如果您利用 Jazz™ Team Server 安裝精靈來建立 Tomcat 配置檔,會自動完成這項程序,您不需要配置 Web 儲存器。
關於這項作業
如果您有意在 Apache Tomcat 中手動配置 LDAP 的 Web 儲存器,請遵循下列步驟:
程序
- 開啟 JazzInstallDir/server/tomcat/conf/server.xml 檔來編輯,並在註解中放置下列標籤:
<Realm className="org.apache.catalina.realm.UserDatabaseRealm"
resourceName="UserDatabase"
digest="SHA-1"
digestEncoding="UTF-8"/>
- 視您使用的目錄而定,新增下列其中一個標籤:
新增「Oracle 網際網路目錄 (OID)」的下列標籤,然後變更資訊來符合您的配置:
<Realm className="org.apache.catalina.realm.JNDIRealm"
debug="99"
connectionURL="ldap://ldap.company.com:389"
roleBase="cn=Groups,dc=company,dc=com"
roleSearch="(uniquemember={0})"
roleName="cn"
userBase="cn=Users,dc=company,dc=com"
userSearch="(uid={0})"/>
新增 Microsoft Active Directory 的下列標籤,然後變更資訊來符合您的配置:
<Realm className="org.apache.catalina.realm.JNDIRealm"
debug="99"
connectionURL="ldap://ldap.company.com:3268"
authentication="simple"
referrals="follow"
connectionName="cn=LDAPUser,ou=Service Accounts,dc=company,dc=com"
connectionPassword="VerySecretPassword"
userSearch="(sAMAccountName={0})"
userBase="dc=company,dc=com"
userSubtree="true"
roleSearch="(member={0})"
roleName="cn"
roleSubtree="true"
roleBase="dc=company,dc=com"/>
針對 Tivoli® Directory Server 新增下列標籤,然後變更資訊來符合您的配置:
<RealmclassName="org.apache.catalina.realm.JNDIRealm"
debug="9"
connectionURL="ldap://Machine where TDS is installed>:389"
userBase="o=company.com"
userSearch="(mail={0})"
userSubtree="true"
roleBase="o=company.com"
roleSubtree="true"
roleSearch="(member={0})"
roleName="cn"/>
- 開啟 JazzInstallDir/server/tomcat/webapps/app
name/WEB-INF/web.xml 來編輯,其中 app
name 是所安裝的應用程式,例如 jts、ccm、qm 或
rm.
- 在您開啟的檔案中,將安全角色參照鏈結並對映至安全角色:
<web-app id="WebApp">
<servlet id="bridge">
<servlet-name>equinoxbridgeservlet</servlet-name>
<display-name>Equinox Bridge Servlet</display-name>
<description>Equinox Bridge Servlet</description>
<servlet-class>org.eclipse.equinox.servletbridge.BridgeServlet</servlet-class>
<init-param><!-- ... --></init-param>
<!-- ... -->
<load-on-startup>1</load-on-startup>
<!-- Addendum
If the names of your LDAP Groups are the same as the default Jazz roles
you don't need to add the following tags
-->
<security-role-ref>
<role-name>JazzAdmins</role-name>
<role-link>[LDAP Group for Jazz admins]</role-link>
</security-role-ref>
<security-role-ref>
<role-name>JazzDWAdmins</role-name>
<role-link>[LDAP Group for Jazz data warehouse admins]</role-link>
</security-role-ref>
<security-role-ref>
<role-name>JazzGuests</role-name>
<role-link>[LDAP Group for Jazz guests]</role-link>
</security-role-ref>
<security-role-ref>
<role-name>JazzUsers</role-name>
<role-link>[LDAP Group for Jazz users]</role-link>
</security-role-ref>
<security-role-ref>
<role-name>JazzProjectAdmins</role-name>
<role-link>[LDAP Group for Jazz project admins]</role-link>
</security-role-ref>
</servlet>
<!-- ... -->
</web-app>
使用下列標籤,將 LDAP 群組宣告為安全角色:
<web-app id="WebApp">
<servlet id="bridge">
<!-- ... -->
<security-role>
<role-name>JazzAdmins</role-name>
<role-name>JazzDWAdmins</role-name>
<role-name>JazzGuests</role-name>
<role-name>JazzUsers</role-name>
<role-name>JazzProjectAdmins</role-name>
<!-- Addendum
If the names of your LDAP Groups are the same as the default Jazz roles
you don't need to add the following tags
-->
<role-name>[LDAP Group for Jazz Admins]</role-name>
<role-name>[LDAP Group for Jazz Data Warehouse Admins]</role-name>
<role-name>[LDAP Group for Jazz Guests]</role-name>
<role-name>[LDAP Group for Jazz Users]</role-name>
<role-name>[LDAP Group for Jazz Project Admins]</role-name>
<!-- End Addendum -->
</security-role>
<!-- ... -->
</web-app>
使用下列標籤,來更新 security-constraint 區段:
<web-app id="WebApp">
<!-- ... -->
<security-constraint>
<web-resource-collection>
<web-resource-name>secure</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>JazzUsers</role-name>
<role-name>JazzAdmins</role-name>
<role-name>JazzGuests</role-name>
<role-name>JazzDWAdmins</role-name>
<role-name>JazzProjectAdmins</role-name>
<!-- Addendum
If the names of your LDAP Groups are the same as the default Jazz roles
you don't need to add the following tags
-->
<role-name>[LDAP Group for Jazz Admins]</role-name>
<role-name>[LDAP Group for Jazz Data Warehouse Admins]</role-name>
<role-name>[LDAP Group for Jazz Guests]</role-name>
<role-name>[LDAP Group for Jazz Users]</role-name>
<role-name>[LDAP Group for Jazz Project Admins]</role-name>
<!-- End Addendum -->
</auth-constraint>
<user-data-constarint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
<!-- ... -->
</web-app>
參照 Jazz 群組,以針對每一個 security-constraint,重複相同的附錄:<web-app id="WebApp">
<!-- ... -->
<security-constraint>
<web-resource-collection>
<web-resource-name>adminsecure</web-resource-name>
<url-pattern>/admin/cmd/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>JazzAdmins</role-name>
<!-- Addendum -->
<role-name>[LDAP Group for Jazz Admins]</role-name>
<!-- End addendum -->
</auth-constraint>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
<!-- ... -->
</web-app>