LDAP can be used for authentication, authorization and user management in WLM. The authentication and authorization for work list client application through LDAP is based on LDAP realm supported in Glassfish and Java EE security model,
in addition to that, WLM integrates LDAP in providing the following feature:

• Assignment and Escalation to a user/group managed by LDAP
• Provide LDAP xpath functions to allow assign/escalate the task to a user's manager, sends emails to a specific user or his/her manager using the email address on LDAP.

LDAP server configuration

---

OpenLdap is used for demonstrate the configuration. Please also refer to Ldap realm configuration in glassfish for examples of setting up LDAP server used in glassfish.

In slapd.conf, core.schema, cosine.schema, inetorgperson.schema are needed.

#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include		/opt/csw/etc/openldap/schema/core.schema
include		/opt/csw/etc/openldap/schema/cosine.schema
include		/opt/csw/etc/openldap/schema/inetorgperson.schema

One sample organization looks like this:

2 groups are created: CustomerServiceRep and Manager under ou=CustomerService,dc=example,dc=com. CustomerServiceRep group contains member: dave, john, mary. Manager group contains: dave. Also, dave is the manager of john and mary.

Note:On person entry, manager attribute is used to point to the manger of the person, on group entry, each uniqueMember attribute contains a members of the group.
Note:On person entry, the mail attribute is used in WLM to send emails, you will need to change the fictitious email address to a configured email to try this sample.

You can download the ldap database used in this sample in LDIF format here and use slapadd to import into your LDAP database.

LDAP Realm configuration on Glassfish

---

Ldap realm configuration in glassfish describes the configuration in details, in our example the settings are below:

Configure worklist client application to use LDAP Realm

In the worklist client application, it uses Java EE security model to point to LDAP Realm, in the default WorklistWebApplication. In the web.xml of the WorklistWebApplication, point the realm to LDAP Realm and define roles allowed to access the application, then map the roles to group name in sun-web.xml

Note:The roles on web.xml are abstract roles and are not used to match with groups in ldap, the groups mapped from roles in sun-web.xml are used to match with groups from LDAP

LDAP configuration on WLMSE

---

WLMSE has a list LDAP related configuration parameters as install and runtime configuration parameters:

Figure 6: WLMSE installation and runtime LDAP configuration

Note:Any properties changed will need a shutdown and restart of wlmse engine.

LDAP XPath functions

---

The following LDAP XPath functions are supported: namespace: "http://jbi.com.sun/wfse/xpath-functions"

• wlmfn:get-email() as xs:string -- get email for the current task owner (who claimed the task)
• wlmfn:get-email($arg as xs:string) as xs:string -- get email for user: $arg
• wlmfn:get-manager-email() as xs:string -- get manager's email for the current task owner (who claimed the task)
• wlmfn:get-manager-email($arg as xs:string) as xs:string -- get manager's email for user: $arg
• wlmfn:get-manager-uid() as xs:string -- get manager uid for the current task owner (who claimed the task)
• wlmfn:get-manager-uid($arg as xs:string) as xs:string -- get manager uid for user: $arg

The sample snippets using the LDAP XPath: (a) Escalate to the manager whose id is an xpath using wlmfn:get-manager-email($arg as xs:string), the parameter is taken from $TaskInput

    <escalation>
        <duration>'P0Y0M0DT0H3M0S'</duration>
        <assignment>
            <!-- <user>'dale'</user> -->
            <user>wlmfn:get-manager-uid($TaskInpu.part1/ns:users)</user>
        </assignment>
    </escalation>

In our configuration sample, if $TaskInpu.part1/po:users returns 'john', wlmfn:get-manager-uid($TaskInput/po:users) returns 'dave', because 'dave' is the manager of 'john' (attribute: manager)

(b) Sends emails to the users assigned on the task using wlmfn:get-email($arg as xs:string)

    <notification name="notifyUsers">
        <email portType="ns1:NotificationHandlerPortType" operation="NotificationHandlerOperation">
            <!-- <address>'mei.wu@sun.com'</address> -->
            <address>wlmfn:get-email($TaskInput.part1/ns:users)</address>
        </email>
        <message>
            <subject>concat('There is a new task of approve purchase order assigned to you :',  $TaskInput.part1/ns:purchaserName) </subject>
            <body>'The task can be found at http://localhost:8080/WorklistWebApplication/wlm-jsp/wlmEntry.jsp'</body>
        </message>
    </notification>

(c) Sends email to the manager of the current task owner using * wlmfn:get-manager-email()
The wlmfn:get-manager-email() gets the current task owner's manager's email, e.g. if john checks out the task, dave's email address will be returned in this call

    <notification name="notifyManager">
        <email portType="ns1:NotificationHandlerPortType" operation="NotificationHandlerOperation">
            <!-- <address>'mei.w.gao@gmail.com'</address> -->
            <address>wlmfn:get-manager-email()</address>
        </email>
        <message>
            <subject>'The approve purchase order task has been completed'</subject>
            <body>concat(concat(' Purchase Order for ', $TaskInput.part1/ns:purchaserName), ' has been completed.')</body>
        </message>
    </notification>

The full project set can be downloaded purchaseOrderReviewNotification_LDAP.zip
Note:
You need to configure SMTP bc to send outbound emails, please see Notes for Notification

This page (revision-27) was last changed on 19-Feb-09 12:29 PM, -0800 by MeiWu.
This page was created on 05-Sep-08 10:33 AM, -0700 by MeiWu.

More info...