191 Lotus blogs updated hourly. Who will post next? Home | Blogs | Search | About 
 
Latest 7 Posts
Automatic WebSphere plugin modification II – PowerShell for Windows
Thu, Dec 1st 2016 2
IBM Connections Docs – file preview not possible for some CCM pdf files
Thu, Nov 17th 2016 9
IBM Connections 5.5 CR2 released
Thu, Nov 10th 2016 3
IBM Connections – How to switch to a custom global unique ID for users
Mon, Nov 7th 2016 4
IBM Connections – add additional login attribute
Wed, Oct 12th 2016 9
IBM Connections – Set read-only access to CCM libraries
Thu, Oct 6th 2016 4
Security Bulletin: HTTP Response Splitting in WebSphere Application Server (CVE-2016-0359)
Tue, Sep 13th 2016 5
Top 10
DB2 Instance autostart does not work on SLES 12 / RHEL 7
Tue, Jul 12th 2016 10
IBM Connections – add additional login attribute
Wed, Oct 12th 2016 9
IBM Connections Docs – file preview not possible for some CCM pdf files
Thu, Nov 17th 2016 9
Configuration of secret key storage in WebSphere Application Server
Thu, Mar 12th 2015 8
HowTo: Change the admin password in IBM Connections
Mon, May 18th 2015 7
Files widget does not load using non US UI language
Wed, Dec 17th 2014 5
HTTP Outbound authentication via SAML
Tue, Oct 6th 2015 5
WebSphere Portal – Change WCM AD Group permissions using memberFixer
Fri, Apr 8th 2016 5
WebSphere custom TAI – Doing SSO the right way
Tue, Sep 6th 2016 5
Security Bulletin: Multiple vulnerabilities in IBM® Java SDK affect WebSphere Application Server April 2016 CPU (CVE-2016-3426, CVE-2016-3427)
Tue, Sep 13th 2016 5


HTTP Outbound authentication via SAML
Twitter Google+ Facebook LinkedIn Addthis Email Gmail Flipboard Reddit Tumblr WhatsApp StumbleUpon Yammer Evernote Delicious
Julius Schwarzweller    

HTTP Outbound authentication via SAML (ADFS Server)

Hi all,

this time I had to deal with a real administrative challenge:

Enable WebSphere Portal to display IBM Connections content using IC portlets and authenticate HTTP Outbound calls using SAML.

WebSphere Portal can load content from external sources using a secure HTTP Outbound proxy (aka. Ajax Proxy). This is the case for IBM Connections portlets that load content from an IBM Connections server.

Normally when you deploy those IBM Connections portlets, authentication of requests sent via HTTP Outbound Proxy is done using IBM`s SSO mechanism using LTPAToken between WebSphere Portal & IBM Connections. But when it comes to more advanced cloud environments (Hybrid cloud integrations, integration of other software tools that do not support LTPA…), this technology is out dated. So I`m back to my “hot topic” SAML ;-)… This solves most of our SSO problems but brings some new hurdles with it.

How does it work?

HTTPOutbound : SAML1

Content that you want to consume from another system is not directly loaded from server to browser when using WebSphere Portal. WebSphere Portal calls backend systems using API to e.g. IBM Connections to display content (in this case if you use the IBM Connections portlets). This communication is routed via an application called HTTPOutbound Proxy (aka. AjaxProxy).

Since WebSphere Portal 8.5 CF03 you can authentication those HTTP Outbound Proxy calls using the SAML protocol. In the above example, the Outbound Proxy authenticates the user that is logged in the WebSphere Portal server on the connected IBM Connections system. The mandatory configuration steps are documented for TFIM & ADFS Server (from CF05 on) as IdP provider. But I think the information provided in knowledge center are a bit confusing and not really complete. That`s why I tried to summarize everything in this blog post.

Steps I used to activate HTTP Outbound Connection authentication via SAML (ADFS Server as IdP)

ADFS: Changing the cookie domain –> described here
This is a rather easy step where you need to make sure that the cookies, ADFS server generates are set for the domain you use with your WebSphere Portal / IBM Connections system.

  • open the file web.config in the IIS ADFS web module (inetpub base folder  – in my case this is c:/inetpub/adfs/ls/) and add the cookie handler between
 <system.web> and <compilation defaultLanguage="c#">

Cookie handler:

<httpCookies domain="your_domain" httpOnlyCookies="false" requireSSL="false"/>

HTTPOutbound1

  • Create a Outbound rule using IIS Management Console

This is a tricky one, as you need an additional ARR (Application Request Routing) snap-in in order to configure this outbound rule. You can install this snap-in using the Microsoft Web Platform Installer 5.0 –> here

Start the exe and search for “Application Request”

HTTOutbound2

Click to install.

Then open the IIS management console and click “Application Request Routing Cache”

HTTPOutbound3

Click on “Server Proxy Settings”

HTTPOutbound4

 

 

 

 

 

Click on “Advanced Routing – URL Rewrite”

HTTPOutbound5

Add a new Outbound rule

HTTPOutbound6

More details

HTTPOutbound7

Puhh… done <img src=" class="wp-smiley" style="height: 1em; max-height: 1em;" /> The documentation in the knowledge center leaves you rather alone when configuring those steps … Anyway it works like this <img src=" class="wp-smiley" style="height: 1em; max-height: 1em;" />

WebSphere Portal: Create HTTP Outbound configuration –> described here

Identity provider settings

Create a xml file with the following content (Adjust hostnames to match your environment)

<?xml version="1.0" encoding="UTF-8"?>
<proxy-rules xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:noNamespaceSchemaLocation="http://www.ibm.com/xmlns/prod/sw/http/outbound/proxy-config/2.0">
<variables>
  <!--  replace values with the IdP login URL and the partner URL -->
  <endpoint name="adfs01.idp_prot">https</endpoint>
  <endpoint name="adfs01.idp_host">YOURADFSSERVER.SERVER.COM</endpoint>
  <endpoint name="adfs01.idp_port">443</endpoint>
  <endpoint name="adfs01.idp_uri">/adfs/ls/IdpInitiatedSignOn.aspx</endpoint>
  <endpoint name="adfs01.partner_url">https://YOURIBMCONNECTIONSSERVER.SERVER.COM/samlsps/acs</endpoint>
</variables>
<meta-data>
  <name>adfs01.IDP_PROTOCOL</name>
  <value>https</value>
</meta-data>
<meta-data>
  <name>adfs01.IDP_HOST</name>
  <value>YOURADFSSERVER.SERVER.COM</value>
</meta-data>
<meta-data>
  <name>adfs01.IDP_PORT</name>
  <value>443</value>
</meta-data>
<meta-data>
  <name>adfs01.IDP_URI</name>
  <value>/adfs/ls/IdpInitiatedSignOn.aspx</value>
</meta-data>
<meta-data>
  <name>adfs01.PARAM_NAME.1</name>
  <value>LoginToRp</value>
</meta-data>
<meta-data>
   <name>adfs01.PARAM_VALUE.1</name>
   <value>https://YOURIBMCONNECTIONSSERVER.SERVER.COM/samlsps/acs</value>
</meta-data>
<meta-data>
   <name>adfs01.IDP_AUTH_TOKEN_SOURCE</name>
   <value>cookies</value>
</meta-data>
<meta-data>
   <name>adfs01.IDP_AUTH_TOKEN_COOKIE.1</name>
   <value>MSISAuth</value>
</meta-data>
<meta-data>
  <name>adfs01.IDP_AUTH_TOKEN_COOKIE.2</name>
  <value>MSISAuth1</value>
</meta-data>
<meta-data>
  <name>adfs01.IDP_AUTH_TOKEN_COOKIE.3</name>
  <value>MSISAuthenticated</value>
</meta-data>
<meta-data>
  <name>adfs01.IDP_AUTH_COOKIE.1</name>
  <value>SamlSession</value>
</meta-data>
</proxy-rules>

Register this XML file using a ConfigEngine task

 ./ConfigEngine.sh update-outbound-http-connection-config -DConfigFileName=XML_file -DOutboundProfileType=global

Define a policy rule for the remote Connections to the IBM Connections Server

Create a xml file with the following content (Adjust hostnames to match your environment):

<?xml version="1.0" encoding="UTF-8"?>
<!-- Copyright IBM Corp. 2011, 2014  All Rights Reserved.              -->
<proxy-rules xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.ibm.com/xmlns/prod/sw/ajax/proxy-config/1.1">
<mapping contextpath="/proxy" url="*"/>
<mapping contextpath="/myproxy" url="*"/>
<mapping contextpath="/common_proxy" url="*"/>

<policy active="true" basic-auth-support="false" name="SocialADFS" url="https://YOURIBMCONNECTIONSSERVER.SERVER.COM/*">
<actions>
  <method>POST</method>
  <method>GET</method>
  <method>DELETE</method>
  <method>PUT</method>
  <method>HEAD</method>
</actions>
<headers>
  <header>Accept-Language</header>
  <header>User-Agent</header>
  <header>Accept.*</header>
  <header>Content.*</header>
  <header>Authorization*</header>
  <header>Content*</header>
  <header>If-.*</header>
  <header>Pragma</header>
  <header>Cache-Control</header>
  <header>X-Update-Nonce</header>
  <header>X-Shindig-ST</header>
  <header>X-IC-CRE-Request-Origin</header>
  <header>X-IC-CRE-User</header>
  <header>X-Method-Override</header>
  <header>X-Requested-With</header>
</headers>
<cookie-rule name="SocialAdfs_WEF_Cookie_Rule">
  <cookie>*</cookie>
  <scope>user</scope>
  <handling>store-in-request</handling>
</cookie-rule>
<meta-data>
  <name>SSO_SAML20_IDP</name>
  <value>adfs01</value>
</meta-data>
<meta-data>
  <name>adfs01.IDP_HOST</name>
  <value>YOURADFSSERVER.SERVER.COM</value>
</meta-data>
<meta-data>
  <name>adfs01.IDP_PORT</name>
  <value>443</value>
</meta-data>
<meta-data>
  <name>adfs01.IDP_URI</name>
  <value>/adfs/ls/IdpInitiatedSignOn.aspx</value>
</meta-data>
<meta-data>
  <name>adfs01.PARAM_NAME.1</name>
  <value>LoginToRp</value>
</meta-data>
<meta-data>
  <name>adfs01.PARAM_VALUE.1</name>
  <value>https://YOURIBMCONNECTIONSSERVER.SERVER.COM/samlsps/acs</value>
</meta-data>
<meta-data>
  <name>adfs01.IDP_AUTH_TOKEN_SOURCE</name>
  <value>cookies</value>
</meta-data>
<meta-data>
  <name>adfs01.IDP_AUTH_TOKEN_COOKIE.1</name>
  <value>MSISAuth</value>
</meta-data>
<meta-data>
  <name>adfs01.IDP_AUTH_TOKEN_COOKIE.2</name>
  <value>MSISAuth1</value>
</meta-data>
<meta-data>
  <name>adfs01.IDP_AUTH_TOKEN_COOKIE.3</name>
  <value>MSISAuthenticated</value>
</meta-data>
<meta-data>
  <name>adfs01.IDP_AUTH_COOKIE.1</name>
  <value>SamlSession</value>
</meta-data>
<meta-data>
  <name>forward-http-errors</name>
  <value>true</value>
</meta-data>
</policy>
<meta-data>
  <name>forward-http-errors</name>
  <value>true</value>
</meta-data>
<meta-data>
  <name>xhr-authentication-support</name>
  <value>true</value>
</meta-data>
<meta-data>
  <name>socket-timeout</name>
  <value>50000</value>
</meta-data>
<meta-data>
  <name>retries</name>
  <value>2</value>
</meta-data>
<meta-data>
  <name>max-connections-per-host</name>
  <value>50</value>
</meta-data>
<meta-data>
  <name>max-total-connections</name>
  <value>1000</value>
</meta-data>
</proxy-rules>

Register this XML file using a ConfigEngine task

 ./ConfigEngine.sh update-outbound-http-connection-config -DConfigFileName=/ibm/proxy_smartcloud.xml -DApplicationScopeRef=PA_icWEFPtlts

–> This time I limit the configuration to the IBM Connections portlets … “-DOutboundProfileType=global” should also work.

The result is:

HTTPOutbound8

Summary

To be honest … This was a real piece of work… Tough and really complex stuff!

Anyway… Thanks IBM for this great integration. Do more SAML stuff… I really like this 😉



---------------------
http://techblog.gis-ag.info/2015/10/06/http-outbound-authentication-via-saml/
Oct 06, 2015
6 hits



Recent Blog Posts
2
Automatic WebSphere plugin modification II – PowerShell for Windows
Thu, Dec 1st 2016 6:54p   GIS Techblog
Automatic WebSphere plugin modification II – PowerShell for Windows Hi, some months ago I published a shell script to automatically modify the Primary / BackupServer definition in a WebSphere plugin-cfg.xml file. As we have several Windows customers we decided to transfer this script to PowerShell so that it is also useable for a Windows Cluster installation. My colleague Jan Bruns did a great job implementing this script. It basically works the same way as the Linux script: modifywasplug
9
IBM Connections Docs – file preview not possible for some CCM pdf files
Thu, Nov 17th 2016 2:15p   GIS Techblog
IBM Connections Docs – file preview not possible for some CCM pdf files Hi all, last week we had trouble in a customer environment using the file preview functionality for some pdf files (only those that were uploaded using CCM). Instead of a preview the message was displayed: At the same time we saw the following warning in the log: The mime-type was set to “image/pcl” instead of “application/pdf”… this mime-type is not supported by IBM Docs File viewer. We had to dig deep into th
3
IBM Connections 5.5 CR2 released
Thu, Nov 10th 2016 8:13a   GIS Techblog
IBM Connections 5.5 CR2 released Hi all, IBM released CR2 for IBM Connections 5.5: The Fix list Download the CR Database updates are mandatory (Activities, Files, Homepage, Mobile, Wikis) Filenet updates are mandatory Updates for Community Surveys (Fixes the TLS 1.2 issues) A prerequisite for CR2 is at least WAS 8.5.5 FP9 (let`s see when FP10 will be officially supported) A general step-by-step guide installing CR2 is provided by IBM. A new CR2 version of the Cognos wizard can be downloaded (y
4
IBM Connections – How to switch to a custom global unique ID for users
Mon, Nov 7th 2016 8:59a   GIS Techblog
IBM Connections – How to switch to a custom global unique ID for users Hi, many of our todays support cases is related to non-working profiles in IBM Connections. If users change their name, switch from one to another location or simply get a new account their profile in IBM Connections might get inactivated because the hash key between LDAP and database has changed. There are three possible hash keys: UID: Often a bad choice, as this might change eMail: Also a bad choice GUID: Unique I
9
IBM Connections – add additional login attribute
Wed, Oct 12th 2016 4:17a   GIS Techblog
IBM Connections – add additional login attribute Hi, last week I got the question if it is possible to use another login attribute for IBM Connections than uid, cn or email. Yes, this is possible and can be done very easy. It just needs some small adjustments (I assume that you already extended your LDAP schema and that the custom attribute is available in LDAP!!): 1. Open a wsadmin session ./wsadmin -lang jacl 2. Make a custom login attribute from LDAP known to the PersonAccount entity:
4
IBM Connections – Set read-only access to CCM libraries
Thu, Oct 6th 2016 5:28a   GIS Techblog
IBM Connections – Set read-only access to CCM libraries Hi, we are in the middle of several migrations to IBM Connections 5.5 and most of our customers come up with the question: What do I need CCM for if I can use nested folders in Files now? Many customers decide to manually migration CCM libraries to Files… This time a customer asked us if it is possible to set access to libraries to read-only so that no new files or folders are added to CCM. This is possible using the following
5
Security Bulletin: HTTP Response Splitting in WebSphere Application Server (CVE-2016-0359)
Tue, Sep 13th 2016 4:30a   GIS Techblog
Classification Score of 6.1 is moderat! Affects IBM WebSphere Application Server (IBM Portal and Connections)! If you need assistance please contact us (support@gis-ag.com) for further procedure. Link to IBM site Content: Summary Vulnerability Details Affected Products and Versions Remediation/Fixes Summary There is a potential HTTP response splitting vulnerability in IBM WebSphere Application Server. Vulnerability Details CVEID: CVE-2016-0359 DESCRIPTION: IBM WebSphere Application
5
Security Bulletin: Multiple vulnerabilities in IBM® Java SDK affect WebSphere Application Server April 2016 CPU (CVE-2016-3426, CVE-2016-3427)
Tue, Sep 13th 2016 4:26a   GIS Techblog
Classification Score of 10 is urgent! Affects all IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server (indirectly all GIS Portal and Connection users are affected)! If you need assistance please contact us (support@gis-ag.com) for further procedure. Link to IBM site: http://www-01.ibm.com/support/docview.wss?uid=swg21982223 Content: Summary Vulnerability Details Affected Products and Versions Remediation/Fixes Summary There are multiple vulnerabi
3
Security Bulletin: Apache Commons FileUpload Vulnerability affects WebSphere Application Server (CVE-2016-3092)
Tue, Sep 13th 2016 4:22a   GIS Techblog
Classification Score of 5.3 is moderate. Affects WebSphere Application Server and WebSphere Application Server Hypervisor Edition! If you need assistance please contact us (support@gis-ag.com) for further procedure. Link to IBM site: http://www-01.ibm.com/support/docview.wss?uid=swg21987864&myns=swgws&mynp=OCSSCKBL&mynp=OCSSEQTP&mync=E&cm_sp=swgws-_-OCSSCKBL-OCSSEQTP-_-E Content: Summary Vulnerability Details Affected Products and Versions Remediation/Fixes Summary
3
Security Bulletin: Redirect HTTP traffic vulnerability may affect IBM HTTP Server (CVE-2016-5387)
Tue, Sep 13th 2016 4:21a   GIS Techblog
Classification Score of 8.1 is high. Affects versions ( 9.0, 8.5.5, 8.5, 8.0, 7.0) and releases of IBM HTTP Server (powered by Apache) component in all editions of WebSphere Application Server and bundling products! If you need assistance please contact us (support@gis-ag.com) for further procedure. Link to IBM site: http://www-01.ibm.com/support/docview.wss?uid=swg21988019&myns=swgws&mynp=OCSSEQTP&mynp=OCSSEQTJ&mync=E&cm_sp=swgws-_-OCSSEQTP-OCSSEQTJ-_-E Content: Su




Created and Maintained by Yancy Lent - About - Planet Lotus Blog - Advertising - Mobile Edition