Service Authentication How to

Question

Hi,
I deployed samples apps and tested them successfully. We have Clarify CRM app
which uses Tuxedo. Clarify has few services exposed which we can call to access
the Business logic written and compiled in Clarify.
I commented the SECURITY USER_AUTH parameter in ubbconfig file for testing. I
was able to test the services OK.
In production we run tuxedo with SECURITY set to USER_AUTH.
So If I have to test a service using ud32, I do the following
tuxedo@voou30> ud32 -U lname
Enter Application Password :
Enter Application Specific Authentication Data:
SRVCNM CB_EXESUB
CLFY_SUB ExternalMsg
To accompish the same in WTC what should I do?
All our users are in Clarify.
(1) If I want to do authentication as part of the initial connection made by WTC,
how do I do that?
(2) Is it possible to do authentication for every call? If so how do I do it?
Thank You
--Raju

Answer 1

Thank you so much for taking the time to answer.
I just finished testing and with SECURITY set to none in both domain config and
wtc config, I was able to access the services though the ubbconfig is set to USER_AUTH.
Now it is clear to me how domain level security works.
Again thank you for the details provided.
off to testing again...................:-)
--Raju
"A. Honghsi Lo" <[email protected]> wrote:
Hi Raju,
My answers are interspersed within your question.
Raju Vatsavayi wrote:
Thank You Honghsi,You are welcome.
I just want to followup with few more questions. Sorry am not toofamiliar with
tuxedo.
In the Clarify system, we have two servers "clearad", and "cleard".Clearad is
used for user authentication and Cleard for business logic. I founda sample Client
code written in c to access services in Clarify via tuxedo and i amattching it
to this posting. In the code they are setting username, applicationpassword and
user password in a structure TPINIT.
// create and init a TPINIT structure
tpinfo = (TPINIT *)tpalloc( "TPINIT", NULL,
sizeof(TPINIT));
if (!tpinfo) {
(void)userlog("--ERROR--out of mem\n", "memory error");
printf("--ERROR--out of mem\n", "memory error");
return 0;
strcpy(tpinfo->usrname, (char *) "sa");// clarifyusername
strcpy(tpinfo->cltname, "clarify");// always clarify
strcpy(tpinfo->passwd, "clarify");//always clarify
strcpy(tpinfo->grpname, "");
tpinfo->flags = TPU_DIP|TPSA_FASTPATH;//defaults
tpinfo->datalen = strlen("freshen")+1;
strcpy((char *) &tpinfo->data, (char *) "freshen");
// tpinit authenticates by calling AUTHSVC from clearad
******This fragment of code is for log-in into Tuxedo application. Tuxedo
will authenticate the password and give permission for the client to
access
Tuxedo. Then the Tuxedo AUTHSVR will authenticate the client and create
user credential. These are done independent of Tuxedo TDOMAIN gateway.
If I set security to NONE in both domain gateway and WTC config file,can i still
access the exposed services? I dont really need any security becausethe
two systems
YES. You still can access from TUXEDO to WTC and vice versa.
The only thing missing is that the session may not be safe. In this
case the application better be deployed behind a firewall.
that are talking (tuxedo and wls) in this case belong to same app andthey mostly
do backend operations and not used by users.
Do I have to have some thing similar to TPINIT in my java code to accessthe services?
NO. In JAVA if you don't set up property for SECURITY_PRINCIPAL and
SECURITY_CREDENTIAL then the user is treated as anonymous user. In this
case as long as TUXEDO is not configured with ACL or MANDATORY_ACL then
there is no problem for anonymous user to access TUXEDO service.
There are many factors that are used in deciding who you are and what
kind of previleges you have. Both Tuxedo UBBCONFIG and DMCONFIG have
attributes that you can customize them according to your need.
For accessing from Tuxedo to WLS is a little different. By default WLS
does have access control on. There are several things you can do.
1. the Tuxedo user to access WLS as anonymous user
2. the Tuxedo user to access WLS as a specific user
3. the Tuxedo user to access WLS as themselves
The WTC configuration and WLS user will be different depends on which
way you want to go. (refers the WCT administration manual)
Because from what you said in the reply, I need to have a matchingpassword (DMCONFIG
and WTC config file). If I have SECURITY set to USER_AUTH in ubbconfig,You only need matching Domain (connection/session principal) password
if
you want to authenticate the session. If you don't need this kind of
session security then you don't need these passwords.
do I have
to somehow pass security credentials in order to access services onTUXEDO? Because
The USER_AUTH for SECURITY attribute in the UBBCONFIG is for TUXEDO
application not for DOMAIN. So setting USER_AUTH has no direct
consequence of DOMAIN session authentication.
with ud32 utility, I have to provide user name and passwords (listedin my original
posting) when security is set to USER_AUTH and however I do not haveto provide
any credentials if SECURITY is commented out in ubbconfig.You only need to do this for Tuxedo user. However, if your SECURITY(in
UBBCONFIG) level is set to ACL and above and you have ACL_POLICY(in
DMCONFIG) set to LOCAL then you also have to add the remote domain id
(also call remote access point id) as a Tuxedo principal/user using
tpusradd. In this case all the remote user from WLS will have the same
credential as the remote domain id. If your ACL_POLICY is set to GLOBAL
and your WTC CREDENTIAL_POLICY is set to GLOBAL then WTC will propagate
user credential (by translating WLS credential to Tuxedo credential
format) to TDOMAIN gateway, and that particular user credential will
be
used to access Tuxedo service. In this case the WLS user better be a
valid Tuxedo user. (you can add them through tpusradd) THIS FEATURE
IS
CALLED SINGLE SIGN-ON.
Hope the above information will be helpful for understanding how the
security works in Tuxedo/WLS environment.
Regards,
Honghsi :-)
Thank You
Raju
"A. Honghsi Lo" <[email protected]> wrote:
Hi Raju,
It all depends on what you want to do. A Tuxedo security change,
as
you
mentioned in your original email, does not change what is going on
through the Gateway. There are two types of security you can configure
for a TDOMAIN session (connection) between WTC and GWTDOMAIN.
1. The session (connection) authentication - done once
This is for making sure only allowed remote party can connect to
local
Gateway. To do it you need to configure both WTC and GWTDOMAIN.
In Tuxedo DMCONFIG file you have to add "SECURITY" attribute foryour
LOCAL TDOMAIN. Please refer to dmconfig(5) for the descriptionof
the
legal values for this attribute, and choose one that is appropriate
to
your purpose. If you choose DM_PW then you can use "dmadmin" toadd
the passwords for the session.(refers to dmadmin(1))
(most of the following information based on 6.x WLS. For 7.0 and
above you can do it from WLS console)
If the SECURITY is not NONE then you also need to configure yourWTC
with same security level for T_DM_LOCAL_TDOMAIN. (this also
depends on the release the tag name may be different) Use
weblogic.wtc.gwt.genpasswd to generate encrypted password withXML
tags. Cut and paste it to the T_DM_PASSWORD in BDMCONFIG if
the security is DM_PW, cut and paste it to T_DM_RESOURCE if the
security is APP_PW.
This should answer your first question.
2. For authentication of every actual request I assume you mean checking
the Access Permission. (because the USER already authenticatedin
Tuxedo, or the connection principal already authenticated when
session
started)
TUXEDO: you need to add ACL_POLICY(both Tux 7.1 and Tux 8.0) and
CREDENTIAL_POLICY(Tux 8.0) to the DM_REMOTE section. (refer toto
dmconfig(5) in Reference manual)
You set both attributes to GLOBAL.
WTC: you need to do the same as Tux 8.0 by adding AclPolicy="GLOBAL"
and CredentialPolicy="GLOBAL". You also have to copy Tuxedo'sTPUSR
file to WTC environment if WLS and Tuxedo runs in 2 different
machine or have different effective user id.
Add TpUsrFile="yourTpUsrFileFullPathName" to the BDMCONFIG.
If the access from Tuxedo user to WLS EJB is allowed then you need
you add users to the weblogic-ejb-jar.xml "security-role-assignment"
(refer to WLS document). In your ejb-jar.xml you add "security-role"
to the "assembly-descriptor". (for more detail refer to WLS doc)
I believe WTC document contains sample weblogic-ejb-jar.xml and
ejb-jar.xml that are for ACL.
this should answer your 2nd question.
Regards,
Honghsi :-)
Raju vatsavayi wrote:
Hi,
I deployed samples apps and tested them successfully. We have ClarifyCRM app
which uses Tuxedo. Clarify has few services exposed which we can
call
to access
the Business logic written and compiled in Clarify.
I commented the SECURITY USER_AUTH parameter in ubbconfig file fortesting. I
was able to test the services OK.
In production we run tuxedo with SECURITY set to USER_AUTH.
So If I have to test a service using ud32, I do the following
tuxedo@voou30> ud32 -U lname
Enter Application Password :
Enter Application Specific Authentication Data:
SRVCNM CB_EXESUB
CLFY_SUB ExternalMsg
To accompish the same in WTC what should I do?
All our users are in Clarify.
(1) If I want to do authentication as part of the initial connectionmade by WTC,
how do I do that?
(2) Is it possible to do authentication for every call? If so how
do
I do it?
Thank You
--Raju
Name: Echocli.c
Echocli.c Type: Plain Text (text/plain)
Encoding: base64