The Web Single Sign On (WebSSO) is distributed both as a standalone project and as a component of other projects (such as caGrid). This guide details the steps involved in deploying a WebSSO server. To learn how to install a WebSSO client to use the server, refer to the WebSSO Client Developers Guide. Each distribution contains a websso directory, herein referred to as WEBSSO_LOCATION. To install and configure the WebSSO, follow the steps below.
WEBSSO requires the same prerequisite software as caGrid. You can perform either of the following actions to install the prerequisites:
Follow the instructions for the installation of caGrid using the caGrid Installer .
Install caGrid manually
Create the following environment variables.
- Create a GLOBUS_LOCATION environment variable and point it at the directory in which you installed Globus.
- Create a CATALINA_HOME environment variable and point it at the directory in which you installed Tomcat.
- Create a ANT_HOME environment variable and point it at the directory in which you installed Ant.
The WebSSO must run a securely, so the hosting container must run with a host credential. A host credential consist of an X.509 certificate and private key. Dorian provides the ability to issue and manage host credentials.
- Request a credential using the GAARDS UI.
For SyncGTS to 'sync' up the CA certificates on the WebSSO Server, the master GTS Certificate Authority .0 file must be copied from GTS to WebSSO.
Copy the MASTER GTS CA.0 file from the GTS server that is at the $HOME/.globus/certificates to the $HOME/.globus/certificates folder on the WebSSO server.
If you don't opt to start syncGTS programatically, see Step 5 and Step 6 for the detailed procedures.
We MUST configure Globus to trust the CA that issued the host credentials obtained in the previous step. To do this, place a copy of the certificate for the CA that issued the host credentials in the Globus trusted certificates directory. Unless otherwise specified during installation, this is usually USER_HOME/.globus/certificates. Globus requires all CA certificates in its trusted certificates directory to be in PEM format and to have a digit extension (0-9). For example, if a CA certificate is stored in the file cacert.pem, it should be copied to the directory USER_HOME/.globus/certificates (create directory if needed) with the file name "cacert.0"
Configuring cas.properties and websso-properties-template.xml requires host certificate,host key obtained from Step 3, websso server host name, websso server https port, and start auto sync gts [yes]/[no].
Type the commands below at the command prompt and provide details when prompted as shown in the sample output:
Following is sample output:
The WebSSO is configured through an file, WEBSSO_LOCATION/src/resources/websso-properties.xml. Below is an example of the websso property file, followed by a description of each of the properties:
|Property Group||Property Name||Description|
|websso-server-information||This section contains information about the WebSSO Server.|
|start-auto-syncgts||This is a configuration parameter indicating whether the WebSSO Server should start SyncGTS automatically or not. "yes" indicates WebSSO Server to start the SyncGTS daemon.|
|host-credential-certificate-file-path||This is the path to the WebSSO Server's Host Certificate File obtained in Step 3.|
|host-credential-key-file-path||This is the path to the WebSSO Server's Host Key File obtained in Step 3.|
|credential-delegation-service-information||This section is used to configure the Credential Delegation Service which will be used to publish the delegation policy for User's Grid Credentials|
|service-url||This is the URL to the Credential Delegation Service.This information is known based on the prior installation of CDS.|
|service-identity||This is the service Identity for Credential Delegation Service.|
|delegation-lifetime-hours||This is the hours for which the delegation policy remains alive.|
|delegation-lifetime-minutes||This is the minutes for which the delegation policy remains alive.|
|delegation-lifetime-seconds||This is the seconds for which the delegation policy remains alive.|
|issued-credential-path-length||A path length specifies the length of a credential chain. For example a credential with a length of 2 means that the credential can be delegated to a second party and the second party could in turn delegate the credential to a third party at which point the third party can no longer delegate the credential. The Issued Credential Path Length specifies the path length of the credentials issued to third parties. An Issued Credential Path Length of 0 indicates that the third party may not further delegate the user's credential.|
|dorian-service-descriptor||This section is used to configure the Dorian Server which will be used to retrieve User's Grid Credentials.|
|display-name - This is the display name for the Dorian Service which is displayed on the login screen.|
|service-url - This is the URL to the Dorian Service.|
|service-identity - This is the service Identity for the Dorian Service.|
|proxy-lifetime-hours - This is the hours for which the proxy remains alive.|
|proxy-lifetime-minutes - This is the minutes for which the proxy remains alive.|
|proxy-lifetime-seconds - This is the seconds for which the proxy remains alive.|
|delegated-applications-group||These are the group of applications to which user's credentials are to be delegated. In the future, users will be able to choose these. As of now they are just in a static list.|
|group-name||This is the name given to the group of the applications to which a user's credentials is delegated.|
|delegated-application-list||These are the list of the applications to which user's credentials are to be delegated.|
|delegated-application - This is the entry for an application to which the user's credentials are delegated.|
To sync with the Grid Trust Fabric and start SyncGTS programatically if the start-auto-syncgts entry in WebSSO Configuration file is set to 'yes', the WebSSO server needs a sync-description.xml file in its classpath. Depending on which grid you are trying to connect to, obtain the sync-description.xml file from the relevant grid administrator. Place this file in the WEBSSO_LOCATION/ext/target_grid folder.
If you have turned start-auto-syncgts to 'no', the administrator must handle syncing with the trust fabric. This can be done manually by starting the syncGTS daemon. For detailed steps, refer to the GTS documentation.
Build WebSSO server. Type the following from a command prompt:
Creating the host credential keystore from host credentials requires the host certificate and host key obtained from Step 3. Type the commands given below at the command prompt and provide details when prompted as shown in the sample output:
Following is sample output :
At the Enter the current password of the private key: prompt, enter the password for your private key. If you private key does not have a password (most cases), just press Enter.
Since the WebSSO Server would be running using SSL, we need to configure Tomcat to enable SSL.
Add the https connector in CATALINA_HOME/conf/server.xml.
- Edit the file CATALINA_HOME/conf/server.xml (example shown below).
- Uncomment connector element for port 8443 (SSL)
- Add keystoreFile parameter containing the location of the keystore you just created.
- Add keystorePass parameter containing the the password of the keystore you just created.
Once you have deployed WebSSO, you have completed the installation and configuration of WebSSO. Next verify that the installation was successful by starting the container to which WebSSO was deployed. To start a secure Tomcat container, run the startup script (startup.sh or startup.bat) located in TOMCAT_INSTALLATION_DIRECTORY/bin. If the container starts up, we are ready to verify that the WebSSO installation was successful.
Type the following in a browser: http://@WEBSSO_SERVER_NAME@:@PORT_NUMBER@/webssoserver and make sure you are able to log in to WebSSO by providing user name and password credentials.