IBM BPM, V8.0.1, All platforms > Install IBM BPM > IBM BPM Advanced > Install IBM BPM Advanced > On Windows > Network deployment environment > Configure profiles and create an ND environment > Create an ND environment > Use the administrative console > Configure components > Configure additional components > Configure Process Portal > Configure the Business Space component for Process Portal > Configure Business Space to work with IBM Case Manager

Configure cross-cell security for IBM BPM and IBM Case Manager

The products are configured in two different cells. Both cells need access the same users, single sign-on (SSO), and Secure Sockets Layer (SSL).

This topic applies to the following products:

Before you configure a cross-cell setup, :


Procedure

  1. Configure so that the IBM BPM and IBM Case Manager cells have access to the same users. There are different possible ways to achieve this, depending on your choice of user account repository.

    For example, if you have an existing LDAP server, you could make it available to both cells.

  2. Identify the necessary search filters that match your user repository definitions. Both cells require identical filter strings for the following searches:

    • User
    • Group
    • Group membership

    You must inspect the definitions for your user repository to be able to determine the correct filter strings.

    For example, if you use a LDAP server that has the following definitions.

    • Group: groupOfNames
    • OrgContainer: organization;organizationalUnit;domain;container
    • PersonAccount: inetOrgPerson

    The appropriate search filters would be the following:

    • User search filter: (&(objectClass=inetOrgPerson)(uid={0}))
    • Group search filter: (&(cn={0})(|(objectClass=groupOfNames)(objectClass=groupOfUniqueNames)))
    • Group membership search filter: (|(&(objectclass=groupOfNames)(member={0}))(&(objectclass=groupOfUniqueNames)(uniqueMember={0})))

  3. Collect information about the user repository. Depending on the type of user repository you use, collect appropriate information such as the server host name, port number, login property, certificate mapping, and LDAP base entry distinguished name.

  4. On the IBM Case Manager server, add the user directory to the federated realm.

    1. Start the Enterprise Manager and connect to the IBM Case Manager P8 domain.

    2. To start the Create a Directory Configuration wizard, right-click Enterprise Manager, select Properties, select the Directory configuration tab, and click Add. The Create a Directory Configuration Wizard window opens.

    3. Enter all the information that is required by the wizard about your user repository.

    4. Add a base entry for the user repositoryto the federated realm. In the administrative console, click Security > Global Security then in the User account repository section, click Configure > Add base entry to realm then enter the required information about the user repository. Click OK and Save.

      If you use an LDAP server, make sure that you specify EXACT_DN for the certificate mapping.

    5. Restart the IBM Case Manager environment.
    6. Verify that you can search the user repository. In the administrative console, click Users and Groups > Manage Users. In the Search for users section enter a string in the Search for field that should match some existing users in the repository, for example a*, click Search and verify that matching users are found.

  5. On the IBM BPM server, add the user directory to the federated realm.

    1. Add a base entry for the user repositoryto the federated realm. In the administrative console, click Security > Global Security then in the User account repository section, click Configure > Add base entry to realm then enter the required information about the user repository. Click OK and Save.

      If you use an LDAP server, make sure that you specify EXACT_DN for the certificate mapping.

    2. Restart the IBM BPM environment.
    3. Verify that you can search the user repository. In the administrative console, click Users and Groups > Manage Users. In the Search for users section enter a string in the Search for field that should match some existing users in the repository, for example a*, click Search and verify that matching users are found.

  6. Configure cross-cell single sign-on (SSO).

    1. Verify that automatic key generation is turned off. Perform the following steps for all participating cells for IBM BPM and IBM Case Manager.

      1. In the administrative console, click Security > SSL certificate and key management > Manage endpoint security configurations
      2. Expand the branches of the tree down to either the inbound or outbound management scope that contains the key set group, and then click the scope link for the cell.

      3. In the Related Items section, click Key Set Groups.

      4. Click the key set group NodeLTPAKeySetGroup.
      5. Clear the Automatically generate keys option.

      6. Click OK and Save to save the changes to the master configuration.

      7. Start the server again to activate the changes.
      8. Remember to perform steps 6.a.i: to 6.a.vii: for all participating cells for both products.
    2. Share a common LTPA key between all participating cells. As an example, the following steps illustrate exporting the LTPA key from the IBM BPM server and importing it into the keystore of one IBM Case Manager cell.

      1. In the IBM BPM administrative console click Security > Global Security, then in the Authentication section, click LTPA.

      2. In the Cross-cell single sign-on section enter a new strong password and a key file name. The file is created in the server's profile root directory unless a fully-qualified path is specified.

      3. Click Export keys then OK.
      4. Transfer the exported key file in binary mode to the file system of the IBM Case Manager cell.

      5. In the IBM Case Manager administrative console, click Security > Global Security, then in the Authentication section, click LTPA.

      6. In the Cross-cell single sign-on section enter the password and a key file name.

      7. Click Import keys then OK.

      8. If your setup includes more cells, repeat steps 6.b.iv: to 6.b.vii: for each additional cell.
    3. Set the same domain name for SSO. Perform the following steps for all participating IBM BPM and IBM Case Manager. cells.

      1. In the administrative console, click Security > Global Security.

      2. In the Authentication cache settings section, expand Web and SIP security, then click Single sign-on (SSO).

      3. In the General Properties section, specify the following configuration values:

        1. Select the Enabled option.

        2. For Requires SSL, enter the domain name that you are using for the servers, for example, example.com.
        3. Verify that the Interoperability Mode and Web inbound security attribute propagation options are both selected.

        4. Click OK and save the changes to the master configuration.
      4. Remember to perform steps 6.c.i: to 6.c.iii.4: for all participating cells.
    4. Verify that SSO works across the cells. If you have Business Space configured on IBM BPM perform the following actions:

      1. Using a web browser, open the IBM BPM Business Space client by entering a URL similar to the following example http://bpmserver.example.com:9080/BusinessSpace.

      2. Log on using a user name and password that is stored in the shared LDAP server.
      3. Without closing the IBM BPM Business Space tab, press Control-T to open a new tab in the browser.

      4. In the new browser tab, open the IBM Case Manager case client by entering a URL similar to the following example http://icmserver.example.com:9080/CaseClient.

      5. If you are automatically logged in as the same user without having to enter a user ID and password in the case client then the SSO is working.

  7. Configure SSL by exchanging the server SSL certificates.

    1. Extract the root SSL certificate from the IBM BPM server. Perform the following actions using the administrative console on the IBM BPM server.

      1. Click Security > SSL certificate and key management > Key stores and certificates > DefaultTrustStore > Signer certificates.

      2. Select the root certificate then click Extract.

      3. Enter a file name for the exported certificate, for example, c:\bpmserverCert.pem, and click OK.

      If you are using a remote desktop connection, the exported certificate will be saved on the machine from which you started the administrative console.

    2. Transfer the exported certificate file in binary mode to the IBM Case Manager file system.

    3. Add the IBM BPM server certificate to the IBM Case Manager server. Perform the following actions using the administrative console on the IBM Case Manager server.

      1. Click Security > SSL certificate and key management > Key stores and certificates > DefaultTrustStore > Signer certificates.

      2. Click Add.

      3. Enter an alias, for example, bpmserver.

      4. Enter the file name of the IBM BPM server certificate, for example, c:\bpmserverCert.pem, and click OK.
      5. Save the changes.
    4. Extract the root SSL certificate from the IBM Case Manager server. Perform the following actions using the administrative console on the IBM Case Manager server.

      1. Click Security > SSL certificate and key management > Key stores and certificates > DefaultTrustStore > Signer certificates.

      2. Select the root certificate then click Extract.

      3. Enter a file name for the exported certificate, for example, c:\icmserverCert.pem, and click OK.

      Remember: If you are using a remote desktop connection, the exported certificate will be saved on the machine from which you started the administrative console.

    5. Transfer the exported certificate file in binary mode to the IBM BPM file system.

    6. Add the IBM Case Manager server certificate to the IBM BPM server. Perform the following actions using the administrative console on the IBM BPM server.

      1. Click Security > SSL certificate and key management > Key stores and certificates > DefaultTrustStore > Signer certificates.

      2. Click Add.

      3. Enter an alias, for example, icmserver.

      4. Enter the file name of the IBM BPM server certificate, for example, c:\icmserverCert.pem, and click OK.
      5. Save the changes.


Results

The cross-cell setup is configured, including SSO and SSL.


What to do next

Register the IBM BPM widgets in IBM Case Manager.

Configure Business Space to work with IBM Case Manager


Related tasks:
Selecting the user repository for Process Portal: