Documentation Changes

• File name changes:
  • roles-map.xml changed to role-mapping.xml
  • csi.properties changed to csi_config.xml
• The simple login module has been replaced by the preconfigured user login module:

  Preconfigured user login – defines a user name, password, and a list of roles. The default user name is sccadmin; its password is configured during installation and its native role is SCC Administrator, which maps to sccAdminRole. You can create additional accounts by adding preconfigured user login modules to csi_config.xml. However, Sybase does not recommend the use of preconfigured user login modules for authentication in production environments.

• The last sentence of the NT proxy login module description has been replaced with this:

  Windows authentication is enabled by default, but it requires some configuration after an upgrade from SCC 3.2.5 or earlier.

1. Log in to Sybase Control Center using an account with administrative privileges. (The login account or its group must have sccAdminRole.)
2. Select Application > Administration > Security.
3. Click to select or deselect the box labeled Automatically add SCC login records for authenticated logins.
4. Click to select or deselect the box labeled Automatically grant sccUserRole to newly created logins.
5. Click OK to close the Security dialog.

• If you opted not to automatically create Sybase Control Center login accounts, enter each account into Sybase Control Center manually.
• Grant privileges to login accounts that require more than basic user access. You can grant privileges by assigning Sybase Control Center roles directly to the login accounts, or by assigning the login accounts to groups and mapping Sybase Control Center roles to the groups. The group approach is generally more efficient.

1. Using a login account with root privileges, configure the pluggable authentication module for your platform:

   Platform	Action
   Solaris	Append the contents of the <SCC-install-dir>/utility/<sunos>/pam.conf file (provided with Sybase Control Center) to the /etc/pam.conf file on your Solaris platform.
   Linux	Copy the <SCC-install-dir>/utility/<linux>/sybase-csi file (provided with Sybase Control Center) to the /etc/pam.d directory on your Linux platform. Note: The sybase-csi file provided with Sybase Control Center is not compatible with the most recent SUSE Linux versions. For SUSE 11 and later, see the example at the end of this topic.

   Note: In the table above, the portion of the path that indicates the operating system might differ slightly from what is shown.
2. If the host UNIX system is not using a directory lookup for authentication (yp or NIS, for example) and authentication is carried out against the local /etc/passwd file, change the permissions on /etc/shadow to provide read access to the login account that executes SCC.
3. (Skip if you configured a PAM before starting Sybase Control Center) Restart Sybase Control Center.
4. (Optional) Change account creation options.
   1. Log in to Sybase Control Center using an account with administrative privileges (sccAdminRole).
   2. Select Application > Administration > Security.
   3. Click to select or deselect the box labeled Automatically add SCC login records for authenticated logins. (By default, this option is enabled for SCC 3.2.6 and later.)
   4. Click to select or deselect the box labeled Automatically grant sccUserRole to newly created logins. (By default, this option is enabled for SCC 3.2.6 and later.)
   5. Click OK to close the Security dialog.

# sybase-csi PAM Configuration (SUSE style)
auth       include      common-auth
account    include      common-account
password   include      common-password
session    include      common-session

• If you opted not to automatically create Sybase Control Center login accounts, enter each account into Sybase Control Center manually. Sybase Control Center needs the accounts for purposes of setting authorization (user privileges).
• Grant privileges to login accounts that require more than basic user access. You can grant privileges by assigning Sybase Control Center roles directly to the login accounts, or by assigning the login accounts to groups and mapping Sybase Control Center roles to the groups. The group approach is generally more efficient.

1. Open the <SCC-install-dir>\conf\csi_config.xml file.
2. Uncomment the LDAP module in the configuration file by removing the surrounding <!-- and --> characters (or, if necessary, add an LDAP module to the file). The sample module below specifies the LDAP server that will provide user authentication.

   The sample module shows the properties used for an OpenDS LDAP server. See the example at the end of this task for values that work for ActiveDirectory. Configuration properties you can use in the LDAP module are described in a subtopic.

   <authenticationProvider controlFlag="sufficient" name="com.sybase.security.ldap.LDAPLoginModule">
       <options name="BindDN" value="cn=Directory Manager"/>
       <options name="BindPassword" value="secret"/>
       <options name="DefaultSearchBase" value="dc=example,dc=com"/>
           <options name="ProviderURL" value="ldap://localhost:10389"/>
          
       <options name="ServerType" value="openldap"/>
   
   </authenticationProvider>
   <provider name="com.sybase.security.ldap.LDAPAttributer" type="attributer"/>
   

   Note: Change only values shown in bold. If BindPassword is encrypted (which Sybase recommends), the line that defines it must include encrypted="true". The line should look similar to this:

   <options name="BindPassword" encrypted="true" value="1snjikfwregfqr43hu5io..."/>

3. Save the file.
4. If your LDAP server’s SSL certificate is signed by a nonstandard certificate authority (for example, if it is a self-signed certificate), use the keytool utility to configure your JVM or JDK to trust the certificate. Execute a command similar to this:

   Windows:

   keytool -import -keystore %SYBASE_JRE7%\lib\security\cacerts -file 
   <your cert file and path> -alias ldapcert -storepass changeit
   

   UNIX:

   keytool -import -keystore $SYBASE_JRE7/lib/security/cacerts -file 
   <your cert file and path> -alias ldapcert -storepass changeit
   

 
ServerType: msad2K
DefaultSearchBase: dc=<domainname>,dc=<tld> or o=<company name>,c=<country code>
                E.g. dc=sybase,dc=com or o=Sybase,c=us
ProviderUrl: ldaps://<hostname>:<port>
                E.g.:  ldaps://myserver:636
AuthenticationFilter: (&amp;(userPrincipalName={uid}) (objectclass=user))
BindDN: <User with read capability for all users>
BindPassword: <Password for BindDN user>
RoleFilter: (|(objectclass=groupofnames) (objectclass=group))
controlFlag: sufficient

• The first paragraph now reads as follows:

  Use these properties in your csi_config.xml file to control your LDAP service.

• The AuthenticationFilter table row (row 6) now reads as follows:

  Property	Default Value	Description
  AuthenticationFilter	For most LDAP servers: (&(uid={uid})(objectclass=person)) or For Active Directory email lookups: (&(userPrincipalName={uid}) (objectclass=user)) [ActiveDirectory] For Active Directory Windows username lookups: (&(sAMAccountName={uid})(objectclass=user))	The filter to use when looking up the user. When performing a username based lookup, this filter is used to determine the LDAP entry that matches the supplied username. The string "{uid}" in the filter is replaced with the supplied username.

• The BindPassword table row (row 10) now reads as follows:

  Property	Default Value	Description
  BindPassword	none	BindPassword is the password for BindDN, which is used to authenticate any user. BindDN and BindPassword are used to separate the LDAP connection into units. The AuthenticationMethod property determines the bind method used for this initial connection. Sybase recommends encrypting passwords and provides a password encryption utility for the purpose. If you encrypt BindPassword, include encrypted=true in the line that sets the option. For example: <options name="BindPassword" encrypted="true" value="1snjikfwregfqr43hu5io..."/> If you do not encrypt BindPassword, the option might look like this: <options name="BindPassword" value="s3cr3T"/>

• The RoleFilter table row (row 12) now reads as follows:

  Property	Default Value	Description
  RoleFilter	For SunONE/iPlanet: (&(objectclass=ldapsubentry) (objectclass=nsroledefinition)) For Netscape Directory Server: (objectclass=groupofnames) (objectclass=groupofuniquenames)) For ActiveDirectory: (objectclass=groupofnames) (objectclass=group))	The role search filter. This filter should, when combined with the role search base and role scope, return a complete list of roles within the LDAP server. There are several default values depending on the chosen server type. If the server type is not chosen or this property is not initialized, no roles are available.

• Required: Configure an LDAP authentication module.
• Optional: Create these LDAP groups and assign Sybase Control Center users to them:
  • sybase – confers sccUserRole. Assign all SCC users to the sybase group.
  • SCC Administrator – confers sccAdminRole. Assign only SCC administrators to this group.

• (Recommended) Add a “sybase” group and an “SCC Administrator” group to the operating system or LDAP server Sybase Control Center is using to authenticate users, and add all users who need to access Sybase Control Center to one or both groups.
• Configure Sybase Control Center to use existing groups in LDAP or the operating system by editing the role-mapping.xml file. This option is described here.

• In the second paragraph, “properties file” has changed to “configuration file.”
• The third paragraph now reads as follows:

  passencrypt, which is located in the Sybase Control Center bin directory, uses the SHA-256 hash algorithm for passwords used in the PreConfiguredLoginModule in csi_config.xml.

• In step 2, the -csi option has been added to the passencrypt command:

  To encrypt a password, enter passencrypt -csi.

• The first note (before step 1) now reads as follows:
  Note: Sybase does not recommend that you manually create a native login account for every Sybase Control Center user. It is more efficient to configure Sybase Control Center to authenticate users through their user accounts in LDAP or the operating system. When you do that, SCC automatically creates a native account for every authenticated user.
• The second note (after step 9) has been removed from the online help.

• To populate the Administration Console with information on one or more resources: in the Perspective Resources view, select the resources and select Resource > Administration Console. This method is fastest.
• To populate the Administration Console with information on all the resources in the current perspective: from the main menu bar, select View > Open > Administration Console. If you are monitoring a large number of resources, the Administration Console may take a few minutes to load. CR #668582.