Sun ONE Portal Server version 6.2

Liberty Enabled Portal Sample 3

Contents
  1. Introduction
  2. Setup
  3. Configuration
  4. Testing

1. Introduction
This sample uses 2 machines, one for IDP running only IS and the other for SP running Portal Server.
This sample is different from sample 1 in that the Authentication-less desktop is enabled. It is different from sample 2 in that the Authentication-less desktop access is enabled for federated users. So, federated users who are not liberty signed-on will also see the authless desktop. The login channel will show a link "Federated users click here". Federated users can perform a liberty login by clicking this link. The users who are liberty signed-on will see the personalized desktop. The Common Login channel will also be displayed on the authless desktop which contains a list of available IDPs (only one in this case). Federated user may also click on an IDP in the common login channel to do liberty login.
It demonstrates the following features:
  1. Identity Federation
  2. Liberty Single Sign-On
  3. Federation Termination
  4. Single Log-Out at SP
2. Setup
3. Configuration

Configuration may be done manually by following the procedure given in the following sections.
It is also possible to do it using scripts configSP.sh and configIDP.sh. These scripts must be edited appropriately before using. The comments in the scripts will help to customize the scripts. Execute the configSP script on the system with Portal Server installed. Execute the configIDP script on the system to be used as IDP which has Identity Server installed.

3.1. Service Provider (SP) Portal Server configuration

3.1.1. Load the metadata for SP

a. Edit spmetadata.xml
Replace the tokens with values appropriate to the deployment. Examples are shown below.
  1. $ORG_DN -> dc=sun,dc=com
  2. $PROTOCOL -> http
  3. $SP_HOST_DOMAIN -> hostA.sun.com
  4. $SP_PORT -> 80
  5. $IS_DEPLOY_DESCRIPTOR -> amserver
  6. $PS_DEPLOY_DESCRIPTOR -> portal
  7. $IDP_HOST_DOMAIN -> hostB.sun.com
  8. $IDP_PORT -> 80
  9. $COOKIE_DOMAIN -> .sun.com
b. Load the metadata using this command on hostA
<IS_BASE_DIR>/SUNWam/bin/amadmin  --runasdn amAdmin --password password --data spmetadata.xml

3.1.2. Create Federation Channel

a. Edit fedChannel.xml
Replace the tokens with values appropriate to the deployment. Examples are shown below.
  1. $PROTOCOL -> http
  2. $SP_HOST_DOMAIN -> hostA.sun.com
  3. $SP_PORT -> 80
  4. $IS_DEPLOY_DESCRIPTOR -> amserver
b. Load DP xml using this command on hostA. Remember to use appropriate dn for amAdmin and organization.
<PORTAL_BASEDIR>/SUNWps/bin/dpadmin modify -u "uid=amAdmin,ou=People,dc=sun,dc=com" -w password -d "dc=sun,dc=com" -m fedChannel.xml

c. Create channel template directory
mkdir /etc/opt/SUNWps/desktop/sampleportal/Federation

d. Copy the channel template from the sample directory to the template directory.
cp fedChannel.template /etc/opt/SUNWps/desktop/sampleportal/Federation/display.template

3.1.3. Set Global Attributes for Desktop Service
In  admin console, goto the "Service Management" tab. Click on the "Portal Desktop" service in navigation frame and set the following values in the global section in the data frame.
  1. Set "Enable Federation" to true.
  2. Set "Hosted Provider ID" to http://hostA.sun.com. Remember to replace the correct protocol and host name as per your deployment.
  3. Set "Authentication-less Portal Desktop Configuration" to enable.
  4. Set the "Default Authentication-less User DN" and "Authorized Authentication-less User DNs and Passwords" appropriately, if not already set. Typically, this will have been already set by the installer if sample portal was installed.
  5. Set the "Disable Authentication-less Access for Federated Users" to false.
3.1.4. Create Common Login channel

a. Edit commonLoginChannel.xml
Replace the tokens with values appropriate to the deployment. Examples are shown below.
  1. $PROTOCOL -> http
  2. $SP_HOST_DOMAIN -> hostA.sun.com
  3. $SP_PORT -> 80
  4. $IS_DEPLOY_DESCRIPTOR -> amserver
b. Load DP xml using this command on hostA. Remember to use appropriate dn for amAdmin and organization.
<PORTAL_BASEDIR>/SUNWps/bin/dpadmin modify -u "uid=amAdmin,ou=People,dc=sun,dc=com" -w password -d "uid=authlessanonymous,ou=People,dc=sun,dc=com" -m commonLoginChannel.xml

3.1.5. Set Login channel properties for authlessanonymous user
  1. Login to admin console of hotsA as amAdmin
  2. Goto "Identity Management" tab
  3. Select "Users" from the "View" menu in navigation frame
  4. Click on properties icon for authlessanonymous in navigation frame
  5. Select "Portal Desktop" in the "View" menu of dataframe
  6. Click on the "Edit..." link
  7. Click on "Channel and Container Management" in the pop-up window
  8. Click on "Edit Properties..." link for "Login" channel
  9. Set "federationEnabled" property to true
  10. Set value of "preLoginURL" property to the following value. Remember to replace the protocol, host, port etc. http://hostA.sun.com.com:58080/amserver/preLogin?metaAlias=hostA.sun.com.com&goto=http://hostA.sun.com.com:80/portal/dt
3.1.6. Create a user on SP hostA
Create a user "psuser" with at least desktop service assigned. Login as psuser and verify the user's desktop.


3.2. Identity Provider (IDP) configuration

3.2.1. Change the cookie name
a. The cookie names should be different for SP and IDP if both are running in the same domain.
Edit /etc/opt/SUNWam/config/AMConfig.properties file on hostB and change "com.iplanet.am.cookie.name" to "sunDirectoryPro". This name may be anything other than the one on SP which will be "iPlanetDirectoryPro" by default.

b. Restart the web container.

3.2.2. Load the metadata for IDP

a. Edit idpmetadata.xml
Replace the tokens with values appropriate to the deployment. Examples are shown below.

   1. $ORG_DN -> dc=sun,dc=com
   2. $PROTOCOL -> http
   3. $SP_HOST_DOMAIN -> hostA.sun.com
   4. $SP_PORT -> 80
   5. $IS_DEPLOY_DESCRIPTOR -> amserver
   6. $IDP_HOST_DOMAIN -> hostB.sun.com
   7. $IDP_PORT -> 80

b. Load the metadata using this command on hostB
<IS_BASE_DIR>/SUNWam/bin/amadmin  --runasdn amAdmin --password password --data idpmetadata.xml

3.2.3. Create a user on IDP
Create a user, say "user1" and login to amconsole as user1 and verify.

4. Testing

Important:
1. Before beginning testing, delete cookies and start a new browser instance.
2. Synchronize clocks on IDP and SP. As root, execute command "rdate hostA" on hostB or vice versa.

4.1. Federation
  1. Access portal as http://hostA.red.iplanet.com:58080/portal/dt
  2. Authless desktop is displayed. Locally login as psuser created earlier.
  3. Click on the "Federate Identity" link in the "Identity Federation" channel.
  4. The IDP hostB will be shown in the drop-down list on the federation page.
  5. Select the IDP to federate (only hostB in this case) and click submit.
  6. Login page for IDP hostB is displayed. Login as "user1" created earlier.
  7. Federation success page is displayed. Click on the "Continue" link.
  8. Desktop for psuser is displayed again. Click "Logout" to logout of portal.
  9. Close the browser.
4.2. Single Sign-On
  1. Start a new browser session.
  2. Access portal as http://hostA.red.iplanet.com:58080/portal/dt
  3. Authless desktop is displayed. The Login channel has a liberty login link and thus the federated user still gets to see the authless desktop and a chance to perform local login, if so desired.
  4. Click on the liberty login link
  5. IDP hostB login screen is presented. Login as "user1" at hostB.
  6. Desktop for psuser is displayed. Notice the user name in the "User Information" channel.
  7. Logout and start a new browser session.
  8. Access http://hostB.red.iplanet.com:58080/amconsole
  9. Login as "user1" at the IDP and see the user profile page at the IDP.
  10. Change url and access http://hostA.red.iplanet.com:58080/portal/dt
  11. Desktop for "psuser" is displayed.
4.3. Single Logout
  1. This assumes that you have already  performed single sign-on and psuser's desktop is displayed
  2. Click "Logout" to logout of the portal server
  3. Now access http://hostB.red.iplanet.com:58080/amconsole
  4. Login page for the IDP hostB is displayed indicating that by performing a logout at the portal server, you have also been logged out of the IDP.
4.4. Federation Termination
  1. This assumes that you have already  performed single sign-on and psuser's desktop is displayed
  2. Click on the "Terminate Federation" link in the "Identity Federation" channel
  3. Select the provider and click submit.
  4. Federation Termination success page is displayed. Click on the "Continue" link.
  5. psuser's desktop is displayed.
  6. Click "Logout" to logout.
  7. Close the browser and start a new browser session.
  8. Access portal as http://hostA.red.iplanet.com:58080/portal/dt
  9. Authless desktop is displayed. Click on link "Federated users click here" in the login channel. As federation has been terminated, local auth page is displayed.
  10. Login as psuser to perform a local login.