RSA ClearTrust Ready Implementation Guide For Application Servers 1. Partner Information Partner Name SilverStream Web Site www.silverstream.com Product Name eXtend Application Server Version & Platform 3.75 Product Description SilverStream eXtend Application Server provides the most complete foundation for building and deploying cross-platform, high performance, standards-based applications.
3. Product Requirements Component Operating system Minimum RAM (memory) Minimum disk space Display mode Integration Modules File Name WSI Module (agisapi.dll) Description One of the following: § Windows NT Workstation or Windows NT Server 4.0 or higher with Service Pack 3 or higher Service Pack 6a or later is recommended for Y2K compliance.
4. Product Configuration The goal of this Implementation Guide is to explain how ClearTrust and SilverStream eXtend Application Server 3.75 can be integrated. It explains how to use ClearTrust as a single sign-on product and to secure pages and other objects on a SilverStream Application Server. It is assumed that the reader has both products up and running and has a working knowledge of them.
Page 4
This integration supports the use either Microsoft’s IIS web server or Sun’s iPlanet web server (formerly Netscape’s). Microsoft’s Web server (IIS 4.0) was used for testing and certification purposes A. Configure the WSI module: There are numerous references within this document to the ‘WSI’ or ‘WSI module’. This item consists of the 3 files below.
Page 5
B. Changed priority of ClearTrust ISAPI Filter. By default, the ClearTrust web plugin ISAPI filter installs at a LOW priority and the SilverStream WSI module ISAPI filter installs at a MEDIUM priority. In order for ClearTrust to authorize SilverStream users, its ISAPI filter has to load at a higher priority.
Page 6
the MMC, right-click your WSI directory and select Properties. On the Directory tab, disable Read and Write access permissions and make sure Execute permissions are enabled. 13. Select the machine/host name, right-click and choose Properties, then click Edit to edit "Master Properties", choose ISAPI Filters and then add the post filter,e.g., D:\Securant\SecCtrl\IIS Plugin\lib\ct_postfilter.dll, and toggle the SecureControl Post Filter to the top taking precedence over the SilverStream Post Filter (sspifilt), then click OK.
Page 7
D. Protect SilverStream resources SilverStream resources are protected via Clear Trust by proxying content through the IIS server running both the RSA ClearTrust IIS web plug-in and the SilverStream IIS WSI module. Because of this, you will need to secure the SilverStream server so that users cannot connect directly to it. This can be done from a network topology standpoint, firewall rules or simply via SilverStream configuration parameters and user/group permissions.
Page 8
1. Start the ClearTrust Services. 2. Verify that the web server is started and that the ClearTrust plug as well as single sign on was successfully initialized. 3. Start the SilverStream application server. 4. Check the AgWSI log file to verify that the WSI module started without errors. 5.
Page 9
Example ClearTrust Logon When a user makes a request for a protected resource that resides on the SilverStream Application server, they will be prompted with a Login Screen: After the user successfully authenticates, they will be directed to the requested page: Page: 9...
Page 10
5. Certification Checklist for Application Servers Product RSA ClearTrust SilverStream eXtend Application Server WSI Module (agisapi.dll) Microsoft Internet Information Server (IIS) Test Case Web/Presentation Access/Allow on unprotected JSP page Access/Allow on protected JSP page (URL only) with entitled user Access/Deny on protected JSP page (URL & Method) with entitled user on URL only Access/Deny on protected JSP page (URL &...
6. Known Issues · Clear Trust IIS plug in priority. The ClearTrust IIS filters should always load first, before any other filters. In order to make sure this happens, include the following line in the ClearTrust plugins default.conf file located on the IIS machine: securecontrol.plugin.iis.priority=HIGH This line can be added anywhere within the default.conf file as long as nothing else is on the same line...
Need help?
Do you have a question about the SILVERSTREAM 3.75 and is the answer not in the manual?
Questions and answers