
</html>
3. While deploying bind web.xml roles with groups from UserRegistry. For simplicity you could also attach the entire role to “any authenticated user”.
Some common errors and their solution,
1. When I start RAD after enabling Global Security, it is in “starting” mode forever!
Open soap.client.props in base_v6\profiles\default\properties folder and add the userid and password fields as shown below. The userid/password must be the same as the one given on “custom user registry” page.
com.ibm.SOAP.loginUserid=test
com.ibm.SOAP.loginPassword=test
Run the following command on the command as shown. Replace the cell name and node name with the values on your machine. This reconfigures FileTransfer application with authentication.
D:\Rational\runtimes\base_v6\bin>wsadmin wsadmin.bat -profile redeployFileTransf
er.jacl -c “fileTransferAuthenticationOn machine97622Node01Cell machine97622Node01
server1″ -user test -password test
2. I am getting the following error,
Authentication failed for user: com.ibm.ws.console.security.ConnectToRuntimeException: null nested exception is com.ibm.websphere.security.CustomRegistryException
This means that custom user registry is not loaded. Ensure that you restart RAD after copying custom user registry class. Also ensure that custom user registry class is under classes folder (base_v6\classes on RAD)
3. I have an error which is not listed above?
Check the trace.log inside base_v6\profiles\default\logs\server1 folder. This should give a lot of information about the underlying problem. If you are still unable to resolve the issue, contact me!
