realm-name {
com.borland.security.provider.authn.BasicLoginModule authentication-requirements-flag
DRIVER=driver-name
URL=database-URL
TYPE=basic|tomcat
LOGINUSERID=user-name
LOGINPASSWORD=password
[USERTABLE=user-table-name]
[GROUPTABLE=group-table-name]
[GROUPNAMEFIELD=group-name-field-of-GROUPTABLE]
[PASSWORDFIELD=field-name]
[USERNAMEFIELDINUSERTABLE=field-name]
[USERNAMEFIELDINGROUPTABLE=field-name]
[DIGEST=digest-name]
};
com.borland.security.provider.authn.JDBCLoginModule authentication-requirements-flag
DRIVER=driver-name
URL=database-URL
[DBTYPE=type]
USERTABLE=user-table-name
USERNAMEFIELD=user-name-field-of-USERTABLE
ROLETABLE=role-table-name
ROLENAMEFIELD=field-name
USERNAMEFIELDINROLETABLE=field-name
};
DataStoreDriver
com.borland.security.provider.authn.LDAPLoginModule authentication-requirements-flag
INITIALCONTEXTFACTORY=connection-factory-name
PROVIDERURL=database-URL
SEARCHBASE=search-start-point
USERATTRIBUTES=attribute1, attribute2, ...
USERNAMEATTRIBUTE=attribute
QUERY=dynamic-query
};
com.borland.security.provider.authn.HostLoginModule authentication-requirements-flag;
};The HostLoginModule shipped with VisiSecure for UNIX platforms utilizes simple APIs that are uniform on most UNIX platforms. This is defined in the POSIX standard header file pwd.h. Advanced shadow password APIs are available for deployments that demand higher security measures. However, one problem associated with this is that the process calling the APIs must run as root. Since the APIs are not in POSIX standard, the login module code is less portable.To write your own custom login module, refer to the ‘customlogin’ example in the VisiSecure example folder. You may then incorporate shadow password APIs in your custom login module. These APIs are available in the system header file shadow.h. Please consult your system manual to find out more about them.As a first step, create and configure the database to store users and roles. Micro Focus provides the userdbadmin tool, run from the command line, to auto-create the required tables, create groups, and associate users with groups.The userdbadmin tool is a command-line tool that can be used to create and manage user databases for the BasicLoginModule. The userdbadmin uses a proprietary schema and can be pointed at any database. Using this tool, you can administer users who can be authenticated using Basic login modules. Though the tool and BasicLoginModule work using various JDBC databases, it is still recommended that you use JDataStore which is shipped with VisiBroker.To facilitate the use of popular databases, the userdbadmin tool comes pre-configured to recognize database urls and to configure itself to use the appropriate drivers.If you do not provide driver information and userdbadmin does not recognize the database, it will prompt for this information. Once it has successfully acquired this information, it will write this information into a file called .userdbadmin.config in the directory corresponding to the user.home system property or to the file specified by the -config command line option.Future users of userdbadmin will read the config file from either the user.home directory or from the file specified by the -config option and will recognize the new database configuration, so you do not need to type the driver information every time.Launch userdbadmin in an interactive mode with the created database. The interactive mode helps you to issue multiple commands. To do this, enter the command as given below at the command prompt.In Example 1, you added a user whose name is Krish and password krishpwd and added him as a member of the group called accountant.In Example 2, you added a user whose name is bill and password billpwd and added him as a member of the group called clerk.To list existing users in the database, type ‘listusers’ in the command line to list all the users and their groups:To list all groups and their membership, enter listgroup at the command prompt.To create new groups and their membership, enter addgroup at the command prompt.You can check the newly added group by running the command listgroup. The newly added groups dba and admin would be listed.You can check the newly added user by running the command listusers. The newly added group memberships would be listed.You can check the newly removed group by running the command listusers. The newly removed group accountant will not be listed.You can check the newly added user by running the command listusers. The newly added user jack would be listed.To remove the group from the user, enter the command leavegroup at the command prompt.You can check the newly removed user by running the command listusers. The user krish would be listed without the removed membership.To remove the user from the group, enter the command removeuser at the command prompt.You can check the newly removed user by running the command listusers. The newly removed user would be listed.