0N/A------------------------------------------------------------------------------
2362N/AREADME file for Open Web Single Sign-On Exercise
0N/A------------------------------------------------------------------------------
0N/A DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
0N/ACopyright (c) 2005 Sun Microsystems Inc. All Rights Reserved
0N/AThe contents of this file are subject to the terms
0N/Aof the Common Development and Distribution License
0N/A(the License). You may not use this file except in
0N/Acompliance with the License.
0N/AYou can obtain a copy of the License at
0N/ASee the License for the specific language governing
0N/Apermission and limitations under the License.
2362N/AWhen distributing Covered Code, include this CDDL
2362N/AHeader Notice in each file and include the License file
0N/AIf applicable, add the following below the CDDL Header,
0N/Awith the fields enclosed by brackets [] replaced by
0N/Ayour own identifying information:
0N/A"Portions Copyrighted [year] [name of copyright owner]"
0N/A$Id: README,v 1.13 2008/08/19 19:08:17 veiming Exp $
0N/A------------------------------------------------------------------------------
0N/A %% 1. Deploying and Configuring the opensso server
0N/A %% 2. Building the agent
0N/A %% 3. Installing and configuring agent
0N/A %% 4. Creating the user
0N/A %% 5. Creating the policies
0N/A %% 6. Exercising the access control
0N/A%% 1. Deploying and Configuring the opensso server
0N/A%% 2. Building the agent
0N/A%% 3. Installing and configuring agent
0N/AInstallation details are provided at
0N/Aplease follow the following steps in place of the bullet
where <protocol>, <hostname> and <port> are the demo server's protocol,
hostname and port respectively.
where XFC3z18nqMEgWbnshtNfwQ== is the encrypted password (adminadmin)
where <agent-protocol>, <agent-hostname> and <agent-port> are the agent's
protocol, hostname and port respectively.
Remember to restart the apache web server after configuring the agent.
New user can be created in the user management datastore. Here, you create a
user and later grant him privileges to access all web resources. Please
follow the following steps to create an user.
%% In the web console, click on the opensso realm hyperlink; and you
see the profile of a realm;
%% Select the Subjects tab to view the realm's subject main page;
%% Click on the New button to access the user creation page;
%% Enter an user ID (example duke); password (example opensso); and
%% Click on OK button to create the user;
%% Click on Access Control breadcrumb to go back to the main page.
%% 5. Creating the policies
Here, you create a policy so that the newly created user, "duke"
can access to all web resources that are served out by the apache
server. Please follow the following steps to create this policy.
%% In the web console, click on the opensso realm hyperlink; and you
see the profile of a realm;
%% Select the Policies tab; and you see the realm's policies main page;
%% Click on the New Policy button to access the policy creation page;
%% Enter a name for the policy (example DemoPolicy);
%% Click on the New ... button under the Rules action table to access
the rule creation page. (Choose "URL Policy Agent (with resource name)"
in the "Select Service Type for the Rule" page; and click on the Next
%% Enter DemoRule as rule name;
%% Enter <agent-protocol>://<agent-hostname>:<agent-port>/* as the
resource name. where <agent-protocol>, <agent-hostname> and
<agent-port> are the agent's protocol, hostname and port
%% Check the GET and POST checkboxes and have their values as allow;
%% Click on Finish button to create the rule;
%% Click on the New ... button under the Subjects action table to access
the subject creation page; (Choose "OpenSSO Identity Subject"
in the "Select Subject Type" page; and click on the Next button)
%% Enter DemoSubject as subject name;
%% Select User in the Filter dropdown list and click on Search button;
%% Select the user Id that was created in step 7. (example duke) under the
Available list box and click on "Add >" button to select the user;
%% Click on Finish button to create the subject;
%% Click on OK button to create the policy.
%% 6. Exercising the access control
This demo is setup so that the user can access all web resource under
<agent-protocol>://<agent-hostname>:<agent-port>.
%% Log out of the web console;
%% Open a web browser (with Javascript and cookie enabled), visit
<agent-protocol>://<agent-hostname>:<agent-port> where
<agent-protocol>, <agent-hostname> and <agent-port> are the
protocol, hostname and port number of the agent's web server
%% You will be redirected to <protocol>://<hostname>:<port>
/demo/UI/Login,
the Login page by the web agent as you have not yet authenticated.
(<protocol>, <hostname> and <port> are the protocol, hostname and port
number of the opensso server respectively.)
%% Log in as the newly created user, "duke" with password "opensso";
%% You will be brought to the URL that you first attempt to visit,
i.e. <agent-protocol>://<agent-hostname>:<agent-port>.
You can modified the policy to alter his access rights. For instance,
<agent-protocol>://<agent-hostname>:<agent-port>/html/*, so that he can
only access all web resource under
<agent-protocol>://<agent-hostname>:<agent-port>/html/*
Or you can visit the web console to delete the policy and then the user will
not have access to any resources
<agent-protocol>://<agent-hostname>:<agent-port>
%% Log in to the system by visiting <protocol>://<hostname>:<port>/demo;
%% Enter "amadmin" and "adminadmin" as username and password respectively;
%% In the web console, click on the opensso realm hyperlink; and you
see the profile of a realm;
%% Select the Policies tab; and you see the realm's policies main page;
%% Check the checkbox next to the policy to delete;
%% Click on the Delete button to delete it.
Now, the user will not have access to any resource in
<agent-protocol>://<agent-hostname>:<agent-port>
%% Log out of the web console;
%% Clear the browser's cache and cookie.
%% Open a web browser (with Javascript and cookie enabled), visit
<agent-protocol>://<agent-hostname>:<agent-port> where
<agent-protocol>, <agent-hostname> and <agent-port> are the
protocol, hostname and port number of the agent's web server
%% You will be redirected to <protocol>://<hostname>:<port>
/demo/UI/Login,
the Login page by the web agent as you have not yet authenticated.
(<protocol>, <hostname> and <port> are the protocol, hostname and port
number of the opensso server respectively.)
%% Log in as the newly created user, "duke" with password "opensso";
%% You will get a denied access message.
You can deploy a sample WAR to try out access control policy evaluation.
%% Deploying and Configuring the opensso demo, Please refer to
%% Login as amadmin user;
depending on where the web application is deployed;
%% We will get a "false" policy decision for this resource.
<protocol>://<hostname>:<port>/opensso or
<protocol>://<hostname>:<port>/openssodemo, depending on where the web
application is deployed; and create a policy.
%% In the web console, click on the opensso realm hyperlink; and you
see the profile of a realm;
%% Select the Policies tab; and you see the realm's policies main
%% Click on the New Policy button to access the policy creation page;
%% Enter a name for the policy (example DemoPolicy);
%% Click on the New ... button under the Rules action table to access
the rule creation page. (Choose "URL Policy Agent (with resource
name)" in the "Select Service Type for the Rule" page; and click
%% Enter DemoRule as rule name;
%% Check the GET and POST checkboxes and have their values as allow;
%% Click on Finish button to create the rule;
%% Click on the New ... button under the Subjects action table to
access the subject creation page; (Choose "Authenticated Users" in
the "Select Subject Type" page; and click on the Next button)
%% Enter DemoSubject as subject name;
%% Click on Finish button to create the subject;
%% Click on OK button to create the policy.
depending on where the web application is deployed;
%% We will get a "true" policy decision for this resource.
You can try different resource names and subject types to test the policy