Administer Transact users and groups

Apache Tomcat configuration is set in the following files:

<Transact Folder>\Application\WEB-INF\classes\META-INF\dcma-user-connectivity\user-connectivity.properties

This file contains the settings necessary to populate groups names in Transact Batch Class Management. The following settings should be set for Tomcat:

user.tomcatUserXmlPath=<Transact Folder>\\JavaAppServer\\conf\\tomcat-users.xml
user.connection=2

<Transact Folder>\JavaAppServer\conf\server.xml

This file tells Transact that users should be authenticated using Tomcat. The file should have the following Realm:

<Realm className="org.apache.catalina.realm.MemoryRealm"/>

<Transact Folder>\JavaAppServer\conf\tomcat-users.xml

This file contains user groups and users. For example, a group called "admin" and a user called "ephesoft" with password "demo" is defined as follows:

<role rolename="admin"/>
<user username="ephesoft" password="demo" roles="admin"/>

OpenLDAP Software is a free, open source implementation of the Lightweight Directory Access Protocol (LDAP) developed by the OpenLDAP Project. It is released under its own BSD-style license called the OpenLDAP Public License. LDAP is a platform-independent protocol. To connect to the Transact LDAP database and modify groups, users, permissions, and other settings, administrators can use the bundled JExplorer tool at the following location:

<Transact Folder>\Dependencies\OpenLDAP\ldap-client\jxplorer-3.2.1\jxplorer.bat

Connection to LDAP configuration is enabled in these files:

<Transact Folder>\Application\WEB-INF\classes\META-INF\dcma-user-connectivity\user-connectivity.properties

This file contains the settings necessary to populate group names in Transact Batch Class Management. The following settings should be set for LDAP configuration:

user.ldap_url=ldap://localhost:389
user.ldap_config=com.sun.jndi.ldap.LdapCtxFactory
user.ldap_domain_component_name=ephesoft
user.ldap_domain_component_organization=com
user.ldap_username=cn=Manager,dc=ephesoft,dc=com
user.ldap_password=*******
user.connection=0

<Transact Folder>\JavaAppServer\conf\server.xml

This file tells Transact that users should be authenticated using Tomcat. The file should have the following Realm:

<Realm   className="org.apache.catalina.realm.JNDIRealm"
connectionURL="ldap://localhost:389"
connectionName="cn=Manager,dc=ephesoft,dc=com"
connectionPassword="secret"
userPattern="cn={0},ou=people,dc=ephesoft,dc=com"
roleBase="ou=groups,dc=ephesoft,dc=com"
roleName="cn"
roleSearch="uniqueMember={0}"
/>

To configure Active Directory, modify the user-connectivity.properties file, which is located in:

<Transact Folder>\Application\WEB-INF\classes\META-INF\dcma-user-connectivity

Set the following:

• user.msactivedirectory_url to ldap://<Server-Name/IP>:<port>. The port is either of the following:

  • 389 to use the standard LDAP port. See Configure Active Directory with the Standard LDAP Service port.

  • 3268 to use the global catalog. See Configure Active Directory with the Global Catalog Service port.

• user.msactivedirectory_context_path to empty.

• user.msactivedirectory_group_search_filter to a single filter value. (Not multiple filters to be specified)

This setting will be in sync with the one done while setting the Realm.

Transact has several URLs, which include the following:

• BatchList.html

• BatchClassManagement.html

• BatchInstanceManagement.html

• ReviewValidate.html

• WebScanner.html

• Reporting.html

Administrators can authorize access to these URLs using group/role names defined in Tomcat, LDAP and MS Active Directory. Web.xml can be found here: <Transact Folder>\WEB_INF\web.xml

By default, all URLs are authorized by all groups by using * in the auth-constrain node:

<auth-constraint>
			<role-name>*</role-name>
</auth-constraint>

To authorize a specific security role or LDAP container, modify the role-name node. This example assigns the admin role to BatchInstanceManagement.html through the <auth-constraint> element.

<security-constraint>
         <web-resource-collection>
               <web-resource-name>batch instance management</web-resource-name>
               <url-pattern>/BatchInstanceManagement.html</url-pattern>
               <http-method>GET</http-method>
               <http-method>POST</http-method>
         </web-resource-collection>
         <auth-constraint>
               <role-name>admin</role-name>
         </auth-constraint>
 </security-constraint>

To allow multiple roles, add <role-name> elements in <auth-constraint> as shown below.

<security-constraint>
         <web-resource-collection>
               <web-resource-name>batch instance management</web-resource-name>
               <url-pattern>/BatchInstanceManagement.html</url-pattern>
               <http-method>GET</http-method>
               <http-method>POST</http-method>
         </web-resource-collection>
         <auth-constraint>
               <role-name>role2</role-name>
               <role-name>admin</role-name>
         </auth-constraint>
 </security-constraint>

The <security-role> tag need not to be modified. It can remain as a single entry (*) allowing all groups. It may give warnings if the <security-role> tag is not mapped to groups individually. These warnings can be eliminated by providing mapping for roles in the <security-role> tag.

<security-role>
            <role-name>*</role-name>
 </security-role>