- 浏览: 117644 次
- 性别:
- 来自: 武汉
最新评论
Description
This TPI addresses Aphelion vulnerabilities for disallowing anonymous Aphelion LDAP access. The access control on Aphelion LDAP directory can be set with various ways. For additional detail, please refer to Access control section in the Aphelion Admin Guide. Starting with a functional working Windchill solution with Apache and Aphelion LDAP installed. In the example below two users are defined, one user can read/write in the directory i.e aphelionadmin and other one has only read access i.e. windchilluser. When the directory is accessed on behalf of the Windchill system or as an Administrator the write user is used. Otherwise, the read only user is used.
Resolution
For Windchill 7.0 solutions see Additional Information below.
For Windchill 8.0 solutions refer to the section "Restricting Access to Aphelion" found in the Info*Engine Installation and Configuration Guide.
For Windchill 8.0 solutions refer to the section "Restricting Access to Aphelion" found in the Info*Engine Installation and Configuration Guide.
Additional Information
The following are the main steps:
Step 1-> Use the Windchill Principal Administrator to define two users or use the LDAP Browser to
define two users. Create users:
Here mymachine is the distinguished name and mycompany is machine name derived from network domain. These users must have a password defined in their entry. Here we are using passwd admin and user for ahelionadmin and windchilluser respectively.
Step 2-> Add the aphelionadmin user to the Administrators group with the Principal Administrator.
Step 3-> Modify <WT_HOME>/tasks/federation/MapCredentials.xml and add the users as shown in
the snippet below.
<ie:webject name="Create-Group" type="GRP">
</ie:webject>
Step 4 -> Add the windchilluser to Apache configuration. For this example, this allows apache to access the directory in read only mode. Please make changes to <Apache loadpoint>/conf/app-Windchill.properties file for following lines:
apacheWebApp.bindDn=uid\=windchilluser,ou\=people,cn\=mymachine,cn\=application services,o\=mycompany
apacheWebApp.anonBind=false
apacheWebApp.bindPwd=user
From a shell, from the <Apache loadpoint> run:
ant -f webAppConfig.xml regenAllWebApps to regenerate the app-Windchill-Auth.conf file.
This will set the user and password that Apache uses to bind to the directory to search for users during authentication.
Step 5-> Change the properties ie.ldap.managerDn and ie.ldap.managerPw in the site.xconf file and propagate the changes. ie.ldap.managerDn should be set to the user with write permision. Using command:
Step 6 -> Make following changes in <Aphelion>\usr\var\lde\PTCLdap\PTCLdap_lde.conf to set access control for Aphelion Directory. (For UNIX, this path is /opt/lde/var/PTCLdap/PTCLdap_lde.conf)
a. Comment following line to allow anonymous access
#anonymous_access_allowed on
b. Uncomment line below
anonymous_access_allowed false
For disallowing access to config, monitor, and schema, uncomment following lines.
access to dn=config by * none
access to dn=.*,cn=monitor by * none
access to dn=schema by * none
access to dn=config by dn=cn=Manager write
access to dn=.*,cn=monitor by dn=cn=Manager write
access to dn=schema by dn=cn=Manager write
c. Change the following line to reflect the specific distinguished name (for example, aphelionadmin) that you want to use for write access:
access to dn=.*cn=Application Services,o=mycompany" by "dn=uid=aphelionadmin,ou=people,cn=mymachine,cn=application services,o=mycompany" write
d. Change the following line to reflect the specific distinguished name (for example, windchilluser) that you want to use for read access:
access to "dn=.*cn=mymachine,cn=application services,o=mycompany" by "dn=uid=windchilluser,ou=people,cn=mymachine,cn=Application Services,o=mycompany" read
After making the changes restart Apache, Aphelion, and Windchill. To verify, login to LDAP browser using "Anonymous bind" checked, the login should fail. Only the user with valid access right will be allowed to login. This disallows anonymous access to the directory.
Step 1-> Use the Windchill Principal Administrator to define two users or use the LDAP Browser to
define two users. Create users:
uid=aphelionadmin,ou=people,cn=mymachine,cn=application services,o=mycompany and uid=windchilluser,ou=people,cn= mymachine,cn=application services,o=mycompany
Here mymachine is the distinguished name and mycompany is machine name derived from network domain. These users must have a password defined in their entry. Here we are using passwd admin and user for ahelionadmin and windchilluser respectively.
Step 2-> Add the aphelionadmin user to the Administrators group with the Principal Administrator.
Step 3-> Modify <WT_HOME>/tasks/federation/MapCredentials.xml and add the users as shown in
the snippet below.
<ie:webject name="Create-Group" type="GRP">
<% if ( isAdmin ) { %> <!------------------------------------------------------------------ Create a credentials map for users with administrative privileges ------------------------------------------------------------------> <ie:param name="element" data="INSTANCE=com.ptc.ptcnet.Ldap:DBUSER=uid=aphelionadmin,ou=people,cn=mymach ine,cn=application services,o=mycompany:PASSWD=admin"/> <!------------------------------------------------------------------ PendingUserAdapter ------------------------------------------------------------------> <ie:param name="element" data="INSTANCE=com.ptc.ptcnet.Ldap-pending:DBUSER=uid=aphelionadmin,ou=people,c n=mymachine,cn=application services,o=mycompany:PASSWD=admin"/> <!------------------------------------------------------------------ ------------------------------------------------------------------> <% } else { %> <!------------------------------------------------------------------ Create a credentials map for non-privileged users ------------------------------------------------------------------> <ie:param name="element" data="INSTANCE=com.ptc.ptcnet.Ldap:DBUSER=uid=windchilluser,ou=people,cn=mymach ine,cn=application services,o=mycompany:PASSWD=user"/> <% } %>
<ie:param name="delimiter" data=":"/> <ie:param name="group_out" data="map"/>
</ie:webject>
Step 4 -> Add the windchilluser to Apache configuration. For this example, this allows apache to access the directory in read only mode. Please make changes to <Apache loadpoint>/conf/app-Windchill.properties file for following lines:
apacheWebApp.bindDn=uid\=windchilluser,ou\=people,cn\=mymachine,cn\=application services,o\=mycompany
apacheWebApp.anonBind=false
apacheWebApp.bindPwd=user
From a shell, from the <Apache loadpoint> run:
ant -f webAppConfig.xml regenAllWebApps to regenerate the app-Windchill-Auth.conf file.
This will set the user and password that Apache uses to bind to the directory to search for users during authentication.
Step 5-> Change the properties ie.ldap.managerDn and ie.ldap.managerPw in the site.xconf file and propagate the changes. ie.ldap.managerDn should be set to the user with write permision. Using command:
xconfmanager -t "codebase/WEB-INF/ieStructProperties.txt" -s "ie.ldap.managerDn=uid= aphelionadmin,ou=people,cn=mymachine,cn=application services,o=mycompany" -s "ie.ld ap.managerPw=admin" -p
Step 6 -> Make following changes in <Aphelion>\usr\var\lde\PTCLdap\PTCLdap_lde.conf to set access control for Aphelion Directory. (For UNIX, this path is /opt/lde/var/PTCLdap/PTCLdap_lde.conf)
a. Comment following line to allow anonymous access
#anonymous_access_allowed on
b. Uncomment line below
anonymous_access_allowed false
For disallowing access to config, monitor, and schema, uncomment following lines.
access to dn=config by * none
access to dn=.*,cn=monitor by * none
access to dn=schema by * none
access to dn=config by dn=cn=Manager write
access to dn=.*,cn=monitor by dn=cn=Manager write
access to dn=schema by dn=cn=Manager write
c. Change the following line to reflect the specific distinguished name (for example, aphelionadmin) that you want to use for write access:
access to dn=.*cn=Application Services,o=mycompany" by "dn=uid=aphelionadmin,ou=people,cn=mymachine,cn=application services,o=mycompany" write
d. Change the following line to reflect the specific distinguished name (for example, windchilluser) that you want to use for read access:
access to "dn=.*cn=mymachine,cn=application services,o=mycompany" by "dn=uid=windchilluser,ou=people,cn=mymachine,cn=Application Services,o=mycompany" read
After making the changes restart Apache, Aphelion, and Windchill. To verify, login to LDAP browser using "Anonymous bind" checked, the login should fail. Only the user with valid access right will be allowed to login. This disallows anonymous access to the directory.
发表评论
-
How to deactivate a user in Windchill?
2012-10-17 22:09 966Introduction Procedure base ... -
How to shorten display time for the inline message in Windchill 10.0
2012-09-03 00:24 1166标题 How to shorten display ... -
How to perform SaveAs on WTPart using API in Windchill PDMLink 10.0
2012-04-05 18:38 1526标题 How to perform SaveAs ... -
Manual Installation Steps For Archive Client Installation on Red Hat Linux 4.0
2012-03-31 19:18 967On Red hat Linus 4.0 (64-Bit), ... -
Windchill单点登录方案
2012-03-31 00:20 3000Windchill SSO 单点登录 可下载附件查看。 ... -
如何在Windchill PDMLink 9.1设定多个Background Method Server去执行特定的工作流
2012-03-31 00:17 2650标题 如何在Windchill PDMLink 9.1 ... -
通过IE8访问Windchill PDMLink 10.0,出现警告提示"Windchill 只支持标准模式下的浏览器".
2012-03-31 00:15 3030标题 通过IE8访问Windchill PDMLink ... -
JSP Authentication with the Method Server
2012-02-07 20:31 3051During development for a cus ... -
Solution for searching the latest revision object
2012-02-01 11:44 1002// Implement your query ... -
Solution for search object with IBA Attribute
2012-02-01 11:39 1460QuerySpec qs = new Quer ... -
Required Ports for Windchill
2011-10-29 18:53 1044Windchill utilizes multiple por ... -
[WIP] How to see the document creator full name instead of the login name in DTI
2011-09-07 14:23 846标题 [WIP] How to see the doc ... -
Windchill Project Daily Build
2011-08-26 22:54 677下载软件: ant svnant sliksvn htt ... -
How to set schedule for Synchronization from Replica to Master?
2011-08-23 10:17 1063To do this, please follow these ... -
copy user from team administrator to workflow team.
2011-07-16 12:14 1634The code can be used directly i ... -
MethodServer Exits Prematurely With the Error *com.ptc.windchill.upgrade.history
2011-06-11 23:39 2888Description ---------------- ... -
从Aphelion迁移至WindchillDS
2011-06-11 23:00 915假设: 1. Aphelion ... -
How to Configure Windchill with Active Directory
2011-06-09 22:28 3770说明 This article describe ... -
Taking the Windchill System Offline
2011-06-09 22:20 1176Description This documen ... -
浅谈基于Info*Engine的Windchill系统集成应用
2011-06-09 21:04 3474...
相关推荐
Before that time, the previous security framework provided a way to allow or disallow access to resources based on what code was executing. For example, a class loaded from another location on the ...
disallow access to resources based on what code was executing. For example, a class loaded from another location on the Internet would have been considered less trustworthy and disallowed access to ...
# This file is to prevent the crawling and indexing of certain parts # of your site by web crawlers and spiders run by sites like Yahoo! # and Google. By telling these "robots" where not to go on your...
How can we use a class Foo in a header file without access to its definition? We can declare data members of type Foo* or Foo&. We can declare (but not define) functions with arguments, and/or ...
know how to access names in templatized base classes. 条款44:将与参数无关的代码抽离templates factor parameter-independent code out of templates. 条款45:运用成员函数模板接受所有兼容类型 use member ...
Describe the different types of indexes and how indexes can be used to improve performance. Describe what statistics are used for and how they can help in optimizing query performance. ...
WordPress博客的robots.txt文件写法得根据自身网站情况来定,当然...Disallow: /wp- Disallow: /? Disallow: /feed/ Disallow: /*/feed/ Disallow: /trackback/ Disallow: /*/trackback/ Disallow: /page/ Disallow:
安装npm install disallow-new 用法 import disallowNew from 'disallow-new' ;function MyFactory ( ) { // [SNIP]}export default disallowNew ( MyFactory ) ; 别处: let a = new MyFactory ( ) ; // Errors! ...
Disallow: /admin/ Disallow: /api/ Disallow: /callback/ Disallow: /common/ Disallow: /core/ Disallow: /install/ Disallow: /login/ Disallow: /manage/ Disallow: /public/ Disallow: /sdks/ Disallow: /...
(had to disallow the use of the mklink command as it is not stable) April 2011: - fixed default visibility switch - added generic response functions 1/5/10nm - minor bug fixes February 2011: - ...
响应式海运空运国际货运物 User-agent: * Disallow: /plus/ad_js.php Disallow: /plus/advancedsearch.php Disallow: /plus/car.php Disallow: /plus/carbuyaction.php Disallow: /plus/shops_...Disallow: /templets
--no-cache disallow server-cached data. -E, --html-extension save HTML documents with `.html' extension. --ignore-length ignore `Content-Length' header field. --header=STRING insert STRING ...
* Disallow programs from running * Process logging * System responsiveness graph * Stand-alone core engine * Available in x86-32 and x86-64 builds * Much more... # Graphical Interface Features Easily...
eslint-plugin-disallow方法 ESLint插件,用于禁止指定方法 用法 此插件要求还安装ESLint。 在安装了ESLint和此插件的情况下,您将需要启用该插件并配置不允许使用的方法。 安装 如果尚未安装ESLint,请执行以下操作...
github-action-disallow-concurrent-runs 禁止并发工作流运行的GitHub动作 不幸的是,GitHub Actions目前尚无法对工作流进行排队。 如果您有工作流来部署应用程序,那么它就可以了 :collision: 如果多个部署同时...
Disallow: /admin/ Disallow: /api/ Disallow: /data/ Disallow: /include/ Disallow: /install/ Disallow: /member/ Disallow: /plus/ Disallow: /templates/ Disallow: /templates_c/ Disallow: /cache/ Disallow:...
是一个电子商务的网站系统。...Disallow: /admin/ Disallow: /api/ Disallow: /cache/ Disallow: /config/ Disallow: /includes/ Disallow: /install/ Disallow: /lib/ Disallow: /script/ Disallow: /templates/
Disallow: /admin/ Disallow: /api/ Disallow: /apps/ Disallow: /attachment/ Disallow: /data/ Disallow: /hack/ Disallow: /images/ Disallow: /ipdata/ Disallow: /js/ Disallow: /lang/ Disallow: /lib/ ……...
学习linux高级编程的必备资料,其中包括了线程间的通信,进程间的通信,网络编程,file编程……
JQuery-Disallow ##许可证MIT许可证(MIT) 版权所有(c)2015 J.Hilburn,Jacob Weigand 特此免费授予获得此软件和相关文档文件(“软件”)副本的任何人无限制地处理软件的权利,包括但不限于使用,复制,修改...