Securing Multiple Domains

To prevent role mapping leaks between multiple tenant domains, configure domains and assign shared security configurations.

SAP recommends that the Platform administrator:

Create at least one new tenant domain in SAP Control Center. You may require more, depending on your mobility strategy.
Restrict the use of the "admin" security configuration on the "default" domain to administration authentication only.
Assign at least one domain administrator. Depending on the maintenance issues of large-scale deployments, the administrator may want to use at least one Domain administrator per domain.
Create and assign at least one new security configuration. The administrator may create and assign security configurations, if security requirements (stringency, uniqueness) differ between tenant domains.

For more information, search for Domains in SAP Control Center for SAP Mobile Platform.

For example, a company named "Acme" has two separate divisions, HR and sales. The employees in each division use different mobile applications. In this case, SAP recommends using two domains in SAP Control Center to simplify the management of packages, users, applications and related artifacts.

Acme implements separate domain administrators for each domain, but is using a single "acme" security configuration due to the way the corporate LDAP directory is configured. This configuration includes an LDAPLoginModule provider that uses this URL:

ldap://ldap.acme.com

As a result, all employees of all domains are authenticated by the same LDAP server, and authorized by the same set of groups and roles.

Note: Because domain administrators are authenticated from the same acme LDAP repository via the admin security configuration on the default domain, those role mappings can "leak" between domains. Consequently, a domain administrator assigned to one domain gets granted access to another. This side-effect is undesirable and should be avoided.

Determining a Tenancy Strategy
Determine how many domains to create and how to distribute domain components. A strategic multitenant structure for the cluster balances system-availability considerations with administrative concerns.
Benefits and Drawbacks of a Shared Security Configuration
Determine whether or not to use a shared security configuration across multiple domains.
Creating and Enabling a New Domain
Create and configure multiple domains within a single SAP Mobile Platform installation. A domain must be enabled for application users to access the packages deployed in the domain. Enabling a domain also triggers synchronization of the domain changes to the secondary nodes in the cluster. Application users who attempt to access a disabled domain receive an error message.

Parent topic: Securing Platform Administration

Previous topic: Preparing SSL for HTTPS Listeners

Next topic: Configuring Secure Communication With an HTTP Proxy