| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| IIB9: LDAP SecurityProfile For Authorization |
« View previous topic :: View next topic » |
| Author |
Message
|
| akil |
 Posted: Wed Dec 09, 2015 3:32 am Post subject: IIB9: LDAP SecurityProfile For Authorization |
 |
|
Partisan
Joined: 27 May 2014
Posts: 338
Location: Mumbai
|
Hi
In the past we've used LDAP as a PDP for authentication and authorisation. We do this as follows :
an LDAP group is created for every 'integration service'
an LDAP security profile is created for every 'integration service' - in this security profile, we specify the group membership requirement
we attach this security profile to the SoapInput node.
[list=]
Now I've a scenario, where I have a single HTTP flow, which is acting like a gateway for some back-end services. The authorisation has to be implemented basis a specific tags that comes in the input-message. There are some 25+ services (and more to come in the future). One way would be to put 25+ securityPEP nodes, (one for each operation), and route the message to the appropriate PEP node. Each PEP node would be assigned the appropriate (LDAP) securityProfile, to enforce the authorisation.
In this approach, as new operations get added, we'll have to add new securityPEP nodes.
I am trying to find a way to avoid this.
# Is there a way to 'override' the securityProfile at runtime ? I didn't find any LocalEnvironment override for it
# Any way of specifying the LDAP group name dynamically ? ( we need to check if the user has membership to a group that has the name of operation )
# any other way ? implement a JCN LDAP look up?
[/list]
_________________
Regards |
|
| Back to top |
|
 |
| mgk |
| Posted: Mon Dec 14, 2015 3:57 pm Post subject: |
|
|
Padawan
Joined: 31 Jul 2003
Posts: 1642
|
Unfortunately there is no way to override the Security Profile at runtime. Please raise an RFE for this if you would find this useful...
_________________
MGK
The postings I make on this site are my own and don't necessarily represent IBM's positions, strategies or opinions. |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
