Configure Jenkins to bind to Active Directly for Security

Jenkins can be download in this website: http://jenkins-ci.org/

What is Jenkins?

Jenkins is an award-winning application that monitors executions of repeated jobs, such as building a software project or jobs run by cron. Among those things, current Jenkins focuses on the following two jobs:

1. Building/testing software projects continuously, just like CruiseControl or DamageControl. In a nutshell, Jenkins provides an easy-to-use so-called continuous integration system, making it easier for developers to integrate changes to the project, and making it easier for users to obtain a fresh build. The automated, continuous build increases the productivity.
2. Monitoring executions of externally-run jobs, such as cron jobs and procmail jobs, even those that are run on a remote machine. For example, with cron, all you receive is regular e-mails that capture the output, and it is up to you to look at them diligently and notice when it broke. Jenkins keeps those outputs and makes it easy for you to notice when something is wrong.

For us, we use jenkins to do gemfire deployments in our environments. Adding security to jenkins is a simple process, the pre-requisite of course is that you have Jenkins installed, configured and jobs setup.

Click Jenkins > Manage Jenkins > Configure System 

 On the configure page, Fill in correct information on the access control > Active Directory field.

Test the Active Directory by clicking on the test. 

Under Authorization, choose Project-based Matrix Authorization Strategy

Add the group and users that you want to have permission to jenkins. 

You can then go ahead, save and test away. 



If you want granular security in some particular jobs, you can then go ahead and configure that job by following these instruction. 

First, click on the job then click Configure

 
Click on "Enable Project based security", add the users that you want access to this job and what they are able to do.

I can then tell that diana.sy is able to execute and run this job but not the other jobs that is not enabled.

Move OIM Resource from 10g to 11g

The process of migrating resource from Oracle Identity Manager 10g to 11g is quite tedious but simple. You got to have admin access to both server in order to do this.

1. Open browser, go to http://<OIM10g_server>:port/xlWebApp/
    Login as xelsysadm
2. Click on Deployment Manager, Export

    Note: I use IE for this and make sure you have the pop-up blocker disabled. 

Select the resource you want to export. In this example, I start with "Error Code"

Click "Select Children"

Click "Select Dependencies"

Click "Add for Export"

After the reviewing the confirmation screen, you can click export and a pop-up will show up. Type in the name of this export, then save the export to a file. 

After export is save to an xml file, go to your 11g server.

http://<OIM11g_hostname>:14000/oim

On the landing page, click "Advanced"

Under System Management, click "Import Deployment Manager File". Make sure the pop-up blocker is not enable.

On the pop-up import Deployment Manager box, click on the file that was exported. 

Click "Add File"

 Click "Import" 

It will prompt if the import is successful.

Configure Design Console on your local

The following are the prerequisites needed before you can configure Design console

1. Install Oracle Identity Manager in your Server
2. Install Oracle Identity Manager in your Local workstation
3. Install Java in your workstation 
4. Run config.sh in your local workstation.

After all the steps above are preform, create the wlfullclient.jar on the OIM Server

# cd <wls_server>/server/lib/
# java -jar /opt/app/middleware/modules/com.bea.core.jarbuilder_1.6.0.1.jar
 

 <output will look like this>
Integrating jar -->(1)/(40277)//opt/app/middleware/modules/com.bea.core.http.pubsub.mbean_1.6.0.0.jar
Integrating jar <--(1)/(40281)/(4)//opt/app/middleware/modules/com.bea.core.http.pubsub.mbean_1.6.0.0.jar
Integrating jar -->(1)/(40281)//opt/app/middleware/modules/com.bea.core.diagnostics.accessor_1.5.0.0.jar
Integrating jar <--(1)/(40377)/(96)//opt/app/middleware/modules/com.bea.core.diagnostics.accessor_1.5.0.0.jar
Created new jar file: /opt/app/middleware/wlserver_10.3/server/lib/wlfullclient.jar





Grab wlfullclient.jar from the server and drop it to your local workstation under <IDM install directory>/designconsole/ext


On you local workstation edit <IDM install directory>/designconsole/config/xlconfig.xml


    <ApplicationURL>http://OIM_host_Name:14000/xlWebApp/loginWorkflowRenderer.do</ApplicationURL>   

    <Discovery>
        <CoreServer>
            <java.naming.provider.url>t3://OIM_host_Name:14000/oim</java.naming.provider.url>
            <java.naming.factory.initial>weblogic.jndi.WLInitialContextFactory</java.naming.factory.initial>
        </CoreServer>
    </Discovery> 

Launch local workstation <IDM Install Dir>/designconsole/xlclient.cmd

Login with credential set up on the server you are pointing to.
 

Integrate OAM 11g & Websphere 7.0

Pre-requisite  (review previous posts)

1. Install and validate Websphere Portal
2. Install and validate Apache & plugin
3. Install and validate Apache webgate

I want to show a basic dataflow diagram to show how it works. 

 


Open a browser and go to "Oracle Access Manager 11g console" thru

http://<host>:14100/oamconsole   or 
http://<host>:7001/oamconsole

Step 1. Create webgate definition in OAMConsole for IHS webgate

On the landing page, click on "Create 10g webgate"

On the next page, fill in appropriate information especially the Name and Base URL.

 

Click Apply  (upper right corner)

Add additional host identifiers under Policy Configuration tab > Host Identifiers. 

 Note: In my experience, the name of the host identifier should be the first entry on under "host name" else its not working.

 Review the Resource information under "Policy Configuration" > "Application Domains" > your-webgate > Resources

 Make sure all context root that are suppose to be protected and public are unprotected.


Step 2. Configure websphere trust association interceptor (TAI)
 
Open the browser and go to websphere admin console

https://<host>:<port>/ibm/console

On the landing page, click on Security > Global security > expand Web and SIP security and click on Trust association

Check "Enable Trust association"

Click on "Interceptors" click "New"

Interceptor class name: oracle.security.was.providers.tai.OAMTrustAssociationInterceptorImpl
Custom property: 
Name: OAMTaiProperty
Value: /opt/appschic/fmwconfig/properties/oamtai.xml (location of your oamtai.xml)

Drop couple of jar files in your lib directory and add this to your classpath. Namely:


jrf-api.jar

OAMTrustAssociationInterceptor.jar


Most of this jar you can find online but there is a defect on oam jar file and I had to edit the class file on my own risk to make it work. If you need the revise jar file, email me at diana.o.sy@gmail.com to request it. Disclaimer: use the edited jar file on your own risk.

Go to "Servers" > "Websphere Application Servers" > Click on your server > Expand "Java and Process Management" > Click "Process Definition" > Under "Additional Properties" > Click on "Java Virtual Machine" > under "Additional Properties" > click on "Custom Properties" > edit ws.ext.dir to append the name of the jar files above. 

Name: ws.ext.dirs
Value: ${WPS_HOME}/shared/ext:/opt/app/appschic/AppServer/lib/webgate/OAMTrustAssociationInterceptor.jar:/opt/app/appschic/AppServer/lib/webgate/jrf-api.jar

Do this step in all the application server in your cluster.

Restart Websphere portal servers to pick up changes.

Make sure the TAI is picked up in the log file. You can see this in SystemOut.log

 


Step 3. Configure webgate for Apache


1. After installing IHS and plugin, install webgate on that same server.
2. On your OAM Console, create a webgate configuration, specify the host and port. (Register the webgate)
3. Drop the output folder files which are ObAccessClient.xml and logout.html to the IHS webgate folder. 

Download and install the webgate depending on your OS and apache version. I have Apache 2.2 in 64bit OS. 

./Oracle_Access_Manager10_1_4_3_0_linux64_APACHE22_WebGate

 
Note: there is a common error when inputting the user and group:




Error Message: Sorry, invalid user "username" or invalid group "group"
Please check and enter again. 
username : group

Resolution: Please make sure this is the user and group you specified in your apache httpd.conf

 #
# If you wish httpd to run as a different user or group, you must run
# httpd as root initially and it will switch.
#
# User/Group: The name (or #number) of the user/group to run httpd as.
# It is usually good practice to create a dedicated user and group for
# running httpd, as with most system services.
#
User appadmin
Group appadmin






If the username and group is what was specified in the httpd.conf and you are still getting the error; 
login as root and install csh

su - root
yum install csh  

Proceed with the install. 

 
Next

At this point, you can escape the installation by typing ^C

Step 4. Add webgate to your httpd.conf (Apache) 

cd /opt/app/appschic/webgate/access/oblix/tools/setup/InstallTools
./EditHttpConf <Apache httpd.conf> <Webgate Install Dir> webgate   <log file>

> ./EditHttpConf /opt/app/appschic/apache/conf/httpd.conf /opt/app/appschic/webgate webgate output.log

Review your httpd.conf configuration to make sure webgate configuration was loaded. It will look like: 


#*** BEGIN WebGate Specific ****

LoadFile "/opt/app/appschic/webgate/access/oblix/lib/libgcc_s.so.1"
LoadFile "/opt/app/appschic/webgate/access/oblix/lib/libstdc++.so.6"

<IfModule mod_ssl.c>
        LoadModule obWebgateModule "/opt/app/appschic/webgate/access/oblix/apps/webgate/bin/webgatessl.so"
</IfModule>

<IfModule !mod_ssl.c>
        LoadModule obWebgateModule "/opt/app/appschic/webgate/access/oblix/apps/webgate/bin/webgate.so"
</IfModule>

WebGateInstalldir "/opt/app/appschic/webgate/access"

WebGateMode PEER

<Location /access/oblix/apps/webgate/bin/webgate.cgi>
SetHandler obwebgateerr
</Location>

<Location "/oberr.cgi">
SetHandler obwebgateerr
</Location>

<LocationMatch "/*">
AuthType Oblix
require valid-user
</LocationMatch>

#*** END WebGate Specific ****

Restart apache server to pick up the new configuration.

 
Step 5. Copy Registered webgate conf (Step 1) to webgate

 From Step 1 performed above, there will be an output directory from your domain directory; 

> cd /opt/app/middleware/projects/domains/uatoam_domain/output/<name of webgate> 
> copy the content of the "webgate name" directory. It will consist of 2 pem file (aaa_cert.pem & aaa_key.pem),  logout.html, ObAccessClient.xml and the password.xml file. Note: The pem files and the password.xml is available the security mode is set to Simple of Cert.

> Drop all file to the webgate home directory in Step 4. 

ObAccessClient.xml & logout.html to /opt/app/appschic/webgate/access/oblix/lib
aaa_cert.pem & aaa_key.xml to /opt/app/appschic/webgate/access/oblix/config/simple 
password.xml to /opt/app/appschic/webgate/access/oblix/config

Restart the apache to pick up new changes.  



  
  

Install IBM Http Server 7.0 and Websphere Plugin

INSTALL IHS7.0 & WP-Plugin

A.  ssh to the server as the service account you want to use as the admin. 

   Note: Before going any further, port 80 (if you plan to use) can only be bound to root. That means you need sudo access to be able to stop and start http server running in port 80.

B.  Download ihs.7000.linux.ia32.tar from http://www14.software.ibm.com/webapp/download/preconfig.jsp?id=2009-05-19+11%3A09%3A57.016128R&cat=&fam=&s=p&S_TACT=&S_CMP=&st=103&sp=20. Untar the binary file.

- Edit responsefile.txt to whatever value is appropriate for your environment.

  

#  ./install –options responsefile.txt -silent

# Check the logs <ihs_home>/logs/install/log.txt make sure the install was successful.

 

C. Download C1G33ML.tar.gz from http://www14.software.ibm.com/webapp/download/preconfig.jsp?id=2009-07-30+10%3A21%3A30.655788R&S_TACT=&S_CMP=. Untar the binary file.

>  tar –zxvf C1G33ML.tar.gz

>  vi <binary_dir>/plugin/responsefile.txt

>  ./install –options responsefile.txt –silent

D.  Generate plugin from websphere portal server. ssh to the host01.

>  cd websphere_home/dmgr_profile/bin

>  ./GenPluginCfg.sh 

Note: The script should generate a plugin-cfg.xml

If you websphere portal is separate from IHS server, transfer the file from websphere host01 to IHS server into the <plugin_home>/config/ directory.

> Review your http server from <ihs_home>/conf/httpd.conf; towards the end of the file, you will see the following configuration that looks like this: 

# LoadModule was_ap22_module wps_plugin_home/bin/mod_was_ap22_http.so

# WebSpherePluginConfig wps_plugin_home/config/plugin-cfg.xml

 

E.  Restart IHS.

#  ihs_home/bin/apachectl -k stop

#  ihs_home/bin/apachectl -k start

 

F.  Test configuration. Open the browser and go to:

http://<host>:<port>/wps/myportal  Host is the server name for IHS server.