web identity manager

8/6/2019 Web Identity Manager

1/4

1

WIMGeneral Users Guide

Rosario Turco (Naples

Italy) [email protected]

DescriptionWhen we have got a Web Application, we also have many questions:

1. How can we protect the Web Application

System?

2. How can we get the profiling capabilities

and maintain the provisioning of users externally

at the Web Application System?

3. How can we obtain the association

between functionality and profile of user?
mailto:[email protected]:[email protected]


2/4

2

WIM accelerate your development:

1) It is a external framework , you can use and attach at your web applications.

2) You must only design your web applications, keeping in mind the security constraints of WIM, so you can

maximize the potential of WIM.

3) WIM is a simple and secure system with SSO, https and a policy server (SPOS) for web applications. It is

suitable for small and medium enterprises, with low cost but high potential. WIM helps you to centralize

the username/password cycle provisioning on SPOS, to assign a profile at the user on each Web

applications (the user can have different profiles, one on each system), to have encrypted password, to

change the expired passwords (each three months). WIM also offers an agent CPOS for login

authentication in https and API for SSO.

SPOS is a Simple Policy Server (SPOS.war), with KBFE (Knowledge Base Framework Engine) and Tomcat

technology. It must be centralized for all system application.

CSPOS is the agent, the client of SPOS (CSPOS.war), with Tomcat & Struts2 Interceptor technology. It must

be installed on each system application.

You can introduce or no, AFPS. AFPS (Associated Functionality & Profile Server) can use KBFE (See KBFE

Users Guide on SourceForge; in the software of WIM you have kbfe.jar) to model an ontology for

Functionality, Profile and relation. In this case you models with Proteg your ontology. You can develop

AFPS yourself or if you want, you can also use a database for this. The database must have a table for

functionality, a table for profile, a table of association.

The software is available onhttp://rturco.users.sourceforge.net/
http://rturco.users.sourceforge.net/http://rturco.users.sourceforge.net/http://rturco.users.sourceforge.net/


3/4


4/4

4

CSPOS configuration

CSPOS is the agent that you must configure on each system for authentication.

Under %CATALINA_HOME%/bin put CSPOS.properties, log4j.properties

Put CSPOS.war under %CATALINA_HOME%/webapps

Start Tomcat, so CSPOS.war is exploded in a directory

Stop Tomcat

Copy the content of lib.zip in %CATALINA_HOME%/webapps/WEBINF/lib

In CSPOS dir you see in resourse struts.xml and index.jsp in WebContent.

Where do we attach our web application?index.jsp is only an example but you mut substitute it with your main servlet. In your main servlet you must

control on the session if username, profile, oursystem aren't null, otherwise you must do

response.sendRedirect("Logout.jsp") or response.sendRedirect("Login.jsp").

Then you must write your servlet in file struts.xml in substitution of index.jsp (See in WebContent of

CSPOS.war).

The PROFILE parameter you can get from session.getAttribute("PROFILE") for you application. CPOS sets

USERNAME, PROFILE and OURSYSTEM, which your main servlet must read on the session.

Can we change the layout of Login page?

Yes, you can customize the Login.jsp with layout of your web application. You must open the war andsubstitute Login.jsp with yours.

Where is Logout?You must insert the logout in each page of your application. An example of Logout is here.

Logout

SuggestYou must made your Web Application keeping in mind the security constraints of WIM, so you can

maximize the potential of WIM.

SSL configuration SPOS e CSPOSYou must configure SPOS and CSPOS with SSL. A tutorial ishttp://techtracer.com/2007/09/12/setting-up-

ssl-on-tomcat-in-3-easy-steps/
http://techtracer.com/2007/09/12/setting-up-ssl-on-tomcat-in-3-easy-steps/http://techtracer.com/2007/09/12/setting-up-ssl-on-tomcat-in-3-easy-steps/http://techtracer.com/2007/09/12/setting-up-ssl-on-tomcat-in-3-easy-steps/http://techtracer.com/2007/09/12/setting-up-ssl-on-tomcat-in-3-easy-steps/http://techtracer.com/2007/09/12/setting-up-ssl-on-tomcat-in-3-easy-steps/http://techtracer.com/2007/09/12/setting-up-ssl-on-tomcat-in-3-easy-steps/

web identity manager

Documents