Progress Software Corporation · NASDAQ:PRGS

Progress Software — Technical Presentation (November 2017)

64 slides from Progress Software's technical presentation, Nov 15, 2017

1. Slide 1: Progress Application Server for OpenEdge (PASOE) Spring security configuration

   Progress Application Server for OpenEdge (PASOE) Spring security configuration

2. Slide 2: Copyright and trademark notice

   © 2017 Progress Software Corporation and/or one of its subsidiaries or affiliates. All rights reserved. These materials and all Progress® software products are copyrighted and all rights are reserved by Progress Software Corporation. The information in these materials is subject to change without no

3. Slide 3: Spring Security Workshop

   Spring Security Workshop For Progress Application Server for OpenEdge (PASOE) Cheryl LaBarge, Ruben Dröge, Chris Skeldon Progress November 15, 2017 Workshop Philosophy We can’t make you an expert in 3 hours but we can give you a solid foundation © 2017 Progress Software Corporation and/or its subsid

4. Slide 4: Learning new things

   Learning new things… 70% of learning is experiential It happens through daily tasks, challenges and practice. 20% of learning is social It happens with and through other people, like coworkers. 10% of learning is formal It happens through structured training courses and programs. © 2017 Progress Sof

5. Slide 5: What is Spring security?

   What is Spring security? © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 5 What is Spring security? User request  Spring security is a powerful and highly customizable authentication and access-control framework  Built into PASOE • Spring is automat

6. Slide 6: What is a security token?

   What is a security token?  An object that contains both user credentials and additional information about the user's roles and capabilities • Offers flexibility - I decide how to give them out – Anonymous or check a flat file, LDAP, AD, OERealm, OpenEdge Authentication Gateway, etc. • Sealed – You

7. Slide 7: Check your request; Authenticate

   1. Check your request – What happens?  Spring applies industry standard filters • HTTPS filters • HTTPS [SSL/TLS] client login filters • CORS (Cross-origin resource sharing) filters External Threats • CSRF (Cross site request forgery) filters  Bottom line: Is the request compliant and reliable? •

8. Slide 8: Authorize; Generate CLIENT-PRINCIPAL

   3. Authorize – What happens?  Based on your configuration, Spring checks the following: • Do we limit access to different types of application (REST, Web, etc.) • Do we limit access to parts of the application Authorization (Accounting, Finance, Human Capital)  Bottom line: Am I limiting access to

9. Slide 9: Where can I store user account information?

   Which applications can use Spring security? User requests access Authentication Provider APSV SOAP REST WEB Static © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 13 Where can I store user account information? User requests access Authentication Provi

10. Slide 10: How do I customize Spring Security

    How do I customize Spring Security  Configuration files • 11.6 uses .xml files • 11.7.x uses two files • oeablSecurity.properties • oeablSecurity.csv • Lesson learned • xml files are error prone • Properties and .csv file are easier to • Edit • Debug • Migrate © 2017 Progress Software Corporation a

11. Slide 11: How do I begin using Spring Security

    How do I begin using Spring Security © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 17 Surprise! You may already be using it! User requests access Authentication Provider 1- Check Request Anonymous yes 2 -Authenticate Check User User info yes yes No

12. Slide 12: Our test application is REST

    Our test application is REST Use a browser to call the ABL Application Ping service Success looks like this json… Why use a simple ping service? To focus on Spring settings application © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 19 Try It 1: Exper

13. Slide 13: Enabling security for REST, WEB, APSV and SOAP

    What did you learn? This is that 20% Social  © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 21 Enabling security for REST, WEB, APSV and SOAP • Spring security is automatically enabled for validating clients of REST and WEB applications • You must u

14. Slide 14: Best Practice

    Best Practice  Use .properties and .csv files • If you read about Spring Security you will find that Spring uses xml files to change behavior – Don’t use .xml – Our updates could overwrite any changes in your xml files  Bottom line: • Keep it simple, always look through the properties we recommend

15. Slide 15: How do I find the right property?

    How do I find the right property? • Your transport determines has potential values for properties • Example: • client.login.model -method client uses to authenticate via HTTP messages Transport URI Path Login Models APSV apsv/** [ none ]; basic SOAP soap/** [ none ] ; basic REST rest/** [ anonymous

16. Slide 16: What does the .csv file customize?

    What does the .csv file customize?  Control URL access controls for web applications • In 11.6 • In 11.7 © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 27 Which file should I edit? Hierarchy of files… Progress install is the superset includes all pr

17. Slide 17: How do I apply changes?

    How do I apply changes?  You will need to restart the Progress Application Server for OpenEdge  When you start the Progress Application Server for OpenEdge the property changes will take effect © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 29 Expl

18. Slide 18: Let's make a change requiring the user to login

    Let’s make a change requiring the user to login User requests access Authentication Provider 1- Check Request Anonymous yes 2 -Authenticate Check User User info yes yes No roles 3- Authorize URL Check Roles * For yes every request! 4 - Generate a CLIENT-PRINCIPAL © 2017 Progress Software Corporation

19. Slide 19: Using form provides default login page

    Setting the client.login.model property to form Default value is anonymous Require a username and password  User.properties flat file located in C:\Progress\OpenEdge\servers\paso e\webapps\ROOT\WEB-INF © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved.

20. Slide 20: What is the http.all.authmanager?

    What is the http.all.authmanager?  User.properties flat file located in C:\Progress\OpenEdge\servers \pasoe\webapps\ROOT\WEB-INF © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 35 Try It 2: Exploring Authentication Progress 18

21. Slide 21: Using form adds additional security

    What did you learn? This is that 20% Social  © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 37 Using form adds additional security  When you use form, • Progress Application Server for OpenEdge receives a client session that persists – You have exp

22. Slide 22: Exploring Authorization

    Exploring Authorization © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 39 Checking roles User requests access 1- Check Request yes Authentication Provider 2 -Authenticate Check User User info Anonymous yes yes 3- Authorize URL Check Roles yes No role

23. Slide 23: How does a direct login handle the request?

    How does a direct login handle the request?  URL access control file located in instance- name/webapps/web-app-name/WEB-INF/oeablSecurity.csv file contains the roles • Intercept-url for each transport type • Default for REST is ‘ROLE_PSCUser’ APSV SOAP REST WEB Static © 2017 Progress Software Corpo

24. Slide 24: Changing the role

    Changing the role  Use the ‘ROLE_PSCAdmin’ Change role to ROLE_PSCAdmin © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 43 Try It 3: Exploring Authorization Progress 22

25. Slide 25: Using a CLIENT-PRINCIPAL

    What did you learn? This is that 20% Social  © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 45 Using a CLIENT- PRINCIPAL © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 46 Progress 23

26. Slide 26: Using a CLIENT-PRINCIPAL

    Using a CLIENT-PRINCIPAL User requests access Authentication Provider 1- Check Request Anonymous yes 2 -Authenticate Check User User info yes yes No roles 3- Authorize URL Check Roles * For yes every request! 4 - Generate a CLIENT-PRINCIPAL © 2017 Progress Software Corporation and/or its subsidiarie

27. Slide 27: CLIENT-PRINCIPAL refresher

    CLIENT-PRINCIPAL refresher  Define a handle DEFINE VARIABLE HCP AS HANDLE NO-UNDO.  Get the CLIENT-PRINCIPAL from the current request hCP = SESSION:CURRENT-REQUEST-INFO:GetClientPrincipal().  Retrieve attributes MESSAGE " ID: '" + hCP:QUALIFIED-USER-ID + "'". MESSAGE " session-id:" hCP:SESSION-ID

28. Slide 28: Startup procedure loads the domains

    Startup procedure loads the domains  Load domains or any persistent information for the server © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 51 Using a client request activate procedure  Event procedures that allow you to User requests access mana

29. Slide 29: What might you do during activation?

    What might you do during activation?  In this lab: We create a variable to look at the CLIENT-PRINCIPAL for the current request and validate the seal, if it is an invalid CLIENT- PRINCIPAL we raise an error - Remember to clean up after yourself ,we delete the handle when we are done © 2017 Progress

30. Slide 30: Where did the messages go?

    Where did the messages go? C:\OpenEdge\WRK\oepas1\logs\oepas1.agent.log StartupProc message Activate client request message © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 55 Try It 4: Using a CLIENT- PRINCIPAL Progress 28

31. Slide 31: Troubleshooting with logs

    What did you learn? This is that 20% Social  © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 57 Troubleshooting with logs © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 58 Progress 29

32. Slide 32: Where to look when it goes wrong

    Where to look when it goes wrong Bad user Immediate feedback 401 Unauthorized Authentication failed © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 59 Default logging  Log files provide general error messages but not all details 1. Agent log 2.Sessio

33. Slide 33: Troubleshooting during development

    Troubleshooting during development <logger name=“org.springframework” level=“DEBUG”  WARNING: Generates HUGE log files for development use only!!! © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 61 How do you apply changes?  You will need to restart

34. Slide 34: Catching authentication errors

    Catching authentication errors  Same bad user Not found  More details with DEBUG level logging  Don’t leave on in Production, debugging only during development © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 63 Catching authorization errors  A use

35. Slide 35: Catching configuration errors

    Catching configuration errors  Manual edits are error prone, how let’s look an example Extra quote Client.login.model=form” Failed © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 65 Catching configuration errors (continued) There it is. form’ There i

36. Slide 36: Try It 5: Troubleshooting with logs

    Try It 5: Troubleshooting with logs What did you learn? This is that 20% Social  © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 68 Progress 34

37. Slide 37: Using LDAP

    Using LDAP © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 69 Configuring to use LDAP with WEB transport User requests access  LDAP - Lightweight Directory Access Protocol .p APSV SOAP REST WEB Static © 2017 Progress Software Corporation and/or its s

38. Slide 38: Add database domains

    For training purposes, LDAP is configured  If your LDAP isn’t configured, that’s another training class   OpenEdge developers will need to 1. Define database domains 2. Create registry entry for domains 3. Set properties to use LDAP and domains 4. Configure authorization to use domains © 2017 Pro

39. Slide 39: Registry domains; LDAP properties

    2. Registry domains  Use gendomreg to create an encrypted registry file seal the domain in the CLIENT-PRINCIPAL • ldapreg.bin  You will load that file into the registery © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 73 Setting properties – LDAP de

40. Slide 40: Domain details; configure authorization

    3. Setting properties – Domain details  oeablSecurity.properties • Only properties you need, at the right level Set domain registryFile Set domainRoleFilter to include all PSC roles © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 75 Configure authori

41. Slide 41: Set handler property

    Set handler property  Use the oeprop command to use a DataObjectHandler to handle web requests oeprop +oepas1.ROOT.WEB.handler1= ”OpenEdge.Web.DataObject.DataObjectHandler : /pdo/{service}”  Warning: Commands must appear on a single line • If you copy and paste from Try It document, you will need

42. Slide 42: The sample application

    The sample application Custom page Employee.html Logout to terminate session © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 79 Using sample stylesheet  Custom style sheet myStyle.css © 2017 Progress Software Corporation and/or its subsidiaries or af

43. Slide 43: Review the agent log

    Review the pasoe1.agent log Domain as part of ID Domain © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 81 Application flow Login Logout Work! © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 82 Progress

44. Slide 44: Try It 6: Using LDAP

    Review the localhost_access_log.YYYY-MM-DDD log login logout © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 83 Try It 6: Using LDAP Progress 42

45. Slide 45: Using SSO

    What did you learn? This is that 20% Social  © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 85 Using SSO © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 86 Progress 43

46. Slide 46: Direct Logins vs. Single Sign-on

    Direct Logins vs. Single Sign-on  Single Sign-On (SSO) is an  Direct logins require users to authentication process that allows a user supply a user name and password to access multiple applications with one for authentication and authorization set of login credentials  SSO is a common procedure

47. Slide 47: For this lab you will use a single server

    For this lab you will use a single server SSOProd Producer ROOT Consumer PASOE1 Payments Consumer © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 89 The user is authenticated someplace! LDAP User requests access  SSO – Single Sign-On Producer APSV SO

48. Slide 48: Configure the SSOProd (Producer) application

    Configure the SSOProd (Producer) application  Deploy a SSOProd application tcman deploy –a SSOProd %DLC%\servers\pasoe\extras\oeabl.war  Customize with properties © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 91 Producer’s oeablSecurities.properti

49. Slide 49: Deploying the Payments application (SSO Consumer)

    Deploying the Payments application (SSO Consumer)  Deploy the Payments application tcman deploy –a Payments %DLC%\servers\pasoe\extras\oeabl.war  Customize with properties © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 93 Consumer’s oeablSecurities

50. Slide 50: Generating HTTP SSO access_token

    SSO tokens have a default timeout 3600 ROOT Payments PASOE1 PASOE2 © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 95 Generating HTTP SSO access_token POST http://localhost:8811/SSOProd/static/auth/j_spring_security_check Accept: application/json j_us

51. Slide 51: Performing SSO using OECP access_token

    Performing SSO using OECP access_token GET http://localhost:8811/web/pdo/DOHService/SportsCE Authorization: OECP <access_token> GET http://localhost:8811/web/pdo/DOHService/SportsCE Authorization: OECP AKAAAQAAAAZBRE1JTgAAoAACAAAABmlzeWVkAACQAAsAAAAIAAAAAFn1Fq4AMAAMAAAAAgAMAKAAGgAAAA9TU09BY2Nlc3NUb2

52. Slide 52: Refresh token and configuring logging

    Generating a new access_token by using a refresh_token POST http://localhost:8811/SSOProd/static/auth/token?op=refresh Accept: application/json {"token_type":"oecp","refresh_token":"faab8dba-5861-4124-b9fe-7767e6eb256e.oepas1"} {"access_token":"AKAAAQAAAAZBRE1JTgAAoAACAAAABmlzeWVkAACQAAsAAAAIAAAAAFn

53. Slide 53: Try It 7: Using SSO

    Try It 7: Using SSO What did you learn? This is that 20% Social  © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 102 Progress 51

54. Slide 54: Using Security Token Service (STS)

    Using the OpenEdge Authentication Gateway Security Token Service (STS) © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 103 Using Security Token Service (STS) User requests access OpenEdge Authentication Gateway Security Token Service APSV SOAP REST WE

55. Slide 55: Authentication Gateway requires Client/Server keys

    Authentication Gateway requires Client\Server keys S Require a Server Key S Require a Server Key C Install as client key © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 105 Installing the client key  The server key will be given to you by the Authent

56. Slide 56: Customize the properties to use STS

    Try your key before you lock your application  You can use the authenticate command to test authenticating users proenv> stsclientutil -url https://52.14.215.117:8810 -cmd authenticate -nohostverify -user ldap_admin@stspug –password password C S © 2017 Progress Software Corporation and/or its subsi

57. Slide 57: Restart the server to see your changes

    Restart the server to see your changes  You will need to restart the Progress Application Server for OpenEdge  When you start the Progress Application Server for OpenEdge the property changes will take effect © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights re

58. Slide 58: Try It 8: Using STS

    Test the application © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 111 Try It 8: Using STS Progress 56

59. Slide 59: What you did today!

    What did you learn? This is that 20% Social  © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 113 What you did today!  Demonstrated that the Spring security process always runs first and lives outside of your applications.  Customized Spring behavio

60. Slide 60: Where can I learn more…

    Where can I learn more… General resources What’s new in 11.7.2  Installation • oeablSecurity.properties.README  OpenEdge Service Pack 11.7.2: ®  Documentation New Information Guide • Spring Security Models and templates • ABL application PING service  Education • Using the OpenEdge Authenticatio

61. Slide 61: Wrist band and cheat card

    Each participant will be given a wrist band as they enter the room Each participant will get a cheat card © 2017 Progress Software Corporation and/or its subsidiaries or affiliates. All rights reserved. 118 Progress 59

62. Slide 62: Definitions

    Definition Definition Authentication – Is a valid user CLIENT-PRINCIPAL – ABL security token. accessing your application? Once created, sealed and validated it is Requires verifying credentials with a used the users credentials for accessing Authentication Provider. application and data. Authorizati

63. Slide 63: Progress

    D Progress 61

64. Slide 64: About Progress

    About Progress Progress (NASDAQ: PRGS) offers the leading platform for developing and deploying mission-critical business applications. Progress empowers enterprises and ISVs to build and deliver cognitive-first applications, that harness big data to derive business insights and competitive advantag

Progress Software — Technical Presentation (November 2017) on 6ix