type=page status=published title=Administering User Security next=message-security.html prev=system-security.html ~~
This chapter provides instructions for administering user security in
the {productName} environment by using the asadmin
command-line utility. {productName} enforces its authentication and
authorization policies upon realms, users, and groups. This chapter
assumes that you are familiar with security features such as
authentication, authorization, and certificates. If you are not, see
Administering System Security.
The following topics are addressed here:
Instructions for accomplishing these tasks by using the Administration Console are contained in the Administration Console online help.
Note
|
JSR-375 defines the concept of an Identity Store, and an SPI interface for writing providers that can authenticate users against Identity Stores. It also provides two built-in providers. This mechanism is conceptually similar to Authentication Realms, but can be configured and managed by applications. See Working with Identity Stores in The Jakarta EE Tutorial for more information about Identity Stores. |
The following topics are addressed here:
An authentication realm, also called a security policy domain or
security domain, is a scope over which the {productName} defines and
enforces a common security policy. {productName} is preconfigured
with the file, certificate, and administration realms. In addition, you
can set up LDAP, JDBC, digest, Oracle Solaris, or custom realms. An
application can specify which realm to use in its deployment descriptor.
If the application does not specify a realm, {productName} uses its
default realm (file
).
- File realm
-
{productName} stores user credentials locally in a file named
keyfile
. The file realm is the initial default realm. - Administration realm
-
The administration realm is also a file realm and stores administrator user credentials locally in a file named
admin-keyfile
. - Certificate realm
-
{productName} stores user credentials in a certificate database. When using the certificate realm, the server uses certificates with the HTTPS protocol to authenticate web clients.
- LDAP realm
-
{productName} can get user credentials from a Lightweight Directory Access Protocol (LDAP) server such as Oracle Virtual Directory (OVD) (
http://www.oracle.com/technetwork/middleware/id-mgmt/overview/index.html
), Oracle Internet Directory (OID) (http://www.oracle.com/technetwork/indexes/products/index.html
), and Oracle Directory Server Enterprise Edition (http://www.oracle.com/us/products/middleware/identity-management/oracle-directory-services/index.html
). LDAP is a protocol for enabling anyone to locate organizations, individuals, and other resources such as files and devices in a network, whether on the public Internet or on a corporate intranet.
See To Configure LDAP Authentication with OID for instructions on configuring {productName} to work with an OVD/OID LDAP provider.NoteBy default, {productName} performs LDAP group search. If you have not created any groups in LDAP, the search fails.
To disable LDAP group search in LDAP user name search, set the
com.oracle.enterprise.security.auth.realm.ldap.DISABLEGROUP_SEARCH
Java system property totrue
in the required {productName} instance or cluster configurations:asadmin> create-jvm-options --target=target -Dcom.oracle.enterprise.security.auth.realm.ldap.DISABLEGROUP_SEARCH=true
where target is the {productName} instance or cluster for which you are disabling LDAP group search. For more information about the
create-jvm-options
subcommand, see the {productName} Reference Manual. - JDBC realm
-
{productName} gets user credentials from a database. The server uses the database information and the enabled JDBC realm option in the configuration file.
- Digest realm
-
Digest Authentication authenticates a user based on a user name and a password. However, the authentication is performed by transmitting the password in an encrypted form.
- Oracle Solaris realm
-
{productName} gets user credentials from the Oracle Solaris operating system. This realm is supported on the Oracle Solaris 9 and Oracle Solaris 10 operating systems. Consult your Oracle Solaris documentation for information about managing users and groups in the Oracle Solaris realm.
- PAM realm
-
A Pluggable Authentication Module (PAM) realm allows applications deployed on {productName} to authenticate users against a native Unix (Solaris/Linux/Mac OS) users list. PAM realms use the class name
com.sun.enterprise.security.auth.realm.pam.PamRealm
and the JAAS ContextpamRealm
.
This realm is supported on all Unix Operating Systems, including the Oracle Solaris 9 and Oracle Solaris 10 operating systems - Custom realm
-
You can create other repositories for user credentials, such as a relational database or third-party components. For more information about custom realms, see the Administration Console online help. For instructions on creating a custom realm, see " Creating a Custom Realm" in {productName} Application Development Guide.
The {productName} authentication service can govern users in multiple realms.
Use the create-auth-realm
subcommand in remote mode to create an
authentication realm.
-
Ensure that the server is running. Remote subcommands require a running server.
-
Create a realm by using the
create-auth-realm
subcommand.
Information about properties for this subcommand is included in this help page.
Example 2-1 Creating a Realm
This example creates a realm named db
.
asadmin> create-auth-realm --classname com.iplanet.ias.security.
auth.realm.DB.Database --property defaultuser=admin:Password=admin db
Command create-auth-realm executed successfully.
See Also
You can also view the full syntax and options of the subcommand by
typing asadmin help create-auth-realm
at the command line.
For information on creating a custom realm, see "Creating a Custom Realm" in {productName} Application Development Guide.
Use the list-auth-realms
subcommand in remote mode to list the
existing authentication realms.
-
Ensure that the server is running. Remote subcommands require a running server.
-
List realms by using the
list-auth-realms
subcommand.
Example 2-2 Listing Realms
This example lists the authentication realms on localhost
.
asadmin> list-auth-realms
db
certificate
file
admin-realm
Command list-auth-realms executed successfully.
See Also
You can also view the full syntax and options of the subcommand by
typing asadmin help list-auth-realms
at the command line.
Use the set
subcommand to modify an existing authentication realm.
Note
|
A custom realm does not require server restart. |
-
List realms by using the
list-auth-realms
subcommand. -
Modify the values for the specified thread pool by using the
set
subcommand.The thread pool is identified by its dotted name.
-
To apply your changes, restart {productName}.
See "To Restart a Domain" in {productName} Administration Guide.
Use the delete-auth-realm
subcommand in remote mode to delete an
existing authentication realm.
-
Ensure that the server is running. Remote subcommands require a running server.
-
List realms by using the
list-auth-realms
subcommand. -
If necessary, notify users that the realm is being deleted.
-
Delete the realm by using the
delete-auth-realm
subcommand. -
To apply your changes, restart {productName}. See "To Restart a Domain" in {productName} Administration Guide.
Example 2-3 Deleting a Realm
This example deletes an authentication realm named db
.
asadmin> delete-auth-realm db
Command delete-auth-realm executed successfully.
See Also
You can also view the full syntax and options of the subcommand by
typing asadmin help delete-auth-realm
at the command line.
{productName} enables you to specify a user’s credentials (user name
and password) in the JDBC realm instead of in the connection pool. Using
the jdbc
type realm instead of the connection pool prevents other
applications from browsing the database tables for user credentials.
Note
|
By default, storage of passwords as clear text is not supported in the JDBC realm. Under normal circumstances, passwords should not be stored as clear text. |
-
Create the database tables in which to store user credentials for the realm.
How you create the database tables depends on the database that you are using. -
Add user credentials to the database tables that you created.
How you add user credentials to the database tables depends on the database that you are using. -
Create a JDBC connection pool for the database.
See " To Create a JDBC Connection Pool" in {productName} Administration Guide. -
Create a JDBC resource for the database.
" To Create a JDBC Resource" in {productName} Administration Guide. -
Create a realm.
For instructions, see To Create an Authentication Realm.NoteThe JAAS context should be
jdbcDigestRealm
for digest authentication orjdbcRealm
for other authentication types. -
Modify the deployment descriptor to specify the
jdbc
realm.
Modify the deployment descriptor that is associated with your application.-
For an enterprise application in an Enterprise Archive (EAR) file, modify the
sun-application.xml
file. -
For a web application in a Web Application Archive (WAR) file, modify the
web.xml
file. -
For an enterprise bean in an EJB JAR file, modify the
sun-ejb-jar.xml
file.
For more information about how to specify a realm, see " How to Configure a Realm" in {productName} Application Development Guide.
-
-
Assign security roles to users in the realm.
To assign a security role to a user, add asecurity-role-mapping
element to the deployment descriptor that you modified. -
Verify that the database is running.
If needed, see "To Start the Database" in {productName} Administration Guide. -
To apply the authentication, restart the server.
See "To Restart a Domain" in {productName} Administration Guide.
Example 2-4 Assigning a Security Role
This example shows a security-role-mapping
element that assigns the
security role Employee
to user Calvin
<security-role-mapping>
<role-name>Employee</role-name>
<principal-name>Calvin</principal-name>
</security-role-mapping>
This procedure explains how to configure {productName} to use LDAP authentication with Oracle Internet Directory.
-
Install Oracle Enterprise Manager 11g and the latest Enterprise Manager patches, if they are not installed already.
Instructions for installing Oracle Enterprise Manager are provided in the Oracle Enterprise Manager (http://docs.oracle.com/cd/E11857_01/index.html
) documentation set. -
Install the Oracle Identity Management Suite (IDM) 11g and Patch Set 2 or later, if they are not installed already.
Instructions for installing the Oracle Identity Management suite are provided in Oracle Fusion Middleware Installation Guide for Oracle Identity Management (http://docs.oracle.com/cd/E12839_01/install.1111/e12002.html
). -
Configure SSL for Oracle Internet Directory (OID), if it is not configured already. Configure the OID instance in the server authentication mode and with the protocol version set to SSLv3
Instructions for configuring SSL for OID are provided in the SSL chapter of Oracle Internet Directory Administrator’s Guide (http://docs.oracle.com/cd/B14099_19/idmanage.1012/b14082/ssl.html
). -
Using Oracle Wallet Manager, export an SSL self-signed certificate you want to use with {productName}.
Instructions for using Oracle Wallet Manager to create and export SSL certificates are provided in the "Configure Oracle Internet Directory for SSL" (http://docs.oracle.com/cd/B14099_19/idmanage.1012/b14082/ssl.html#CHDCADIJ
) section of the SSL chapter in Oracle Internet Directory Administrator’s Guide (http://docs.oracle.com/cd/B14099_19/idmanage.1012/b14082/ssl.html
). -
On the {productName} side, use the
keytool
command import the certificate you exported with Oracle Wallet Manager.
Thekeytool
command is available in the$JAVA_HOME/bin
directory. Use the following syntax:keytool -importcert -alias "alias-name" -keystore domain-dir/config/cacerts.jks -file cert-name
where the variables are defined as follows:
- alias-name
-
Name of an alias to use for the certificate
- domain-dir
-
Name of the domain for which the certificate is used
- cert-name
-
Path to the certificate that you exported with Oracle Wallet Manager.
For example, to import a certificate named
oi.cer
for a {productName} domain in/glassfish7/glassfish/domains/domain1
, using an alias called "OID self-signed certificate," you would use the following command:keytool -importcert -alias "OID self signed certificate" -keystore \ /glassfish7/glassfish/domains/domain1/config/cacerts.jks -file oid.cer
-
Restart the {productName} domain.
See "To Restart a Domain" in {productName} Administration Guide. -
Use the Oracle Enterprise Manager
ldapmodify
command to enable Anonymous Bind for OID.
For example:ldapmodify -D cn=orcladmin -q -p portNum -h hostname -f ldifFile
In this example, the LDIF file might contain the following:
dn: cn=oid1,cn=osdldapd,cn=subconfigsubentry changetype: modify replace: orclAnonymousBindsFlag orclAnonymousBindsFlag: 1
To disable all anonymous binds, you would use a similar LDIF file with the last line changed to:
orclAnonymousBindsFlag: 0
See "Managing Anonymous Binds" (
http://docs.oracle.com/cd/E14571_01/oid.1111/e10029/authentication.html#CACJEJDA
) in Oracle Fusion Middleware Administrator’s Guide for Oracle Internet Directory (http://docs.oracle.com/cd/E14571_01/oid.1111/e10029.html
) for complete instructions on theldapmodify
command.
This procedure explains how to configure {productName} to use LDAP authentication with Oracle Virtual Directory.
-
Create the OVD adapter, as described in the "Creating and Configuring Oracle Virtual Directory Adapters" (
http://docs.oracle.com/cd/E12839_01/oid.1111/e10046/basic_adapters.html#BABCBGJA
) chapter of Administrator’s Guide for Oracle Virtual Directory (http://docs.oracle.com/cd/E12839_01/oid.1111/e10046.html
). -
Configure SSL for Oracle Virtual Directory (OVD), if it is not configured already. For instructions on configuring SSL for OVD, see the section "Enable SSL for Oracle Virtual Directory Using Fusion Middleware Control" in SSL Configuration in Oracle Fusion Middleware (
http://docs.oracle.com/cd/E12839_01/core.1111/e10105/sslconfig.html#ASADM1800
).Also, configure the SSL for the OVD listener in server authentication mode.
-
Export the certificate from JKS keystore you want to use with {productName}. See "Exporting a Keystore Using Fusion Middleware Control" (
http://docs.oracle.com/cd/E16764_01/core.1111/e10105/wallets.html#CIHECAIB
) for information. -
On the {productName} side, use the
keytool
command to import the certificate you exported from the JKS keystore.
Thekeytool
command is available in the$JAVA_HOME/bin
directory. Use the following syntax:keytool -importcert -alias "alias-name" -keystore domain-dir/config/cacerts.jks -file cert-name
where the variables are defined as follows:
- alias-name
-
Name of an alias to use for the certificate
- domain-dir
-
Name of the domain for which the certificate is used
- cert-name
-
Path to the certificate that you exported from the keystore.
For example, to import a certificate named
ovd.cer
for a {productName} domain in/glassfish7/glassfish/domains/domain1
, using an alias called "OVD self-signed certificate," you would use the following command:keytool -importcert -alias "OVD self signed certificate" -keystore \ /glassfish7/glassfish/domains/domain1/config/cacerts.jks -file ovd.cer
-
Restart the {productName} domain.
See "To Restart a Domain" in {productName} Administration Guide.
This procedure explains how to enable LDAP authentication for logins to
the {productName} Domain Administration Server (DAS). Logging in to
the DAS is typically only performed by {productName} administrators
who want to use the {productName} Administration Console or asadmin
command. See To Configure LDAP Authentication with OID for
instructions on enabling general LDAP authentication for {productName}.
Before you begin, ensure that you have followed the configuration instructions in To Configure LDAP Authentication with OID
Use the asadmin configure-ldap-for-admin
subcommand to enable user
authentication to the {productName} DAS.
Use the following syntax:
asadmin configure-ldap-for-admin --basedn "dn-list" --url [ldap|ldaps]://ldap-url
--ldap-group group-name
where the variables are defined as follows:
- dn-list
-
basedn parameters
- ldap-url
-
URL and port number for the LDAP server; can use standard (
ldap
) or secure (ldaps
) protocol - group-name
-
LDAP group name for allowed users, as defined on the LDAP server.
For example:
asadmin configure-ldap-for-admin --basedn "dc=red,dc=iplanet,dc=com" \
--url ldap://interopoel54-1:3060 --ldap-group sqestaticgroup
asadmin configure-ldap-for-admin --basedn "dc=red,dc=iplanet,dc=com" \
--url ldaps://interopoel54-1:7501 --ldap-group sqestaticgroup
See Also
See configure-ldap-for-admin
for more information
about the configure-ldap-for-admin subcommand
.
A user is an individual (or application program) identity that is defined in {productName}. A user who has been authenticated is sometimes called a principal.
As the administrator, you are responsible for integrating users into the {productName} environment so that their credentials are securely established and they are provided with access to the applications and services that they are entitled to use.
The following topics are addressed here:
Use the create-file-user
subcommand in remote mode to create a new
user by adding a new entry to the keyfile
. The entry includes the user
name, password, and any groups for the user. Multiple groups can be
specified by separating the groups with colons (:).
Note
|
If secure administration is enabled as described in Running Secure Admin, you cannot create an administrative user with a blank password. |
Creating a new file
realm user is a dynamic event and does not require
server restart.
-
Ensure that the server is running. Remote subcommands require a running server.
-
If the user will belong to a particular group, see the current groups by using the
list-file-groups
subcommand. -
Create a file user by using the
create-file-user
subcommand.
Example 2-5 Creating a User
This example create user Jennifer
on the default realm file
(no groups are specified).
The asadmin
--passwordfile
option specifies the name of a file that
contains the password entries in a specific format. The entry for a
password must have the AS_ADMIN_
prefix followed by the password name
in uppercase letters, an equals sign, and the password. See
asadmin
(1M) for more information.
asadmin> create-file-user --user admin
--passwordfile=c:\tmp\asadminpassword.txt Jennifer
Command create-file-user executed successfully.
See Also
You can also view the full syntax and options of the subcommand by
typing asadmin help create-file-user
at the command line.
Use the list-file-users
subcommand in remote mode to list the users
that are in the keyfile
.
-
Ensure that the server is running. Remote subcommands require a running server.
-
List users by using the
list-file-users
subcommand.
Example 2-6 Listing File Users
This example lists file users on the default file
realm file.
asadmin> list-file-users
Jennifer
Command list-file-users executed successfully.
See Also
You can also view the full syntax and options of the subcommand by
typing asadmin help list-file-users
at the command line.
A group is a category of users classified by common traits, such as job
title or customer profile. For example, users of an e-commerce
application might belong to the customer
group, and the big spenders
might also belong to the preferred
group. Categorizing users into
groups makes it easier to control the access of large numbers of users.
A group is defined for an entire server and realm. A user can be
associated with multiple groups of users.
A group is different from a role in that a role defines a function in an
application, while a group is a set of users who are related in some
way. For example, in the personnel application there might be groups
such as full-time
, part-time
, and on-leave
. Users in these groups
are all employees (the employee
role). In addition, each user has its
own designation that defines an additional level of employment.
Use the list-file-groups
subcommand in remote mode to list groups for
a file user, or all file groups if the --name
option is not specified.
-
Ensure that the server is running. Remote subcommands require a running server.
-
List file groups by using the
list-file-groups
subcommand.
Example 2-7 Listing Groups for a User
This example lists the groups for user joesmith
.
asadmin> list-file-groups --name joesmith
staff
manager
Command list-file-groups executed successfully
Use the update-file-user
subcommand in remote mode to modify the
information in the keyfile
for a specified user.
Note
|
If secure administration is enabled as described in Running Secure Admin, you cannot update an administrative user to have a blank password. |
-
Ensure that the server is running. Remote subcommands require a running server.
-
Update the user information by using the
update-file-user
subcommand. -
To apply your changes, restart {productName}.
See "To Restart a Domain" in {productName} Administration Guide.
Example 2-8 Updating a User
The following subcommand updates the groups for user Jennifer
.
asadmin> update-file-user --passwordfile c:\tmp\asadminpassword.txt --groups
staff:manager:engineer Jennifer
Command update-file-user executed successfully.
See Also
You can also view the full syntax and options of the subcommand by
typing asadmin help update-file-user
at the command line.
Use the delete-file-user
subcommand in remote mode to remove a user
entry from the keyfile
by specifying the user name. You cannot delete
yourself, that is, the user you are logged in as cannot be deleted
during your session.
-
Ensure that the server is running. Remote subcommands require a running server.
-
List users by using the
list-file-users
subcommand. -
Delete the user by using the
delete-file-user
subcommand.
Example 2-9 Deleting a User
This example deletes user Jennifer
from the default file
realm.
asadmin> delete-file-user Jennifer
Command delete-file-user executed successfully.
See Also
You can also view the full syntax and options of the subcommand by
typing asadmin help delete-file-user
at the command line.