Migrate custom user registries

If we built our own custom user registry, consider the migration items listed below. If we have a custom user registry that was provided by a Security Solution Provider, contact that provider to ensure that we have the correct version of their custom user registry to support WAS.

In WAS, in addition to the UserRegistry interface, the custom user registry requires the Result object to handle user and group information. This file is already provided in the package and we are expected to use it for the getUsers, getGroups, and the getUsersForGroup methods.

We cannot use other WAS components, for example, data sources, to initialize the custom registry because other components, like the containers, are initialized after security and are not available during the registry initialization. A custom registry implementation is a pure custom implementation, independent of other WAS components.

The getCallerPrincipal enterprise bean method and the getUserPrincipal and getRemoteUser servlet methods return the security name instead of the display name.

See Develop the UserRegistry interface for using custom registries or the API documentation.

If the migration tool is used to migrate the WAS V 5 configuration to WAS V6.0.x and later, this migration does not change the existing code. Because the WAS V5 custom registry works in WAS V 6.0.x and later without any changes to the implementation, except when using data sources, we can use the V5-based custom registry after the migration without modifying the code.

Copy the files to the cell and to each of the node class paths.

In WAS V6.0.x and later, a case-insensitive authorization can occur when using an enabled custom user registry.

Set this flag does not have any effect on the user names or passwords. Only the unique IDs that are returned from the registry are changed to lower-case before comparing them with the information in the authorization table, which is also converted to lowercase during runtime.

Before proceeding, look at the UserRegistry interface. See Develop standalone custom registries for a description of each of these methods in detail.

The following steps go through all the changes that are required to move the WAS V4.x custom user registry that implemented the old com.ibm.websphere.security.CustomRegistry interface to the com.ibm.websphere.security.UserRegistry interface.

The sample implementation file is used as an example when describing the following steps.

 

1. Change the implementation to UserRegistry instead of CustomRegistry. Change:

   public class FileRegistrySample implements CustomRegistry
   

   to:

   public class FileRegistrySample implements UserRegistry
   

2. Create the java.rmi.RemoteException exception in the constructors:

   public FileRegistrySample() throws java.rmi.RemoteException
   

3. Change the mapCertificate method to take a certificate chain instead of a single certificate. Change

   public String mapCertificate(X509Certificate cert)
   

   to:

   public String mapCertificate(X509Certificate[]cert)
   

   Having a certificate chain gives you the flexibility to act on the chain instead of one certificate. If interested only in the first certificate, take the first certificate in the chain before processing. In WAS V6.0.x and later, the mapCertificate method is called to map the user in a certificate to a valid user in the registry when certificates are used for authentication by the Web or the Java clients.

4. Remove the getUsers method.

5. Change the signature of the getUsers(String) method to return a Result object and accept an additional parameter (int). Change:

   public List getUsers(String pattern)
   

   to:

   public Result getUsers(String pattern, int limit)
   

   In your implementation, construct the Result object from the list of the users that is obtained from the user registry (whose number is limited to the value of the limit parameter) and call the setHasMore method on the Result object if the total number of users in the registry exceeds the limit value.

6. Change the signature of the getUsersForGroup(String) method to return a Result object and accept an additional parameter (int) and throw a new exception called NotImplementedException exception. Change the following code:

   public List getUsersForGroup(String groupName)
             throws CustomRegistryException,                  EntryNotFoundException {
   

   to:

   public Result getUsersForGroup(String groupSecurityName, int limit)
             throws NotImplementedException,                  EntryNotFoundException,                  CustomRegistryException {
   

   In WAS V 6.0.x and later, this method is not called directly by the WAS security component. However, other components of WAS, like the WebSphere Business Integration Server Foundation process choreographer, use this method when staff assignments are modeled using groups. Because this implementation is supported in WAS V6.0.x and later, it is recommended that you change the implementation similar to the getUsers method as explained in step 5.

7. Remove the getUniqueUserIds(String) method.

8. Remove the getGroups method.

9. Change the signature of the getGroups(String) method to return a Result object and accept an additional parameter (int). Change the following code:

   public List getGroups(String pattern)
   

   to:

   public Result getGroups(String pattern, int limit)
   

   In your implementation, construct the Result object from the list of the groups that is obtained from the user registry whose number is limited to the value of the limit parameter. Call the setHasMore method on the Result object if the total number of groups in the registry exceeds the limit value.

10. Add the createCredential method. This method is not called at this time, so return as null.

    public com.ibm.websphere.security.cred.WSCredential 
       createCredential(String userSecurityName)
             throws CustomRegistryException,                 NotImplementedException,                 EntryNotFoundException {
             return null;
    
    
     
    

    The first and second lines of the previous code example are split onto two lines for illustrative purposes only.

11. To build the WAS V6.0.x and later implementation, make sure we have the com.ibm.ws.runtime.jar file in the class path. To set the files in the class path, use the following code as a sample and substitute the environment values for the variables that are used in the example:

    APP_ROOT/java/bin/javac -classpath 
    
    APP_ROOT/plugins/com.ibm.ws.runtime.jar  FileRegistrySample.java
    
    

    Type the previous lines as one continuous line.

    To build the WAS V5 custom registry (CustomRegistry) in WAS V 6.0.x and later, only the com.ibm.ws.runtime.jar file is required.

12. Copy the implementation classes to WAS class path.

    The %install_root%/lib/ext directory is the preferred location.

    Make sure that you copy these classes to the cell and all the nodes. Without the classes in each of the node class paths, the nodes and the appservers in those nodes cannot start when security is on.

13. Use the admin console to set up the custom registry.

    Follow the instructions in Set standalone custom registries to set up the custom registry, including the Ignore case for authorization option. Make sure that you add the WAS_UseDisplayName properties if required.

 

Results

WAS V4.x based custom user registry that implemented the old com.ibm.websphere.security.CustomRegistry interface is migrated to the com.ibm.websphere.security.UserRegistry interface.

 

Next steps

If enabling security, see Enable security to complete the remaining steps. When completed, save the configuration and restart all the servers. Try accessing some Java EE resources to verify that the custom registry migration is successful.

 

Related tasks

Develop standalone custom registries
Enable security

 

Related

UserRegistry.java files
FileRegistrySample.java file
getRemoteUser and getAuthType methods