Back | Next | Contents Cams Web Agent Guide

Servlet Filter Web Agent Integration

Cams web agents are integrated into web and application servers to protect the resources that they provide. When a user's web browser makes a request to a web or application server, the Cams web agent asks a Cams policy server if access is granted or denied. The Cams web agent enforces the response, including prompting for user authentication if required.

This document provides instructions on how to install and configure the Cams Servlet Filter web agent. The Cams Servlet Filter web agent is a Java J2EE servlet filter implementation that provides web content security on J2EE servers that supports the Servlet 2.3 API.

NOTE: For known issues with the Cams Servlet Filter web agent, see ReleaseNotes.html found in the root directory of the Cams Servlet Filter web agent distribution.

Installation

These instructions guide you through the installation of Cams Servlet Filter web agent on a system with a J2EE server already installed. If a J2EE server is not yet installed, you must first do so. You must also download the Cams Servlet Filter web agent. If you are not a currently registered customer or evaluator, you will also need to request an evaluation license.

Unpack the download (cams-webagent-servletFilter-2.1.X.tar.gz or cams-webagent-servletFilter-2.1.X.zip) into an installation directory of your choosing (referred to as INSTALL_DIR in the remainder of this document).

Linux/UNIX

tar xvfz cams-webagent-servletFilter-2.1.X.tar.gz

Windows

pkunzip cams-webagent-servletFilter-2.1.X.zip

Change directories to the directory that was created. The files shown in Figure 1 should have been extracted from the distribution into the directory.

<!-- Cams Servlet Filter web agent documentation and license -->
README.txt
LICENSE.txt
ReleaseNotes.html

<!-- Scripts for creating cams.war -->
bin/create_cams_war.bat
bin/create_cams_war.sh

<!-- The "cams" web application supplies the login, denied and error pages -->
cams/camstest.jsp
cams/denied.jsp
cams/error.jsp
cams/login.jsp
cams/WEB-INF/web.xml

<!-- Cams Servlet Filter web agent configuration file -->
conf/cams-webagent.conf

<!-- Cams Servlet Filter web agent Java libraries -->
lib/cams.jar
lib/cams-common.jar
lib/cams-webagent-servletFilter.jar
lib/cscore.jar
lib/log4j.jar
lib/InfiniteMonkey.jar
lib/infinitemonkey.dll
lib/InfiniteMonkeyLicense.txt

Figure 1 - Directory listing of the Cams Servlet Filter web agent files after unpacking

Each J2EE server has different directory structures where you will need to copy the Cams Servlet Filter web agent libraries and configuration files. From a high-level, installation is a six step process:

  1. Shutdown the J2EE server
  2. Install the Cams Servlet Filter web agent lib files in a common directory or web application specific directory where they will be loaded by the J2EE server. If the directory is web application specific, the Cams Servlet Filter web agent lib files must be copied into each web application that uses Cams security services.
  3. Install the cams web application in the J2EE container's web application directory and edit web.xml. You can install the expanded cams web application or use the create_cams_war.bat/sh scripts in the bin directory to create a cams.war file (edit web.xml before you create cams.war so the webapp deploys in a ready state). The cams web application provides sample login.jsp, denied.jsp and error.jsp pages for use. Alternatively, you can integrate the login.jsp, denied.jsp and error.jsp pages into web applications of your choice.
  4. Copy cams-webagent.conf to any directory (usually located in the J2EE server directory structure)
  5. Configure the Cams Servlet Filter web agent
  6. Start the J2EE server

The next sections step you through installation for specific J2EE servers on which the Cams Servlet Filter web agent has been tested. If server-specific instructions are not available for the J2EE server you are using, try following the server neutral steps specified above. If you have difficulties, please contact Cafésoft support with the J2EE server name and version number. The tested J2EE servers include:

NOTE: All tests with J2EE servers that implement Servlet specification 2.3 have been successful. Other J2EE servers that support Servlet specification 2.3 are likely to work and will be added as they are tested.

BEA Weblogic 8.1

Before installing the Cams Servlet Filter web agent, make sure that WebLogic is installed and working on your system. The documentation will use YOUR_DOMAIN to represent the location where your WebLogic server domain is installed. If you are unfamiliar with the server domain concept please read the documentation provided by BEA.

To install the Cams Servlet Filter web agent on BEA Weblogic 8.1 perform the following steps:

  1. Shutdown WebLogic
  2. Create a directory named cams in YOUR_DOMAIN
  3. Copy INSTALL_DIR/lib to YOUR_DOMAIN/cams
  4. Edit INSTALL_DIR/cams/WEB-INF/web.xml

    NOTE: You must do this for each web application that will be protected by Cams

  5. Copy INSTALL_DIR/cams to the YOUR_DOMAIN/applications (alternatively create cams.war using INSTALL_DIR/bin/create_cams_war.bat/sh and deploy)
  6. Copy INSTALL_DIR/conf to YOUR_DOMAIN/cams
  7. Configure the Cams Servlet Filter web agent
  8. Open the startWebLogic.bat/startWebLogic.sh script file and add the following lines:

    For Windows:

    set CAMS_HOME=YOUR_DOMAIN\cams
    set CAMS_CLASSPATH=%CAMS_HOME%\lib\cscore.jar
    set CAMS_CLASSPATH=%CAMS_CLASSPATH%;%CAMS_HOME%\lib\cams.jar
    set CAMS_CLASSPATH=%CAMS_CLASSPATH%;%CAMS_HOME%\lib\cams-common.jar
    set CAMS_CLASSPATH=%CAMS_CLASSPATH%;%CAMS_HOME%\lib\log4j.jar
    set CAMS_CLASSPATH=%CAMS_CLASSPATH%;%CAMS_HOME%\lib\InfiniteMonkey.jar
    set CAMS_CLASSPATH=%CAMS_CLASSPATH%;%CAMS_HOME%\lib\cams-webagent-servletFilter.jar


    For Linux:

    set CAMS_HOME=YOUR_DOMAIN/cams
    set CAMS_CLASSPATH=${CAMS_HOME}/lib/cscore.jar
    set CAMS_CLASSPATH=${CAMS_CLASSPATH}:${CAMS_HOME}/lib/cams.jar
    set CAMS_CLASSPATH=${CAMS_CLASSPATH}:${CAMS_HOME}/lib/cams-common.jar
    set CAMS_CLASSPATH=${CAMS_CLASSPATH}:${CAMS_HOME}/lib/log4j.jar
    set CAMS_CLASSPATH=${CAMS_CLASSPATH}:${CAMS_HOME}/lib/InfiniteMonkey.jar
    set CAMS_CLASSPATH=${CAMS_CLASSPATH}:${CAMS_HOME}/lib/cams-webagent-servletFilter.jar


  9. Edit the following line:

    For Windows:

    set CLASSPATH=%WEBLOGIC_CLASSPATH%;...

    to

    set CLASSPATH=%CAMS_CLASSPATH%;%WEBLOGIC_CLASSPATH%;...


    For Linux:

    CLASSPATH="${WEBLOGIC_CLASSPATH}${CLASSPATHSEP} ... "

    to

    CLASSPATH="${CAMS_CLASSPATH}${CLASSPATHSEP}${WEBLOGIC_CLASSPATH}${CLASSPATHSEP} ... "

  10. Save and exit the file
  11. Start WebLogic

Oracle 9iAS 9.0.x

Before installing the Cams Servlet Filter web agent, make sure that Oracle 9iAS 9.0.x is installed and working on your system. This document will use ORACLE_HOME to represent the location where Oracle 9iAS OC4J is installed. If you have difficulties installing the Cams Servlet Filter web agent with Oracle 9iAS, check the log files in ORACLE_HOME/opmn/logs for errors or warnings.

To install the Cams Servlet Filter web agent on Oracle 9iAS 9.0.x, perform the following steps:

  1. Shutdown Oracle 9iAS
  2. Create the directory ORACLE_HOME/j2ee/<OC4J_INSTANCE>/cams (where <OC4J_INSTANCE> is the directory where Oracle deployed the OC4J instance)
  3. Copy INSTALL_DIR/lib to ORACLE_HOME/j2ee/<OC4J_INSTANCE >/cams
  4. Open ORACLE_HOME/j2ee/<OC4J_INSTANCE>/config/application.xml and add the following line(in black):

    ...

    <!-- Path to the libraries that are installed on this server.
    These will be accesible for the servlets, EJBs etc -->
    <library path="../../<OC4J_INSTANCE>/lib" />
    <library path="../../<OC4J_INSTANCE>/cams/lib"/>

    ...

  5. Copy INSTALL_DIR/conf to ORACLE_HOME/j2ee/<OC4J_INSTANCE>/cams
  6. Open the Oracle 9iAS environment settings file ORACLE_HOME/bin/iasenv.bat and modify the path to include ORACLE_HOME/j2ee/<OC4J_INSTANCE>/cams/lib (this allows the infiniteMonkey.dll to be found)
  7. Configure the Cams Servlet Filter web agent
  8. Create the cams.war file by executing:

    INSTALL_DIR/bin/create_cams_war.bat (Windows)

    INSTALL_DIR/bin/create_cams_war.sh (Unix)

  9. Start Oracle 9iAS
  10. Edit INSTALL_DIR/cams/WEB-INF/web.xml

    NOTE: You must do this for each web application that will be protected by Cams

  11. Use the Oracle 9iAS Enterprise Manager to deploy the Cams war file INSTALL_DIR/cams/cams.war (the Cams webapp should be mapped to the URL /cams)

NOTE: Resources that are mapped to Oracle's Apache web server are not protected by the Cams Servlet Filter web agent. If you need to protect these ressources as well as the servlet/JSP resources, you can use the Cams Apache web agent on supported operating systems.

JBoss 3.2.x

Before installing the Cams Servlet Filter web agent, make sure that JBoss is installed and working on your system. This document will use JBOSS_HOME to represent the location where JBoss is installed.

To install the Cams Servlet Filter web agent on JBoss 3.2.x perform the following steps:

  1. Shutdown JBoss
  2. Copy all files from INSTALL_DIR/lib to JBOSS_HOME/server/<conf name>/lib (where <conf name> is the name of the JBoss server configuration)
  3. Edit INSTALL_DIR/cams/WEB-INF/web.xml

    NOTE: You must do this for each web application that will be protected by Cams

  4. Copy the contents of INSTALL_DIR/webapps/cams to JBOSS_HOME/server/<conf name>/deploy/cams.war (alternatively create cams.war using INSTALL_DIR/bin/create_cams_war.bat/sh and deploy)
  5. Copy cams-webagent.conf from INSTALL_DIR/conf to JBOSS_HOME/server/<conf name>/conf
  6. Configure the Cams Servlet Filter web agent
  7. Start JBoss

Jetty 4.2.x

Before installing the Cams Servlet Filter web agent, make sure that Jetty is installed and working on your system. This document will use JETTY_HOME to represent the location where Jetty is installed.

To install the Cams Servlet Filter web agent on Jetty 4.2.x perform the following steps:

  1. Shutdown Jetty
  2. Copy all files from INSTALL_DIR/lib into JETTY_HOME/ext
  3. Edit INSTALL_DIR/cams/WEB-INF/web.xml

    NOTE: You must do this for each web application that will be protected by Cams

  4. Copy INSTALL_DIR/cams to JETTY_HOME/webapps (alternatively create cams.war using INSTALL_DIR/bin/create_cams_war.bat/sh and deploy)
  5. Copy cams-webagent.conf from the INSTALL_DIR/conf directory to JETTY_HOME/etc
  6. Configure the Cams Servlet Filter web agent
  7. Start Jetty

Tomcat 4.1.x/5.x

Before installing the Cams Servlet Filter web agent, make sure that Tomcat is installed and working on your system. This document will use CATALINA_HOME to represent the location where Tomcat is installed.

To install the Cams Servlet Filter web agent on Tomcat perform the following steps:

  1. Shutdown Tomcat
  2. Copy all files from INSTALL_DIR/lib to CATALINA_HOME/common/lib
  3. Edit INSTALL_DIR/cams/WEB-INF/web.xml

    NOTE:
    You must do this for each web application that will be protected by Cams

  4. Copy INSTALL_DIR/cams to CATALINA_HOME/webapps (alternatively create cams.war using INSTALL_DIR/bin/create_cams_war.bat/sh and deploy)
  5. Copy cams-webagent.conf file from INSTALL_DIR/conf to CATALINA_HOME/conf
  6. Configure the Cams Servlet Filter web agent
  7. Start Tomcat

IBM WebSphere 5.1

Before installing the Cams Servlet Filter web agent, make sure that WebSphere Application Server (WAS) is installed and working on your system. This document will use WAS_HOME to represent the location where WAS is installed.

Here is an overview of the steps needed to install the Cams Servlet Filter web agent under WAS 5.1:

  1. Copy the Cams servlet filter web agent libraries and configuration file to the WAS installation tree
  2. Edit the Cams web agent configuration file: cams-webagent.conf
  3. Edit the cams web application deployment descriptor: web.xml
  4. Build the cams web application archive file: cams.war
  5. Use the WAS administrator console to deploy the cams web application
  6. Use the WAS administrator console to create a cams-webagent shared library
  7. Bind the cams-webagent shared library with the cams web application
Step 1 - Copy the Cams ServletFilter Web Agent libraries and configuration file to WAS

This step will enable multiple web applications deployed on WAS to use the same Cams Servlet Filter web agent configuration file and libraries. The goal is to create the following directory/file hierarchy by copying a subset of files from INSTALL_DIR:

WAS_HOME/cams/conf/cams-webagent.conf
WAS_HOME/cams/lib/cams.jar
WAS_HOME/cams/lib/cams-common.jar
WAS_HOME/cams/lib/cams-webagent-servletFilter.jar
WAS_HOME/cams/lib/cscore.jar
WAS_HOME/cams/lib/infinitemonkey.dll
WAS_HOME/cams/lib/InfiniteMonkey.jar
WAS_HOME/cams/lib/InfiniteMonkeyLicense.txt
WAS_HOME/cams/lib/log4j.jar

NOTE: The Cams libraries and configuration file will be made accessible to one or more web applications.

To create the specified directory/file hierarchy:

Step 2 - Edit the Cams Web Agent Configuration File: cams-webagent.conf

This step configures the master Cams web agent configuration file. This configuration file can either be shared by each Cams protected web application (by referencing the same cams-webagent.conf file) or serve as a master template for each web application (by copying cams-webagent.conf to different locations).

Step 3 - Edit the Cams web application deployment descriptor: web.xml

The cams web application contains various Java Server Pages, including: login.jsp, error.jsp, login.jsp and camstest.jsp, which are referenced by the Cams Servlet Filter web agent configuration and the Cams policy server. It also uses the Cams Servlet Filter web agent for protection, so correctly configuring this application will serve as a model for integrating the web agent with other applications (if needed).

Step 4 - Build the cams web application archive file: cams.war

This step will create a web application archive file named cams.war that includes the newly edited web.xml file and the .jsp files used as login, error and access denied pages by Cams. It will be deployed on WAS using the WAS admin console.

Step 5 - Use the WAS admin console to deploy the "cams" web application

Before you can complete this step, you'll need to:

  1. Start the WAS (if not already startedj)
  2. Login to the WAS admin console (e.g. http://localhost:9090/admin)

Once you have access to the WAS admin console:

Step 6 - Use the WAS admin console to create a cams-webagent shared library

This step will enable convient binding of the cams web application a WAS shared library, which contains the .jar files needed for the Cams web agent to execute. Creation of the WAS shared library will conveniently enable you to bind future web applications that need protection by the Cams Servlet Filter web agent.

In the WAS admin console:

Step 7 - Bind the cams-webagent shared library with the cams web application

This step binds the cams web application with the cams-webagent shared library, enabling it to access the associated .jar files and native binaries.

The cams web application should now be started and available. To confirm proper operation, try accessing the Cams test page. For example:

http://localhost:9080/cams/camstest.jsp

If the test page fails to load, you'll need to debug the installation by looking at the Cams web agent and WAS log files and taking appropriate corrective actions. Based on the installation instructions above, you can find these log files at:

WAS_HOME/logs/cams-webagent.log
WAS_HOME/AppServer/logs/<server name>

NOTE: You'll need to look in the approprate directory for the WAS server name configured on your system.

Web Agent Configuration

The Cams Servlet Filter web agent is configured in cams-webagent.conf. You also need to edit the web.xml configuration file for all web applications that will use the Cams Servlet Filter Agent and integrate the Cams login.jsp, error.jsp and denied.jsp pages.

Most J2EE server configurations should share only one cams-webagent.conf file between all webapps. Using a shared configuration file has the following benefits:

  1. Easier administration
  2. Shared logging
  3. Shared caching
  4. Lower memory requirements
  5. Increased throughput
  6. Decreased chance of configuration errors

To share cams-webagent.conf between web applications, simply specify the same cams-webagent.conf file in the configPath parameter for each web application's web.xml file.

It is possible to use different cams-webagent.conf files for each web application secured by a Cams Servlet Filter web agent. For example, you may desire for each web application to have a custom login.jsp, error.jsp and denied.jsp page. To do so, specify a unique name or path for each cams-webagent.conf file in web.xml for each web application. Then follow the configuration instructions below for each file.

NOTE: To secure resources on your J2EE server, you'll also need to configure a Cams security domain. See the Cams Policy Server Configuration section in this document for more information.

Editing cams-webagent.conf

Open the cams-webagent.conf file in a text editor. The file contains comments to help you understand the property values that you may need to change. You can also reference more detailed information on the properties in the Configuration Properties document.

NOTE: The most important properties are at the top of cams-webagent.conf. In most cases, the default property values will work if the Cams policy server and Cams web agent are on the same host. As you begin to integrate more web and application servers, reference Configuration Properties to understand the properties that will usually be the focus of your attention.

Editing web.xml

You must add a reference to the Cams Servlet Filter web agent in web.xml for EACH webapp that uses Cams security. Add the filter and filter mapping as shown in Example 1. Make sure that your replace the fully_qualified_path (shown in red in Example 1) with a file path of your choosing to the appropriate cams-webagent.conf file. This is the only value you need to change.

WARNING: The Cams Servlet Filter web agent should be first in the filter chain so that it can determine if access should be granted. If the Cams Servlet Filter web agent fails to load correctly, it will deny access to the web application.

<Web-app>

 ...

 <filter>
  <filter-name>Cams Servlet Filter Web Agent</filter-name>
  <filter-class>com.cafesoft.security.webagent.servletFilter.CamsServletFilterWebAgent</filter-class>

  <init-param>
   <param-name>configPath</param-name>
   <param-value>/fully_qualified_path/cams-webagent.conf</param-value>
  </init-param>

  <init-param>
   <param-name>contextClass</param-name>
   <param-value>com.cafesoft.security.common.agent.StandardCamsAgentContext</param-value>
  </init-param>
 </filter>

 <filter-mapping>
  <filter-name>Cams Servlet Filter Web Agent</filter-name>
  <url-pattern>/*</url-pattern>
 </filter-mapping>

 ...

</web-app>

Example 1 - Configuring a web application to use the Cams Servlet Filter web agent

Filter Values

Filter Mapping Values

Java Server Pages

The distribution cams directory is a J2EE compliant webapp that includes four sample Java Server Pages (JSP) for user interaction:

For information on how to customize these pages, see Scripts. For information on how to configure the Cams web agent to redirect to these pages, see Configuration Properties.

NOTE: The camstest.jsp page is extremely useful for integration testing. You use it to quickly confirm correct Cams web agent communications with a Cams policy server, validate authentication configuration, and determine if expected user session values are available in the web environment for authenticated users.

Cams Policy Server Configuration

Before you start the J2EE/Servlet 2.3 server with a Cams Servlet Filter web agent, you'll need to ensure that the Cams policy server knows about it. See the Cams Administrator's Guide - Integration Quick Start to learn more. Pay close attention during integration to steps 4 and 5, which provide information on the settings that must be configured correctly for a Cams web agent to connect to a Cams policy server. You'll need to configure an access control policy corresponding to your site requirements.

Testing

That's it, you should now be able to start the J2EE/Servlet 2.3 server to test your Cams Servlet Filter web agent configuration. After you've started both the J2EE/Servlet 2.3 with the Cams Servlet Filter web agent and the Cams policy server, test the configuration using:

http://[hostname:port]/cams/camstest.jsp

Login to an account in the security domain that you've established. See the test page for more configuration and testing information.

Debugging

Debugging information is available in the following web server-specific log files:

  1. The J2EE server-specific error log file (see your J2EE server documentation)
  2. The Cams web agent cams-webagent.log file (CAMS_SERVLET_FILTER_WEB_AGENT_HOME/logs/cams-webagent.log)

During Cams web agent integration, it is helpful to set the following values in cams-webagent.conf:

cams.debug=true
cams.cluster.debug=true

If the Cams web agent is successfully loaded and initialized, verbose DEBUG messages will be logged to cams-webagent.log. If the Cams web agent fails to load or initialize, errors will be reported in the J2EE server error file. In most cases, errors will be cause by misconfigured values in the J2EE server-specific configuration values and/or cams-webagent.conf.

WARNING: Remember to disable all Cams web agent debug flags for production environments. Leaving them enabled will decrease performance and result in very large log files.

Back | Next | Contents