Create the main body of the policy XML file
Place all your policy definitions inside <policy> tags:
<policy>
<!-- Define your policy entries inside the element -->
</policy>
Define security constraints
For each set of resources identified, you need to define a <security-constraint> that maps these resources to the roles you wish to allow access.
For example:
<security-constraint>
<web-resource-collection>
<web-resource-name>Customer files</web-resource-name>
<description>
Resources that may be accessed by customers
</description>
<url-pattern>/customer/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>Customer</role-name>
</auth-constraint>
</security-constraint>
You can define one or more security constraints, and they can map to multiple resources and roles.
|
|
Note: If you previously had defined security constraints in your deployment descriptor, you can copy these directly in the policy file. |
Define roles
You have two options for defining roles:
- Set the idm.access.groupsAsRoles option in the SSO Servlet/Filter configuration. For each role in a security constraint you should ensure there is a group defined in Active Directory of the same name.
- Define one or more <role> elements that map the roles you have specified to Active Directory groups/principals.
Either option can be used, however we recommend defining the roles directly in the policy file if you are using programmatic security. See Single Sign-on for Java authorization. This allows group membership to be resolved by querying Active Directory at load time rather than at run time.
If you are using the idm.access.groupsAsRoles option, we recommend defining Domain Local groups specific to your application in the same domain as the application server.
To define a role mapping to Active Directory groups using the role element, do the following:
<role name="Customer">
<include>
<group name="My Application Customers"/>
</include>
</role>
|
|
Note: Group names are case-sensitive. |
More examples are given for the role element on Examples.
Set the deployment descriptor parameters
Edit the deployment descriptor (web.xml) file using either a standard text editor, or a tool supplied by your application server vendor. Add the following parameters to your SSO Servlet/Filter configuration:
<init-param>
<param-name>idm.access.policy</param-name>
<param-value>policy.xml</param-value>
</init-param>
Where policy.xml is replaced with the name of your policy file.