Novell ACCESS MANAGER 3.1 SP2 - J2EE AGENT GUIDE... Bedienungsanleitung

Novell

www.novell.com

novdocx (en) 16 April 2010

AUTHORIZED DOCUMENTATION

Novell Access Manager 3.1 SP2 J2EE Agent Guide

Access Manager

3.1 SP 2

June 11, 2010

J2EE Agent Guide

novdocx (en) 16 April 2010

Legal Notices

Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation, and

specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.

Further, Novell, Inc., reserves the right to revise this publication and to make changes to its content, at any time,

without obligation to notify any person or entity of such revisions or changes.

Further, Novell, Inc., makes no representations or warranties with respect to any software, and specifically disclaims

any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.,

reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to

notify any person or entity of such changes.

Any products or technical information provided under this Agreement may be subject to U.S. export controls and the

trade laws of other countries. You agree to comply with all export control regulations and to obtain any required

licenses or classification to export, re-export or import deliverables. You agree not to export or re-export to entities on

the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export laws.

You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. See the

Novell International Trade Services Web page (http://www.novell.com/info/exports/) for more information on

exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary export

approvals.

stored on a retrieval system, or transmitted without the express written consent of the publisher.

Novell, Inc.

404 Wyman Street, Suite 500

Waltham, MA 02451

U.S.A.

www.novell.com

Online Documentation: To access the latest online documentation for this and other Novell products, see

the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 16 April 2010

Novell Trademarks

For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/

trademarks/tmlist.html).

Third-Party Materials

All third-party trademarks are the property of their respective owners.

4Novell Access Manager 3.1 SP2 J2EE Agent Guide

novdocx (en) 16 April 2010

Contents 5

Contents

novdocx (en) 16 April 2010

About This Guide 9

1 Installing the J2EE Agents 11

1.1 Overview of the J2EE Agents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

1.2 Overview of the Sample Payroll Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

1.3 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

1.4 Software Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

1.5 Installing the J2EE Agents on JBoss . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

1.5.1 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

1.5.2 Installing and Configuring the JBoss Web Deployer Service. . . . . . . . . . . . . . . . . . . 14

1.5.3 Installing JBoss by Using the Installer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

1.5.4 Installing the JBoss Agent through the Console . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

1.6 Installing the J2EE Agent on WebSphere . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

1.6.1 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

1.6.2 Installing on WebSphere by Using the Installer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

1.6.3 Installing the WebSphere Agent through the Console. . . . . . . . . . . . . . . . . . . . . . . . 28

1.6.4 Configuring WebSphere for J2EE Agents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

1.7 Installing the J2EE Agent on WebLogic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

1.7.1 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

1.7.2 Installing WebLogic Agent by Using the Installer. . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

1.7.3 Installing a J2EE Agent through the Console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

1.7.4 Configuring WebLogic for J2EE Agents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

1.8 Verifying If a J2EE Agent Is Installed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

1.9 Uninstalling a J2EE Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

2 Configuring the Agent for Authentication 45

2.1 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

2.2 Possible Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

2.2.1 Allowing Direct Access to the J2EE Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

2.2.2 Protecting the Application Server with the Access Gateway . . . . . . . . . . . . . . . . . . . 46

2.3 Configuring the Agent for Direct Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

2.4 Configuring Authentication Contracts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

2.4.1 Protecting Different Applications by Using Different Authentication Contracts . . . . . 49

2.4.2 Configuring Additional Authentication for Applications . . . . . . . . . . . . . . . . . . . . . . . 52

2.5 Protecting the Application Server with the Access Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . 53

2.5.1 Setting Up a Path-Based Proxy Service for an Application Server . . . . . . . . . . . . . . 53

2.5.2 Setting Up a Domain-Based Proxy Service for an Application Server. . . . . . . . . . . . 57

2.5.3 Configuring a Protected Agent for Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

3 Clustering J2EE Agents 63

3.1 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

3.2 Creating a Cluster Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

3.3 Assigning a J2EE Agent to a Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

3.4 Modifying Cluster Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

3.5 Removing a J2EE Agent from a Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

6Novell Access Manager 3.1 SP2 J2EE Agent Guide

novdocx (en) 16 April 2010

4 Preparing the Applications and the J2EE Servers 67

4.1 Preparing the Application for the Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

4.1.1 Configuring for Login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

4.1.2 Configuring for Logout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

4.2 Configuring Applications on the JBoss Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

4.2.1 Configuring a Security Domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

4.2.2 Configuring Security Constraints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

4.2.3 Configuring for Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

4.3 Configuring Applications on the WebSphere Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

4.3.1 Configuring for Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

4.3.2 Configuring for RunAs Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

4.3.3 Configuring the Trust Association Interceptor Module for WebSphere Application . . 73

4.4 Configuring Applications on the WebLogic Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84

5 Configuring the Basic Features of a J2EE Agent 85

5.1 Enabling Tracing and Auditing of Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

5.1.1 Tracing Events to Log Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

5.1.2 Enabling the Auditing of Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

5.2 Managing Embedded Service Provider Certificates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

5.3 Configuring SSL Certificate Trust. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

5.4 Modifying the Display Name and Other Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88

5.5 Changing the IP Address of a J2EE Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88

6 Protecting Web and Enterprise JavaBeans Modules 89

6.1 Configuring Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89

6.2 Protecting Web Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

6.2.1 Creating a Protected Resource for a Web Application . . . . . . . . . . . . . . . . . . . . . . . 90

6.2.2 Assigning a Web Authorization Policy to the Resource . . . . . . . . . . . . . . . . . . . . . . . 92

6.3 Protecting Enterprise JavaBeans Resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

6.3.1 Creating a Protected Enterprise JavaBean Resource . . . . . . . . . . . . . . . . . . . . . . . . 92

6.3.2 Assigning an Enterprise JavaBeans Authorization Policy to a Resource . . . . . . . . . 94

7 Deploying the Sample Payroll Application 95

7.1 Deploying the Sample Payroll Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

7.2 Preparing the Sample Application for the Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

7.2.1 Configuring for Login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

7.2.2 Configuring for Logout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

7.3 Using the J2EE Server to Enforce Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

7.4 Using Access Manager Policies to Enforce Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

7.4.1 Creating an Employee Role and a Manager Role . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

7.4.2 Creating Authorization Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

7.4.3 Assigning Policies to Protected Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

7.4.4 Testing the Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

8 Managing a J2EE Agent 109

8.1 Viewing General Status Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

8.2 Managing the Health of an Agent. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110

8.3 Managing the Health of a Cluster. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112

8.4 Managing Alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

8.5 Managing Cluster Alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

Contents 7

novdocx (en) 16 April 2010

8.6 Viewing Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

8.7 Viewing Cluster Statistics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

8.8 Viewing Platform Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116

8.9 Viewing the Status of Recent Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116

8.10 Stopping and Starting the Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117

8.11 Stopping and Starting the Embedded Service Provider . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117

8.12 Deleting an Agent from the Administration Console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118

9 Troubleshooting the J2EE Agent 119

9.1 Troubleshooting the J2EE Agent Import . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

9.2 Authorization Policies Fail for Some Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

9.3 The Health Status Displays as “Server Is Not Responding . . . . . . . . . . . . . . . . . . . . . . . . . . 120

9.4 Auto-import Agents Fails on WebLogic Running on RedHat . . . . . . . . . . . . . . . . . . . . . . . . . 120

9.5 Error: Invalid Administration Server IP Address. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120

9.5.1 JRE Version is Wrong . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120

9.5.2 Issues With the Administration Console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121

9.6 Installer Stops Responding While Installing on WebSphere . . . . . . . . . . . . . . . . . . . . . . . . . 121

9.7 Unable to Federate WebSphere Custom Profile If Agent Already Installed . . . . . . . . . . . . . 122

9.8 Authorization Fails in the WebSphere Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122

9.9 Audit Log Event Problems on 64-Bit Platforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

9.9.1 JBoss Agent. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

9.9.2 WebLogic Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

9.10 JBoss and SSL. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

9.11 Viewing Log Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

9.12 Troubleshooting Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

8Novell Access Manager 3.1 SP2 J2EE Agent Guide

novdocx (en) 16 April 2010

About This Guide 9

novdocx (en) 16 April 2010

About This Guide

This guide describes the J2EE Agents and explains how to install, configure, and manage them:

Chapter 1, “Installing the J2EE Agents,” on page 11

Chapter 2, “Configuring the Agent for Authentication,” on page 45

Chapter 3, “Clustering J2EE Agents,” on page 63

Chapter 4, “Preparing the Applications and the J2EE Servers,” on page 67

Chapter 5, “Configuring the Basic Features of a J2EE Agent,” on page 85

Chapter 6, “Protecting Web and Enterprise JavaBeans Modules,” on page 89

Chapter 7, “Deploying the Sample Payroll Application,” on page 95

Chapter 8, “Managing a J2EE Agent,” on page 109

Chapter 9, “Troubleshooting the J2EE Agent,” on page 119

Audience

This guide is intended for Access Manager administrators. It is assumed that you have knowledge of

evolving Internet protocols, such as:

Extensible Markup Language (XML)

Simple Object Access Protocol (SOAP)

Security Assertion Markup Language (SAML)

Public Key Infrastructure (PKI) digital signature concepts and Internet security

Secure Socket Layer/Transport Layer Security (SSL/TLS)

Hypertext Transfer Protocol (HTTP and HTTPS)

Uniform Resource Identifiers (URIs)

Domain Name System (DNS)

Web Services Description Language (WSDL)

Feedback

We want to hear your comments and suggestions about this guide and the other documentation

included with this product. Please use the User Comments feature at the bottom of each page of the

online documentation, or go to Documentation Feedback (http://www.novell.com/documentation/

feedback.html) at www.novell.com/documentation/feedback.html and enter your comments there.

Documentation Updates

For the most recent version of the Access Manager J2EE Agent Guide, visit the Novell Access

Manager Documentation Web site (http://www.novell.com/documentation/novellaccessmanager31).

10 Novell Access Manager 3.1 SP2 J2EE Agent Guide

novdocx (en) 16 April 2010

Additional Documentation

Before proceeding, you should be familiar with the Novell Access Manager 3.1 SP2 Installation

Guide and the Novell Access Manager 3.1 SP2 Setup Guide, which provide information about

setting up the Access Manager system.

Documentation Conventions

In Novell documentation, a greater-than symbol (>) is used to separate actions within a step and

items in a cross-reference path.

Dieses Handbuch passt für folgende Modelle

Inhaltsverzeichnis

Andere Novell Software Handbücher

Novell

Novell ZENWORKS 7.2 LINUX MANAGEMENT - SCENARIOS 1... Bedienungsanleitung

Novell

Novell CLIENT FOR LINUX 2.0 Bedienungsanleitung

Novell

Novell GROUPWISE 7 - WEB ACCESS Bedienungsanleitung

Novell

Novell GROUPWISE 7 - SECURITY POLICIES Bedienungsanleitung

Novell

Novell LINUX ENTERPRISE DESKTOP 11 Bedienungsanleitung

Novell

Novell LINUX ENTERPRISE SERVER 10 SP2 - STORAGE ADMINISTRATION GUIDE... Bedienungsanleitung

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - NETWORK DISCOVERY DATABASE... Bedienungsanleitung

Novell

Novell GROUPWISE 7 - TROUBLESHOOTING 3 Bedienungsanleitung

Novell

Novell GROUPWISE 8 - MONITOR Bedienungsanleitung

Novell

Novell GROUPWISE 8 - TROUBLESHOOTING 3 Bedienungsanleitung

Novell

Novell PLATESPIN ORCHESTRATE 2.0.2 - ADMINISTRATOR REFERENCE... Service-Handbuch

Novell

Novell PLATESPIN ORCHESTRATE 2.0.2 - VIRTUAL MACHINE MANAGEMENT GUIDE... Programmierhandbuch

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Bedienungsanleitung

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Technisches Handbuch

Novell

Novell LINUX ENTERPRISE DESKTOP 10 - KDE 21-06-2006 Bedienungsanleitung

Novell

Novell LINUX ENTERPRISE SERVER 10 - ARCHITECTURE-SPECIFIC INFORMATION... Handbuch

Novell

Novell IFOLDER 3.6 - CROSS-PLATFORM Bedienungsanleitung

Novell

Novell IDENTITY MANAGER 3.6.1 - ENTITLEMENTS Bedienungsanleitung

Novell

Novell IMANAGER 2.7.3 Bedienungsanleitung

Novell

Novell FILE SYSTEM FACTORY 1.2.1 - ADMINISTRATION Bedienungsanleitung

Novell

Novell IFOLDER 3.6 - SECURITY ADMINISTRATION Bedienungsanleitung

Novell

Novell ZENWORKS APPLICATION VIRTUALIZATION - V8.0.3 INTEGRATION AND STREAMING... Bedienungsanleitung

Novell

Novell IFOLDER 3.X - SECURITY ADMINISTRATOR GUIDE... Service-Handbuch

Novell

Novell IDENTITY MANAGER 3.6.1 - UNDERSTANDING POLICIES... Bedienungsanleitung

Beliebte Software Handbücher anderer Marken

COMPRO

COMPRO COMPROFM Bedienungsanleitung

Muratec

Muratec OFFICEBRIDGE ONLINE Bedienungsanleitung

Oracle

Oracle Contact Center Anywhere 8.1 Bedienungsanleitung

Adobe

Adobe 65007312 - Photoshop Lightroom Handbuch

Avaya

Avaya NULL One-X for RIM Blackberry Bedienungsanleitung

HP ProLiant BL420c Bedienungsanleitung

PS Audio

PS Audio PowerPlay Betriebsanleitung

Brady

Brady LOCKOUT PRO 3.0 Service-Handbuch

Avaya

Avaya Interaction Center Bedienungsanleitung

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Handbuch

Oracle

Oracle Application 9i Bedienungsanleitung

Acer

Acer RDM Bedienungsanleitung

Canon

Canon Vixia HF21 Bedienungsanleitung

Canon

Canon ZR950 Bedienungsanleitung

Samsung

Samsung Auto Backup Bedienungsanleitung

Polycom

Polycom Vortex EF2201 Montage- und Bedienungsanleitung

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Bedienungsanleitung

Lexmark

Lexmark Apps Service-Handbuch