| Back | Next | Contents | Cams Web Agent Guide |
Cams web agents are integrated into web and application servers to protect the resources that they provide. When a user's web browser makes a request to a web or application server, the Cams web agent asks a Cams policy server if access is granted or denied. The Cams web agent enforces the response, including prompting for user authentication if required.
This document provides instructions on how to install and configure the Cams Servlet Filter web agent. The Cams Servlet Filter web agent is a Java J2EE servlet filter implementation that provides web content security on J2EE servers that supports the Servlet 2.3 API.
NOTE: For known issues with the Cams Servlet Filter web agent, see ReleaseNotes.html found in the root directory of the Cams Servlet Filter web agent distribution.
These instructions guide you through the installation of Cams Servlet Filter web agent on a system with a J2EE server already installed. If a J2EE server is not yet installed, you must first do so. You must also download the Cams Servlet Filter web agent. If you are not a currently registered customer or evaluator, you will also need to request an evaluation license.
Unpack the download (cams-webagent-servletFilter-2.1.X.tar.gz or cams-webagent-servletFilter-2.1.X.zip) into an installation directory of your choosing (referred to as INSTALL_DIR in the remainder of this document).
Linux/UNIX
tar xvfz cams-webagent-servletFilter-2.1.X.tar.gz
Windows
pkunzip cams-webagent-servletFilter-2.1.X.zip
Change directories to the directory that was created. The files shown in Figure 1 should have been extracted from the distribution into the directory.
<!-- Cams Servlet Filter web agent documentation and license --> README.txt LICENSE.txt ReleaseNotes.html <!-- Scripts for creating cams.war --> bin/create_cams_war.bat bin/create_cams_war.sh <!-- The "cams" web application supplies the login, denied and error pages --> cams/camstest.jsp cams/denied.jsp cams/error.jsp cams/login.jsp cams/WEB-INF/web.xml <!-- Cams Servlet Filter web agent configuration file --> conf/cams-webagent.conf <!-- Cams Servlet Filter web agent Java libraries --> lib/cams.jar lib/cams-common.jar lib/cams-webagent-servletFilter.jar lib/cscore.jar lib/log4j.jar lib/InfiniteMonkey.jar lib/infinitemonkey.dll lib/InfiniteMonkeyLicense.txt |
Figure 1 - Directory listing of the Cams Servlet Filter web agent files after unpacking
Each J2EE server has different directory structures where you will need to copy the Cams Servlet Filter web agent libraries and configuration files. From a high-level, installation is a six step process:
The next sections step you through installation for specific J2EE servers on which the Cams Servlet Filter web agent has been tested. If server-specific instructions are not available for the J2EE server you are using, try following the server neutral steps specified above. If you have difficulties, please contact Cafésoft support with the J2EE server name and version number. The tested J2EE servers include:
NOTE: All tests with J2EE servers that implement
Servlet specification 2.3 have been successful. Other J2EE servers that support
Servlet specification 2.3 are likely to work and will be added as they are tested.
Before installing the Cams Servlet Filter web agent, make sure that WebLogic is installed and working on your system. The documentation will use YOUR_DOMAIN to represent the location where your WebLogic server domain is installed. If you are unfamiliar with the server domain concept please read the documentation provided by BEA.
To install the Cams Servlet Filter web agent on BEA Weblogic 8.1 perform the following steps:
Before installing the Cams Servlet Filter web agent, make sure that Oracle 9iAS 9.0.x is installed and working on your system. This document will use ORACLE_HOME to represent the location where Oracle 9iAS OC4J is installed. If you have difficulties installing the Cams Servlet Filter web agent with Oracle 9iAS, check the log files in ORACLE_HOME/opmn/logs for errors or warnings.
To install the Cams Servlet Filter web agent on Oracle 9iAS 9.0.x, perform the following steps:
NOTE: Resources that are mapped to Oracle's Apache web server are not protected by the Cams Servlet Filter web agent. If you need to protect these ressources as well as the servlet/JSP resources, you can use the Cams Apache web agent on supported operating systems.
Before installing the Cams Servlet Filter web agent, make sure that JBoss is installed and working on your system. This document will use JBOSS_HOME to represent the location where JBoss is installed.
To install the Cams Servlet Filter web agent on JBoss 3.2.x perform the following steps:
Before installing the Cams Servlet Filter web agent, make sure that Jetty is installed and working on your system. This document will use JETTY_HOME to represent the location where Jetty is installed.
To install the Cams Servlet Filter web agent on Jetty 4.2.x perform the following steps:
Before installing the Cams Servlet Filter web agent, make sure that Tomcat is installed and working on your system. This document will use CATALINA_HOME to represent the location where Tomcat is installed.
To install the Cams Servlet Filter web agent on Tomcat perform the following steps:
Before installing the Cams Servlet Filter web agent, make sure that WebSphere Application Server (WAS) is installed and working on your system. This document will use WAS_HOME to represent the location where WAS is installed.
Here is an overview of the steps needed to install the Cams Servlet Filter web agent under WAS 5.1:
This step will enable multiple web applications deployed on WAS to use the same Cams Servlet Filter web agent configuration file and libraries. The goal is to create the following directory/file hierarchy by copying a subset of files from INSTALL_DIR:
WAS_HOME/cams/conf/cams-webagent.conf
WAS_HOME/cams/lib/cams.jar
WAS_HOME/cams/lib/cams-common.jar
WAS_HOME/cams/lib/cams-webagent-servletFilter.jar
WAS_HOME/cams/lib/cscore.jar
WAS_HOME/cams/lib/infinitemonkey.dll
WAS_HOME/cams/lib/InfiniteMonkey.jar
WAS_HOME/cams/lib/InfiniteMonkeyLicense.txt
WAS_HOME/cams/lib/log4j.jar
NOTE: The Cams libraries and configuration file will be made accessible to one or more web applications.
To create the specified directory/file hierarchy:
This step configures the master Cams web agent configuration file. This configuration file can either be shared by each Cams protected web application (by referencing the same cams-webagent.conf file) or serve as a master template for each web application (by copying cams-webagent.conf to different locations).
The cams web application contains various Java Server Pages, including: login.jsp, error.jsp, login.jsp and camstest.jsp, which are referenced by the Cams Servlet Filter web agent configuration and the Cams policy server. It also uses the Cams Servlet Filter web agent for protection, so correctly configuring this application will serve as a model for integrating the web agent with other applications (if needed).
This step will create a web application archive file named cams.war that includes the newly edited web.xml file and the .jsp files used as login, error and access denied pages by Cams. It will be deployed on WAS using the WAS admin console.
Before you can complete this step, you'll need to:
Once you have access to the WAS admin console:
This step will enable convient binding of the cams web application a WAS shared library, which contains the .jar files needed for the Cams web agent to execute. Creation of the WAS shared library will conveniently enable you to bind future web applications that need protection by the Cams Servlet Filter web agent.
In the WAS admin console:
Click in the "Classpath" text area. You'll need to enter the
fully-qualified path to each .jar file needed by the Cams Servlet Filter
web agent. The actual paths will depend on the directory in which you installed
WAS. Here are some example paths for a Windows-based installation:
C:/Program Files/WebSphere/AppServer/cams/lib/cscore.jar
C:/Program Files/WebSphere/AppServer/cams/lib/cams.jar
C:/Program Files/WebSphere/AppServer/cams/lib/cams-common.jar
C:/Program Files/WebSphere/AppServer/cams/lib/log4j.jar
C:/Program Files/WebSphere/AppServer/cams/lib/InfiniteMonkey.jar
C:/Program Files/WebSphere/AppServer/cams/lib/cams-webagent-servletFilter.jar
This step binds the cams web application with the cams-webagent shared library, enabling it to access the associated .jar files and native binaries.
The cams web application should now be started and available. To confirm proper operation, try accessing the Cams test page. For example:
http://localhost:9080/cams/camstest.jsp
If the test page fails to load, you'll need to debug the installation by looking at the Cams web agent and WAS log files and taking appropriate corrective actions. Based on the installation instructions above, you can find these log files at:
WAS_HOME/logs/cams-webagent.log
WAS_HOME/AppServer/logs/<server name>
NOTE: You'll need to look in the approprate directory for the WAS server name configured on your system.
The Cams Servlet Filter web agent is configured in cams-webagent.conf. You also need to edit the web.xml configuration file for all web applications that will use the Cams Servlet Filter Agent and integrate the Cams login.jsp, error.jsp and denied.jsp pages.
Most J2EE server configurations should share only one cams-webagent.conf file between all webapps. Using a shared configuration file has the following benefits:
To share cams-webagent.conf between web applications, simply specify the same cams-webagent.conf file in the configPath parameter for each web application's web.xml file.
It is possible to use different cams-webagent.conf files for each web application secured by a Cams Servlet Filter web agent. For example, you may desire for each web application to have a custom login.jsp, error.jsp and denied.jsp page. To do so, specify a unique name or path for each cams-webagent.conf file in web.xml for each web application. Then follow the configuration instructions below for each file.
NOTE: To secure resources on your J2EE server, you'll also need to configure a Cams security domain. See the Cams Policy Server Configuration section in this document for more information.
Open the cams-webagent.conf file in a text editor. The file contains comments to help you understand the property values that you may need to change. You can also reference more detailed information on the properties in the Configuration Properties document.
NOTE: The most important properties are at the top of cams-webagent.conf. In most cases, the default property values will work if the Cams policy server and Cams web agent are on the same host. As you begin to integrate more web and application servers, reference Configuration Properties to understand the properties that will usually be the focus of your attention.
You must add a reference to the Cams Servlet Filter web agent in web.xml for EACH webapp that uses Cams security. Add the filter and filter mapping as shown in Example 1. Make sure that your replace the fully_qualified_path (shown in red in Example 1) with a file path of your choosing to the appropriate cams-webagent.conf file. This is the only value you need to change.
WARNING: The Cams Servlet Filter web agent should be first in the filter chain so that it can determine if access should be granted. If the Cams Servlet Filter web agent fails to load correctly, it will deny access to the web application.
<Web-app> ... <filter> <filter-name>Cams Servlet Filter Web Agent</filter-name> <filter-class>com.cafesoft.security.webagent.servletFilter.CamsServletFilterWebAgent</filter-class> <init-param> <param-name>configPath</param-name> <param-value>/fully_qualified_path/cams-webagent.conf</param-value> </init-param> <init-param> <param-name>contextClass</param-name> <param-value>com.cafesoft.security.common.agent.StandardCamsAgentContext</param-value> </init-param> </filter> <filter-mapping> <filter-name>Cams Servlet Filter Web Agent</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> ... </web-app> |
Example 1 - Configuring a web application to use the Cams Servlet Filter web agent
Filter Values
The distribution cams directory is a J2EE compliant webapp that includes four sample Java Server Pages (JSP) for user interaction:
For information on how to customize these pages, see Scripts. For information on how to configure the Cams web agent to redirect to these pages, see Configuration Properties.
NOTE: The camstest.jsp page is extremely useful for integration testing. You use it to quickly confirm correct Cams web agent communications with a Cams policy server, validate authentication configuration, and determine if expected user session values are available in the web environment for authenticated users.
Before you start the J2EE/Servlet 2.3 server with a Cams Servlet Filter web agent, you'll need to ensure that the Cams policy server knows about it. See the Cams Administrator's Guide - Integration Quick Start to learn more. Pay close attention during integration to steps 4 and 5, which provide information on the settings that must be configured correctly for a Cams web agent to connect to a Cams policy server. You'll need to configure an access control policy corresponding to your site requirements.
That's it, you should now be able to start the J2EE/Servlet 2.3 server to test your Cams Servlet Filter web agent configuration. After you've started both the J2EE/Servlet 2.3 with the Cams Servlet Filter web agent and the Cams policy server, test the configuration using:
http://[hostname:port]/cams/camstest.jsp
Login to an account in the security domain that you've established. See the test page for more configuration and testing information.
Debugging information is available in the following web server-specific log files:
During Cams web agent integration, it is helpful to set the following values in cams-webagent.conf:
cams.debug=true
cams.cluster.debug=true
If the Cams web agent is successfully loaded and initialized, verbose DEBUG messages will be logged to cams-webagent.log. If the Cams web agent fails to load or initialize, errors will be reported in the J2EE server error file. In most cases, errors will be cause by misconfigured values in the J2EE server-specific configuration values and/or cams-webagent.conf.
WARNING: Remember to disable all Cams web agent debug flags for production environments. Leaving them enabled will decrease performance and result in very large log files.
© Copyright 1996-2005 Cafésoft LLC. All rights reserved.