<html>
<head>
<base href="https://docs.jboss.org/author">
<link rel="stylesheet" href="/author/s/en/2172/19/5/_/styles/combined.css?spaceKey=TEIID&forWysiwyg=true" type="text/css">
</head>
<body style="background: white;" bgcolor="white" class="email-body">
<div id="pageContent">
<div id="notificationFormat">
<div class="wiki-content">
<div class="email">
<h2><a href="https://docs.jboss.org/author/display/TEIID/SAML+Based+Security+For+OData">SAML Based Security For OData</a></h2>
<h4>Page <b>edited</b> by <a href="https://docs.jboss.org/author/display/~shawkins">Steven Hawkins</a>
</h4>
<br/>
<h4>Changes (2)</h4>
<div id="page-diffs">
<table class="diff" cellpadding="0" cellspacing="0">
<tr><td class="diff-snipped" >...<br></td></tr>
<tr><td class="diff-unchanged" >h3. Configure for SAML based authentication the OData <br> <br></td></tr>
<tr><td class="diff-deleted-lines" style="color:#999;background-color:#fdd;text-decoration:line-through;">* Open Standalone[-teiid].xml file and following configurations <br></td></tr>
<tr><td class="diff-added-lines" style="background-color: #dfd;">* Open standalone-teiid.xml file and add the following configurations <br></td></tr>
<tr><td class="diff-unchanged" > <br>{code:title="Adding Extension to Picketlink Subsystem"} <br></td></tr>
<tr><td class="diff-snipped" >...<br></td></tr>
</table>
</div> <h4>Full Content</h4>
<div class="notificationGreySide">
<p>By default the OData access to a Virtual Database (VDB) in JBoss AS is restricted to authentication using the HTTP Basic. However, it possible with below instructions one can configure OData access to participate in a Single-Sign-On (SSO) based security using SAML2. The below instructions are based on JBoss EAP platform using Picketlink security framework.</p>
<p>In SAML based authentication there are Identity Providers (IDP) who provide authentication services and Service Providers (SP), a end user service like odata and user (you). It is expected that you already have IDP, configured and working with security domain of your choice like LDAP or Kerberoes etc. The SP in this case is the OData WAR file that is supplied with Teiid distribution along with Picketlink based framework. Picketlink framework does not explicitly mention the interoperability with other third party external vendors supplied IDP, but Teiid team has tested successfully with</p>
<ul>
<li>Shibboleth</li>
<li>Picketlink IDP</li>
<li>Salesforce IDP (this is documented on Picketlink, not verified)</li>
<li>Social Logins with Picketlink IDP (like, google, facebook etc. This has been mentioned in Picketlink documentation but not verified)</li>
</ul>
<div class='panelMacro'><table class='tipMacro'><colgroup><col width='24'><col></colgroup><tr><td valign='top'><img src="/author/images/icons/emoticons/check.gif" width="16" height="16" align="absmiddle" alt="" border="0"></td><td>Since SAML2 is standard, we believe any standards complaint IDP vendor will work with Picketlink SP.</td></tr></table></div>
<h3><a name="SAMLBasedSecurityForOData-Prerequisites"></a>Pre-requisites </h3>
<ul>
<li>Collect the certificate for authentication that is used by IDP to sign the SAML messages.</li>
<li>Install <a href="http://docs.jboss.org/picketlink/2/latest/reference/html/ch11.html" class="external-link" rel="nofollow">Picketlink JBoss AS subsystem</a> into JBoss AS.</li>
<li>Gather the DNS names for machine where JBoss EAP is installed. This should be externally accessible, if the IDP is external to this system.</li>
<li>Gather the SSO POST based URL for your IDP, that your SP can use to redirect for authentication call.</li>
</ul>
<div class='panelMacro'><table class='tipMacro'><colgroup><col width='24'><col></colgroup><tr><td valign='top'><img src="/author/images/icons/emoticons/check.gif" width="16" height="16" align="absmiddle" alt="" border="0"></td><td><b>"DNS Names"</b><br />Do not try to use IP address or localhost except for the testing scenarios. Configure proper DNS names for both IDP and SP servers and make sure both can access each other using the URLs configured.</td></tr></table></div>
<h3><a name="SAMLBasedSecurityForOData-ConfigureforSAMLbasedauthenticationtheOData"></a>Configure for SAML based authentication the OData </h3>
<ul>
<li>Open standalone-teiid.xml file and add the following configurations</li>
</ul>
<div class="code panel" style="border-width: 1px;"><div class="codeHeader panelHeader" style="border-bottom-width: 1px;"><b>"Adding Extension to Picketlink Subsystem"</b></div><div class="codeContent panelContent">
<pre class="theme: Confluence; brush: java; gutter: false" style="font-size:12px; font-family: ConfluenceInstalledFont,monospace;">
<extensions>
<extension module="org.picketlink.as.extension" />
<extensions>
</pre>
</div></div>
<div class="code panel" style="border-width: 1px;"><div class="codeHeader panelHeader" style="border-bottom-width: 1px;"><b>"Configuring the Picketlink Subsystem"</b></div><div class="codeContent panelContent">
<pre class="theme: Confluence; brush: java; gutter: false" style="font-size:12px; font-family: ConfluenceInstalledFont,monospace;">
<subsystem xmlns="urn:jboss:domain:picketlink:1.0">
<federation alias="odata">
<saml token-timeout="4000" clock-skew="0"/>
<key-store url="/\{CERTIFICATE-FILE-NAME\}" passwd="\{PASSWD\}" sign-key-alias="\{CERTIFICATE-ALIAS\}" sign-key-passwd="\{PASSWD\}"/>
<identity-provider url="\{SSO-IDP-POST-URL\}" alias="idp.war" security-domain="idp" supportsSignatures="true" strict-post-binding="true">
<trust>
<trust-domain name="localhost" cert-alias="\{CERTIFICATE-ALIAS\}"/>
<trust-domain name="127.0.0.1" cert-alias="\{CERTIFICATE-ALIAS\}"/>
<trust-domain name="{IDP-DNS-NAME}" cert-alias="\{CERTIFICATE-ALIAS\}"/>
</trust>
</identity-provider>
<service-providers>
<service-provider alias="odata.war" security-domain="sp" url="http://\{SP-DNS-NAME\}:8080/odata/" post-binding="true" supportsSignatures="true"/>
</service-providers>
</federation>
</subsystem>
</pre>
</div></div>
<div class='panelMacro'><table class='tipMacro'><colgroup><col width='24'><col></colgroup><tr><td valign='top'><img src="/author/images/icons/emoticons/check.gif" width="16" height="16" align="absmiddle" alt="" border="0"></td><td><b>"CERTIFICATE-ALIAS"</b><br />Typically certificate alias in certificate is domain name, such as "idp.jboss.org"</td></tr></table></div>
<p>Now configure the Security domains to be used by the SP.</p>
<div class="code panel" style="border-width: 1px;"><div class="codeHeader panelHeader" style="border-bottom-width: 1px;"><b>"Security-Domain for SP"</b></div><div class="codeContent panelContent">
<pre class="theme: Confluence; brush: java; gutter: false" style="font-size:12px; font-family: ConfluenceInstalledFont,monospace;">
<subsystem xmlns="urn:jboss:domain:security:1.2">
<security-domains>
<security-domain name="sp" cache-type="default">
<authentication>
<login-module code="org.picketlink.identity.federation.bindings.jboss.auth.SAML2LoginModule" flag="required"/>
<login-module code="org.jboss.security.ClientLoginModule" flag="required"/>
</authentication>
</security-domain>
</security-domains>
</subsystem>
</pre>
</div></div>
<p>Now change the OData transport in the Teiid subsystem to use the security domain define above.</p>
<div class="code panel" style="border-width: 1px;"><div class="codeHeader panelHeader" style="border-bottom-width: 1px;"><b>"Change OData transport security-domain"</b></div><div class="codeContent panelContent">
<pre class="theme: Confluence; brush: java; gutter: false" style="font-size:12px; font-family: ConfluenceInstalledFont,monospace;">
......
<transport name="odata">
<authentication security-domain="sp"/>
</transport>
......
</pre>
</div></div>
<h3><a name="SAMLBasedSecurityForOData-ModifytheODataWARFiletouseSAMLbasedauthentication"></a>Modify the OData WAR File to use SAML based authentication</h3>
<ul>
<li>Extract the "teiid-odata-xxxx.war" file from "<JBossAS>/modules/system/base/org/jboss/teiid/main/deployments" to temporary location. The WAR file is simple ZIP file so you can "jar -x teiid-odata-xxxx.war /temp"</li>
</ul>
<ul>
<li>Edit "jboss-web.xml" file, and it should look like
<div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent">
<pre class="theme: Confluence; brush: java; gutter: false" style="font-size:12px; font-family: ConfluenceInstalledFont,monospace;">
<?xml version="1.0" encoding="UTF-8"?>
<jboss-web>
<context-root>odata</context-root>
</jboss-web>
</pre>
</div></div></li>
</ul>
<ul>
<li>Edit "web.xml" file and it should look like below
<div class="code panel" style="border-width: 1px;"><div class="codeHeader panelHeader" style="border-bottom-width: 1px;"><b>"web.xml"</b></div><div class="codeContent panelContent">
<pre class="theme: Confluence; brush: java; gutter: false" style="font-size:12px; font-family: ConfluenceInstalledFont,monospace;">
<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" version="2.5">
<display-name>odata</display-name>
<context-param>
<param-name>javax.ws.rs.Application</param-name>
<param-value>org.teiid.odata.TeiidODataApplication</param-value>
</context-param>
<context-param>
<param-name>batch-size</param-name>
<param-value>256</param-value>
</context-param>
<context-param>
<param-name>skiptoken-cache-time</param-name>
<param-value>300000</param-value>
</context-param>
<context-param>
<param-name>local-transport-name</param-name>
<param-value>odata</param-value>
</context-param>
<listener>
<listener-class>org.jboss.resteasy.plugins.server.servlet.ResteasyBootstrap</listener-class>
</listener>
<servlet>
<servlet-name>Resteasy</servlet-name>
<servlet-class>org.teiid.odata.ODataServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>Resteasy</servlet-name>
<url-pattern>/*</url-pattern>
</servlet-mapping>
<security-constraint>
<display-name>require valid user</display-name>
<web-resource-collection>
<web-resource-name>Teiid Rest Application</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>*</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<realm-name>sp</realm-name>
<form-login-config>
<form-login-page>/jsp/login.jsp</form-login-page>
<form-error-page>/jsp/loginerror.jsp</form-error-page>
</form-login-config>
</login-config>
<security-role>
<description>security role</description>
<role-name>*</role-name>
</security-role>
</web-app>
</pre>
</div></div></li>
</ul>
<ul>
<li>Add the certificate received from IDP vendor to "WEB-INF/classes" directory. Note this must be same name as {CERTIFICATE-FILE-NAME} used in "Configuring the Picketlink Subsystem"</li>
</ul>
<ul>
<li>Create the WAR file again based on the modified contents of the files.
<div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent">
<pre class="theme: Confluence; brush: java; gutter: false" style="font-size:12px; font-family: ConfluenceInstalledFont,monospace;">
jar -cvf teiid-odata-xxxx.war /temp/*
</pre>
</div></div></li>
</ul>
<ul>
<li>Copy the newly created WAR file into "<JBossAS>/modules/system/base/org/jboss/teiid/main/deployments" directory</li>
</ul>
<ul>
<li>Start the Teiid Server, and access the OData URL, you will be redirected to SSO based authentication.</li>
</ul>
</div>
<div id="commentsSection" class="wiki-content pageSection">
<div style="float: right;" class="grey">
<a href="https://docs.jboss.org/author/users/removespacenotification.action?spaceKey=TEIID">Stop watching space</a>
<span style="padding: 0px 5px;">|</span>
<a href="https://docs.jboss.org/author/users/editmyemailsettings.action">Change email notification preferences</a>
</div>
<a href="https://docs.jboss.org/author/display/TEIID/SAML+Based+Security+For+OData">View Online</a>
|
<a href="https://docs.jboss.org/author/pages/diffpagesbyversion.action?pageId=77005447&revisedVersion=3&originalVersion=2">View Changes</a>
|
<a href="https://docs.jboss.org/author/display/TEIID/SAML+Based+Security+For+OData?showComments=true&showCommentArea=true#addcomment">Add Comment</a>
</div>
</div>
</div>
</div>
</div>
</body>
</html>