Changes between Version 12 and Version 13 of Aaa


Ignore:
Timestamp:
Oct 12, 2010, 4:45:54 PM (14 years ago)
Author:
tim.bauge
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • Aaa

    v12 v13  
    2929||keystore.filepath||File path of keystore, as an absolute path||
    3030||keystore.password||Keystore password, defined during the keystore deployement||
    31 ||key.alias||Key alias, obtained from ''__???__''||
    32 ||key.password||Key password, obtained from ''__???__''||
    33 ||partner.aaaservice.filepath||File path of AAA Service metadata. ''__how do you include multiple AAA services ???__''  This metadata is generated by ''__???__''||
    34 ||partner.sts1.filepath||File path of trusted STS metadata. This metadata is generated by ''__???__''||
    35 ||partner.sts2.filepath||File path of trusted STS metadata. This metadata is generated by ''__???__''||
    36 Note that more partner STS can be added, with incremental numbers. This allows peering between STS, and can be removed for a stand alone STS.
     31||key.alias||Key alias, defined during the keystore deployement||
     32||key.password||Key password, defined during the keystore deployement||
     33||partner.aaaservice.filepath ^^1||File path of AAA Service metadata. This metadata file is available from the AAA service provider (file name hostedAaaMetadata.xml found in aaa.war/WEB-INF/classes/trustedEntities/)||
     34||partner.sts1.filepath ^^1||File path of a trusted STS metadata if needed (one with which a federation agreement is in place). This metadata file is available from the remote STS provider (file name hostedStsMetadata.xml found in sts.war/WEB-INF/classes/trustedEntities/)||
     35||partner.sts2.filepath ^^1||File path of another trusted STS metadata if needed (one with which a federation agreement is in place). This metadata file is available from the remote STS provider (file name hostedStsMetadata.xml found in sts.war/WEB-INF/classes/trustedEntities/)||
     36^^1 For simplicity of configuration, the STS is by default set to have one AAA service which it trusts, and up to two federated STS (i.e. a federation of three in all). If more AAA services of STSs are required to be used in the deployment, further configuration changes are required which are beyond the scope of this cookbook. Please contact TRT (UK) directly for further instructions.
    3737* sts.war/WEB-INF/classes/trustedEntities/hostedStsMetadata.xml
    3838Configuration fields:
    … …  
    4343* sts.war/WEB-INF/classes/metadata.properties
    4444Configuration fields:
    45 '''COPY THESE FROM ABOVE'''
    4645||= '''Field''' =||= '''Expected content''' =||
    47 ||keystore.file||File path of keystore||
    48 ||keystore.pass||Keystore password||
    49 ||key.pass||Key password||
    50 ||key.alias||Key alias||
    51 ||partner.aaaservice.file||File path of AAA Service metadata||
    52 ||partner.sts1.file||File path of trusted STS metadata||
    53 ||partner.sts2.file||File path of trusted STS metadata||
     46||keystore.file||File path of keystore, as an absolute path||
     47||keystore.pass||Keystore password, defined during the keystore deployement||
     48||key.pass||Key password, defined during the keystore deployement||
     49||key.alias||Key alias, defined during the keystore deployement||
     50||partner.aaaservice.file||File path of AAA Service metadata, as described in pom.xml above||
     51||partner.sts1.file||File path of a trusted STS metadata, as described in pom.xml above||
     52||partner.sts2.file||File path of another trusted STS metadata, as described in pom.xml above||
    5453
    55 
    56 
    57 -----------------------------
    58 ----------------------------------
    59 
    60 
    61 ==== Configure ====
    62  located in ???/WEB-INF.
    63 ===== Setting up a keystore =====
    64 
    65 === User administration ===
    66 The User Register contains user account data relating to users and their roles. It is configured in applicationContext-security.xml.
    67 The default configuration is an in-memory list that is populated using a properties file, “users.properties”. To add a user add the following to the file:
     54==== User administration ====
     55The STS holds user accounts. These are configured in sts.war/WEB-INF/classes/users.properties, and require entries of the following type:
    6856{{{
    6957username=password,role[,role][,enabled|disabled]
    70 e.g.    user1=password,USER,ADMIN,enabled
     58e.g.    joe.blogs=zsd*7d],USER,ADMIN,enabled
    7159}}}
    72 The implementation of the user register can easily be changed, for example, to a database by changing the configuration of the userRegister bean. 
    73 The allowed roles are:
     60Modifying the users.properties file required a restart of the STS to take effect.
     61The default deployment uses the following role semantics:
    7462* GUEST
    7563* USER
    … …  
    7765* ADMIN
    7866* SECURITY_CONTROLLER
     67Other role semantics can be used, but require additional configuration. Please contact TRT (UK) directly for further instructions.
    7968
    8069== Access control decision making: AAA block ==
    8170A system provider MAY choose to deploy a AAA block. If it does not, resource and framework component providers wishing to use access control will have to provide their own.
    8271=== Deployment ===
    83 The AAA Service is provided as a web app, to be deployed in a servlet container. A number of configuration options need to be set in the WAR file before it is deployed.
    84 ==== Configure ====
    85 The configuration files are located in /WEB-INF within the WAR file. The Spring Security and authentication filters are configured in applicationContext-security.xml. The rest of the code is configured in applicationContext.xml. However, many of the properties set in the Spring context can configured in the properties files located in /WEB-INF/classes.
    86 ===== Keystore =====
    87 The AAA Service requires a JKS keystore that contains a private key. This is the key that will be used to sign all SAML objects such as requests. A keystore can be generated using the Java Keytool. Instructions here: http://wiki.eclipse.org/Generating_a_Private_Key_and_a_Keystore
    88 The keystoreManager bean needs to be configured to use this keystore. This can be done by changing the following properties in metadata.properties:
    89 ||=Property=||=Description=||
    90 ||keystore.file||Location of the keystore. Default is classpath:keystore.jks||
    91 ||keystore.pass||Keystore password||
    92 ||key.alias||Certificate alias to be used for signing objects||
    93 ||key.pass||Password for the certificate alias||
    94 ===== Metadata =====
    95 The exchange of SAML metadata is the first stage in enabling SAML single sign-on. Entities that wish to establish trust with the hosted AAA Service will need to exchange metadata. Therefore the STS used by the AAA Service to generate tokens must have the metadata for the AAA Service. Similarly, the AAA Service must have the metadata for the STS. The metadata follows the SAML 2.0 Metadata specification [1]. Metadata for the AAA Service should be created by hand or in the same way as for the STS above.
    96 In addition, the following properties must be set in metadata.properties
    97 ||=Property=||=Description=||
    98 ||sts.uri||Location of the STS to use to generate tokens||
    99 ||sts.request.uri||URI on the STS to which requests for tokens should be sent||
    100 ||aaaservice.uri||Location of the hosted AAA Service||
    101 ===== Trusted Entity Register =====
    102 The Trusted Entity Register contains the metadata for all trusted Service Providers and trusted STSs. It is configured in the metadataProvider bean in applicationContext-saml.xml.
    103 To register a trusted entity, you will need the metadata for that entity either in a file or as a URL. The default metadata files are stored in /WEB-INF/classes/trustedEntities. Configure a bean for each trusted entity using the org.opensaml.saml2.metadata.provider.FilesystemMetadataProvider class for metadata contained in a file or the org.opensaml.saml2.metadata.provider.HTTPMetadataProvider class for metadata as a URL. 
    104 ===== Accounting =====
    105 The database used for storing the accounting data may be configured by changing the following properties in application.properties.
    106 ||=Property=||=Description=||
    107 ||jdbc.driverClassName||The fully qualified Java classname of the JDBC driver to be used||
    108 ||jdbc.url||The connection URL to be passed to the JDBC driver to establish a connection||
    109 ||jdbc.username||The connection username to be passed to the JDBC driver to establish a connection||
    110 ||jdbc.password||The connection password to be passed to the JDBC driver to establish a connection||
    111 ||hibernate.dialect||The classname of a org.hibernate.dialect.Dialect which allows Hibernate to generate SQL optimised for a particular relational database||
    112 The AAA Service requires the following permissions for the database:
    113 * Create
    114 * Update
    115 * Delete
    116 * Select
    117 * Insert
     72The AAA service is provided as a web app, to be deployed in a servlet container. A number of configuration options need to be set by editing property files in the WAR file before deployment.
     73==== Getting the software components for the AAA service ====
     74* Apache Tomcat servlet container or equivalent
     75Instructions for setting up Apache Tomcat can be found [http://tomcat.apache.org/tomcat-6.0-doc/setup.html here].
     76* Keystore
     77The AAA service requires a JKS keystore that contains a private key. A keystore can be generated using the Java Keytool. Instructions [http://wiki.eclipse.org/Generating_a_Private_Key_and_a_Keystore here].
     78* AAA service WAR file
     79The AAA service WAR file can be downloaded from here: [wiki:trt-war AAA downloads page].
     80The WAR files should be first configured for the deployment setup (see below) and then deployed in the servlet container. For Tomcat, instructions are provided [http://tomcat.apache.org/tomcat-6.0-doc/deployer-howto.html here] (see in particular the "Deployment on Tomcat startup" section).
     81==== AAA Service Configuration ====
     82The WAR file contains 3 files which need configuring to run correctly on the target deployment platform. Each field requiring a deployment specific value has been identified with the string "REPLACE:". Other fields have been set to typical defaults which should satisfy most deployments. These can however be modified for advanced tuning of the AAA service. For more information contact TRT (UK).
     83The WAR file is an archive containing object code, presentation templates and configuration files. The downloaded WAR file should therefore be opened (e.g. using [http://www.7-zip.org/ 7-zip]) to edit the following configuration files:
     84* aaa.war/META-INF/maven/com.thalesresearch.sensei/sensei-sts-service/pom.xml
     85Configuration fields:
     86||= '''Field''' =||= '''Expected content''' =||
     87||aaaservice.uri||URL of AAA. This will be the Tomcat server URL route suffixed with /AAA||
     88||sts.uri||URL of the trusted STS||
     89||sts.requestUri||URL of the trusted STS's request interface. By default, sts.uri/'''???'''||
     90||sts.metadata.file||File path to the trusted STS metadata. This metadata file is available from the STS provider (file name hostedStsMetadata.xml found in sts.war/WEB-INF/classes/trustedEntities/)||
     91||keystore.file||File path of keystore, as an absolute path||
     92||keystore.password||Keystore password, defined during the keystore deployement||
     93||key.alias||Key alias, defined during the keystore deployement||
     94||key.password||Key password, defined during the keystore deployement||
     95* aaa.war/WEB-INF/classes/trustedEntities/AaaMetadata.xml
     96Configuration fields:
     97||= '''Field''' =||= '''Expected content''' =||
     98||entityID=||add the URL of this AAA service after the =||
     99||ds:X509Certificate||encoded signing key of this AAA service (instructions on obtaining it [wiki:encoded_signing_key here]).||
     100||Location=||add the URL of this AAA service between the = and the /.||
     101* aaa.war/WEB-INF/classes/metadata.properties
     102||= '''Field''' =||= '''Expected content''' =||
     103||keystore.file||File path of keystore, as an absolute path||
     104||keystore.pass||Keystore password, defined during the keystore deployement||
     105||key.alias||Key alias, defined during the keystore deployement||
     106||key.pass||Key password, defined during the keystore deployement||
     107||sts.metadata.file||File path to the trusted STS metadata. This metadata file is available from the STS provider (file name hostedStsMetadata.xml found in sts.war/WEB-INF/classes/trustedEntities/)||
     108||sts.uri||URL of trusted STS||
     109||sts.request.uri||URL of the trusted STS's request interface. By default, sts.uri/'''???'''||
     110||aaaservice.uri||URL of this AAA Service||
     111
    118112=== Management ===
    119113==== Accounting interface ====
    120 * what it does
    121 The AAA Service records data about each request for an access control decision. It stores the following information:
    122 * The time at which the request was received
    123 * The username and role of the user accessing the resource
    124 * The identifier of the requested resource
    125 * The AAA decision and reason
    126 The Accounting interface provides access to the accounting information stored by the AAA Service.
    127 * how to view / reset / etc
    128114The Accounting data can be viewed at <aaaservice URI>/REST/Accounting
    129115The data can also be cleared at <aaaservice URI>/REST/Accounting/ClearAll
    130 Access to both of these URLs can be restricted by configuring the Spring Security Filter in applicationContext-security.xml
     116Access to both of these URLs can be restricted by configuring the Spring Security Filter in applicationContext-security.xml. For more information contact TRT (UK).