Federated SSO to SalesForce Using ISAM 9

Salesforce is one of the well known applications in the Corporate world and also one of the best applications suited for federation, For all the people who want to learn Federation based SSO, the first example application that you can use to test federation based sso is Salesforce.
Salesforce has one of the best and easy way to configure SAML based SSO functionality.

As a test of ISAM 9 federation capability, i got the chance to integrate salesforce with ISAM 9 VA.
To be honest there were a few issues and being new to the federation capability on VA had to overcome some pretty long hurdles.

After some exploring it feels that IBM has done some pretty good stuff, though it might not have that much flexibilty as TFIM had but overall a good interface to begin with.
and frankly speaking 90% of people dont read the stuff completely, Dont know if anyone is reading this as well ...... :-)

So these are the things that you need to do for configuring SSO to salesforce:

1. Configure TFIM Runtime in ISAM
In the software version, we have to configure runtime manually which creates a application in Websphere. In the VA the runtime comes preconfigured and running as localhost which means its basically using management server ip address.
So first configure a new ip address from interfaces in VA to be specifically used for Runtime,
then go to Secure Federation>> Runtime Parameters,
and in the runtime listening interfaces select the rows with localhost and delete them and configure the same with the new IP which you have configured in interfaces, makes ure to configure with 80 and 443 ports.

2. Create a Mapping Rule using javascript in ISAM mapping rules
This step might seem a little confusing for all the people who were using XSL files for mapping, as the new VA has the support of javascript and not an xsl.
But not to worry as usual if you have the previous version of TFIM installed somewhere make sure to copy the examples folder in it, as it has a lot of information and examples which can help you a lot.
So for the current configuration we will be using your isam userid same as the salesforce userid/emailadress
Go to secure federation>> globalsettings >> mapping rules and add a new rule.
make sure to give the category as SAML2.0
The below image shows the java script that was used for this configuration.
mapping rule image ....

3. Create Federation with the newly created mappping rule.
Go to secure federation >> manage >> federations.
click on ADD button and provide a new name for federation and check the box beside saml 2.0

In Template tab make sure the SAML2.0 checkbox is checked.

Now give a proper name for the company name and also give the provider as https://<websealip>/isam/sps and select the option as identity provider.

Give the point of contact as https://<websealip>/isam

In profile selection, select Web Browser Single sign on.

Single Sign on Settings select the options as shown in the below figure.

In Signature options select as below.

Make sure to select the same certificates as the previous screen.

Keep the settings as shown below.

For Identity Mapping, select the option of javascript transformation for identity mapping.

Select the Identity Mapping which was created previously.

Recheck all your previous selected options in the Summary.

4. verify the TFIM Runtime and get the federation ID.
Now that the Federation is configured we need to confirm the details of the Federation.
Go to Secure Federation >> Global Settings >> user registry.
make sure a user other than admin is created in this example easuser is created.
Now Access the URL in the Browser.
https://<Webseal IP>/Info/InfoServiceXML
For credentials provide easuser and password as passw0rd
This should show you the details of your federation, make sure to note down all the details like federation name, federation ID as well.

5. Configuring Federation(TFIM) with ISAM:
There are multple ways to do this,
We can do the configurations manually(you will learn a lot in this but basically one wrong move can lead to a lot of headache)
Personally i believe the best option to use is  to call the webservice(REST), most people get very afraid of the name webservice but trust me its one of the easiest and most interesting options.
If you have TDI you can use that or curl command or if you have SOAP UI you can use that as well.
The easy option is SOAP UI, which we will be using in this configuration.
So create a REST Project in SOAP UI and provide the details as given in the screenshot.

6. Export the certificate which was used while creating federation for encryption.
In this example we have used the certificate database called rt_profile_keys with a label called server.
Now export this certificate and import it to signer certificates of webseal certificate database in my case it is pdsrv

7. Configure SSO settings in Salesforce and export the metadata.
Login to the sales force application and navigate to Administration Setup -> Security Controls -> Single Sign-On Settings:
and create the SAML 2.0 setup with the below details

8. Use the metadata to create the partner in ISAM.
Now download the metadata from salesforce after configuring sso settings in it.
Now login to ISAM and browse to Secure Federation>> Manage>> Federations.
Then select the federation and click on partners and add a partner.
Now upload the metadata file to ISAM
In the General information tab provide the name as https://saml.salesforce.com as select the check box enabled and click on next.

Give the provider ID as https://saml.salesforce.com and make sure the partner role is selected as service provider and click on next.

select web browser single sign on and click on next.

Keep the settings as default and select next.

In ssl certificates make sure you are using the same certificate as the one that you used in federation and click on Next.

Make sure to have the settings as shown in the below image.

In encryption options select the certificates and click on Next.

In Identity Mapping select the option use Identity Mapping that is configured for this federation.

In summary verify all the options again and click on OK.

This will create your partner and then you are done..

Now access the below url for SSO to salesforce.
https://<your webseal ip/hostname>/isam/sps/salesforce/saml20/logininitial?RequestBinding=HTTPPost&PartnerId=https://saml.salesforce.com&NameIdFormat=email

Decrypting the Password from the ITIM property files in JAVA

Decrypting the Password from the ITIM property files in JAVA.

Yes we can decrypt an encrypted password from the ISIM Property files like enRoleLDAPConnection.properties and enRoledatabase.properties file.
This can be very helpful when you are trying to connect to ISIM LDAP or DB in the java code from workflows using FESI Extension or custom Extension or even in ISIM Hooked Reports.

The by default com.ibm.itim.common.properties package Provided by IBM in the websphere Libraries contains a class called PropertiesManager

Create an object for this class and check for the options of methods it provides from it.
Use the method called getEncryptedProperty and get the decrypted password.

Confused....... and probably wondering why the heck do you need all the above information right.
Ok then to make it much easier see the below sample code for reference.


Sample Code for reference

//add the below line along with your import statements
import com.ibm.itim.common.properties.PropertiesManager;

public class my class{

public myldapconnection(){
//creates an object for the PropertiesManager class
PropertiesManager pm =PropertiesManager.gInstance();
String ldapserverpwd =pm.getEncryptedProperty("enrole.ldap.connection","java.naming.security.credentials");


Ok so in the above code enrole.ldap.connection is actually an property in the properties.properties file in the <ISIM Installed location>/data/ folder
In my code The Properties Manager is refering to the properties.properties file and searching for the property file to look into.

Script to Delete a file using ITDI

What you have heard is correct you can delete a file from the system using TDI.

It is easy just a two lines of code is enough to delete a file using ITDI but you would need to make sure that you have the required permissions to delete the file or not.


Script to delete a file from the system 

var dirObj = new java.io.File("c:\\temp\\mydir");
dirObj["delete"]();

Note: The delete method needs to be brackets because itdi sometimes is not able to detect the referenced methods so you will need to de-reference the delete method, If not you would face a parser exception.

How to call our own java custom method in ITIM workflow

How to call our own java custom method in ITIM workflow:

There are different approaches for calling our own java methods or classes in ITIM Workflows.

One of those examples is calling the custom java method in ITIM script node of the ITIM workflow.

There are three main steps to be done for adding an custom extension in ITIM workflows:

l   Creating the jar of the java code.

1.Now make a jar file of the java program without including the supporting jars while making the jar file.

2.Now the supporting jars which are required for executing your code should be added to the itim reference libraries

Step 2: Modifying the properties file in itim:

1. Add the java package and class reference in the scriptframework.properties file in the itim data folder in the below format.

ITIM.java.access.<extension name>=<Package name as well as classname>

Eg:- ITIM.java.access.AppExt=com.company.AppExtExample

Step 3: Calling the method in Workflow:

1.Now restart the Websphere including the ITIM application, appserver, nodes and dmgr.

2.In the Script Node you can call the custom java method.

Eg:-obi = new com.company.ConnectDB2();

var b=obi.entlist("a","b");

Where com.company.ConnectDB2() is the package name

And entlist is the method and a,b are the parameters

References:-

http://tivoli-iam-help.blogspot.in/2012/08/writing-java-extensions-in-itim.html

http://www.slideshare.net/51lecture/techimplementation-of-complex-itim-workflows

http://tech.ivkin.net/wiki/IBM_Tivoli_Identity_Manager_How_To