OpenAM/OpenSSO agent for JBoss EAP 6 / JBoss AS 7

Question

I'd like to add the OpenAM/OpenSSO SSO feature to JBoss EAP 6 or JBoss AS 7. This means I must install an SSO Java EE agent on JBoss. Forgerock's OpenAM download page gives the opportunity to get agents for previous versions of JBoss, but new JBoss EAP 6 / JBoss AS 7 are not supported (for the moment).

Do you know if such an agent is available somewhere, or will be available in short future? If not, do you know how to change JBoss configuration to make it work with OpenAM?

Answer 1

It seems there is no official agent for JBoss EAP 6 for the moment.

However, I could make it work with OpenAM SSO by configuring my JBoss instance manually. To do it, I started with existing jboss_v42_agent.zip available on forgerock download site. Using the jars agent.jar, openssoclientsdk.jar and agent configuration files, I could build a JBoss module using this module.xml:

<?xml version="1.0" encoding="UTF-8"?>
<module xmlns="urn:jboss:module:1.1" name="openam.agents">
  <resources>
    <resource-root path="agent.jar"/>
    <resource-root path="openssoclientsdk.jar"/>
    <resource-root path="."/>
  </resources>
   <dependencies>
    <module name="javax.api"/>
    <module name="javax.servlet.api" />
    <module name="org.picketbox"/>
  </dependencies>
</module>

Then I must update standalone.xml by adding a security domain:

  <security-domain name="AMRealm" cache-type="default">
    <authentication>
      <login-module code="com.sun.identity.agents.jboss.v40.AmJBossLoginModule" flag="required">
        <module-option name="unauthenticatedIdentity" value="anonymous"/>
      </login-module>
      <login-module code="org.jboss.security.ClientLoginModule" flag="required">
        <module-option name="restore-login-identity" value="true"/>
      </login-module>
    </authentication>
  </security-domain>

Finaly I deployed the agentapp.war on JBoss after having modified the MANIFEST.MF by adding a line:

Dependencies: openam.agents

where openam.agents is the name of my module.

Now for the application I want to enable SSO for, I also must perform some updates:

1. web.xml: Add the and nodes:

   <filter>
     <filter-name>Agent</filter-name>
     <display-name>Agent</display-name>
     <description>OpenAM Tomcat Policy Agent Filter</description>
     <filter-class>com.sun.identity.agents.filter.AmAgentFilter</filter-class>
   </filter>
   <filter-mapping>
     <filter-name>Agent</filter-name>
     <url-pattern>/*</url-pattern>
     <dispatcher>REQUEST</dispatcher>
     <dispatcher>INCLUDE</dispatcher>
     <dispatcher>FORWARD</dispatcher>
     <dispatcher>ERROR</dispatcher>
   </filter-mapping>
   

2. jboss-web.xml: Declare the security-domain to be used

   <?xml version="1.0" encoding="UTF-8"?>
   <jboss-web>
     <security-domain>AMRealm</security-domain>
   </jboss-web>
   

3. MANIFEST.MF: Apply same modification than in agentapp.was (add "Dependencies: openam.agents" line)

I'm not sure if it's the best way to enable SSO on JBoss EAP 6 / AS 7 (I'm not a expert), but it seems to work well.

Answer 2

One idea is putting an Apache http server with the OpenAM policy agent installed getting the requests in front of Jboss 7.

This is known as the reverse proxy integration. You can find out more here: http://developers.sun.com/identity/reference/techart/app-integration.html and http://docs.oracle.com/cd/E19575-01/820-3746/gjbna/index.html

Using the reverse proxy aproach you don't have to care about the application's runtime environment.

Answer 3

I noticed some days ago that forgerock has now released a J2EE Agent for JBoss 7.x but I haven't tested it yet. See http://forgerock.org/openam.html