MQSeries.net :: View topic - WS-Security and Active Directory work with WMB?

liminzhang · Posted: Mon Sep 29, 2014 1:26 pm Post subject:

Hi there,

Did anyone use WMB 7.0.0.6 with WS-Security and Microsoft Active Directory? I searched the forum and it appears that no one encountered this issue before.

The following is the settings I used.

Settings for the security profile

SecurityProfiles
SecurityProfile_1
authentication='LDAP'
authenticationConfig='ldap://dc001:389/OU=MyCompany Users,OU=MyCompany Users and Computers,DC=MyCompany,DC=com?sAMAccountName'
authorization='LDAP'
authorizationConfig='ldap://dc001:389/CN=MyGroup,OU=DISTRIBUTION LISTS,OU=Security Groups,OU=MyCompany Users,OU=MyCompany Users and Computers,DC=MyCompany,DC=com'
keyStore='keystore.jks'
mapping='NONE'
mappingConfig=''
passwordValue='PLAIN'
propagation='TRUE'
rejectBlankpassword='FALSE'
trustStore='Reserved for future use'

Settings for AddressBookProviderFlow.cmf

Provider Policy Set:WSS10Default
Provider Policy Set Binding:WSS10Default
Security Profile Name:SecurityProfile_1

The SOAP request

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:con="http://cds.gdt.com/ContraventionDetailsService/">
<soapenv:Header>
<wsse:Security soapenv:actor="" mustUnderstand="1"
xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:UsernameToken>
<wsse:Username xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="unt_907818524">MyUid</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">MyPassword</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
></soapenv:Header>
<soapenv:Body>
<NS2:Person xmlns:NS2="http://addressbook.com/" ><NS2:Name>Dave1</NS2:Name><NS2:Address><NS2:City>Carlisle</NS2:City><NS2:Street>Welton</NS2:Street><NS2:Province>Cumbria</NS2:Province><NS2:PostalCode>NE2 3HP</NS2:PostalCode><NS2:PhoneNumber><NS2:Area>1</NS2:Area><NS2:Prefix>2</NS2:Prefix><NS2:Local>3</NS2:Local></NS2:PhoneNumber></NS2:Address></NS2:Person>
</soapenv:Body>
</soapenv:Envelope>

User trace logs.

2014-09-29 09:57:09.397778 5012 UserTrace BIP2735I: Identity has been passed to the ''LDAP'' security provider as instructed by security profile ''SecurityProfile_1''. The following operations are requested: ''authentication'', '''', ''authorization''.
The security profile ''SecurityProfile_1'' has specified ''LDAP'' for security processing. A message has entered a node that uses this profile and the provider is being invoked.
No action is required.

2014-09-29 09:57:09.415883 5012 UserTrace BIP2736I: Preparing to bind to LDAP server ''ldap://dc001:389'', using username ''CN=MyLastName\, MyFirstName,OU=MyCompany Users,OU=MyCompany Users and Computers,DC=MyCompany,DC=com'' and the associated password.
The LDAP security provider is authenticating the username (''CN=MyLastName\, MyFirstName,OU=MyCompany Users,OU=MyCompany Users and Computers,DC=MyCompany,DC=com'') by performing an LDAP bind; success of this bind will guarantee the authenticity of the password.
No action is required.

2014-09-29 09:57:09.434168 5012 UserTrace BIP2735I: Identity has been passed to the ''LDAP'' security provider as instructed by security profile ''SecurityProfile_1''. The following operations are requested: ''authorization'', 'AddressBookProviderFlow', '{4}'.
The security profile ''SecurityProfile_1'' has specified ''LDAP'' for security processing. A message has entered a node that uses this profile and the provider is being invoked.
No action is required.

2014-09-29 09:57:09.459191 5012 UserTrace BIP2737I: Preparing to look up distinguished name (DN) ''CN=MyLastName\, MyFirstName,OU=MyCompany Users,OU=MyCompany Users and Computers,DC=MyCompany,DC=com'' in group ''CN=MyGroup,OU=DISTRIBUTION LISTS,OU=Security Groups,OU=MyCompany Users,OU=MyCompany Users and Computers,DC=MyCompany,DC=com'' on LDAP server ''ldap://dc001:389''. Member attributes searched are ''[member, uniquemember]''.
The LDAP security provider is performing an authorization check on the username (''CN=MyLastName\, MyFirstName,OU=MyCompany Users,OU=MyCompany Users and Computers,DC=MyCompany,DC=com'') by checking whether it is a member of group ''CN=MyGroup,OU=DISTRIBUTION LISTS,OU=Security Groups,OU=MyCompany Users,OU=MyCompany Users and Computers,DC=MyCompany,DC=com''.
No action is required.

2014-09-29 09:57:09.464107 5012 UserTrace BIP2703W: The identity token type ''Username and password'', issued by '''', was not authorized by security provider ''ldap://dc001:389'' to access message flow ''AddressBookProviderFlow''. (For a 'username' token type, the token is: ''MyUid''.)
If access is expected, ensure that the specified security provider has been configured to allow access to the specified message flow. If the security provider is shown as 'Cached', the authorization result is now being returned from the broker security cache. You can use the 'mqsireloadsecurity' command to clear the broker security cache. Check your security provider logs for information about why the identity token could not be authorized.

I double checked the membership with the following query in a .Net program. The query show that the memebership is in Active Directory.

Membership Query

srch.Filter = @"(&(objectClass=user)(distinguishedName=CN=MyLastName\, MyFirstName,OU=MyCompany Users,OU=MyCompany Users and Computers,DC=MyCompany,DC=com)(memberOf=CN=MyGroup,OU=DISTRIBUTION LISTS,OU=Security Groups,OU=MyCompany Users,OU=MyCompany Users and Computers,DC=MyCompany,DC=com))";

I am in local administrator group on my computer and the message flow was deployed on my computer.

Does anyone have a clue? Can Microsoft Active Directory work with WMB at all?

Thanks

L.Z.