RCDevs WebADM Administrators Guide - Page 1 of 76

The specications and information in this document are subject to change without notice. Companies, names, and data used in examples herein are ctitious unless otherwise noted. This document may not be copied or distributed by any means, in whole or in part, for any reason, without the express written permission of RCDevs. Copyright (c) 2010-2012 RCDevs SARL. All rights reserved. http://www.rcdevs.com/ WebADM and OpenOTP are trademarks of RCDevs. All further trademarks are the property of their respective owners. Limited Warranty No guarantee is given for the correctness of the information contained in this document. Please send any comments or corrections to [email protected].

RCDevs WebADM Administrators Guide - Page 2 of 76

1. Product Documentation! 2. Product Overview! 3. Product Files and Folders! 4. WebADM Components! 4.1. Network Services! 4.1.1. HTTP Server! 4.1.2. SOAP Server! 4.1.3. Session Manager! 4.1.4. PKI Server! 4.1.5. Services Start and Stop! 4.2. Web Portals! 4.2.1. The Administrator Portal! 4.2.2. The WebApps Portal! 4.2.3. The Web Services Portal! 4.3. Web Services! 4.4. WebApps! 4.5. The Manager Interface! 5. Conguration Files! 5.1. Other Congurations! 6. LDAP Management! 6.1. Common LDAP Objects! 6.1.1 User Accounts! 6.1.2. User Groups! 6.1.3. Administrative Accounts! 6.1.4. Containers! 6.2. WebADM Conguration Objects! 6.2.1. WebADM OptionSets! 6.2.2. WebADM MountPoints!

6 6 7 8 8 8 8 9 9 9 9 9 13 14 15 16 17 17 20 20 21 21 22 24 25 26 27 27

RCDevs WebADM Administrators Guide - Page 3 of 76

6.2.3. WebADM LDAP Domains! 6.2.4. WebADM Trust Domains! 6.2.5. WebADM Web Service Clients! 6.2.6. WebADM WebApps and Web Services! 6.3. WebADM-Specic Attributes! 6.3.1. WebADM Settings Attribute! 6.3.2. WebADM Data Attribute! 6.3.3. Password Attribute! 6.3.4. UID Attribute! 6.3.5. Certicate Attribute! 6.3.6. Language Attribute! 6.3.7. Mobile Attribute! 6.3.8. Mail Attribute! 6.3.9. WebADM Cong Type Attribute! 6.4. WebADM LDAP Schema! 6.5. Creating Objects! 6.6. Editing Objects! 6.6.1. The Contextual Action Box! 6.6.2. The Information Box! 6.6.3. The Application Box! 6.6.4. Object Name! 6.6.5. New Attributes! 6.6.6. Extensions! 6.6.7. Attribute List! 6.7. Moving / Copying Objects! 6.8. Exporting / Importing Objects! 6.8.1. LDIF Export / Import! 6.8.2. CSV Import!

27 28 28 28 28 28 29 29 30 30 30 30 31 31 31 32 33 33 34 34 34 35 35 35 36 37 37 38

RCDevs WebADM Administrators Guide - Page 4 of 76

6.9. Searching for Objects! 6.9.1. Batch Search Actions! 7. WebADM OptionSets! 7.1. Administrator Restriction Options! 7.2. LDAP Tree Options! 8. WebADM MountPoints! 9. WebADM LDAP Domains! 10. WebADM Trust Domains! 11. WebADM Web Service Clients! 12. Log Viewer! 12.1. Creating Log Filters! 12.2. Log Display Options! 12.3. Log Result Actions! 12.4. Pruning the Log Database! 13. Localized Messages Editor! 14. Extending the LDAP Schema! 15. Managing User Certicates! 15.1. Rsign PKI Subsystem! 15.2. Rsignd Server! 15.3. Rsign Client! 16. Managing Applications! 16.1. User Application Settings! 17. Using the Manager Interface! 18. Installing WebApps and Web Services! 18.1. Embedding a WebApp! 19. Clustering! 20. Common Issues! Appendix A : Sample webadm.conf le!

39 40 41 41 43 44 46 48 49 51 52 52 53 53 54 54 55 57 57 57 58 59 60 61 62 63 64 65

RCDevs WebADM Administrators Guide - Page 5 of 76

Appendix B : Sample servers.xml le! Appendix C : Sample rsignd.conf le! Appendix D : Sample Manager Interface usage!

69 72 74

RCDevs WebADM Administrators Guide - Page 6 of 76

1. Product Documentation
This document is a conguration guide for RCDevs WebADM. The reader should notice that this document is not a guide for conguring WebADM applications (Web Services and WebApps). Specic application guides are available through the RCDevs online documentation library. WebADM installation and setup is not covered by this guide and is documented in the RCDevs WebADM Installation Guide.

2. Product Overview
WebADM is a powerful Web-based LDAP administration software designed for professionals to manage LDAP Organization resources such as domain users and groups. It is also the conguration interface for RCDevs Web Services and WebApps (end-user applications). WebADM usage is 100% graphical and many features are documented inside the management interface itself. Moreover, WebADM has been built for a maximum simplify of use and its usage is very intuitive. For this reason, not all the features are documented in this guide as they are most of the time self-explaining. WebADM can be used standalone, as a powerful LDAP management interface. It provides a hierarchical view of LDAP Organizations, SQL and le-based audit trails and ultra-rich LDAP object management features. It is the centralized administration interface for all RCDevs Web services and Web applications. It supports domains of users, LDAP groups, multi-level applications policies, web service client applications access control rules... The possibilities for managing your enterprise security are nearly unlimited and WebADMs exibility makes it possible to implement any enterprise security requirement. WebADM is compatible with Novell eDirectory, OpenLDAP, RCDevs Directory Server and Microsoft ActiveDirectory 2003/2008. Other directories might work but are not tested nor supported by RCDevs. WebADM can manage and federate all your organization directories in one single interface. It connects your ActiveDirectory, Novell, OpenLDAP all together and provides hierarchical view, delegated administration and powerful management for your directories. With OpenOTP, it implements your centralized authentication system, working with your existing directories and domains. WebADM understands both Microsoft ActiveDirectory domains and UNIX PAM-LDAP users. You can seamlessly manage both systems from the interface. Better, WebADM can extend your ActiveDirectory users (with POSIX functionalities) so that they work with your PAM-LDAP UNIX systems. WebADM is also the only software which able to unify your Microsoft and UNIX infrastructure. WebADM does not use static LDAP object administration templates. Instead, it is able to read and understand any LDAP directory schema. With this information, it is able to provide dynamic administration interfaces for managing the existing objects with their attributes, and create new ones. To achieve this, WebADM includes a set of objectclass and attribute specications providing information for manipulating specic data types. That means, when you connect a WebADM to a LDAP directory, it will read the LDAP server schemas and will immediately be able to manage the directory objects, without needing specic congurations or new object manipulation templates.

RCDevs WebADM Administrators Guide - Page 7 of 76

WebADM is also able to manipulate Unix, Windows accounts, groups and whatever data your directory is able to store, without additional congurations. WebADM supports delegated administration and ne-grained access control to LDAP resources. Administrators can be created at different levels of the tree structure, with different privileges and views. WebADM includes all the necessary features to create new administrators, assign them quotas or settings, restrict tree access, etc... With Novell eDirectory, WebADM takes advantage on the LDAP built-in permissions (ACLs). Administrators can create new contexts with subadministrators and assign them rights in the limit of their own authorizations, but without compromising the directory security. WebADM can be used as a central management system for multiple LDAP trees. With the OptionSets, it provides a very simple way to assign settings to specic contexts. And, in order to provide even more detailed management policies, the OptionSets work with inheritance, so the settings can be re-dened into sub-contexts, or quota can be afned at sub-tree levels... WebADM uses client certicates as default and recommended authentication mechanism for more security when administering LDAP resources. It includes its own PKI subsystem to create, renew, distribute and revoke user login certicates.

3. Product Files and Folders

Find below the WebADM software installation le structure and important les. /opt/webadm/bin/ : Location for WebADM service binaries and startup scripts. webadm : WebADM executable control script for starting and stopping the server processes. To start WebADM from command line, issue ./webadm start. To stop webADM, issue ./ webadm stop. setup : Initial WebADM setup script run by the self-installer. The setup can be re-run manually at any time. The setup slave command provides slave mode setup for clustered environments. Please look at the WebADM High Availability documentation for details. /opt/webadm/doc/ : Location for WebADM documentation resources. /opt/webadm/doc/scripts/ : This folder contains some useful scripts such as the tool for creating and renewing WebADM SSL certicates. /opt/webadm/conf/ : Location for WebADM conguration les. webadm.conf : Main conguration le. Denes the basic WebADM startup parameters, location of WebADM-specic LDAP containers, WebADM proxy-user account DN, etc... Please look at the Appendix A for an example of webadm.conf le with explanations. objects.xml : XML conguration le that denes the LDAP objects supported by WebADM and their related parameters. You can edit the XML denitions in this le to customize many aspects of the WebADM behavior.

RCDevs WebADM Administrators Guide - Page 8 of 76

servers.xml : XML conguration le that species the server connections for LDAP, SQL, Session Manager, PKI, SMTP and HTTP proxies. Please look at the Appendix B for an example of servers.xml le with explanations. rsignd.conf : PKI server (Rsignd) conguration le. Denes the integrated certicate authority settings and its clients. Please look at the Appendix C for an example of rsignd.conf le with explanations. webadm.env : Some runtime environment variables can be re-dened in this le. Please look at the bin/webadm startup script for the list of variables. /opt/webadm/websrvs/ : Location for WebADM Web Services. Applications are provided with self-installers and are automatically installed in this place. /opt/webadm/webapps/ : Location for WebADM Web Applications. Applications are provided with self-installers and are automatically installed in this place. /opt/webadm/lib/ : Location for WebADM system libraries. /opt/webadm/libexec/ : Location for WebADM system executables. /opt/webadm/logs/ : Location for log les produced by all the WebADM services. /opt/webadm/pki/ : Location for WebADM integrated PKI server les. This folder contains the WebADM CA signing certicate and the services SSL certicates. WebADM automatically checks the conguration les for syntax errors or mistakes and writes any problem discovered in the log le /opt/webadm/logs/httpd.log. WebADM conguration les are documented inline. Please look at the appendixes in this document for the default conguration les with comments.

4. WebADM Components
The WebADM server is composed of several server components and Web Portals, bundled into one unique application. These components include:

4.1. Network Services

4.1.1. HTTP Server
WebADM provides only Web-based user interfaces and includes its own HTTP server which provides the administrator portal, the WebApp portal and a Web Services information portal. By default, all the Web interfaces are running over HTTPS on port 443. The Web server includes a high performance multithreaded caching system which uses shared memory for maximum service responsiveness.

4.1.2. SOAP Server

RCDevs WebADM Administrators Guide - Page 9 of 76

WebADM registered applications provide SOAP/XML interfaces only. The SOAP server component provides the HTTP and HTTPS listeners over which the SOAP/XML interfaces are accessible. By default, the SOAP service is running on HTTP port 8080 and HTTPS port 8443. The SOAP server includes a high performance multithreaded caching system which uses shared memory for maximum service responsiveness.

4.1.3. Session Manager

Most of the WebADM registered applications require storing session data, timers, counters and object locks. The WebADM session manager provides those functionalities in a very high performant and distributed way. Best of all, a cluster of WebADM servers can be bound to one common session manager for operating commonly and having all their work data always synchronized. This ensures the clustered systems are not affected by some kind of replay attacks and are able to handle the failover and load-balancing in the best conditions.

4.1.4. PKI Server

WebADM includes its own PKI system for issuing user certicates. The PKI functionalities are used by the administrator portal and some WebADM applications. For security requirements, the PKI is working in client-server mode and the signing server does not run under the same system user than the other WebADM services. This ensures the Certicate Authority (CA) component cannot be accessed even through a breach in the other components. As for the session manager, a clustered system should use only one PKI server for maintaining the coherence in the certicate serial numbers.

4.1.5. Services Start and Stop

The WebADM startup script (webadm) is located in the bin/ directory. Use the commands webadm start, webadm stop and webadm restart to start, stop or restart the WebADM services. The startup script is responsible for starting and stopping the WebADM HTTP server, the SOAP server, the session manager server and the PKI server. WebADM administration action logs are accessible in the Databases menu in WebADM. System logs are accessible in the logs/httpd.log and logs/soad.log les.

4.2. Web Portals

4.2.1. The Administrator Portal
This portal allows administrators to manage the LDAP objects of the organization, setup and congure WebADM applications. It provides a tree view of the LDAP organization, an object editor and many wizard-based LDAP operations. The administrator portal is accessible at the URL: https://yourserver/.

RCDevs WebADM Administrators Guide - Page 10 of 76

Figure 1. WebADM Admin Portal Login

Figure 2. WebADM Menu

The main Admin Portal menu at top of the page gives instant access to: 1) The Administrator Home Page: This page display a summary of the administrator user details, installed applications, administrative options and tree options for the LDAP login context (see section OptionSets for details). When logging in as a super administrator (see WebADM main conguration le conf/ webadm.conf), and if WebADM is not properly installed, the home page displays the button to access the initial setup wizard.

RCDevs WebADM Administrators Guide - Page 11 of 76

Figure 3. WebADM Home Page

2) The General Information Menu: It displays a list of buttons for getting information concerning the LDAP server and schema, WebADM congurations, registered Domains, MountPoints and applications. It includes buttons for retrieving the Certicate Authority (CA) public certicate and the server SSL certicate, as well as buttons for ushing the WebADM caches.

RCDevs WebADM Administrators Guide - Page 12 of 76

Figure 4. Information Page

3) The Object Creation Menu: It displays a list of object that can be created. The listed objects are those which are specied in the object specications le (conf/objects.xml). See section Creating Objects for details. The rst object of the list is a generic LDAP object used for creating WebADM conguration objects such as MountPoints, OptionSets, Domains, WebApps and Web Services. It includes a drop-down list for selecting one of these object types. 4) The Search Menu: It allows searching for LDAP objects. See section Searching Objects for details.

RCDevs WebADM Administrators Guide - Page 13 of 76

5) The Import Menu: It allows importing LDAP objects in batch using LDIF or CSV le formats. See section Importing Objects for details. 6) The Databases Menu: It displays the list of SQL log tables and application localized message tables. See section Log Viewer and Localized Messages Editor for details. 7) The Application Menu: It displays the list and status of the registered WebADM WebApps and Web Services. 8) The About Menu: It display WebADM version information, changelog and some RCDevs contact email addresses.

Figure 5. About Page

4.2.2. The WebApps Portal

The WebApp portal displays the list of registered applications with the links for directly entering them. This portal is accessible at the URL: https://yourserver/webapps/..

RCDevs WebADM Administrators Guide - Page 14 of 76

Figure 6. WebApps Portal

A WebApp named mywebapp can be accessed directly at the URL: https://yourserver/webapps/ mywebapp. The /webapps/ HTTP location contains all the necessary resources for running a WebApp (meaning stylesheets and image references). That means there exist no references pointing to other locations on the Web server when you access a WebApp. The WebApps URL can also easily the placed behind a reverse-proxy which redirects URLs only for the WebApps location. This can be useful if you want to expose the WebApps over the Internet but not the admin portal. Note that if you run a system with multiple servers, the admin portal can be disabled too in the WebADM main conguration le (conf/webadm.conf).

4.2.3. The Web Services Portal

This portal is only informational and displays the list of registered Web Services with their service descriptions les (WSDL). The Web Services portal is accessible at the URL: https://yourserv/ websrvs/.

RCDevs WebADM Administrators Guide - Page 15 of 76

Figure 7. Web Services Portal

4.3. Web Services

RCDevs solutions (example: OpenOTP) run on top of the WebADM Server. The solutions are generally composed of both Web Services and end-user Web Applications (WebApps). WebADM is a container (application server), which embeds the HTTP and SOAP engines required by Web Services and WebApps. A WebADM Web Service is a pluggable component to be installed (deployed) in WebADM. The Web Services provide nal functionalities such as user authentication services. The Web Services provide: 1) A SOAP XML interface. 2) A WSDL service description le.

RCDevs WebADM Administrators Guide - Page 16 of 76

3) A graphical congurator. You can review the list of registered Web Services and their status in the Application Menu.

Figure 8. Registered Web Services

4.4. WebApps
A WebADM Web Application (WebApp) is a pluggable component to be installed (deployed) in WebADM. WebApps are generally companion application for some Web Services. For example, RCDevs OpenOTP Software Token requires the end users to register their secret Token keys, resynchronize their token application, etc... The Web Applications provide: 1) Some public Web pages. 2) Optional authentication with PKI, or Domain login (depending on the WebApp purpose). 3) A graphical congurator.

RCDevs WebADM Administrators Guide - Page 17 of 76

You can review the list of registered Web Services and their status in the Application Menu.

Figure 9. Registered Web Services

4.5. The Manager Interface

The Manager is a remote procedure call (RPC) interface which provides access to some WebADM user management functions and operations exported by your registered applications. The Manager also allows external systems such as Web portals to remotely trigger user management operations and actions from the network. The Manager interface is accessible at the URL: https://yourserver/manag/. Please look at section 17 for details about the Manager Interface.

5. Conguration Files

RCDevs WebADM Administrators Guide - Page 18 of 76

The conguration les are self-documented. Please read them as part of this documentation. The following settings are part of the main WebADM conguration le (conf/webadm.conf). - auth_mode : WebADM authentication mode can be: - PKI: WebADM requires a client certicate and a login password. - DN: WebADM requires a login DN and a password. - UID: WebADM requires a domain name, a login name and a password. Using certicates is the most secure login method. To use certicate login, you must login WebADM and create a login certicate for your administrators. The UID mode requires a WebADM domain to exist and have its User Search Base set to the subtree where are located the administrator users. When using UID and if there is no domain existing in WebADM, the login mode is automatically forced to DN. You will also need to login with the the full user DN and setup a WebADM domain to be able to use the UID login mode. - list_domains : Show the domain list in a drop-down list in when auth_mode is set to UID. - proxy_user : The proxy user is used by WebADM for accessing LDAP objects over which the administrator user does not have read permissions, or to access the LDAP resources out of an administrator session. The proxy user should have read permissions on the whole LDAP tree, and write permissions on the users and groups used by the WebApps and Web Services. A well congured proxy user is mandatory for WebADM to work correctly. With Microsoft ActiveDirectory, you must add the proxy user to the Domain Admins group. Be sure to respect your directory password complexity policy for the proxy user password and to have the SSL enabled. Else, WebADM will not be able to create the proxy user during the graphical setup. - super_admins : Super administrators have extended WebADM privileges such as setup permissions, additional operations and unlimited access to any LDAP encrypted data. Access restriction congured in the WebADM OptionSets do not apply to super admins. You can set a list of individual LDAP users or LDAP groups here. With ActiveDirectory, your default administrator account should be is something like cn=Administrator,cn=Users,dc=mydomain,dc=com. And you can replace the sample super_admins group on the second line with an existing security group. - other_admins : Any other WebADM administrator must be dened in the other_admins to be able to login. You can set access restrictions for other admins in WebADM OptionSets. You can set a list of individual LDAP users or LDAP groups. You can comment the setting not to use other administrators. With ActiveDirectory, you can use another existing security group here. - container_oclasses : List of LDAP objectclasses to be considered by WebADM as LDAP containers. - user_oclasses : List of LDAP objectclasses to be considered by WebADM as LDAP users. user_oclasses is used to build the LDAP search lter when auth_mode is set to Domain. If your super administrator user does not have one of these objectclasses, then be sure to add one of its objectclasses to the list.

RCDevs WebADM Administrators Guide - Page 19 of 76

- group_oclasses : List of LDAP objectclasses to be considered by WebADM as LDAP groups. - webadm_account_oclasses : List of LDAP objectclasses (extensions) to be considered by WebADM as WebADM account objects. WebADM accounts are usable by Web Services and WebApps. Note: With ActiveDirectory 2003, you need to add the 'user' objectclass to the webadm_account_oclasses. - webadm_group_oclasses : List of LDAP objectclasses (extensions) to be considered by WebADM as LDAP groups with WebADM settings. Group settings are usable by Web Services and WebApps. Note : With ActiveDirectory 2003 only, you need to add the 'user' objectclass to the 'group' objectclass to the webadm_group_oclasses. - webadm_cong_oclasses : List of LDAP objectclasses to be considered as WebADM conguration objects. - ignored_attrs : List of LDAP attributes to be ignored by WebADM when crating or copying objects. This is a requirement for managing Microsoft ActiveDirectory users and groups. - optionsets_container, webapps_container, websrvs_container, domains_container, clients_container : WebADM containers required by WebADM for storing conguration objects. You have to change the container locations to match your LDAP tree base and constraints. - tmp_dir : Temporary WebADM work directory. - session_timeout : You can set here the timeout (in seconds) of a WebADM session. Sessions will be closed after this period of inactivity. - cache_timeout : You can set here the WebADM internal cache timeout. - time_zone : The timezone is required for the logs and for some applications such as OpenOTP Time-based Tokens. You can nd here the list of time zones: http://www.php.net/manual/en/ timezones.php. Else look at the docs/timezones.txt for the list of time zones. - languages : List of languages to be supported by your WebADM applications. The languages are used by the WebADM localized messages editor and for editing LDAP language attributes. - encrypt_data : Set to Yes if you want WebADM to encrypt LDAP sensitive data such as passwords, keys and session manager sessions with the AES-256 algorithm. - encrypt_key : This is the encryption key. The key must be a 256bit base64-encoded random binary data. Use the command openssl rand -base64 32 to generate a new key. Important: If you change the encryption key, any encrypted data will become invalid! - group_mode : The group mode denes how WebADM will handle LDAP groups. - direct mode: WebADM nds user groups using the memberof_attrs dened above. In this case, the group membership is dened in the LDAP user objects. - indirect mode: WebADM nds user groups by searching group objects which contain the user DN as part of the member_attrs. By default (when group_mode is not specied) WebADM handles both group modes.

RCDevs WebADM Administrators Guide - Page 20 of 76

- enable_admin, enable_webapps, enable_websrvs, enable_manager : You can optionally disable main WebADM features if you run multiple WebADM servers with different purposes. For example, if you dont want to provide the Administrator Portal on an Internet-exposed WebApps and Web Services server. By default, all the functionalities are enabled. - log_webapps : Enables extended logging to the httpd.log for WebApps. Extended logging is enabled by default. - log_websrvs : Enables extended logging to the soapd.log for Web Services. Extended logging is enabled by default. - check_versions : Enables WebADM versions checking. WebADM will check for new versions for itself and for all the registered applications. - alert_email : Email recipient address used by WebADM for sending system alerts. - webapps_theme : WebApps theme for WebApps. Only the default theme is available.

5.1. Other Congurations

You can create a webadm.env le in the WebADM conf/ directory to modify some internal congurations such port numbers and listen interface. You can change the following variables: - INTERFACE : Denes the network IP address to listen on. The default is 0.0.0.0 (any interface). - HTTP_PORT : Denes the HTTP port over SSL used for the Admin Portal and WebApps. The default port is 443. - SOAP_PORT_STD : Dened the SOAP port in cleartext to be used for Web Services. The default port is 8080. - SOAP_PORT_SSL : Dened the SOAP port over SSL to be used for Web Services. The default port is 8443. - MEM_SIZE : Denes the memory size in megabytes to be allocated to the session manager. The default size is 256 Mo. The format for the webadm.env le is :
INTERFACE=0.0.0.0 HTTP_PORT=443 SOAP_PORT_STD=8080 SOAP_PORT_SSL=8443 MEM_SIZE=256

6. LDAP Management

RCDevs WebADM Administrators Guide - Page 21 of 76

With WebADM, administrators can create and edit LDAP users, groups and other objects. Administrators can also extend existing LDAP users or groups with WebADM functionalities.

6.1. Common LDAP Objects

6.1.1 User Accounts
User accounts are LDAP standard user objects. WebADM considers a user account is an object containing at least one objectclass from the user_oclasses list in the WebADM main conguration le (conf/webadm.conf).

Figure 10. User Objects

WebADM provides its own user account schema named webadmAccount. The webadmAccount schema provides additional attributes, such as the webadmSettings, or webadmData for normal users and groups. These attributes are required by the registered Web Services and WebApps to store user-specic settings and user metadata. The webadmAccount objectclass is a LDAP extension class and cannot be created standalone. It must be used together with a structural user objectclass. WebADM considers a WebADM account is an object containing at least one objectclass from the webadm_account_oclasses list in the WebADM main conguration le (conf/webadm.conf). In Figure 10, WebADM Account is a LDAP user object with the webadmAccount extension. WebADM can create standalone users, or extend existing users by adding new objectclasses to the user object. See section Extending Objects for details. The LDAP attribute corresponding to the login name (i.e. RADIUS user name used for VPN logins) depends on the WebADM congurations. It can be the object name (CN) as well as the UID attribute, sAMAccountName, userPrincipalName, the mobile number, or anything else. WebADM just needs to know what attributes can be used for the logins. This is adjustable in the objects specication le (conf/objects.xml). By default, the user name is the UID LDAP attribute. WebADM accounts can contain several application settings. The list of available settings depends on the registered applications and the scope of the settings. Any Public or LDAP application setting can be set at the user or group level. WebADM and its applications use LDAP binds for static password checking. That means that the user objects must be combined with a bindable objectclass and must have their LDAP password set. Important: To be used by the Web Services and WebApps, a LDAP user must be a WebADM account. WebADM user accounts are those containing the webadmAccount LDAP objectclass. You can enable the WebADM features on any existing LDAP user by extending it with the webadmAccount extension (with the object extension action in the object editor).

RCDevs WebADM Administrators Guide - Page 22 of 76

You can assign WebADM settings to LDAP groups (instead of users) by extending the groups with the webadmGroup extension. Like with users this is done with the object extension action in the object editor.

6.1.2. User Groups

User groups are LDAP object that contains a list of LDAP members, each representing the Distinguished Name (DN) of the user object belonging to the group. WebADM considers a group is an object containing at least one objectclass from the group_oclasses list in the WebADM main conguration le (conf/webadm.conf).

Figure 11. Group Objects

Groups are often used for access purposes. Members of a particular group are allowed to access different services than members of another. Groups are also used for storing application settings common to all group members. This often reduces the overhead in managing settings stored in user accounts. In that case, the groups must be extended with the webadmGroup objectclass. WebADM supports two methods to assign users to groups: 1) Using group membership: The user account includes a groupmemership (such as memberOf) attribute specifying which group DNs it belongs to.

Figure 5. Group Membership User Attribute

2) Using group members: The group object includes a member list containing the user DN.

Figure 6. Group Member Attribute

WebADM provides two ways to dene groups: 1. Static groups. The group member list is statically dened and updated manually.

RCDevs WebADM Administrators Guide - Page 23 of 76

Figure 12. Static Group

2. Dynamic groups. The group member list is dened as a dynamic LDAP query (Dynamic Member Query). The member list is computed at runtime when the group members are queried. Dynamic groups require a Dynamic Group Query Identity attribute which defines the user account DN to be used internally by Novell eDirectory, for performing the ldap searches needed for looking up the dynamic group members. You can assign WebADM settings to LDAP groups (instead of users) by extending the groups with the webadmGroup extension. Like with users this is done with the object extension action in the object editor. Note about group settings: User groups and group settings are cached for 5 minutes in order to optimize group searches and user setting resolutions. This has the side effect that user groups and group settings' changes may be delayed for a maximum time of 5 minutes when used by WebApps and Web Services.

RCDevs WebADM Administrators Guide - Page 24 of 76

Figure 13. Dynamic Group

WebADM provides administration pages to dene dynamic queries and check their content. Note : Dynamic groups are supported on Novell eDirectory and RCDevs Directory Server only.

6.1.3. Administrative Accounts

WebADM considers any bindable LDAP user object with write permissions to LDAP contexts is an administrator. An administrator can create or edit LDAP objects, create new contexts with subadministrators, and assign permissions in the boundaries of his own restrictions. It is possible to assign restrictions to administrators using the WebADM OptionSets.

Permissions
By default, a newly created administrator has no write permissions. - With Novell eDirectory, write permissions must be created by adding permission attributes (ACL) to LDAP contexts. You can use the Add Permissions action when editing a container object to create new permissions.

RCDevs WebADM Administrators Guide - Page 25 of 76

Figure 14. LDAP Permissions (ACL) Attribute

- With Microsoft ActiveDirectory, the user must be added to an administrative group. - With OpenLDAP, the user permissions must be added in the OpenLDAP server conguration le (slapd.conf). By default, a user does not have any other rights than read access on himself. He is able to manage his own user data, change his password or renew his own certicates. If another administrator creates context permissions for him, he becomes an administrator in these contexts.

Certicates
WebADM supports certicate-based authentication for a simpler and more secure access to the Administration Portal and WebApps. It provides the necessary pages and actions to easily manage administrator certicates. Supported operations are certicate creation, deletion, renewal, download. Certicate-based authentication is highly recommended when using delegated administration and especially when using WebADM for remote administration over the Internet. It adds another level of security while authorizing the administrator's sessions at the web server's level. WebADM provides a wizard to create a new administrator certicate and parameters allow to set the type and validity time for the new certicates. See the Managing Certicates section for details. An administrator is able to renew, remove or add new certicates for other users he manages or for himself.

Figure 15. User Certicate Attribute

The WebADM internal PKI (Rsign) is the default certicate management system. However, it is also possible to use an external Certicate Authority (CA). In that case, WebADM will issue certicate signing requests (CSR) and ask for external signing. Note that any bindable object is able to log into WebADM. That means any user object with a bind password and a login certicate is able to enter WebADM. To prevent normal users from logging in WebADM, use the certicate-based login instead of the Domain or DN login modes. Then, only administrators owning a valid administrator certicate can login.

6.1.4. Containers

RCDevs WebADM Administrators Guide - Page 26 of 76

LDAP containers (or contexts) are objects, which can contain child objects. WebADM considers a container is an object containing at least one objectclass from the container_oclasses list in the WebADM main conguration le (conf/webadm.conf). Common containers are Organizations, Organizational Units, Countries, Locations, Domains, etc... When WebADM is used to manage a lot of users, it is highly recommended to structure the LDAP tree with containers in order to reduce the number of child objects within one container.

Figure 16. Container Objects

An administrator can assign LDAP permissions and OptionSets on containers.

6.2. WebADM Conguration Objects

Conguration objects are WebADM-specic LDAP objects that are used by WebADM for storing persistent congurations in LDAP. WebADM considers a LDAP conguration object is an object containing at least one objectclass from the webadm_cong_oclasses list in the WebADM main conguration le (conf/webadm.conf). The type of the conguration object is determined by the webadmCong attribute which can be either Domain, Trust, Client, OptionSet, MountPoint, WebApp or WebSrv.

Figure 17. Conguration Objects

WebADM creates a set of LDAP containers and objects during its setup for storing WebADM Domains, OptionSets, MountPoints, Web Services and WebApps congurations. The LDAP locations for these objects are dened in the main WebADM conguration le (conf/webadm.conf). This tree structure is mandatory for WebADM to operate correctly.

RCDevs WebADM Administrators Guide - Page 27 of 76

Figure 18. WebADM Tree Structure

6.2.1. WebADM OptionSets

Some WebADM administrator restrictions or tree options can be assigned to specic LDAP contexts using WebADM OptionSets. OptionSets are essentially LDAP proles that can be used for example to dene LDAP settings specic to some subset of a LDAP tree. Option sets can for example be used for creating Organization proles that specify the default LDAP attributes that each member of the organization inherit. See section WebADM OptionSets for details. All OptionSets must be stored in the same container (as specied in the WebADM main conguration le) to be read by WebADM at start-up.

6.2.2. WebADM MountPoints

MountPoints are containers in the LDAP tree that include objects and child containers (i.e. the entire tree structure) from another LDAP server. The objects are not physically present in tree structure. Instead, WebADM connects at a runtime to an external LDAP and renders its contents as if the data were stored in the mounted context. See section WebADM MountPoints for details. All MountPoints objects must be stored in the same container (as specied in the WebADM main conguration le) to be read by WebADM at start-up.

6.2.3. WebADM LDAP Domains

All the WebADM applications identify a user with a username, a password and a domain name. The domain objects establish the relationship between a domain name and a LDAP tree base. Also, when an application wants to obtain a LDAP user DN corresponding to the provided login information, it will use the domain tree base to build the LDAP search. See section WebADM Domains for details. All Domains objects must be stored in the same container (as specied in the WebADM main conguration le) to be read by WebADM at start-up.

RCDevs WebADM Administrators Guide - Page 28 of 76

6.2.4. WebADM Trust Domains

Trusts are special domain objects which do not correspond to a set of local LDAP users but to a remote WebADM installations domain. The trust system works like a web service proxy for remote domains (within a trusted organization) and maps a local virtual domain name to a remote domain on another WebADM server. Trusts work with all web services (OpenOTP, OpenSSO, SMSHub...). 6.2.5. WebADM Web Service Clients Web Services Clients provide configuration of client applications access control and setting policies. The client objects are also used to customize the behavior of a Web Service client application (ex. a VPN server using OpenOTP Authentication Server). You can now create a client object having the name of a Web Service client ID. For example, you use the client names as displayed in the WebADM log viewer for the client object names. When a client is defined, any request from the corresponding client application (ex. a VPN server with matching client ID), will obey to the defined client policy. For a client, you can restrict users able to use the client application with allowed and excluded group lists. And you can define some Web Service settings which will always be enforced for the client. For example, you want the VPN to authenticate users with LDAP+OTP passwords and Token, whatever policy is defined for the user.

6.2.6. WebADM WebApps and Web Services

These objects are used by WebADM to store registered application congurations. When you register a new application in WebADM, it creates a LDAP object. You can access the application conguration either by editing the application LDAP object or using the Applications menu in WebADM. All WebApp and Web Service conguration objects must be stored in the same container (as specied in the WebADM main conguration le) to be read by WebADM at start-up.

6.3. WebADM-Specic Attributes

WebADM schema (see section WebADM LDAP Schema for details) provides two additional objectclasses : webadmAccount and webadmCong. LDAP objects extended or created with the webadmAccount and webadmGroup objectclass support the following new attributes.

6.3.1. WebADM Settings Attribute

This attribute is used to store user-specic application settings inside the user or group objects. The object settings have priority over the default application settings for the registered WebADM applications.

RCDevs WebADM Administrators Guide - Page 29 of 76

Figure 19. webadmSetting Attribute

The WebADM user setting editor displays a drop-down list containing the registered applications. Select an application and the list of corresponding settings is displayed and available for conguration.

6.3.2. WebADM Data Attribute

This attribute is used by the WebADM applications to store user data such as Token keys. The WebADM user data editor displays all the data stored by the applications and allows raw edition of the data.

Figure 20. webadmData Attribute

The webadmData contents are encrypted in the LDAP using an AES-256 key which is congured in the WebADM main conguration le (conf/webadm.conf). Only the super administrators and the users themselves are able to read this attribute unencrypted. They can edit the data values with the data editor. Important: The webadmData encryption uses the LDAP DN together with the encryption key. This is a security mechanism to prevent the same data values from two different users to be encrypted identically. When a user is copied, WebADM handles the re-encryption automatically. But if you export the user in an LDAF le, and re-import it at another location, the webadmData are lost.

6.3.3. Password Attribute

Any bindable LDAP object must have its password attribute set. Password attributes are dened by the password_attrs setting in the WebADM main conguration le (conf/webadm.conf). The password encoding and format depends on the LDAP directory type. The encoding and encryption format of passwords is dened in the objects specication le (conf/objects.xml). Administrators can change user passwords with the Change password action in the object editor.

RCDevs WebADM Administrators Guide - Page 30 of 76

Figure 21. Changing User Password

6.3.4. UID Attribute

WebADM allows specifying multiple attributes to be used as login attributes. Login attributes are dened by the uid_attrs setting in the WebADM main conguration le (conf/webadm.conf). When a user logs in a WebApp or a Web Service, he enters his login name, domain and password. WebADM computes the LDAP tree base using the information stored in the Domain conguration object and searches for objects of type webadm_account_oclasses, having one uid_attrs corresponding to the provided login name. Then WebADM binds the LDAP directory with the user DN and the provided password. The same system is used when WebADM Administrator Portal is congured in Domain login mode. But in that case, WebADM will search for any user object of type user_oclasses, having one uid_attrs corresponding to the provided login name.

6.3.5. Certicate Attribute

WebADM uses this attribute to store user certicates in the LDAP accounts. Note that the private keys are never stored in this attribute. Certicate attributes are dened by the certicate_attrs setting in the WebADM main conguration le (conf/webadm.conf). WebADM supports storing user certicates in both binary and base64 encoding. The encoding is specied in the objects specication le (conf/objects.xml).

6.3.6. Language Attribute

This attribute is used by the WebADM applications to query the user language. When application messages are localized in several languages (with the WebADM Localized Message Editor), the applications will automatically select the massage corresponding to the user language.

Figure 22. preferredLanguage Attribute

6.3.7. Mobile Attribute

This attributes stores the user mobile phone number. It is used by some WebADM applications.

RCDevs WebADM Administrators Guide - Page 31 of 76

Figure 23. mobile Attribute

6.3.8. Mail Attribute

This attributes stores the user email address. It is used by some WebADM applications.

Figure 24. mail Attribute

6.3.9. WebADM Cong Type Attribute

This attribute is used by WebADM to assign a role to a webadmCong object (examples of WebADM types are Domain, Trust, OptionSet, MountPoint, Client, WebApp or WebSrv).

Figure 25. webadmType Attribute

6.4. WebADM LDAP Schema

The WebADM LDAP schema extension provides two additional objectclasses: webadmAccount and webadmCong. See the gure below for the schema detail.

Figure 26. WebADM Schema

The new LDAP schema entries are automatically registered in the LDAP server schema by the WebADM setup.

RCDevs WebADM Administrators Guide - Page 32 of 76

6.5. Creating Objects

With WebADM, you can create any object type dened in the objects specication le (conf/ objects.xml). Yet, if the object is not present in the LDAP schema, it is ignored. The objects specication le denes additional information used by WebADM about the object types and their capabilities. It denes what administrative level is required by an administrator to create an object, the additional objectclasses to be merged during creation and the available extension classes. Administrative levels are used to setup level-based object creation restrictions. They are used to control what objects can be created by administrators belonging to a given context. An object specication also includes the minimum administrative level required for the object to be created. The auxclasses in the object specication is used to consider a set of objectclasses as a single WebADM object type. It is mandatory for certain object types such as WebADM accounts because the webadmAccount objectclass is an LDAP extension class. That means, it is cannot created standalone and must be associated with a structural objectclass which denes other LDAP attributes. The extensions denes the objectclasses with which the object can be extended. For example an objectclass corresponding to existing user objects should be extendable with the webadmAccount objectclass to allow adding WebADM features and settings to existing users. Objects can be created either from the top menu Create button or directly from the Create button within a context in the LDAP tree. The creation forms will depend on the OptionSets applying on the creation context and on the LDAP schemas corresponding the to the new object DN in case of MountPoint.

Figure 27. Create Object List

RCDevs WebADM Administrators Guide - Page 33 of 76

The object creation forms are computed dynamically by querying the LDAP schema for the objectclass and auxclasses, associated attributes and they constraints. They display all the mandatory attributes (merged from all objectclasses) and the optional attributes to be created. Note that only those optional attributes congured in the attribute specications of the WebADM objects specication le (conf/objects.xml) are displayed. This is a display simplication not to show all the merged optional attribute list which can be very long depending on your LDAP. Some attribute values can be auto-lled if default values are dened in the OptionSets which apply on the object creation context.

Figure 28. Create Object Form

The creation wizard includes a WebADM Config Object item (with a drop-down list) in the new objects list. This kind of object corresponds to WebADM configuration objects such as Domains, MountPoints, OptionSets, WebApps or WebSrvs.

6.6. Editing Objects

The object editor displays useful informations about the object, a list of actions to be performed and the list of attributes contained by the object.

6.6.1. The Contextual Action Box

The action box is displayed at the top left of the edition page. It contains a list of actions to be performed on the object such as deletion, copy, LDIF export, child creation, add permissions, issue certicate... It includes a button to change the user password if the object is usable for LDAP binds. When the edited object is a container containing child objects, copy, delete and export operation can be performed recursively. A button allows switching to advanced edition mode. By default, the edition form does not display all the object attributes nor all the edition capabilities or attribute list. It displays all the mandatory attributes but only the optional attributes which are dened in the in the objects specication le (conf/objects.xml). And the behavior is the same for extension classes list and new attributes list. If required, you can at any moment switch to advanced mode for extended display and capabilities.

RCDevs WebADM Administrators Guide - Page 34 of 76

Figure 29. Action Box

6.6.2. The Information Box

The object informational box is displayed at the top middle of the edition page. It displays useful information for the object such as unicity check, WebADM settings, data summary, etc... If some attributes are dened as unique within a specic context, WebADM check the unicity and display the result and the list of checked attributes in this box. If attributes have to be unique, this must be set in the objects specication le (conf/objects.xml).

Figure 30. Information Box

6.6.3. The Application Box

This box is displayed at the top right of the edition page (only when application are registered). All the registered applications can specify some additional actions to be performed by WebADM administrators as part of the user management. Those actions are generally accessible in this box (for the administrators) and through the SelfDesk WebApp (for the end-users).

Figure 31. Application Box

6.6.4. Object Name

RCDevs WebADM Administrators Guide - Page 35 of 76

The object name is the value of the LDAP naming attribute for the object. You can change the object name by typing a new name and using the rename button. Generally, the naming attribute is the object Common Name (CN). Note: You cannot rename a container object which already contains child objects. But you can recursively copy the container to a new one (with another name).

Figure 32. Rename Object

6.6.5. New Attributes

The Add Attrisbute button allows adding optional attributes supported by any of the objectclasses composing the object.

Figure 33. Add Attribute

6.6.6. Extensions
The Add Extension button allows adding new compatible objectclasses to the object. When adding an extension, a wizard will ask for the new mandatory attributes and the optional attributes which are dened in the objects specication le (conf/objects.xml).

Figure 34. Add Extensions

To see the list of objectclasses in an object, switch to advanced edition mode. You can remove an extension objectclass from a LDAP object by switching to advanced edition mode, checking the objectclass checkbox (in the objectclass attribute list), and clicking the Apply Changes / Delete Selected button. The objectclass removal will also remove the objectclass and all the attributes that are not part of any of the remaining objectclasses.

Figure 35. Remove Objectclass

6.6.7. Attribute List

RCDevs WebADM Administrators Guide - Page 36 of 76

The attribute list displays the attributes which have a value dened in the object. Note that only the attributes dened in the objects specication le (conf/objects.xml) are displayed by default. This is a display simplication to ease the use of WebADM but you can display all the attributes by switching to the advanced edition mode.

Figure 36. Object Attribute List

Some action buttons appear under the attribute name such as add values or delete attribute. These actions are determined upon the attribute constraints in the LDAP schema. For example, if an attribute is optional, then you can delete it, and if an attribute can have multiple values, then you can add values or delete some of them. The attribute value display is dynamically rendered using WebADM attribute type templates (called WebADM attribute handlers). A set of default templates is already dened to display simple data types such as booleans, texts or members as well as complex data types such as certicates, permissions or WebADM-specic data. After modifying one or several attribute values, you must commit the changes with the Apply Changes / Delete Selected button at the bottom of the page. Yet, some special attributes call specic modication pages, which should update the attribute values themselves. This is the case for member lists, permissions, WebADM settings, WebADM data, etc... When an attribute has multiple values and you want to remove some of them, just select them on the right of the value and click he Apply Changes / Delete Selected button at the bottom of the page.

6.7. Moving / Copying Objects

RCDevs WebADM Administrators Guide - Page 37 of 76

WebADM does not provide actions for moving objects. The objects to be moved must be copied and then the original object should be deleted. To copy from a LDAP server to another, objects can be exported, modied and then re-imported using LDIF. Copy operations must respect the quotas dened in the OptionSets if you have quotas enabled. So ensure the copy will not reach your quotas before copying. It is not recommended to move administrator objects when using certicate-based authentication. Or his certicates must be re-created after moving because the administrator's login DN is part of the certicate data. Password attributes are invalidated after a copy or import on Novell eDirectory and Microsoft ActiveDirectory. User passwords must also be reset after a copy. WebADM data inside LDAP objects are encrypted with an AES-256 key and the object DN. The copy action will handle the re-encryption automatically. Yet, an export followed by a re-import at a different place will invalidate the encrypted data.

6.8. Exporting / Importing Objects

6.8.1. LDIF Export / Import
WebADM is able to export and import LDAP objects using LDIF les. When editing an object, it is possible to export it or its whole content.

Figure 37. LDIF Import Form

When importing an LDIF le, WebADM operates in two passes: 1) The rst pass creates the objects and all their mandatory attributes. 2) The second pass adds the optional attributes. It is not always possible to create objects in one step because some attribute values may include references to other objects that do not exist at creation time (if the are listed later in the LDIF le). It would not respect the directory integrity and would make it impossible to create some objects. Permissions or group members are some good examples.

RCDevs WebADM Administrators Guide - Page 38 of 76

WebADM allows to export, delete and re-import a subtree with its administrators, permissions and object references by using the two-passes import mechanism.

Figure 38. LDIF Import

With Novell eDirectory and Microsoft ActiveDirectory, the user passwords cannot be restored at import. The password also have to be reset after the import. For super-administrators, it is possible to export LDAD encrypted attributes (such as webadmData) unencrypted. By default, the LDIF export contains the raw data as stored in the LDAP directory (with encrypted data). Exporting unencrypted data can be useful for backing up your LDAP users and data. Note: The WebADM LDAP encryption depends on the objects DN. If you export users and then reimport them in another location, any encrypted data will be lost. You can used the unencrypted export/import for this purpose.

6.8.2. CSV Import

WebADM provides a method for creating large number of objects of the same type in one single step. The CSV Import feature allows importing a le containing raw object data. The import page asks for the objects type to be created and the creation context. The import le must be structured that way: - The rst line must contain the attribute names corresponding to the values appearing in the same column in the next lines. - The next lines must contain the attribute values for the imported object type. And all the mandatory attributes for the specied object type must be present. - The naming attribute must be the rst one listed. - Fields must be separated by commas.

RCDevs WebADM Administrators Guide - Page 39 of 76

Figure 39. CSV Import Form

6.9. Searching for Objects

WebADM search system provides a simple interface to look for objects based on criteria. It woks in two modes: - The simple search mode allows to select an attribute, a search criteria and the data to be searched.

Figure 40. Simple Search

- The advanced search mode provides more detailed searching. You can select the search context and scope, edit the search lter (manually or using the search lter editor) and dene what attributes should be searched and displayed.

RCDevs WebADM Administrators Guide - Page 40 of 76

Figure 41. Advanced Search

The list of attributes to be searched in simple mode as well as the attributes to be displayed in the results are congurable in the objects specication le (conf/objects.xml).

6.9.1. Batch Search Actions

WebADM allows performing batch actions on the resulting entries of a search. The actions that are supported are : - Adding webadmAccount objectclass to users. - Adding objects to groups. - Removing objects from groups. - Setting LDAP attributes. - Adding LDAP attribute values. - Setting WebADM applications Settings. - Removing objects. The syntaxes and details for each batch action are displayed in the batch actions wizard.

RCDevs WebADM Administrators Guide - Page 41 of 76

Figure 42. Batch Search Actions

7. WebADM OptionSets
Some administrative restrictions and tree options can be assigned to specic LDAP contexts using WebADM OptionSets. OptionSets are essentially LDAP proles that can be used for example to dene LDAP settings specic to some subset of a LDAP tree. OptionSets can for example be used for creating Organization proles that specify behavior and restrictions that each member of the organization inherit. Option sets are used by WebADM Administrator Portal only, and do not impact the Web Services or WebApps. When several OptionSets are dened for the same context (even at different level of the LDAP tree), the options are inherited from the upper tree down to the current context. All OptionSets must be stored in the same container as specied in the WebADM main conguration le (conf/webadm.conf) to be read by WebADM at session startup. The OptionSet is congured with a LDAP DN which corresponds to the scope of application for the options listed hereafter.

7.1. Administrator Restriction Options

Administrator restrictions are options which concern the administrators only and are computed at login time. The scope of application of the options is also the login contexts of the administrators. For example if you create an OptionSet with a LDAP DN set to o=Mycompany and an Administrative Level set to 1. Then all the administrators having their login DN located under o=Mycompany will have an Administrative Level of 1 all along their session.

RCDevs WebADM Administrators Guide - Page 42 of 76

Figure 43. Administrator Restrictions

- Certicate Signing Method : Determines how WebADM will issue X.509 certicates. The available signing methods are: a. Rsign, where WebADM uses its internal PKI subsystem to sign certicates. b. Ext, where WebADM uses HTML forms for copy-pasting data from an external Certication Authority (CA). c. Off, where certicate signing is not allowed.

RCDevs WebADM Administrators Guide - Page 43 of 76

- Login Certicates Revocations : Denes if WebADM should query the administrator's account at login for a list of valid user certicates and check if the provided one is present in the account. When revocation is disabled, WebADM trusts the web server client certicate access control mechanism and uses the common name (present in the certicate) and provided password to bind the directory. WebADM does not try to nd the provided certicate in the administrator's account. This is the default behavior. When revocation is enabled, and if the certicate in the administrator's account has been removed, it is not usable anymore. Otherwise the certicate, even if removed from the list, is still usable as long as it has not expired. - Tree Base : Set the tree base limit for the administrators. This option is used to limit the access when using OpenLDAP and Microsoft ActiveDirectory. With Novell eDirectory, the tree access limitations are provided by the LDAP permissions (ACL) on the containers. The tree base option prevents administrators from accessing any object out of the specied tree base and reduces the tree view accordingly too. - Administrative Level : This option is used to control which objects, the administrators belonging to a given context can create. Objects to be listed in the creation pages are those dened in the objects specication le (conf/objects.xml). And each object specication is dened with the minimum administrative level required for the object to created. The current administrative level is displayed on the WebADM home page. The default administrative level is level 3 (maximum). - Decrypted User Data : By default in WebADM, Super Administrators can access the encrypted user data (ex. OpenOTP user data) in cleartext (unencrypted) and Other Administrators can only access the user data in their encrypted form. They can also manipulate LDAP objects including data but they can never see the sensitive user data in their unencrypted form. Enable this option if you want Other Administrators to have full (unencrypted) access to the user data. - Allowed SQL Tables : Defines which SQL Log and localized message tables are accessible by the administrators. Note: This option does not apply for super administrators. - Read-Only SQL Tables : Defines which SQL log and localized message tables are accessible in read-only mode by the administrators. Note: This option does not apply for super administrators. - Allowed LDAP MountPoints : Defines which mounted LDAP trees are accessible by the administrators. Note: This option does not apply for super administrators. - Allowed-Only WebApps / WebSrvs : Defines which applications are configurable by the administrators. Note: This option does not apply for super administrators.

7.2. LDAP Tree Options

Unlike the administrative options described before, the tree options concern the managed LDAP objects and are computed in realtime when administrators manipulate objects. The scope of application of the options is also the location of the object being managed. For example if you create an OptionSet with a Tree DN set to o=Mycompany and a LDAP Quota set to 100. Then all the administrators cannot create more than 100 objects under o=Mycompany.

RCDevs WebADM Administrators Guide - Page 44 of 76

Figure 44. Tree Options

- LDAP Quotas : Denes the maximum amount of LDAP objects within a context that can be created by the administrators. When quotas are dened at several tree levels, WebADM enforces the quotas from the current context to the root level. In other words, if you have dened a quota of 10 objects for context o=MyCompany, then its sub-contexts (such as ou=Sales, ou=Marketing) are only allowed to have a maximum of 10 accounts in total, whatever is dened at the sublevels. Use the Details buttons in the tree view to review the quota chain applying on a context. - Unicity Context : Denes the LDAP tree base to be used by WebADM for checking unique users attributes. Unique attributes are dened in the objects specication le (conf/objects.xml). The unicity context is used for other things too, such as the counting base for determining free UID numbers for POSIX accounts. - LDAP Defaults : List of default attribute values which will be auto-lled when creating or extending objects.

8. WebADM MountPoints
MountPoints are containers in the LDAP tree that include objects and child containers (i.e. the entire tree structure) from another LDAP server. The objects are not physically present in the main tree structure. Instead, WebADM connects at runtime to an external LDAP and renders its contents as if the data were stored in the mounting context. MountPoints are LDAP objects that hold LDAP connection parameters. WebADM connects to a remote LDAP using these parameters. Once connected, WebADM retrieves the remote LDAP tree structure and renders it on the main tree. The rendering location, or namely the mounting point, is specied inside the MountPoint object. All MountPoints must be stored in the same container (specied in the WebADM conguration le) to be read by WebADM at start-up.

RCDevs WebADM Administrators Guide - Page 45 of 76

WebADM provides a virtual DN notation for accessing objects in mounted LDAP trees. This notation concatenates the MountPoint DN (of the main LDAP) with the real DN in the mounted LDAP, and works with all the pages having DN inputs. You can check the virtual DN when editing an object in a mounted LDAP. The MountPoint supports the following settings: - Mount DN : The local LDAP tree node where the mounted LDAP tree should be mounted. - Host Name : The host name or IP address of the mounted LDAP server. - Port Number : The LDAP port number of the mounted LDAP server. - Connection Type : The connection type used to connect the mounted LDAP server. Allowed connection types are None (no encryption), SSL and TSL. - Tree Base : The tree base on the mounted LDAP server. - Login DN : The DN used to bind the mounted LDAP server. This account must have write permissions on the mounted LDAP server. - Login Password : The password corresponding to the login DN. - Client Certificate File : The client certificate if the mounted LDAP server requires certificatebased client authentication. - Client Certificate Key File : The certificate key corresponding to the client certificate.

RCDevs WebADM Administrators Guide - Page 46 of 76

Figure 45. MountPoint Settings

9. WebADM LDAP Domains

WebADM Domains are used by the registered WebADM applications to identify a user with a username, a password and a domain name. The domain objects establish the relationship between a domain name and a LDAP tree base. Also, when an application wants to obtain an LDAP user DN corresponding to the provided login information, it will use the domain tree base to build the LDAP search. All Domains must be stored in the same container (specied in the WebADM conguration le) to be read by WebADM at start-up. A WebADM Domain object supports the following settings: - User Search Base : The tree base corresponding to the domain and to be used in the user LDAP searches. - Group Search Base : The tree base to be used in the LDAP group searches. If not specified, it defaults to the Tree DN. This setting will be ignored if WebADM is configured to use direct groups only. - Disable Domain : Allows disabling a domain. By default, the domain is enabled.

RCDevs WebADM Administrators Guide - Page 47 of 76

- Hide Domain : Do not list the domain in the Admin login page (when login_mode is set to UID and list_domains is enabled in the conf/webadm.conf file) and in the WebApps portal. - Allowed WebApps / Web Services : List of applications with which the domain is usable. By default, a domain work with all registered applications. - Allowed Groups : Mandatory LDAP group(s) the domain users must belong to (in order to be considered as part of the domain). If set, users must be a member of at least one of the listed groups. - Excluded Groups : Exclusion LDAP group(s) the domain users must not belong to. If set, users must not be a member of any of the listed groups.

Figure 46. WebADM LDAP Domain Settings

The Domain Tree DN can be set to a container inside a mounted LDAP or the LDAP mount point DN itself (see MountPoints). This is a very convenient way to assign a domain to the users of another LDAP server. Important: The WebADM Domains are not the same thing as the LDAP Domain containers (example: dc=myobject). LDAP Domain containers (DC objects) are generic containers like

RCDevs WebADM Administrators Guide - Page 48 of 76

Organizations or Organizational Units. Whereas WebADM Domains are objects of type webadm_config_object such as the OptionSets, MountPoints or Clients and contain some settings.

10. WebADM Trust Domains

Trusts are special Domains which do not correspond to a set of local LDAP users but a domain on a remote WebADM installation. The Trust system works like a authentication proxy for remote domains (within a trusted organization) and maps a local virtual Domain name to a remote Domain on another WebADM server. Trust work only with Web Services. The local Web Service will forward the incoming SOAP request to the trusted system through a secure communication. All Trusts must be stored in the Domains container (specied in the WebADM conguration le) to be read by WebADM at start-up. A WebADM Trust object supports the following settings: - Remote Server Address : This is the server name (hostname) for the remote services. - Remote Server SOAP Port : This is the remote SOAP port (typically 8080 or 8443). - Use SSL Connection : If enabled, connection will use SSL (port 8443). - Trusted CA Certification File : This is the file containing the remote CA certificate. If set only the certificates issued by this CA will be trusted for remote server authentication. - Trusted Certificate CN : Mandatory certificate common name required for remote server authentication. Trusted certificates with non-matching CN will be refused. - Remote Domain Name : If the remote domain name is not the same as the local Trust Domain name, you can specify the remote domain. - Disable Trust : Enable or disable the Trust Domain. - Allowed Web Services : List of Web Services applications with which the domain is usable. By default, a domain work with all registered applications.

RCDevs WebADM Administrators Guide - Page 49 of 76

Figure 47. WebADM Trust Domain Settings

11. WebADM Web Service Clients

A Web Service Client object can be dened if you need to assign an access control policy for a specic client application (which uses the SOAP or RADIUS APIs), or if you want to force some Web Service settings for a client application. You can also dene per-client application proles in WebADM using Client objects. By dening a Web Service Client, you can for example restrict access to the Client application for some LDAP authorized groups or prevent some groups to use the application. You can even restrict the application access to some WebADM Domains. Another feature of the Client is that you can dene some Web Application settings which will always be enforced for the Client application whatever setting is set in the users or its groups. For example, you want one VPN to authenticate users through RCDevs OpenOTP with LDAP+OTP passwords and Token whatever policy is dened for the user, and you want you internal systems to authenticate users with LDAP only. To create a Client prole, you must know your client application IDs. The WebADM Client object must have the same name as the client ID. The ID is typically the Client name that appears in the WebADM Log Viewer for Web Services. The Client ID is generally provided in the client requests in the client SOAP attribute. With RADIUS, it is the NAS-Identier. If this information is not provided by the client, WebADM will use the client IP Address as client name. A WebADM Web Service Client supports the following settings:

RCDevs WebADM Administrators Guide - Page 50 of 76

- Disable Client : Enables or disables the Client profile. - Default Domain : The Web Services SOAP APIs under WebADM support multiple Domains. When the Client does not provide the user domain name in the SOAP requests, WebADM will look at the targeted Web Service configuration for a default Domain. But if the Client object corresponding to that request has a default Domain set, it will be use in priority. - Allowed Domains : You can restrict the Domains that are usable for the client application. - Allowed Groups : Another possibility is to restrict the client application access based on the user groups. Only the users part of at least one of the listed groups will be authorized. - Excluded Groups : You can define a set of groups which cannot use the client application. If a user is part to at least one of the excluded groups, then he cannot use the client application. - Priority Application Settings : You can force some Web Service settings for the client application to implement client application custom behaviors. The syntax is the a commaseparated list of value-pairs in the form OpenOTP.LoginMode=OTP,OpenOTP.OTPType=TOKEN. In order to know the syntax for the Priority Application Settings, you can go to the Application menu, then congure one application. Put the mouse over one of the setting names and the real setting will appear. For example, OpenOTP Login Mode will display LoginMode (public list). The setting name must be prexed by the Web Service Name and a separating dot. And only the public settings can be set in a Client object. Note that SOAP requests are also able to transport user settings in order to implement perapplication settings.

RCDevs WebADM Administrators Guide - Page 51 of 76

Figure 48. Web Service Client Settings

12. Log Viewer

The WebADM SQL logs are accessible from the Databases menu. By default, WebADM provides the following logs: - Admin Logs : Contains all the actions performed by administrators in the WebADM Administrator Portal. - WebApp Logs : Contains all the actions reported by the WebApps registered in WebADM. - WebSrv Logs : Contains all the actions reported by the Web Services registered in WebADM.

RCDevs WebADM Administrators Guide - Page 52 of 76

Figure 49. WebADM WebSrv Logs

Important: If you dene an OptionSet with a Tree Base restriction, the same restriction will apply to the log entries to be displayed in the log viewer. So the administrators will only see the user action logs corresponding to user DNs under their own scope of visibility. By default, all log entries found in the WebADM logs database are shown. If the number of logs is large, you can create log lters to narrow down the number of logs shown on the screen.

12.1. Creating Log Filters

You can create lters with different criteria. There are a number of lters types that can be combined with operators and the searched value to produce accurate ltering results. You can also lter the logs by time, administrator names, session IDs, application names... You can click the links in the log items to generate automatic lters too.

Figure 50. Log Filters

12.2. Log Display Options

By default, all log entries found in the WebADM logs database are shown. If number of logs is large, you can narrow down the number of logs shown on the screen. You can control the number of visible logs in the area using: - The Retrieve last value controls the number of last log entries retrieved from the logs database. - The Per page results value controls the number of log entries shown per page. The log results are paginated and you can switch page with the links at the bottom right of the page.

RCDevs WebADM Administrators Guide - Page 53 of 76

Figure 51. Log Display Options

12.3. Log Result Actions

A number of log result actions is available to you. - The Delete Selected deletes the logs selected by checking the checkbox next to the log entry in the log result list. - The Export (CSV) link exports the selected logs to comma separated value text (CSV) le. You can save this le and view it in the application of you choice. - The Statistics (CSV) link creates comma separated value text (CSV) statistics of the selected log column. You can select the column by checking the checkbox in the appropriate column title in the log result list. You can dene the number of entries in the statistics with the Display First value. You can get statistics grouped by time steps with the Group By value.

Figure 52. Log Display Options

12.4. Pruning the Log Database

In time, the log database grows and you have to prune it. Enter the pruning time values in the data entry elds press the Clean button to delete logs older than specied from the log database.

Figure 53. Log Database Pruning

RCDevs WebADM Administrators Guide - Page 54 of 76

13. Localized Messages Editor

The WebADM localized messages editor allows conguring message templates for the registered applications in different languages. There are two way to congure WebADM applications localized messages. 1) You can review all the messages from all the applications using the messages editor accessible from the Databases menu. 2) You can go through application congurations, locate the message templates and click the Localized buttons to edit the messages in other languages.

Figure 54. Localized Messages Editor

The list of supported languages is congurable in the WebADM main conguration le (conf/ webadm.conf).

14. Extending the LDAP Schema

WebADM relies on its own LDAP objectclasses and attributes. These informations constitute the WebADM schema and the LDAP server using WebADM and its applications must include the WebADM schema informations. The schema of your LDAP server is extended during the WebADM graphical setup (see WebADM Installation Guide for details). When you create a MountPoint, the LDAP in the mounted LDAP server must be extended too. Once you created a MountPoint, WebADM checks if the LDAP schema is extended and proposes to add the extension if not present. This does not work with OpenLDAP where the WebADM schema le must be added to the server conguration manually.

RCDevs WebADM Administrators Guide - Page 55 of 76

You can extend the mounted LDAP schema by editing the MountPoint object or the LDAP container where the remote LDAP is mounted. The schema extension link is included in the contextual object action box. With Active Directory, WebADM must be connected to a Domain Controller having the schema master role for the extension to succeed. The WebADM schema includes OIDs registered at IANA under the RCDevs Private Enterprise Numbers 34617.

15. Managing User Certicates

WebADM includes its own PKI subsystem to handle user certicates. The PKI functionalities are completely transparent and allows issuing certicates for your administrators and users using the certicate wizards. When you create a certicate for a user, you have the following options: - Certicate validity period : Denes how long the certicate will remain valid. This period is limited to the default_cert_validity setting in the Rsignd signing server conguration le (conf/ rsignd.conf). - Email address : If the user has an email address dened, you can select one email address to be part of the certicate informations. - Send by email : If the user has an email address dened, WebADM can automatically send the new certicate package to the users email address. Note that the generated PKCS12 certicate package is encrypted by WebADM with a random password that is not sent in the email. - Certificate usage : You can create WebADM Administration certicates for your WebADM administrators if you enabled the certicate-based login mode in the WebADM main conguration le (conf/webadm.conf). And you can create WebApp User certicates for your WebApp end-user if you enabled the PKI login mode for the WebApps. Note that administration certicates are working with WebApps too (those congured with PKI login mode), but WebApp User certicates are not usable to log in the Administrator Portal. - WebApp login domain : With WebApp User certificates, you can link the user certificate to one specific WebADM Domain. If the user is part of several domains, then only the selected domain is usable with the certificate.

RCDevs WebADM Administrators Guide - Page 56 of 76

Figure 55. User Certicate Creation Form

When you issue or renew a user certicate, WebADM creates a certicate request based on the user informations and calls the Rsign PKI subsystem for signing the certicate with the Internal CA. The issued public certicate is stored in the user account and can be displayed or downloaded later. The certicate and its public key are bundled into a PKCS12 encrypted package that must be provided to the user. This certicate PKCS12 package is generated once and cannot be redownloaded later.

Figure 56. User Certicate Creation

RCDevs WebADM Administrators Guide - Page 57 of 76

WebADM can use an external CA for signing the user certicates. You can set the Sign Mode to Ext in your OptionSet for this purpose. Note that with the OptionSets, you can also specify different signing method for different parts of your LDAP tree. The Rsign internal signing mode is required by some WebApps (such as SelfDesk) and Web Services which need an automated certicates signing system. When you congure the user certicate as login method (auth_mode in conf/webadm.conf) for the WebADM Administrator Portal authentication, you can enable the certicate revocation system in the OptionSet. By default, WebADM accepts any valid certicate it has issued. When revocations are enabled, WebADM requires the login certicate used by the user to be listed in the accounts public certicate list. That means that you can revoke a certicate simply by removing it from the user account, and WebADM will refuse the user login. Moreover, revocation is an OptionSet setting so you can adjust your revocation policy depending on the administrators contexts.

15.1. Rsign PKI Subsystem

WebADM Rsign is designed for the WebADM application only. It provides the minimal features needed to automatically and immediately deliver administrators and users client certicates without requiring human process. Rsign system works in client-server mode and provides a set of network remote procedure call (RPC) functions. These functions are available from a client library and are directly usable by WebADM. The CA server component is congured to accepts or refuses client requests based on the clientprovided information and rule-based ltering. It includes a conguration le (conf/rsignd.conf) where each client IP address must be declared and optionally given a shared access secret. Rsign client requests are sent over SSL with two-way authentication. Being a network service, the CA server component can be installed anywhere on a protected network if necessary.

15.2. Rsignd Server

It is the server component. It maintains the CA serial number, indexes issued certicates. It is multithreaded and allows processing concurrent requests. The CA is accessible to root user only but the request-processing threads run in a user-protected environment for security reasons. It uses a proprietary protocol over SSL to communicate with the client library and WebADM. Rsignd can work in proxy mode. It proxies the incoming requests to the next congured Rsignd server. This can be useful when the main Rsignd CA is located on a private network but should be accessed by clients on the public side through a proxy in a DMZ. In a clustered installation, only one of the WebADM servers is running the Rsignd service. The other WebADM servers will use the main Rsignd service and become PKI slaves.

15.3. Rsign Client

RCDevs WebADM Administrators Guide - Page 58 of 76

Rsign client is available as a client program and a shared library. Rsign can be integrated into C/C ++ programs. Or the client functions can be implemented in a dedicate program that can be called from other programs. WebADM uses a Rsign PHP dynamic extension to implement the Rsign RPC functions. The WebADM Rsign client requires server conguration in the WebADM servers conguration le (conf/servers.xml). The client authenticates the server through its SSL certicate.

16. Managing Applications

WebADM registered applications provide their own conguration schemas to the system. The application congurations are accessible from the WebADM Applications menu. WebADM provides a very high-level interface for managing very complex application congurations. WebADM relies on XML schema les, which transparently make the mapping between the application conguration requirements and the graphical conguration editors. The schema les are provided with the applications and should not be edited. To setup an application in WebADM: 1) Install the application on the system with its self-installer. 2) Enter WebADM and navigate to the Applications menu. 3) Click to register the application.

Figure 57. Register Application

4) Click to congure the application.

Figure 58. Congure Application

RCDevs WebADM Administrators Guide - Page 59 of 76

5) Save the settings and your application is now immediately operational.

16.1. User Application Settings

The default applications settings are dened as described just before. Yet, some settings can be re-dened per user or groups. WebADM processes the settings in the following order: 1) Application level settings are applied rst. They are considered as default settings. 2) Group settings (if any) are applied. If the user is a member of multiple groups, the groups settings are merged. Note : User groups and group settings are cached for 5 minutes in order to optimize group searches and user setting resolutions. This has the side effect that user groups and group settings' changes may be delayed for a maximum time of 5 minutes when used by WebApps and Web Services. 3) User settings (if any) are applied. 4) Web Service Client settings are applied if the client requesting the service matches a Client object name. 5) Request settings (if any) are applied. The Web Services API provides a Settings SOAP eld to dynamically pass user settings to the WebADM services. That means That the user settings have priority over the group settings which have themselves priority over the application default settings, etc... To add settings to a user or group (when no setting is dened yet), select the WebADM Settings in the Add Attribute action for the user. If the user/group is not extended with the webadmAccount objectclass, or the group is not extended with the webadmGroup objectclass, you must extend it rst with the Add Extension action to be able to add settings. To modify the user/group settings in a webadmAccount/webadmGroup object, edit the object and click the links in the information box (at the top middle of the edition page), or click the Edit WebADM Settings button in the object attribute list.

RCDevs WebADM Administrators Guide - Page 60 of 76

Figure 59. User Settings Editor

17. Using the Manager Interface

The Manager interface provides access to some WebADM user management functions and operations exported by your registered applications. The Manager also allows external systems such as Web portals to remotely trigger user management operations and actions from the network. The user management functions provide LDAP operations such as object creation, update, removal, WebADM settings and data management, etc... The method names for internal management functions are in the form Manager_Method. The operations exported by the registered applications provide access to any feature which are accessible from the application actions in the Admin Portal. The method names for applicationexported functions are in the form Application.Manager_Method. The interface communication protocol is based on the JSON-RPC v2.0 specication. You can nd the JSON-RPC specication at http://jsonrpc.org/spec.html. You can go to the Manager Interface page in the WebADM Infos menu to have a full listing of the supported Manager functions and parameters. You can then navigate between applications to get the Manager functions supported by a specic registered application. The Manager API requires authentication and a WebADM administrator account must be provided to access the interface. The authentication mechanism which is enforced is always the same as

RCDevs WebADM Administrators Guide - Page 61 of 76

the mechanism congured for the WebADM Admin Portal (i.e. The auth_mode setting in the webadm.conf le). Note that any LDAP permission or OptionSet restriction congured in WebADM will be enforced within the Manager interface. Administrators have also the same level of access in the Manager as they have in the the Admin Portal.

- With DN login mode, the administrator DN and password must be provided in the HTTP-Basic
Authorization header.

- With UID login mode, the administrator user ID and password must be provided in the HTTPBasic Authorization header.

- With PKI login mode, the administrators user certicate must be used for establishing the HTTPs
connection to the interface and the administrator password must be provided in the HTTP-Basic Authorization header. A connections to the Manager automatically creates an Administrator session in WebADM for processing the requested methods. The Manager responses return a session cookie called WEBADMMANAG in the response headers. You can pass the session cookie in the next Manager requests to avoid starting new sessions. Note that the Manager sessions have a short expiration time are are automatically closed after 10 seconds of inactivity. Yet, you can force the closure of the session by passing the Connection: close header to the requests. The Manager interface is accessible at the URL: https://yourserver/manag/. Look at Appendix D for some simple examples of function calls using the PHP language to use the Manager Interface.

18. Installing WebApps and Web Services

WebADM has been designed to ease as much as possible the installations, upgrades and removal of applications (WebApps and Web Services). To install a new RCDevs application (WebApp or Web Service) in WebADM, proceed as follows: 1) Get the application self-installer package from the the RCDevs website. 2) Copy it to you Linux server running WebADM. 3) Uncompress it with the command gunzip application-x.x.x.sh.gz 4) Set installer as UNIX executable with the command chmod 755 application-x.x.x.sh. 5) Run the self installer and answer the setup questions with the command ./application-x.x.x.sh. WebApps application les will be installed in the webapps/ system folder, under a folder having the name of your WebApp.

RCDevs WebADM Administrators Guide - Page 62 of 76

Web Services application les will be installed in the websrvs/ system folder, under a folder having the name of your Web Service. 6) Log in WebADM as with a super administrator account. 7) Navigate to the Applications menu and click the Register button for the new application (see section Applications Administrators for details). WebADM will create a LDAP conguration object for the new application in the webapps_container for WebApps and in the websrvs_container for Web Services, as dened in the WebADM main conguration le (conf/webadm.conf).

Figure 60. Application Registered in LDAP

8) Click the Congure button for the new application, adjust the application settings and save the settings (see section Applications Administrators for details). WebADM will update the LDAP conguration object with the new settings. Important: You do not have to modify any le in the application installation directory! The applications congurations are managed and stored in LDAP by WebADM from the Applications menu only. To upgrade an application, do not remove the previous version and proceed exactly like for the installation. Read the CHANGELOG and README les to get the list of changes and proceed with the required modications. After a WebApp or Web Service upgrade, the application congurations may need to be updated. Log in WebADM and check the installed application status in the home page or in the Applications menu. If a conguration update is required, click the Not Congured button to update the conguration and save the application settings again.

18.1. Embedding a WebApp

By default, WebApps are accessible from the WebApps portal at the URL http://yourserver/ Webapps/. And a specific WebApp (mywebapp) can be accessed at the URL http://yourserver/ webapps/mywebapp. You can embed a WebApp directly into a part of your website in an HTML iFrame or HTML Object. Insert the following code in your website to embed a WebApp directly into your website.

RCDevs WebADM Administrators Guide - Page 63 of 76

<object data="https://myserver/webapps/mywebapp?inline=1" /> Replace myserver and mywebapp with your WebADM server address and the WebApp name. The parameter inline=1 informs WebADM that the WebApp is embedded. WebADM will skip the HTML headers, footers and stylesheets. It will stream only the HTML BODY content for the WebApp.

19. Clustering
WebADM has been entirely designed for clustering. A WebADM system can be divided into more than one server for failover or load-balancing purposes. A WebADM server can be dedicated to one specic task such as administrator portal, WebApp server or Web Services servers. Moreover, multiple server can be assigned the same task. Please look at the WebADM High Availability Guide for Cluster installations. For a clustered conguration, you mainly have to respect the following conditions: 1) All the servers of the cluster must use the same session manager at one moment. There can be multiple session managers for failover but all the systems must be congured to work with the same session manager at one time. 2) All the servers of the cluster must use the same PKI server (as for session manager). This is mandatory to keep the Certicate Authority consistent. 3) All the servers must have basically the same congurations and especially must use the same LDAP encryption key. The session manager and PKI server are very high performance systems, multithreaded and written in C. Those components do not call external network services such as LDAP or SQL servers and can also handle very high numbers of request. Several servers can be congured to play the same role without any consequence because the application congurations and user informations are stored in LDAP (which is a network service). So as long as all the clustered servers are connected to the same services (or multiple real-time replicated services) the whole system should not be impacted by the clustering. Several Web Services servers can be accessed in the same time and client requests can even go randomly to any of the servers without problem (as long as all the servers use the same session manager). For example, an OpenOTP SMSTOP login request can come to Server1, and the OTP challenge response request can come to Server2. As Server1 and Server2 use the same session manager, the second request will be recognized by Server2 and part of a valid session. In a clustered system, all the WebADM servers are automatically informed when an application conguration is changed by an administrator, and then, all the servers automatically refresh their conguration caches.

RCDevs WebADM Administrators Guide - Page 64 of 76

20. Common Issues

1) OpenLDAP server may forbid adding the inetOrgPerson objectclass to an existing user. In that case, you may need to re-create your users in WebADM, or remove the inetOrgPerson objectclass from the user object specications in the conf/objects.xml le. 2) With Microsoft ActiveDirectory, you must add the WebADM proxy user to the Domain Admins group. Be sure have the SSL enabled and to respect the domain password complexity policy for the proxy user password and user passwords. Else, WebADM will not be able to create users or set passwords.

RCDevs WebADM Administrators Guide - Page 65 of 76

Appendix A : Sample webadm.conf le

# # WebADM Server congurations # # WebADM login mode # - PKI: Requires client certicate and login password. # - UID: Requires domain name, login name and password. # - DN: Requires login DN and password. # Using certicates is the most secure login method. To use certicate login, # you must login WebADM and create a login certicate for your administrators. # The UID mode requires a WebADM domain to exist and have its User Search Base # set to the subtree where are located the administrator users. When using UID # and if there is no domain existing in WebADM, the login mode is automatically # forced to DN. You will also need to login with the the full user DN and setup # a WebADM domain to be able to use the UID login mode. auth_mode DN # Show the registered domain list when auth_mode is set to UID. list_domains Yes # The proxy user is used by WebADM for accessing LDAP objects over which the # admin user does not have read permissions or out of an admin session. # The proxy user should have read permissions on the whole LDAP tree, # and write permissions on the users / groups used by the WebApps and WebSrvs. # The use of a proxy user is required for WebApps and WebSrvs. # With ActiveDirectory, you can use any Domain Administrator DN as proxy user, # which should look like cn=Administrator,cn=Users,dc=mydomain,dc=com. proxy_user "cn=webadm,dc=WebADM" proxy_password "Password1234" # Super administrators have extended WebADM privileges such as setup permissions, # additional operations and unlimited access to any LDAP encrypted data. Access # restriction congured in the WebADM OptionSets do not apply to super admins. # You can set a list of individual LDAP users or LDAP groups here. # With ActiveDirectory, your administrator account should be is something like # cn=Administrator,cn=Users,dc=mydomain,dc=com. And you can replace the sample # super_admins group on the second line with an existing security group. super_admins "cn=admin,o=root", \ "cn=super_admins,dc=WebADM" # Any other WebADM administrator must be dened in the other_admins to be able # to login. You can set access restrictions for other admins in WebADM OptionSets. # You can set a list of individual LDAP users or LDAP groups. # You can comment the setting not to use other administrators. # With ActiveDirectory, you can use another existing security group here. other_admins "cn=other_admins,dc=WebADM" # LDAP objectclasses container_oclasses "container", "organizationalUnit", "organization", "domain", "locality", "country", "openldaprootdse"

RCDevs WebADM Administrators Guide - Page 66 of 76

# user_oclasses is used to build the LDAP search lter with 'Domain' auth_mode. # If your super admin user user does not have one of the following objectclasses, # add one of its objectclasses to the list. user_oclasses "user", "account", "person", "inetOrgPerson", "posixAccount" group_oclasses "group", "groupOfNames", "groupOfUniqueNames", "dynamicGroup", "posixGroup" # With ActiveDirectory 2003 only, you need to add the 'user' objectclass to the # webadm_account_oclasses and the 'group' objectclass to the webadm_group_oclasses. webadm_account_oclasses "webadmAccount" webadm_group_oclasses "webadmGroup" webadm_cong_oclasses "webadmCong" # LDAP attributes certicate_attrs "userCerticate" password_attrs "userPassword", "unicodePwd" uid_attrs "uid", "samAccountName" member_attrs "member" memberof_attrs "memberOf", "groupMembership" language_attrs "preferredLanguage" mobile_attrs "mobile" mail_attrs "mail" webadm_data_attrs "webadmData" webadm_settings_attrs "webadmSettings" webadm_type_attrs "webadmType" # ignore some AD attributes ignored_attrs "ntsecuritydescriptor", "objectcategory", "objectsid", "badpasswordtime", \ "badpwdcount", "lastlogoff", "lastlogon", "logoncount", "lastlogontimestamp", \ "pwdlastset", "primarygroupid", "samaccounttype" # Find below the LDAP containers required by WebADM. # Change the container's DN to t your ldap tree base. # WebADM Optionsets container optionsets_container "dc=OptionSets,dc=WebADM" # WebApp congurations container webapps_container "dc=WebApps,dc=WebADM" # WebSrv congurations container websrvs_container "dc=WebSrvs,dc=WebADM" # Mount points container mountpoints_container "dc=MountPoints,dc=WebADM" # Domain and Trusts container domains_container "dc=Domains,dc=WebADM" # Clients container clients_container "dc=Clients,dc=WebADM" # With MS Active Directory use the following settings instead of the previous ones # Note: Replace dc=mydomain,dc=com with your AD domain DN #optionsets_container "cn=OptionSets,cn=WebADM,dc=mydomain,dc=com" #webapps_container "cn=WebApps,cn=WebADM,dc=mydomain,dc=com" #websrvs_container "cn=WebSrvs,cn=WebADM,dc=mydomain,dc=com" #mountpoints_container "cn=Mountpoints,cn=WebADM,dc=mydomain,dc=com" #domains_container "cn=Domains,cn=WebADM,dc=mydomain,dc=com"

RCDevs WebADM Administrators Guide - Page 67 of 76

#clients_container "cn=Clients,cn=WebADM,dc=mydomain,dc=com" # Temporary WebADM work directory where temporary work les should be created. tmp_dir "/tmp" # You can set here the timeout (in seconds) of a WebADM session. # Sessions will be closed after this period of inactivity. session_timeout 900 # You can set here the WebADM internal cache timeout. A normal value is one hour. cache_timeout 3600 # Time zone # Look at the docs/timezones.txt for the list of time zones. time_zone "Europe/Paris" # Application languages languages "EN","FR","DE","ES","IT","FI" # WebADM can encrypt LDAP sensitive data such as password, keys # and session manager sessions with the AES-256 algorithm. # The encryption key must be a 256bit base64-encoded random binary data. # Use the command 'openssl rand -base64 32' to generate a key. # IMPORTANT: If you change the encryption key, any encrypted data will become invalid! encrypt_data Yes encrypt_key "cq19TEHgHLQuO09DXzjOw30rrQDLsPkT3NiL6l3BH2w=" # The group mode denes how WebADM will handle LDAP groups. # direct mode: WebADM nds user groups using the memberof_attrs dened above. # In this case, the group membership is dened in the LDAP user objects. # indirect mode: WebADM nds user groups by searching group objects which contain # the user DN as part of the member_attrs. # By default (when group_mode is not specied) WebADM handles both group modes. #group_mode direct # You can optionally disable some features if you run multiple WebADM server with # different purposes. For example, if you dont want to provide admin portal on an # Internet-exposed WebApps and WebSrvs server. # By default, all the functionalities are enabled. enable_admin Yes enable_manager Yes enable_webapps Yes enable_websrvs Yes # Enable extended logging to the httpd.log and soapd.log les (enabled by default). # Records all WebApps and Web Service events to the httpd.log and soapd.log les. log_webapps Yes log_websrvs Yes # Alerts are always recorded to the SQL Alert log. Additionally, when alert_email # is dened, the alerts are also sent by email to the congured recipient. #alert_email "[email protected]"

RCDevs WebADM Administrators Guide - Page 68 of 76

# Check for new versions on RCDevs' website (requires HTTP connectivity). check_versions Yes # WebApps theme # Comment the following line to disable the default theme. webapps_theme "default"

RCDevs WebADM Administrators Guide - Page 69 of 76

Appendix B : Sample servers.xml le

<?xml version="1.0" encoding="UTF-8" ?> <Servers> <!-************************************************* *** WebADM LDAP/SQL/Session/Proxy/PKI Servers *** ************************************************* You can specify multiple LDAP servers here. At logon, WebADM will try to connect the servers in the same order they appear in this le and will use the rst one it successfully established the connection to. Allowed LDAP parameters are: - name: server friendly name - host: server hostname or IP address - port: LDAP port number default: 389 - encryption: connection type Allowed type are NONE, SSL and TLS. default: 'none' --> <LdapServer name="LDAP Server" host="localhost" port="389" encryption="TLS" cert_le="" key_le="" /> <!-<LdapServer name="LDAP Server 2" host="remotehost" port="389" encryption="TLS" cert_le="" key_le="" /> --> <!-SQL servers are used for logs and message localizations. You can specify one or more SQL server here. Spported SQL type: MySQL, PostgreSQL, MSSQL, Sybase, Oracle. --> <SqlServer name="SQL Server" type="MySQL" host="localhost"

RCDevs WebADM Administrators Guide - Page 70 of 76

user="webadm" password="webadm" database="webadm" /> <!-A session server is required for webservices using sessions such as OpenOTP. You can specify one or more SQL servers here. The session server is included in WebADM. So you can keep the default settings. --> <SessionServer name="Session Server" host="localhost" port="11211" /> <!-A PKI server (or CA) is required for signing user certicates. You can specify one or more PKI servers here. The Rsign PKI server is included in WebADM. So you can keep the default settings. --> <PkiServer name="PKI Server" host="localhost" port="5000" secret="secret" /> <!-HTTP proxy servers can be used by WebADM for connecting remote Web services and version checking. You can specify one or more HTTP proxy servers here. --> <!-<ProxyServer name="HTTP Proxy" host="proxy" port="8080" user="" password="" /> --> <!-SMTP mail servers can be used by WebADM for sending emails. If no server is specied, WebADM will use the local mailer in /usb/sbin/sendmail to send emails. You can specify one or more SMTP servers here. --> <!-<MailServer name="SMTP Server" host="localhost" port="25"

RCDevs WebADM Administrators Guide - Page 71 of 76

user="" password="" encryption="NONE" /> --> </Servers>

RCDevs WebADM Administrators Guide - Page 72 of 76

Appendix C : Sample rsignd.conf le

# # WebADM PKI Server conguration le # port 5000 logle /opt/webadm/logs/rsignd.log pidle /opt/webadm/logs/rsignd.pid # uid used for rsignd sub process execution user webadm # # Certicates and keys # # default validity period for issued certicates default_cert_validity 365 # certicate and key used for ssl connection rsignd_cert /opt/webadm/pki/rsignd.crt rsignd_key /opt/webadm/pki/rsignd.key # In proxy mode, you do not need a CA. # You do not need "ca_cert", "ca_key" and "ca_serial" too. ca_cert /opt/webadm/pki/ca/ca.crt ca_key /opt/webadm/pki/ca/ca.key ca_serial /opt/webadm/pki/ca/serial # Server settings max_data_size 16000 # # Proxy settings # # If the server is a rsignd proxy, use "proxy yes" here. # Specify the real rsignd server IP and service port number. proxy_mode no #server_name xxx.xxx.xxx.xxx #server_port 5000 # # Directory or le containing trusted CA certicate(s) (in PEM format) # After adding a new certicate, type a "make" in the "trusted_ca_path" # to rebuild certicate's hash. # This is needed for rsignd to read the trusted CA certicates. # Comment "trusted_path" to diasble rsignd certicate's trust restrictions. trusted_ca_path /opt/webadm/pki/trusted # # client sections # # Declare here the Rsign clients with the allowed services. # In cluster mode, the secondary servers must be dened.

RCDevs WebADM Administrators Guide - Page 73 of 76

client { hostname 127.0.0.1 secret secret services getcacert signcsr #cert_validity 180 } #client { # hostname Slave_Server_IP # secret secret # services getcacert signcsr #}

RCDevs WebADM Administrators Guide - Page 74 of 76

Appendix D : Sample Manager Interface usage

Find below 2 simple examples of use of the WebADM Manager interface. 1. Resolve the DN of an existing user
<?php $method = Get_User_DN; $params = array( ! username => test, ! domain => Default, ); $request = array( ! 'jsonrpc' => "2.0", ! 'method' => $method, ! 'params' => $params, ! 'id' => 0); $json = json_encode($request); $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, "https://localhost/manag/"); curl_setopt($ch, CURLOPT_USERPWD,"default\\admin:password"); curl_setopt($ch, CURLOPT_HTTPHEADER, array("connection: close")); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt($ch, CURLOPT_POST, 1); curl_setopt($ch, CURLOPT_POSTFIELDS, $json); $out = curl_exec($ch); curl_close($ch); print_r(json_decode($out)); ?>

The manager will return a structure int the form:

stdClass Object ( [jsonrpc] => 2.0 [result] => cn=test,o=Root [id] => 0 )

2. Set the user mobile number and email address

$method = Set_User_attrs; $params = array( ! dn => cn=test,o=root, ! attrs => array(mobile => array(12345678), mail => array([email protected])), );

Will return:

RCDevs WebADM Administrators Guide - Page 75 of 76

stdClass Object ( [jsonrpc] => 2.0 [result] => 1 [id] => 0 )

3. Get the user mobile number and email address

$method = Get_User_attrs; $params = array( ! dn => cn=test,o=root, ! attrs => array(mobile, mail), );

Will return:
stdClass Object ( [jsonrpc] => 2.0 [result] => stdClass Object ( [mobile] => Array ( [0] => 12345678 ) [mail] => Array ( [0] => [email protected] ) ) [id] => 0 )

4. Set some user application settings

$method = Set_User_Settings; $params = array( ! dn => cn=test,o=root, ! settings => array(OpenOTP.LoginMode => LDAPOTP, OpenOTP.SecureMail => false), );

Will return:
stdClass Object ( [jsonrpc] => 2.0 [result] => 1 [id] => 0 )

RCDevs WebADM Administrators Guide - Page 76 of 76

5. Register a HOTP Token with OpenOTP

$method = OpenOTP.HOTP_Register; $params = array( ! dn => cn=test,o=root, ! key => base64_encode(12345678901234567890), ! counter => 0 );

Will return:
stdClass Object ( [jsonrpc] => 2.0 [result] => 1 [id] => 0 )