Configuring Basic Authentication for HTTP Servlets

Administering Security Features 5-31

5.12 Provisioning Resources in Oracle Internet Directory

The following sections provide an overview of how to provision Oracle WebLogic Communication Services resources when using Oracle Internet Directory as your LDAP provider. These instructions are necessary when using Digest Authentication with a precalculated hash value, or when configuring Basic authentication for HTTP Servlets. See the Oracle Fusion Middleware Administrators Guide for Oracle Internet Directory for more details about these procedures.

5.12.1 Configuring Oracle Internet Directory

You must configure the following mappings for the OID LDAP backend: ■ JAAS Usernames to LDAP User Entries--JAAS Java Authentication and Authorization Service user names are mapped to LDAP Users based on value of the orclcommonnicknameattribute under the node cn=Common,cn=Products,cn=OracleContext. For example, setting this attribute to uid implies that users authenticating against OID must provide their corresponding LDAP uid as their username during authentication. The rest of the configuration described in this chapter assumes that the orclcommonnicknameattribute is set to uid default value. ■ JAAS Realms to LDAP Subscribers--JAAS realms are mapped to LDAP Realm entries based on the value given to orclsubscribernicknameattribute under the root cn=Common,cn=Products,cn=OracleContext node for an OID deployment. For example, setting the value of orclsubscribernicknameattribute to o the letter o for an OID deployment implies that users authenticating against OID must belong to the JAAS realm identified by the value of the o attribute. Set the value of orclsubscribernicknameattribute to o. ■ JAAS Roles to LDAP Groups--Group membership determines the JAAS roles for a specific user. Mapping LDAP groups to JAAS roles is based on the value given to orclcommonnamingattribute under the node cn=Common,cn=Products,cn=OracleContext for each of the provisioned LDAP Realms. For example, if a user belongs to an LDAP group with the distinguished name of cn=Location Service, cn=groups, dc=example, dc=com and the orclcommonnamingattribute is set to cn, then that JAAS user is populated with the Location Service JAAS role. Set the value of orclcommonnamingattribute to cn

5.12.2 Configuring Static Verifiers

After configuring Oracle Internet Directory as described above, you must create a new product entry for Oracle WebLogic Communication Services OWLCS, install the static verifier, create entries for each instance of OWLCS, and grant verifier privileges to each new instance created. You must perform these steps before provisioning users in OID. If users already exist in OID, after creating and configuring the static verifier, users must reset their passwords before they can login successfully.

5.12.2.1 Add Oracle WebLogic Communication Services

To add the Oracle WebLogic Communication Services product to Oracle Internet Directory: 1. Start the oidadmin tool in ORACLE_HOMEbin and connect to the installed Oracle Internet Directory server. Login using orcladmin account and the password you chose during your installation of Oracle Internet Directory. 5-32 Oracle WebLogic Communications Server Administration Guide 2. Browse the Entry Management tree to find: cn=Products,cn=OracleContext,dc=example,dc=com. The exact domain part dc=example,dc=com will depend on the domain that you created when you installed Oracle Internet Directory 3. A convenient way to create a new entry for OWLCS is to clone an existing product entry. Select the first entry under Products this is generally the Calendar entry and right-click on the Calendar entry and choose Create Like. In the resulting dialog: Replace Calendar entry in dn with WLCS. Enter WLCS for cn

4. Click OK.

5. Select the Products entry, right-click and choose Refresh SubTree Entries and make sure that a new product with name WLCS shows up under Products.

5.12.2.2 Install the Static Verifier

Use the ldapadd command-line tool to install the static verifier, as follows:

1. Set the environmental variable ORACLE_HOME to point to the ORACLE_HOME

of your OID installation

2. Create an ldif file containing the following lines again replace the domain parts

with your domain: dn: cn=WLCSVerifierProfileEntry,cn=WLCS,cn=Products,cn=OracleContext,dc=exam ple,dc=com objectclass:top objectclass:orclpwdverifierprofile cn:WLCSVerifierProfileEntry orclappid:wlcs orclpwdverifierparams;authpassword: crypto:SASLMD5 realm:example.com usernameattribute:uid 3. cd ORACLE_HOME 4. Run the command .binldapadd -D cn=orcladmin -w password of orcladmin user -f yourfile.ldif 5. In oidadmin, refresh the WLCS product entry by right-clicking on entry and choosing Refresh SubTree Entries. The WLCSVerifierProfileEntry should appear

5.12.3 Add a New Oracle WebLogic Communication Services

To add a new Oracle WebLogic Communication Services Instance:

1. Select the WLCS product entry you created, right-click and choose Create.

2. In the Distinguished Name dn field enter orclApplicationCommonName=WLCSInstance1,cn=WLCS,cn=Products,cn=OracleContext,dc =example,dc=com replacing the domain part with your domain

3. Under Object Classes, click Add.