Cisco Prime Service Catalog – Management Console of ServiceCatalog on Active Directory

Instead of passwords managed locally,

It’s time to use an LDAP/Active Directory to be able to manage users without restarting the Prime Service Catalog.

This modification has been done on a Custom Installation of Cisco Prime Service Catalog 11.1.1 Patch 3 and should be compatible with 11.2 (future version) as well.

First, make a backup of your configuration directory (on our environment, we use git with gitlab Community Edition, to keep an history of all our modifications).

Location: /opt/cisco-psc/wildfly-8.2.0.Final/ServiceCatalogServer/configuration

File to edit: standalone-full.xml

Edit the section security-realm and change the subsection ManagementRealm like this:

        <security-realms>
            <security-realm name="ManagementRealm">
                <authentication>
                        <jaas name="YOUR_SECURITY_DOMAIN"/>
                </authentication>
            </security-realm>
            <security-realm name="ApplicationRealm">
                <authentication>
                    <local default-user="$local"/>
                    <properties path="application-users.properties" relative-to="jboss.server.config.dir"/>
                </authentication>
            </security-realm>
        </security-realms>

<security-realms>

<security-realm name="ManagementRealm">

</authentication>

</security-realm>

<security-realm name="ApplicationRealm">

</authentication>

</security-realm>

</security-realms>

Edith the section security-domains and add a subsection security-domain like this:

                 <security-domain name="YOUR_SECURITY_DOMAIN" cache-type="default">
                     <authentication>
                         <login-module code="LdapExtended" flag="required">
                             <module-option name="java.naming.provider.url" value="ldap://YOUR_ACTIVEDIRECTORY_SERVER:389/"/>
                             <module-option name="java.naming.factory.initial" value="com.sun.jndi.ldap.LdapCtxFactory"/>
                             <module-option name="java.naming.security.authentication" value="simple"/>
                             <module-option name="java.naming.referral" value="follow"/>
                             <module-option name="bindDN" value="USERNAME@ACTIVEDIRECTORY_DOMAIN"/>
                             <module-option name="bindCredential" value="PASSWORD"/>
                             <module-option name="baseCtxDN" value="OU=Users,OU=...,DC=ACTIVEDIRECTORY,DC=DOMAIN"/>
                             <module-option name="baseFilter" value="(sAMAccountName={0})"/>
                             <module-option name="roleAttributeID" value="memberOf"/>
                             <module-option name="roleAttributeIsDN" value="true"/>
                             <module-option name="rolesCtxDN" value="OU=Groups,OU=...,DC=ACTIVEDIRECTORY,DC=DOMAIN"/>
                             <module-option name="roleFilter" value="(member={1})"/>
                             <module-option name="roleNameAttributeID" value="cn"/>
                             <module-option name="searchScope" value="SUBTREE_SCOPE"/>
                             <module-option name="roleRecursion" value="5"/>
                         </login-module>
                         <login-module code="RoleMapping" flag="optional">
                             <module-option name="rolesProperties" value="file:///${jboss.server.config.dir}/AD_GroupsMapping.properties"/>
                             <module-option name="replaceRole" value="true"/>
                         </login-module>
                     </authentication>
                 </security-domain>

<security-domain name="YOUR_SECURITY_DOMAIN" cache-type="default">

<login-module code="LdapExtended" flag="required">

<module-option name="java.naming.provider.url" value="ldap://YOUR_ACTIVEDIRECTORY_SERVER:389/"/>

<module-option name="java.naming.factory.initial" value="com.sun.jndi.ldap.LdapCtxFactory"/>

<module-option name="java.naming.security.authentication" value="simple"/>

<module-option name="java.naming.referral" value="follow"/>

<module-option name="bindDN" value="USERNAME@ACTIVEDIRECTORY_DOMAIN"/>

<module-option name="bindCredential" value="PASSWORD"/>

<module-option name="baseCtxDN" value="OU=Users,OU=...,DC=ACTIVEDIRECTORY,DC=DOMAIN"/>

<module-option name="baseFilter" value="(sAMAccountName={0})"/>

<module-option name="roleAttributeID" value="memberOf"/>

<module-option name="roleAttributeIsDN" value="true"/>

<module-option name="rolesCtxDN" value="OU=Groups,OU=...,DC=ACTIVEDIRECTORY,DC=DOMAIN"/>

<module-option name="roleFilter" value="(member={1})"/>

<module-option name="roleNameAttributeID" value="cn"/>

<module-option name="searchScope" value="SUBTREE_SCOPE"/>

<module-option name="roleRecursion" value="5"/>

</login-module>

<login-module code="RoleMapping" flag="optional">

<module-option name="rolesProperties" value="file:///${jboss.server.config.dir}/AD_GroupsMapping.properties"/>

<module-option name="replaceRole" value="true"/>

</login-module>

</authentication>

</security-domain>

And a file AD_GroupsMapping.properties containing the mapping between a specific usersgroup and the management group in Wildfly like this:

CPSC_Administrators=admin,developer,analyst,manager,user,rest-all

1	CPSC_Administrators=admin,developer,analyst,manager,user,rest-all

Then restart the Service Catalog with systemctl restart servicecatalog

And you should be able to log in with an user defined on your LDAP/ActiveDIrectory server.

Leave a Reply Cancel reply