Develop a custom interceptor for trust associations

If you are using a third-party reverse proxy server other than Tivoli WebSeal Version 3.6, you must provide an implementation class for the WebSphere Application Server - Express interceptor interface for your proxy server. This topic describes the interface you must implement.

  1. Define the interceptor class method.
    WebSphere Application Server - Express provides the interceptor Java interface, com.ibm.websphere.security.TrustAssociationInterceptor Go to API documentation which defines these methods:

  2. Set properties in the trustedservers.properties file.
    To be configurable, the interceptor must extend com.ibm.websphere.security.WebSphereBaseTrustAssociationInterceptor. Implement these methods:

    To make your custom interceptor configurable, perform these steps:

    1. Configure these methods implemented by the custom interceptor implementation.

      Note: This list only shows the methods and does not include any implementation.

      import java.util.*;
import javax.servlet.http.HttpServletRequest;
import com.ibm.websphere.security.*;

public class myTAIImpl extends WebSphereBaseTrustAssociationInterceptor
   implements TrustAssociationInterceptor {

  public myTAIImpl () {
  }

  public boolean isTargetInterceptor (HttpServletRequest req)
     throws WebTrustAssociationException {
    // Return true if this is the target interceptor, else return false.
  }

  public void validateEstablishedTrust (HttpServletRequest req) 
     throws WebTrustAssociationFailedException {
    // Validate if the request is from the trusted proxy server.
    // Throw exception if the request is not from the trusted server.
  }

  public String getAuthenticatedUsername (HttpServletRequest req)
     throws WebTrustAssociationUserException {
    // Get the user name from the request and if the user is 
    // entitled to the requested resource return the user. 
    // Otherwise, throw the exception.
  }

  public int init (Properties props) {
    // Initialize the implementation. If successful return 0, else return -1.
  }

  public void cleanup () {
    // Cleanup code.
  }
}

    2. Previous versions of com.ibm.websphere.security.WebSphereBaseTrustAssociationInterceptor include the public int init(String propsfile) method. This method is no longer required becasue the interceptor properties are not read from a file. The properties are now entered with the administrative console (in the Custom Properties section of the interceptor) or with scripts. These properties then are made available to your implementation in the init(Properties) method. However, for backward compatibility, the init(String) method still is supported. The init(String) method is called by the default implementation of init(Properties) as shown in the following example:

      Note: If your custom interceptor implements the init(Properties) method as described previously, you do not need to call the init(String). You can continue to the next step.

      // Default implementation of init(Properties props) method. A Custom
// implementation should override this.
public int init (java.util.Properties props) {
  String type =
    props.getProperty("com.ibm.websphere.security.trustassociation.types");
  String classfile = 
    props.getProperty("com.ibm.websphere.security.trustassociation."
     + type
     + ".config");
  if (classfile != null && classfile.length() > 0 ) {
    return init(classfile);
  } else {
    return -1;
  }
}

      Change your implementation to implement the init(Properties) method instead of the init(String propsfile) method. As shown in the previous example, this default implementation reads the properties to load the property file. To determine the properties file that it must read, the com.ibm.websphere.security.trustassociation.types property appends .config to its value.

      Note: The init(String) method still works if you want to use it instead of implementing the init(Properties) method. The only requirement is that the name of the file that contains the custom trust association properties should now be entered using the Custom Properties link of the interceptor in the administrative console or by using scripts. You can enter the property using either of the following methods. The first method is used for backward compatibility with previous versions of WebSphere Application Server:

      • The same property names used in the previous release are used to obtain the file name. The file name is obtained by concatenating the .config extension to the com.ibm.websphere.security.trustassociation.types property value. If the file name is called myTAI.properties and is located in the /QIBM/UserData/WebASE/ASE5/myInstance/properties directory, set the following properties:

        com.ibm.websphere.security.trustassociation.types = myTAItype 
com.ibm.websphere.security.trustassociation.myTAItype.config =
   /QIBM/UserData/WebASE/ASE5/myInstance/properties/myTAI.properties

      • You can set the com.ibm.websphere.security.trustassociation.initPropsFile property in the trust association custom properties to the location of the file. For example, set the following property:

        com.ibm.websphere.security.trustassociation.initPropsFile=
  /QIBM/UserData/WebASE/ASE5/myInstance/properties/myTAI.properties

      Note: These properties have been wrapped for display purposes. Type them as one continuous line.

    3. Compile the implementation. Make sure that wssec.jar and j2ee.jar are in the compiler class path. These JAR files are located in the /QIBM/ProdData/WebASE/ASE5/lib directory.

    4. Create a classes subdirectory in the /QIBM/UserData/WebASE/ASE5 directory. For example, /QIBM/UserData/WebASE/Base/classes.

    5. Grant read, write, and execute authority (*RWX) to the QEJBSVR user profile. You can use the i5/OS Change Authority (CHGAUT) command, for example:

      CHGAUT OBJ('/QIBM/UserData/WebASE/ASE5/classes') USER(QEJBSVR) DTAAUT(*RWX)

    6. Restart the server.

    7. Use the administrative console to delete the default WebSEAL interceptor and add your custom interceptor. Verify that the class name is dot separated and appears in the class path. For instructions on configuring trust association interceptors, see Configure a trust association interceptor.

    8. Click Custom Properties to add additional properties that are required to initialize the custom interceptor.

    9. Save the configuration.

    10. Stop and restart the application server.