How do I configure Security?

How do I configure Security?

Pramati Server security is based on Java Authentication and Authorization Service (JAAS) specification.

JAAS is the Java API for providing standard security features for applications and enables services to verify and enforce access controls on users. It extends an access control architecture to the J2EE platform by implementing Java version of the standard Pluggable Authentication Module (PAM) framework.

Server Security can be configured for:

• Realms
• URL access control

How do I configure Realms?

• User name/password-based realm that uses XML-based repository
• User name/password-based realm that uses DB-based repository
• User name/password-based realm that uses LDAP-based repository
• Certificate-based realm that uses certificates for authentication

In a standalone node, the realm is implemented as an XML-based realm. In a cluster node, the realm is implemented as a DB-based realm.

For further details on realms, read Defining Security Realms.

How do I set up Password Protection?

• Plain Text - Password stored a in clear text format.
• Base 64 - Password stored in an encoded format. Not recommended as it is not hack proof.
• Hash - Hash of the password is stored. Recommended. The password can only be compared and cannot be retrieved. Hence should not be used for applications involving Digest Authentication.
• Encrypted - Encrypted form of the password is stored. The default algorithm type is ‘DES’.

One of the above ways can be selected while adding a realm based on XML and DB.

What are XML-Based Realms?

XML-based realm is typically used when there are limited users in the realm. This can occur when the applications deployed on the server do not use any security features or when the application is expected to have limited users.

Table 1: Initial options for the XML-based realm

If the provided path does not have the valid XML file, it will be created. If the file exists, the user/group information is picked up from the file.

What is the Default DB-Based Realm?

This implementation uses a database with the following tables for storing user names, passwords and groups:

• User table: stores the user names and passwords
• Groups table: stores the group names
• Usergroup table: stores the user-group mappings

The default implementation assumes that all the columns are of the SQL VARCHAR type.

What are the features of a DB-Based Realm?

• In-memory caching of user information.
• Detecting weak passwords.
• Enforcing periodic password changes.
• Password protection through encryption/hashing using custom JCE/JCA providers.
• Pluggable PersistanceManager API, when the DB columns are not of the SQL VARCHAR type.
• Using existing database tables of user information.
• Option to store password in encoded and clear formats in the table.

How do I use LDAP Server for Authentication and Authorization?

The most common and popular repository is LDAP Server. LDAP Servers provide a common repository and can be used for authentication and authorization services.

Pramati Server can use any LDAP v2 or v3 compliant Server for authentication and authorization. The following LDAP directory servers have been tested on Pramati Server:

• Open LDAP
• Active Directory shipped as part of Windows 2000

To enable Pramati Server to use LDAP Server for authentication and authorization, an LDAP based realm must be configured.

How do I Perform Authentication in LDAP-Based Realm?

To authenticate a user, Pramati Server uses the user name and password, and tries to connect to the LDAP Server. If the connection succeeds, the user is assumed to be authenticated.

How do I perform Authorization in LDAP-Based Realm?

User-Group Mapping is maintained by LDAP Servers in three ways.

Group has ‘user’ as attribute

This is the most common way to store the user-group mapping in the LDAP Server where group node in the LDAP server has users as attributes.

User has ‘group’ as attribute

In this case, user has group as attribute specifying the groups the user belongs to.

User DN contains the group mapping

In this case, the DN for the user has the group information. For example if the DN for a user is 'uid=Tom, ou=admin, ou=Employees, dc=xyz,dc=com', and if ‘ou’ is taken as the group key, this DN implies that user ‘Tom’ belongs to two groups, ‘admin’ and ‘Employee’.

Pramati Server supports all the three types of user-group mapping.

How do I use Certificate-Based Realm?

For authentication in this realm, the user presents the certificate to the server. For the server to trust and authenticate this certificate, the server certificate of the signing authority or the certificate itself should be in the trusted CA Certificate store. This store is located at <install_dir>\server\nodes\<node_name>\trustedcacert.

The Certificate-based realm uses the KeyLoginModule.

The following table lists the classes that implement the Certificate-based realm:

Table 2: Classes that implement the Certificate-based realm

What is LoginModule?

What is KeyUserManager?

The initial option for the KeyLoginModule and the KeyUserManager are the same. The only difference is that the realm option is not available to the KeyUserManager class.

How do I add Realm using the Console?

• XML-based Realm
• LDAP-based Realm
• DB-based Realm

How do I create XML-Based Realms?

1. On the Console, select Configure > Security.
2. To add a new realm, under the section Realm select XML-based from the drop-down list and click Add.
3. Provide the name for the realm and the path for the XML. The password can be set based on the available algorithm types discussed in the previous section.
4. Click Save. A new XML-based realm is created, which will be listed in the realm page. For configuring the groups, click the settings link for the specified realm.

You can add the following for this realm:

• A Group
• A User
• A Permission

How do I create DB-Based Realms?

Table 3: Step 2 of adding a DB-based realm

To encrypt passwords for a DB-based realm, provide the algorithm type for the password field. The various algorithm types are described in the previous section. After providing the necessary details for the DB-based realm, click Save.

You can add Groups to the realm by clicking the settings link. Provide here the names of the Groups you would like to add to the realm. The new DB-based realm is created. If the DB tables do not exist, they are created.

How do I detect Weak Passwords?

Following is a sample implementation which throws an exception if the password length is < 6 characters:

import com.pramati.services.security.BadPasswordException;
import com.pramati.security.base.CheckPasswordSecurity;
import java.util.Properties;
public class SampleCheckPasswordSecurity implements CheckPasswordSecurity
{public void isPasswordSecure(Properties options, String password)
	throws BadPasswordException
	{if (password.length()<6)
	 throw new BadPasswordException("Password is too short");
	}
}

How do I use Cracklib to detect weak passwords?

To enable this facility:

1. Download the latest version of cracklib and extract it to the <install_dir>\cracklib.
2. Setup your CLASSPATH to point to <install_dir>\cracklib.
3. Run java org.solinger.cracklib.Packer make <install_dir>\config\cracklib.dict words. This creates a compressed dictionary file needed by cracklib under the <install_dir>\config directory.

How do I set up a Realm to use Cracklib?

1. Add <install_dir>\cracklib\classes to your server's CLASSPATH. If the server is already running, restart the server after changing the CLASSPATH.
2. When you create a DB-based realm, specify the value for the init option checkPasswordClass as com.pramati.security.loginmodules.db.CracklibCheckPasswordSecurity and dictionaryWordsFileName in the LoginModules option while adding the realm.

Note: Setup your realm to use Cracklib when you are creating it. If you want to set it up later, you need to make modifications to the security-config.xml located at <install_dir>\server\nodes\<node_name>\config.

How do I create LDAP-Based Realms for Pramati Server?

Table 4: Step 2 of adding an LDAP-based realm

In case the LDAP Server does not have the User group Mapping and LDAP is used only for authentication and not for authorization, the mapping can be defined in an XML file.

How do I create Users and Groups in LDAP-Based Realm?

In case the user-group Mapping is not there in LDAP Server and XML is used for this purpose, the user and group can be added to the XML from the Console. However, the user must be present in the LDAP Server for authentication to succeed.

How do I add Groups?

1. On the Console, select Configure > Security in the Explore panel. This displays the Security screen. By default, the system realm is defined when you install Server.
2. Click Settings for an existing realm. This leads you to the Security > Realm screen that displays the details of the selected realm. The existing Groups, Permissions, Login Module, and User Manager are listed in this page.
3. Under the Groups section, click Add. This leads you to the Security > Realm > Add Group screen for adding a group.
4. Provide the Name for the Group to be added, and select the available Groups and Users to be added to the new Group. The selected group will be added as a sub-group for this group.

If the realm is an LDAP realm, and the User-Group mapping is in LDAP, the Group cannot be added to that realm.

In case of a DB-based realm, if an existing table is being used for a User, Group, and User-Group, and its structure is different from the default structure used by the Server, it may not be possible to add a group or a User to the DB-based realm.

On the next screen, add Permissions for the new Group, and click Save. This adds the group to the realm. The details are provided on the main page.

How do I add Sub-groups?

1. Click Settings for an existing realm. This leads you to the Security > Realm screen that displays the details of the selected realm.
2. Under the Groups section, clicking on Add leads you to the Security > Realm > Add Group screen for adding a group.
3. Provide the Name for the Group to be added.
4. Select the available Groups to be added to the new Group and click the >> button.
5. The selected group will be added as a sub-group for this group and click Save.

How do I remove Sub-groups?

1. Start and connect to Server.
2. On the Console, select Configure > Security in the Explore panel.
3. Click Settings for an existing realm.
4. Click on the group name from which the sub-group has to be deleted. All sub-groups and users associated with this group are displayed.
5. Select the required sub-group using the checkbox, and click Delete.

Note: When you delete a sub-group from a parent group, you only remove the parent-child association. The sub-group and the other associations of the group (if any) are retained in the realm.

How do I add Permissions?

1. On the Console, select Configure > Security in the Explore panel.
2. Click Settings for an existing realm.
3. Under the Permissions section, click Add. This displays the Security > Realm > Add Permission screen for adding a group.
4. Enter a name and select the permission type from the drop-down list. Read the section on Permission Types -- add link for more information.
5. Click Add.

How do I associate Actions and Groups with Permissions?

1. Start and connect to Server.
2. On the Console, select Configure > Security in the Explore panel.
3. Click any existing realm. The realm appears and the existing permissions and groups are listed in this page.
4. Click the required permission.
5. A list of existing groups and the actions that are permitted for the selected permission appears in the Permissions page.
6. Select the required actions against the required group.
7. Click Save.

How do I delete Permissions?

1. Start and connect to Server.
2. On the Console, select Configure > Security in the Explore panel.
3. Click any existing realm. By default, the system realm is defined when you install Server.
4. The realm page appears. The existing permissions and groups are listed in this page.
5. Select the permission that has to be deleted from the list of permissions and click Delete.

How do I add Users?

1. Start and connect to Server.
2. On the Console, select Configure > Security in the Explore panel.
3. Click Settings for an existing realm.
4. Under the Groups section, click Add User. This leads you to the Security > Realm > User screen for adding a user. Provide the following details for the new user:

   Table 5: Adding a User

   Fields	Description
   Name	Name of the new User
   Password	To authenticate the new user name
   Retype Password	Confirm your password here
   Groups	Select the available Groups to which the new User is to be added using the ‘>>’ option

5. Click Save. This adds the user to the selected group, that shows an increment in its number of Users field. Clicking the Group name link displays the details for the User.

If no Group has been selected while adding the User, the user is added to the ‘Everybody’ group, and can be later on assigned to any group.

To make changes to the password and the group fields, click Edit against the selected user.

How do I delete Users?

To delete a user from a specific group:

1. Click the required group. The list of existing users and permissions appears in the Group page.
2. Select the user to be deleted from the list using the checkbox, and click Delete.

To remove a user from the server:

1. Select Configure > Security > Edit > All Users. The list of existing users and permissions appears.
2. Select the user to be deleted from the list using the checkbox, and click Delete.

How do I change Passwords?

1. Select Start > Programs > Pramati <version_no.> > Server Administration.
2. Enter the user name as root and password as pramati and press Enter to login to the Console.
3. On the Console screen, select Configure. There are two ways for changing the password:
   • Using the User Settings
   • Using the Security option

How do I use User Settings to change Passwords?

How do I use Security Option to Change Passwords?

• Groups
• Permissions
• Login Module
• User Manager

Changing Password for Users in Groups

Under Groups, click All Users. This takes you to the Security > Realm > Users screen. Click Settings for the user for which the password is to be changed. This takes you to a screen for editing the following details:

Table 6: Changing Password for the selected Group

The name of the user is displayed by default. Click Save to go back to the Security > Realm page.

How do I set URL Access Control?

Select Enable Access Control. Now click Allow IPs and provide the list of IPs that can access the specified application. The request will be honoured only when the request comes from the specific IP for the requested application.

What is Server Authentication for Web Clients?

When an authentication needs to be done using the Web client, the Web client passes all the necessary values to the security framework for the same. If the authentication is username/password based, then basic authentication or form authentication is used. But if the authentication is Certificate-based using HTTPS, the SSL layer takes care of authenticating the client.

What is Server Authentication for Standalone Java Clients?

In case the authentication needs to be done on username/password based realm, the com.pramati.security.client.ClientLoginModule, should be used.

In case the authentication needs to be done on a Certificate-based realm, the com.pramati.security.client.ClientCertificateLoginModule should be used. Once the client gets authorized, the subject is populated along with the principals and sent back to the client.

This ClientLoginModule abstracts the complexity of authentication process from the client and returns a handle to LoginContext which could then be used to log on.

To perform server authentication:

1. Define a login configuration file by specifying the port on which the server is listening and the realm into which the user wishes to log in.
2. Write a client program that creates a LoginContext and invokes the login() method. Read Sample CertificateClientLoginModule for Server authentication.
3. Invoke the client program and specify the path and name of the configuration file as a parameter.

What is a Configuration File?

Example of a configuration file:

Login {com.pramati.security.client.ClientLoginModule required com.pramati.realm="realm://127.0.0.1:9191/system"; };
The module option com.pramati.realm specifies the server location, port number (//127.0.0.1/9191) and realm (system) to which the user wishes to log in.

How do I invoke ClientLogin?

java -Djava.security.auth.login.config=<pathtologin.cfg> <client’s class name>

In both Web and Java client authentication, the login information is stored in a log file by the security auditor.

Related Documents

• http://java.sun.com/security/jaas/doc/api.html
• http://java.sun.com/security/jaas/doc/acsac.html

© Pramati Technologies 2007	Runs on Pramati Server | Feedback | Legal