IBM WebSphere V5.0 Security - CGISecurity

1. In the Administrative Console, navigate to the Security -> User Registries ->
LDAP item, then select Advanced LDAP Settings at the bottom of the page.
2. Modify the User filter field by adding the (objectclass=inetOrgPerson) part
to reflect the following configuration:
(&(uid=%v)(objectclass=inetOrgPerson)(objectclass=ePerson))
3. Modify the Group filter field by adding the (objectclass=accessGroup) item
to reflect the following configuration:
(&(cn=%v)(|(objectclass=groupOfNames)(objectclass=accessGroup)
(objectclass=groupOfUniqueNames)))
4. Modify the Group Member ID Map field by adding the accessGroup:member
item to reflect the following configuration:
groupOfNames:member;accessGroup:member;groupOfUniqueNames:uniqueM
ember
5. Save the configuration for WebSphere. If you are planning to enable SSL for
the LDAP connection, go ahead and configure it following the instructions
from the next section; if not, then restart WebSphere to make the changes
live.
Configuring WebSphere SSL access to IBM Directory Server
Now that we have WebSphere configured to use the IBM Directory Server, you
need to decide whether you need to secure the message traffic between
WebSphere and the directory server. Using non-SSL for our connection, all
message traffic between WebSphere and the directory server will not be
encrypted, meaning that someone could capture the data flowing between
WebSphere and the directory, and could find our user IDs and their passwords.
For a development environment this is probably fine, but once we move our
application into a production environment, we may find this to be less than
desirable.
During the installation of the IBM Directory Server, using the
ezinstall_ldap_server script for Access Manager, we chose to enable SSL
connections between IBM Directory Server and our Access Manager
components to ensure that our message traffic was secure.
1. First you have to configure your WebSphere Application Server’s LDAP
settings to support SSL for the LDAP connection. Follow the steps from
Section , “Configuring the secure LDAP (LDAPS) connection” on page 328.
2. In order to provide SSL access between WebSphere and the directory server,
we must establish a trusted relationship between them. This requires that
WebSphere, when binding to the directory server, must have a means to
identify the directory server. We are going to accomplish this by placing the
directory servers public certificate into the WebSphere trusted servers keyring
file. It is a similar scenario to Section 10.11, “SSL between the Web server
384 IBM WebSphere V5.0 Security Handbook