IBM WebSphere V5.0 Security - CGISecurity

1. In the Administrative Console, navigate to the Security -> User Registries ->LDAP item, then select Advanced LDAP Settings at the bottom of the page.2. Modify the User filter field by adding the (objectclass=inetOrgPerson) partto reflect the following configuration:(&(uid=%v)(objectclass=inetOrgPerson)(objectclass=ePerson))3. Modify the Group filter field by adding the (objectclass=accessGroup) itemto reflect the following configuration:(&(cn=%v)(|(objectclass=groupOfNames)(objectclass=accessGroup)(objectclass=groupOfUniqueNames)))4. Modify the Group Member ID Map field by adding the accessGroup:memberitem to reflect the following configuration:groupOfNames:member;accessGroup:member;groupOfUniqueNames:uniqueMember5. Save the configuration for WebSphere. If you are planning to enable SSL forthe LDAP connection, go ahead and configure it following the instructionsfrom the next section; if not, then restart WebSphere to make the changeslive.Configuring WebSphere SSL access to IBM Directory ServerNow that we have WebSphere configured to use the IBM Directory Server, youneed to decide whether you need to secure the message traffic betweenWebSphere and the directory server. Using non-SSL for our connection, allmessage traffic between WebSphere and the directory server will not beencrypted, meaning that someone could capture the data flowing betweenWebSphere and the directory, and could find our user IDs and their passwords.For a development environment this is probably fine, but once we move ourapplication into a production environment, we may find this to be less thandesirable.During the installation of the IBM Directory Server, using theezinstall_ldap_server script for Access Manager, we chose to enable SSLconnections between IBM Directory Server and our Access Managercomponents to ensure that our message traffic was secure.1. First you have to configure your WebSphere Application Server’s LDAPsettings to support SSL for the LDAP connection. Follow the steps fromSection , “Configuring the secure LDAP (LDAPS) connection” on page 328.2. In order to provide SSL access between WebSphere and the directory server,we must establish a trusted relationship between them. This requires thatWebSphere, when binding to the directory server, must have a means toidentify the directory server. We are going to accomplish this by placing thedirectory servers public certificate into the WebSphere trusted servers keyringfile. It is a similar scenario to Section 10.11, “SSL between the Web server384 IBM WebSphere V5.0 Security Handbook