Thursday, April 16, 2009

Building a Custom Trust Association Interceptor for WebSphere Portal, Part II

In Part I, we looked at the code for building a simple SSO Trust Association Interceptor for WebSphere Portal. This part explains the general steps on how to install the TAI on the application server.

The following steps describe how to Install a custom Trust Association Interceptor for WebSphere.

1.) Develop a class that extends TrustAssociationInterceptor
  • Fully qualified class for WebSphere is com.ibm.wsspi.security.tai.TrustAssociationInterceptor
  • Need to override the following methods:
  • initialize: initializes the TAI
  • isTargetInterceptor: determines if this TAI should be used as the one to check for Trust Association for the requested resource
  • negotiateValidateandEstablishTrust: this method does the actual checking to see if we can create the custom TAI Subject that is passed to the underlying protected resource
2.) Add the following libraries to the build path - (for development purposes. Project will have compilation errors without them)
  • sas.jar
  • wssec.jar
3.) Export the jar
  • Needs to be installed in the /lib/ext directory on all nodes for the application server
  • Any other necessary jar files used by the TAI should be placed in the /lib directory
4.) Configure the TAI on the ND
  • Security > Authentication Mechanisms > LPTA > Trust Association > Interceptors
  • Choose to create a new Interceptor
  • Enter the fully qualified class name of the Interceptor class (package + class name)
  • Apply, then Ok
6.) Enable Security on both WebSphere Application server and WebSphere Portal (if this hasn't been done yet). See here for more information.

5.) Restart all nodes

You should be able to see a print out at Server start up indicating it has loaded the new TAI.

Posted by SirCrofty at 2:10 PM
Labels: , , ,

7 comments:

  1. AnonymousJune 21, 2009 at 2:10 PM

    you have no idea how much this helped me.

    Thanks x100000

    ReplyDelete
  2. AnonymousNovember 4, 2009 at 4:01 AM

    Hi,

    Thank you very much for your guide. I developped an interceptor reading it, but I have a serious problem because we can't install it in the WebSphere. We copy the jar with the interceptor in the node in which the interceptor is necessary (in the path /lib/ext). In the log this error appears: " Trust Association Init Unable to load Trust Association class es.ceca.mir.CECAInterceptor." And in other log this is the error: java.lang.NoClassDefFoundError: com.ibm.wsspi.security.tai.TrustAssociationInterceptor. We don't understand. Do you think that we have to copy the jar in all nodes? Any idea about this error?

    Thank you

    ReplyDelete
  3. SirCroftyNovember 4, 2009 at 10:52 AM

    I believe (and it's been a while) that you need the jar in all nodes. When I did this it was for WebSphere 5.1.x, and the interface was in the wssec.jar. I believe WebSphere comes with a couple TAI's configured in the security, so that's my guess on the jar needing to be in all nodes.

    ReplyDelete
  4. AnonymousNovember 5, 2009 at 3:25 AM

    Hi,

    Thank you for your help. We copied the jar file in /usr/IBM/WebSphere/AppServer/lib/ext/, and we added the interceptor in the interceptor list in the Websphere Administration Console, and the error is always the same. We tried to copy the jar in the path /usr/IBM/WebSphere/AppServer/java/jre/lib/ext/, and the error is the same. The version of Websphere is the 6.1.

    We don't undertand the problem, because we are following all the steps and it doesn't work.

    Thank you

    ReplyDelete
  5. SirCroftyNovember 9, 2009 at 6:41 PM

    Off the top of my head, I would try looking at 2 things:

    1. User permissions on the jars in that directory
    2. Whether there is a duplicate jar in the directory/on the classpath that's causing a conflict.

    Let me know if that works.

    ReplyDelete
  6. AnonymousNovember 13, 2009 at 6:29 AM

    Thank you for your help. Finally, Websphere loads the Interceptor, the problem has changed and now the Interceptor doesn't work. Websphere administrators have recovered the initial security configuration, and for this the Interceptor is loaded. But the "Applications security" is not checked in the security configuration of Websphere, and probably this is the problem. What do you think?

    Thanks again

    ReplyDelete
  7. SirCroftyNovember 14, 2009 at 8:58 PM

    I would also check to make sure you've declared the page you're trying to hit as protected.

    ReplyDelete

Subscribe to: Post Comments (Atom)