LDAP authentication with OWSM

OWSM policies works seamlessly with integrated LDAP provided by weblogic. However sometimes the requirement is to integrate the OWSM policies like user name token policy to work with external LDAP.

Here are the steps that I recently followed to secure my Proxy services using OWSM and user token authenticated using LDAP server.


Part I: Create an external LDAP provider in weblogic

1. Add LDAP Provider : Login to Weblogic console
Home >Summary of Servers >Summary of Security Realms >myrealm >Providers
Create a new provider : MyLdapProvider
Type :  Active Directory Authentication provider



2) Set Control Flag : Sufficient
This step is important as this will make sure that if the user is not validated using this provider the validation will go to next provider. As the document says:
A SUFFICIENT value specifies this LoginModule need not succeed. If it does succeed, control is returned to the application. If it fails and other Authentication providers are configured, authentication proceeds down the LoginModule list




3. Set the Provider Specific configuration this is very important to get connected to LDAP server.

Host : mycompanycatalog.com
Port : 389
Principal  : CN=LdapAdmin,OU=WLUsers,DC=Myorg,DC=com
Credential : password

User Base DN: OU=WLUsers,DC=Myorg,DC=com , add filter for particular user if you want to restrict the access to only one user. like CN=Sam001, OU=WLUsers,DC=Myorg,DC=com

Group Base DN :OU=MyorgUsers, DC=Myorg,DC=com

4. Reorder Providers to make MyLdapProvider as first provider

5. Restart the servers

6. Verify if the LDAP settings are good .

My Realms -> Users and Groups

You should see the user fetched from Ldap Provider MyLdapProvider

Part II : Securing the OSB proxy with OWSM

1) Attach the policy to Proxy service

oracle/wss_username_token_service_policy

2) Pass security header with LDAP user credentials :

  <wsse:Security soapenv:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">

         <wsse:UsernameToken wsu:Id="UsernameToken-4" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">

            <wsse:Username>Sam001</wsse:Username>

            <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">PassWord3241</wsse:Password>

         </wsse:UsernameToken>

  </wsse:Security> 

This works !!

Creating REST Services in OSB

In my previous post Rest Support from OSB I have explained on how to consume the HTTP post multi mime REST service in OSB . This post describes on how to create REST services in OSB for basic native HTTP methods GET & POST .


Part I : Creating a proxy service for Native HTTP methods (GET/ POST) and Testing :
1) Decide on how the query parameters will be passed to the GET service , there are two approaches first using relative URL parameters or using the Query string. I prefer the query string approach where you can pass multiple query parameters , like :
http://localhost:7001/LoanRestServices/Proxy/GetLoanService?BorrId=101&LoanId=9001

The value of these parameters can be fetched inside the proxy flow using xpath :
$inbound/ctx:transport/ctx:request/http:query-parameters/http:parameter[@name="BorrId"]/@value
$inbound/ctx:transport/ctx:request/http:query-parameters/http:parameter[@name="LoanId"]/@value


2) Create a Proxy Service : GetLoanService
Type : Any XML Service

3) Implement message flow

3.1 you can create separate services for each type of operation or can use conditional Branch, here is how the flow should look like using the conditional branch:




The conditional branch will be based on inbound variable value :
./ctx:transport/ctx:request/http:http-method/text() = 'GET' or 'POST'

3.3 For GET flow fetch the value from query parameters  and use them to invoke other downstream services or just create a static response.

3.4 For POST flow fetch the input parameters  value using simple Xpath like : $body//LoanId/text() and use them to invoke other downstream services or just create a static response.

4) Testing the GET and POST service , execute the proxy from service bus console .

4.1 For GET
In Transport section populate below values :
http-method: GET
query-parameters:
<tp:query-parameters xmlns:tp="http://www.bea.com/wli/sb/transports/http">
<tp:parameter name="LoanId" value="9001"/>
<tp:parameter name="BorrId" value="101"/>
</tp:query-parameters>

4.2 For POST

In Transport section :  http-method: POST
In payload pass :
<Loan>
<LoanId>8001</LoanId>
<BorrId>10233</BorrId>
</Loan>

Execute. This runs perfectly fine.

 Part II : Creating a Test service to test the Rest service created in previous step to do testing without using a test console and see how other services can consume the REST service.

1) Create Two Proxy services :
InvokeLoanService
InvokeLoanServicePOST for invoking GET and POST operation respectively.
Type : Any XML service

2) Implement the Proxy Flow :

2.1 ) Fetch the input values using  simple Xpath : $body//LoanId/text()

2.2) Add a Route Node to invoke the service created in Step I.
- Add Insert for adding the Method Type for invoking the service :
Insert <http:http-method>GET</http:http-method> for Xpath ./ctx:transport/ctx:request in Outbound

- Add Insert for adding the Query parameters like :

Insert <http:query-parameters/> for Xpath ./ctx:transport/ctx:request in Outbound
Insert <http:parameter name="LoanId" value="{$LoanId}"/> for Xpath ./ctx:transport/ctx:request/http:query-parameters in Outbound
Insert <http:parameter name="BorrId" value="{$BorrId}"/> for Xpath ./ctx:transport/ctx:request/http:query-parameters in Outbound

2.3 ) For Post service , We just need to have one insert for the method type , like :
Insert <http:http-method>POST</http:http-method> for Xpath ./ctx:transport/ctx:request in Outbound
2.4 ) For Post service replace the body in route to pass required values like:
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
    <soap:Header>
    </soap:Header>
    <soap:Body>
<LoanId>{$LoanId}</LoanId>
<BorrId>{$BorrId}</BorrId>
</soap:Body>
</soap:Envelope>

  The Route will look like :



 You can simply test these services using payload, no need to set the query parameters and HTTP method as that is handled internally by the services.
<Loan>
<LoanId>102</LoanId>
<BorrId>2345</BorrId>
</Loan>

Cheers !!

1Z0-543 - Oracle Application Integration Architecture 11g Certified Implementation Specialist

Here are few tips for AIA foundation pack certification preparation. Since this exam is expensive than other middleware exams it makes more sense to give that extra effort while preparing for this.

Recommended books :

1. Oracle student guide for AIA foundation pack , you get this if you have attended Oracle training.
2. Oracle Application Integration Architecture (AIA) Foundation Pack 11gR1: Essentials PackT publishing
3. Oracle documentation for AIA FP

Try to focus on basics of AIA : EBO/EBM/ABCS/EBF/CBP/EBS .

The exam consists of 70 questions and mainly from below areas :

- ABCS, EBO , EBM , EBF , CBP , EBS , extending EBO/ABCS
-  Harvesting AIA artifacts
- AIAConfigurationProperties
- AIA tools like XMAN, PIP auditor
-  AIA deployment process , password management , BOM , deployment plan
- PLW , service solution components , CAVS
- AIA guaranteed message delivery MEP patterns
- AIA error handling framework
- Jdeveloper service constructor
- AIA annotations

Hope this helps.

Good luck !!