<< May 2011 | Home | July 2011 >>

RedWiki Residency: Domino Development Best Practices

The RedWiki team is now accepting nominations for a new RedWiki project on Domino Development Best Practices. The (remote) residency will cover a total period of 5 weeks, from August 8, 2011 through September 9, 2011 and requires 6 residents. If you want to give back to the community and share your expert experience this is for you.

As one who has been part of the RedWiki process I can recommend it although it does require sufficient time being set aside for this and some writing experience would be good.

AbcWidget is trying to be downgraded to a lower installation scope. Reinstallation of this item will not be permitted.

When trying to update a plugin (feature) using a widget the installation failed and I got the below message.

<widget name> is trying to be downgraded to a lower installation 
scope. Reinstallation of this item will not be permitted. 
I wondered what it meant as I didn't really understabd the "installation scope" thing so I asked IBM and here's the answer I got from Doug MacDonald. Very useful and nicely explains why the installation failed.

When you install a widget, it is assign a scope. The scopes have a heirarchy.

  1. If the widget was installed from the corporate catalog using a category of widgets, the scope is catalog.push.
  2. If the widget was installed from the corporate catalog using drag and drop, the scope is user.catalog.
  3. If the widget was installed from a location other than the corporate catalog, the scope is user.import.
You cannot move down the scope hierarchy. For example:
  • Not allowed: If you install a widget from the corporate catalog using a category of widgets and then you try to drag and drop the same widget.
  • Not allowed: If you install a widget from the corporate catalog using drag and drop and then you try to drag and drop the same widget from a file on the file system.
You can move up in scope. For example:
  • Allowed: If you install a widget from the corporate catalog using drag and drop and then you install the same widget from the corporate catalog using a category of widgets.
  • Allowed: If you install a widget by drag and drop from the file system and then install the same widget from the corporate catalog using drag and drop.

IBM Champion

Really honored and flattered to have been both nominated to, and yesterday proclaimed as, an IBM Champion for IBM Collaboration Solutions (i.e. Lotus). Thank you guys who nominated me and voted for me VERY much.

A TAI code example

To complete my series posts on writing Trust Association Interceptors (TAI's) for Websphere Application Server I wanted to show a real-life example. Not a good example necessarily but an example never the less... :-)

The below example is a very simple TAI that simply does the following:

  1. The initialize() method reads a cookie name from the configuration done in the Websphere Application Server ISC. It illustrates how you can configure a TAI externally without having to hard code it.
  2. The isTargetInterceptor() method looks at the request and sees if a cookie with the configured name is available. If yes it continues to process the request and if not it aborts processing (from the TAI point of view).
  3. The negotiateValidateandEstablishTrust() method does the actual work by simply telling WAS that the username of user is the value from the cookie.
As you see writing a TAI is very simple but extremely powerful. Imagine what could be done if you did SSO between Websphere Application Server and Lotus Domino.

import java.util.Properties;

import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import com.ibm.websphere.security.WebTrustAssociationException;
import com.ibm.websphere.security.WebTrustAssociationFailedException;
import com.ibm.wsspi.security.tai.TAIResult;
import com.ibm.wsspi.security.tai.TrustAssociationInterceptor;

public class ExampleTAI implements TrustAssociationInterceptor {
   // declarations
   private String cookie = null;
   
   @Override
   public void cleanup() {
   }

   @Override
   public String getType() {
      return String.format("Example TAI %s", this.getVersion());
   }

   @Override
   public String getVersion() {
      return "1.0";
   }

   @Override
   public int initialize(Properties props) 
      throws WebTrustAssociationFailedException {
      System.out.println("ExampleTAI.initialize()");
      
      // read properties from configuration in WAS
      this.cookie = props.getProperty("cookieName");
      
      // return 0 to indicate success
      return 0;
   }

   @Override
   public boolean isTargetInterceptor(
      HttpServletRequest req) 
      throws WebTrustAssociationException {
      System.out.println("ExampleTAI.isTargetInterceptor()");
      for (Cookie c : req.getCookies()) {
         if (c.getName().equals(this.cookie)) return true;
      }
      return false;
   }

   @Override
   public TAIResult negotiateValidateandEstablishTrust(
      HttpServletRequest req, 
      HttpServletResponse res) 
      throws WebTrustAssociationFailedException {
      System.out.println("ExampleTAI.negotiate...()");
      for (Cookie c : req.getCookies()) {
         if (c.getName().equals(this.cookie)) {
            // send 200 to signal we're okay
            return TAIResult.create(HttpServletResponse.SC_OK, 
                c.getValue());
         }
      }
      
      // not authenticated
      return TAIResult.create(HttpServletResponse.SC_UNAUTHORIZED);
   }

}

Tags : , , ,

Developing TAI's for Websphere Application Server

Trust Association Interceptors (or TAI's) for Websphere Application Server is quickly becoming my new favorite technology. They just might be best thing since sliced bread and the reason why why you want to embrace Websphere Application Server. And so quickly.

I have discussed TAI's and why they're important in an earlier blog post.

One thing to know however is when developing them you need to have the necessary stuff in place. For TAI's these are the JAR required on the class path and they are:

  • <WASHOME>\runtimes\com.ibm.ws.webservices.thinclient_6.1.0.jar
  • <WASHOME>\lib\bootstrap.jar
  • <WASHOME>\lib\com.ibm.ws.runtime.jar
  • <WASHOME>\lib\j2ee.jar

After that it's a matter of creating a new class and implementing the com.ibm.wsspi.security.tai.TrustAssociationInterceptor interface which only contains two methods:

  • public boolean isTargetInterceptor (HttpServletRequest req)
    "The isTargetInterceptor method determines whether the request originated with the proxy server that is associated with the interceptor. The implementation code must examine the incoming request object and determine if the proxy server that forwards the request is a valid proxy server for this interceptor. The result of this method determines whether the interceptor processes the request."
  • public TAIResult negotiateValidateandEstablishTrust (HttpServletRequest req, HttpServletResponse res)
    "The negotiateValidateandEstablishTrust method determines whether to trust the proxy server from which the request originated. The implementation code must authenticate the proxy server. The authentication mechanism is proxy-server specific. For example, in the product implementation for the WebSEAL server, this method retrieves the basic authentication information from the HTTP header and validates the information against the user registry that WebSphere Application Serve uses. If the credentials are not valid, the code creates the WebTrustAssociationException exception, which indicates that the proxy server is not trusted and the request is denied. If the credentials are valid, the code returns a TAIResult result, which indicates the status of the request processing with the client identity (Subject and principal name) to use for authorizing the Web resource."

In short isTargetInterceptor is called to determine if a given request matches a given TAI and if it returns true negotiateValidateandEstablishTrust is called to determine if this TAI could authenticate the user and that the username ("Subject") is. Very easy.

It's important to note that "authenticate" could mean whatever you decide it means. That is you could actually do some work to authenticate the request but you could just as well simply decide that the user is authenticated and that the username is "John Doe123". Whether the authentication is done based on "real authentication", based on a cookie being set or something else is entirely up to you. That's why it's so powerful.

Once deemed authenticated by negotiateValidateandEstablishTrust a valid LtpaToken/LtpaToken2 is generated and the user is granted access into the Kingdom.

Infocenter: Trust association interceptor support for Subject creation

Tags : , ,

Do you care for TAI? You really should!!

Websphere Application Server is a beast. A big beast. But it's a beast that good (even great?!) on a lot of levels and it's definitely not as bad as you might think and it comes with a lot of goodness and loads of functionality. One of the real cool things about Websphere Application Server is the ability you have to extend the core application server (which is something that is hard - becoming easier but still hard - with Lotus Domino). The extendibility I want to mention today is Trust Association Interceptors - or TAI for short.

A Trust Association Interceptor is an exciting piece of technology that has been part of Websphere Application Server for quite a while and a technology that is becoming my new best friend. It's objective is to sit between an incoming request and the application server runtime and let you manage the authentication state of incoming requests. Think DSAPI filters to manage authentication if you will except that TAI's are written in Java and much easier to write, test, debug and deploy.

If you have a reverse proxy such as WebSEAL the way you make it work with Websphere Application server today is by installing a TAI into the application server. It's also the way that SPNEGO support is added. As with many Java technologies you could just as well write your own - and it's dead easy. It's even well documented in the IBM Infocenter. So why would you want to do so? Well imagine if you're installing IBM Connections and have an existing SSO solution you want to reuse to authentication. Writing a TAI lets you do that with a minimal hazzle.

I'll post about how you actually go ahead and write a Trust Association Interceptor later.

Tags : , ,

Gul Skole on Friday - come hear from one of the gurus

If you're in Denmark on Friday and want to hear about social media and social software from a Guru come to our seminar with Louis Richardson from IBM at Sofienholm. More information may be found on the event page. If you're contemplating social software within your organization this is a must-attend event and a chance to hear from one of the masters. And it's FREE!!

Please note that this is a business oriented event so no mention of Websphere Application Server, LDAP etc. Unless you hit me up for a conversation. :-)

Turning the login procedure for IBM Connections on its head

In the latter part of last year I was involved in installing IBM Connections at a customer site for initially 20.000 users and then, if all went well, for the full 70.000 users. The challenges in evangelizing the solution and getting people to use it is for another blog post but the project is interesting from other perspectives as well.

Firstly they wanted to change the layout of IBM Connections and add their own colors etc. which wasn't a biggie. Next they wanted to change certain core words within IBM Connections. In Danish the word for "Communities" is "Fællesskaber" but they wanted it to be "Grupper". Changing that throughout IBM Connections was a hazzle and we have to migrate these changes by hand when we upgrade to version 3 but it was possible which is the good story here. The last one was the biggest requirement and the the requirement it took the most work to satisfy. They wanted to turn the entire login process for IBM Connections on its head.

So what do I mean by that?

By default IBM Connections works by you importing all valid users into the Profiles database using TDI or a handcrafted tool and then hooking Websphere Application Server up to LDAP. They didn't want that and the users actually didn't exist in a LDAP directory but instead in another (Domino based) member database.

They had a number of requirements:

  1. IBM Connections should work with their existing single-sign-on (SSO) solution which supported a number of different login methods incl. two-factor and digital certificates.
  2. Before being granted access to IBM Connections the user should accept an End User License Agreement (EULA) and if not the user should be denied access to IBM Connections.
  3. Users wasn't allowed to be available in IBM Connections before opting in to using it by accepting the EULA i.e. they didn't want users in the Profiles database before they had accepted the EULA.
The access procedure they wanted may be illustrated as below.


(click the image to a larger version)

So what does an IBM Business Partner do? Say "Sorry that isn't possible" and "That's really not the way that IBM Connections work"? Well of course not because it was and is possible due to IBM Connections being built on top of Websphere Application Server which is an open and highly extensible platform.

The key piece to the puzzle is a piece of technology called a Trust Association Interceptor - or TAI for short - and is a way to change the way Websphere handles authentication and how Websphere normally integrates with reverse proxies such as WebSEAL.

A TAI is a Java class written to a specification (interface) from IBM and very easy to write. The functionality may of course be complex but the way you integrate with Websphere Application server isn't. Once the TAI was written and installed into Websphere Application Server the customer now has an access procedure like this:

  1. User tries to access IBM Connections.
  2. If the user isn't logged in using the 3rd party SSO solution the user is sent to the login screen (1 in the diagram above).
  3. If the user is logged in (and tokens are still valid) an EULA check is performed to verify that the latest EULA has been agreed to.
  4. If not the user is sent to the EULA system (2 in the diagram above) to accept the EULA instructing the EULA system to return the user to IBM Connections afterwards.
  5. If the user did accept the latest EULA we check to see if the user is available in IBM Connections.
  6. If the user isn't in Profiles yet the user is sent to the Populator system (3 in the diagram above) that handles collecting using information and populating Profiles. Once completed the user is returned to Websphere Application Server.
  7. If the user is in Profiles already the user is granted access to IBM Connections (bottom on the diagram).
It sounds complex but it's done in less than 500 lines of code incl. comments and documentation. That isn't too bad is it? What's really cool is that it allows for some very exciting ways to integrated IBM Connections into existing environments.

I'll post more about TAI's over the next few days about how you write them and more about the technical underpinnings. Stay tuned.