If you want to know how to configure the Open Web SSO project (OpenSSO) to authenticate users who access protected resources, an article on Securing Applications With Identity Services, Part 1: Authentication may be a good place to start. An example client application built with the NetBeans IDE is used to demonstrate the process.

"Organizations and developers, such as those who focus on Web 2.0, are demanding interface support from identity and access management software," write Aravindan Ranganathan and Marina Sum. "The Open Web SSO Project, called OpenSSO for short, answers those demands."

This SDN article begins by covering the basis of OpenSSO, Sun's open web access management project that's based on the Sun Java System Access Manager source code. The basic architecture of OpenSSO's identity services is illustrated and the process explained:

1. The user interacts with the presentation logic of the application, for example, calendar, human resources applications, or banking.

2. The application authenticates, authorizes, audits, and finally creates personalized services for the user by calling either the SOAP/WSDL or REST identity services, as provided by OpenSSO.

3. OpenSSO calls the identity repository for authentication and obtains the user profile, the policy configuration (for authorization), and the audit repository (for log requests)."

The article then links readers to the necessary downloads, which include OpenSSO along with the web and Java EE bundle of the NetBeans IDE 6.0 that comes with GlassFish and Apache Tomcat.

Configurations for OpenSSO are offered next and can be completed in four simple steps.

The article then delves into identity services accessible through either SOAP with WSDL or Representational State Transfer (REST). It covers the setup of authentication, making authentication calls with either of these two interfaces and finally deploying and running the sample application. This application can be downloaded as a NetBeans project for future reference.

This article is the first in a planned series of four on securing applications with identity services. The next three will focus on how to authorize, profile and audit using identity services. [...read more...]

		fullsource
Print Email Current Profile Archive Blog Generate newsletter