• local system ID: the user's local operating system ID. Web Express Logon currently supports Microsoft Active Directory (Windows Domain). Host On-Demand will use native code to obtain a user's local Windows domain ID when User Identity Type is set to "Local System ID" in the Express Logon session properties panel. To use this option, the "WindowsDomain" HTML parameter must be set to contain the name of the Windows Domain(s) to which the end users belong. Multiple domains must be separated by commas.
• network ID: the user's network security application ID or client certificate. Web Express Logon currently supports IBM Tivoli Access Manager and Netegrity Siteminder.
• Portal ID: the user's Portal Server ID. Web Express Logon currently supports Portal Server, a component of IBM WebSphere Portal.

• login macro
• Credential Mapper Servlet (CMS)
• Network Security plug-in
• Host Credential Mapper (HCM) database

• a JDBC database such as one created with IBM WebSphere DB2
• Portal Server Credential Vault

• IBM Tivoli Access Manager: amcms.war
• Netegrity Siteminder: smcms.war
• Microsoft Active Directory (Windows Domain): wincms.war

If you have a different network security application, you will need to customize your own version of the CMS. For more information about how to do this, refer to Customizing Web Express Logon.

• web.xml: the servlet configuration file that you will edit in a later step
• DCAS.xml: for non-Certificate-based Web Express Logon, a sample file to help you better understand DCAS parameters and their values
• DCASELF.xml: for Certificate-based Web Express Logon, a sample file to help you better understand DCAS parameters and their values
• was.policy: for IBM WebSphere Application Server users only, this file contains the required permissions for the CMS when Java 2 security is enabled (refer to Troubleshooting Web Express Logon for more information)

• Host Credential Mapper (HCM) plug-in: The name of the parameter is CMPICredentialMappers, and the parameter value is a compound value that contains the list of all available HCM plug-ins, for example, CMPIDCASPlugin CMPIVaultPlugin, and CMPIDCASELFPlugin. Currently, the value is echo, but you will eventually replace this with the name of your HCM plug-in.
  Code example:

  <init-param>
     <param-name>CMPICredentialMappers</param-name>          
     <param-value>echo</param-value>  
  </init-param>

• Network Security plug-in: The name of the parameter is CMPINetworkSecurity, and the parameter value is the full path name of the class that handles the CMS interface into the network security application. This example is taken from the amcms.war file, which is for Tivoli Access Manager:
  Code example:

  <init-param>
       <param-name>CMPINetworkSecurity</param-name>
       <param-value>com.ibm.eNetwork.security.sso.cms.CMNPIAccessManager
  			</param-value>      
  </init-param>

  The Network Security plug-in does not apply to Microsoft Active Directory (Windows Domain), Portal Server, or Certificate-based Web Express Logon. For Microsoft Active Directory, the Windows login ID is used to identify the user. For Portal Server, the Portal ID is used to identify the user. For Certificate-based Web Express Logon, the client certificate is used to identify the user.

• echo plug-in: The name of this INIT parameter (echo) is the same as the value for the HCM plug-in. In a future step, you will replace echo with the name of your HCM plug-in.
  Host On-Demand provides this optional echo plug-in in case you want to confirm that you are able to deploy the CMS correctly before you begin editing the web.xml file. For example, after you deploy your CMS to a Web server, you can test it by entering the following syntax in a workstation's browser address bar: https://web_application_server_name/context_root/CredMapper, where web_application_server_name is the name of the Web application server, context_root is the name of the context root that you specify when deploying the CMS, and CredMapper is the name of the CMS itself.

  Some Web application server products allow you to deploy the servlet first and then edit the XML file. Other products, such as WebSphere Application Server Version 5, work best when you deploy the servlet after you edit the XML code. Refer to your product's documentation for details.

  Code example:

  <init-param>
     <param-name>echo</param-name>
     <param-value>com.ibm.eNetwork.security.sso.cms.CMPINetEcho,AuthType_All,*
  		</param-value>
  </init-param>

Starting with Host On-Demand V9.03, the CMPI_DCAS_KEYRING_FILE and CMPI_DCAS_KEYRING_PASSWORD are deprecated and should not be used. Instead, CMPI_DCAS_TRUSTSTORE, CMPI_DCAS_TRUSTSTORE_PASSWORD, and CMPI_DCAS_TRUSTSTORE_TYPE should be used. However, CMPI_DCAS_KEYRING_FILE and CMPI_DCAS_KEYRING_PASSWORD will continue to work in lieu of CMPI_DCAS_TRUSTSTORE and CMPI_DCAS_TRUSTSTORE_PASSWORD, and the type pkcs12 will be assumed when these deprecated parameters are used.

For non-Certificate-based Web Express Logon, use DCAS.xml located in the WAR file as a reference for adding parameters when editing the web.xml file. For Certificate-based Web Express Logon, use DCASELF.xml as a reference.

1. Add the following HCM database parameters to allow the client to connect to the DCAS securely:

   CMPI_DCAS_KEYRING_FILE

   This parameter references an SSL keyring database file that provides access to the DCAS client certificate as well as the DCAS server's certificate. The certificates establish a client-authenticated, secure connection with the DCAS server. The DCAS plug-in serves as the DCAS client. You will create a keyring database file called HODDCAS.p12 in Step 3: Create the SSL key database..

   Code example:

   <init-param> 
       <param-name>CMPI_DCAS_KEYRING_FILE</param-name> 
       <param-value>C:\Program Files\IBM\Host On-Demand\HOD\HODDCAS.p12
   		</param-value>
   </init-param>

   CMPI_DCAS_KEYRING_PASSWORD

   This parameter specifies the password for the keyring database.

   This parameter should be encrypted using the password encryption tool. It is decrypted by the HCM before using it. For more information about the password encryption tool, refer to Password encryption tool.

   Code example:

   <init-param>
   	  <param-name>CMPI_DCAS_KEYRING_PASSWORD</param-name>
   	  <param-value>45ie8WciVu</param-value> 
   </init-param>

   CMPI_DCAS_TRUSTSTORE

   This parameter is required unless CMPI_DCAS_USE_DEFAULT_TRUSTSTORE or CMPI_DCAS_USE_WELLKNOWN_KEYS is true. This parameter contains the name of the truststore to be used by JSSE to lookup the DCAS certificates.

   CMPI_DCAS_TRUSTSTORE_TYPE

   This parameter is required unless CMPI_DCAS_USE_DEFAULT_TRUSTSTORE or CMPI_DCAS_USE_WELLKNOWN_KEYS is true. This parameter contains the type of the truststore specified by CMPI_DCAS_TRUSTSTORE. Valid values are pkcs12, jceks, and jks.

   CMPI_DCAS_TRUSTSTORE_PASSWORD

   This parameter is required unless CMPI_DCAS_USE_DEFAULT_TRUSTSTORE or CMPI_DCAS_USE_WELLKNOWN_KEYS is true. This parameter contains the password of the truststore specified by CMPI_DCAS_TRUSTSTORE.

2. The following parameters contain all the relevant information needed to connect to your HCM database, which in this example is a JDBC database table. You can either configure access to an existing database or point to a newly created database. The level of security for the database varies according to database vendor. Refer to the database application's documentation for details.

   The following parameters are not used for Certificate-based Web Express Logon: CMPI_DCAS_DB_ADDRESS CMPI_DCAS_DB_NET_DRIVER CMPI_DCAS_DB_USERID CMPI_DCAS_DB_TABLE CMPI_DCAS_DB_PASSWORD

   CMPI_DCAS_DB_ADDRESS

   This is a URL string that provides the address of the database. An example of this string is jdbc:db2://dtagw:6789/HODSSO.

   Code example:

   <init-param> 
      <param-name>CMPI_DCAS_DB_ADDRESS</param-name>
   	 <param-value>jdbc:db2://dtagw.raleigh.ibm.com:6789/HODSSO
   		</param-value> 
   </init-param>

   CMPI_DCAS_DB_NET_DRIVER

   This string contains the name of the class that acts as the network database driver. An example of this string is COM.ibm.db2.jdbc.net.DB2Driver. The location of this class is assumed to be in the existing class path.

   Code example:

   <init-param> 
      <param-name>CMPI_DCAS_DB_NET_DRIVER</param-name> 
      <param-value>COM.ibm.db2.jdbc.net.DB2Driver</param-value> 
   </init-param>

   CMPI_DCAS_DB_USERID

   This is the ID of the user account to use when accessing the database.

   Code example:

   <init-param> 
      <param-name>CMPI_DCAS_DB_USERID</param-name> 
      <param-value>admin</param-value> 
   </init-param>

   CMPI_DCAS_DB_PASSWORD

   This is the password of the user account to use when accessing the database.

   This parameter should be encrypted using the encrypt password tool. It is decrypted by the HCM plug-in before using it. For more information about the password encryption tool, refer to Password encryption tool.

   Code example:

   <init-param> 
      <param-name>CMPI_DCAS_DB_PASSWORD</param-name> 
      <param-value>tuBu9v8lHiJi1jt08UgHzA==</param-value> 
   </init-param> 

   CMPI_DCAS_DB_TABLE

   This entry identifies the table to use for the needed query.

   Code example:

   <init-param> 
      <param-name>CMPI_DCAS_DB_TABLE</param-name> 
      <param-value>HACP</param-value> 
   </init-param>

3. The following parameters should correspond directly to the column headings in your HCM database and should clearly indicate the contents of the columns. With some databases, such as IBM DB2, the column headings must be in all upper-case letters, for example, NETWORKID, HOSTADDRESS, APPLICATIONID, and HOSTID.
   Based on the information provided by the first three of these parameters (network ID, host address, and the host application ID), you can make a SQL query of the database to get the host ID. The result of the query is entered in the host ID (HOSTID) column. Assuming that the query is successful, a call is made to the DCAS to request the passticket.

   The following parameters are not used for Certificate-based Web Express Logon: CMPI_DCAS_DB_NETID_COL_NAME CMPI_DCAS_DB_HOSTADDR_COL_NAME CMPI_DCAS_DB_HOSTAPP_COL_NAME CMPI_DCAS_DB_HOSTID_COL_NAME

   CMPI_DCAS_DB_NETID_COL_NAME

   This entry identifies the name of the column that contains the network ID value (NETWORKID).

   Code example:

   <init-param> 
      <param-name>CMPI_DCAS_DB_NETID_COL_NAME</param-name> 
      <param-value>NETWORKID</param-value> 
   </init-param>

   CMPI_DCAS_DB_HOSTADDR_COL_NAME

   This entry identifies the name of the column that contains the host address value (HOSTADDRESS).

   Code example:

   <init-param> 
      <param-name>CMPI_DCAS_DB_HOSTADDR_COL_NAME</param-name> 
      <param-value>HOSTADDRESS</param-value> 
   </init-param>

   CMPI_DCAS_DB_HOSTAPP_COL_NAME

   This entry identifies the name of the column that contains the host application value (APPLICATIONID).

   Code example:

   <init-param> 
      <param-name>CMPI_DCAS_DB_HOSTAPP_COL_NAME</param-name> 
      <param-value>APPLICATIONID</param-value> 
   </init-param>

   CMPI_DCAS_DB_HOSTID_COL_NAME

   This entry identifies the name of the column that contains the user's host identification value (HOSTID).

   Code example:

   <init-param> 
      <param-name>CMPI_DCAS_DB_HOSTID_COL_NAME</param-name> 
      <param-value>HOSTID</param-value> 
   </init-param>

   CMPI_DCAS_USE_NETID_AS_HOSTID

   This entry when set to True identifies the network ID as the RACF ID without performing any mapping.

   Code example:

   <init-param> 
      <param-name>CMPI_DCAS_USE_NETID_AS_HOSTID</param-name> 
      <param-value>False</param-value> 
   </init-param>

CMPI_DCAS_TRACE_LEVEL

This parameter specifies the trace level for the DCAS plug-in. The trace messages are logged to the log file specified by CMPI_TRACE_LOG_FILE parameter. Depending on your Web application server, they may or may not be logged to the console. Trace level values include the following:

• 0 = None: No tracing. This is the default.
• 1 = Minimum: Trace APIs and parameters, return values, and errors.
• 2 = Normal: Trace Minimum plus internal APIs and parameters and informational messages.
• 3 = Maximum: Trace Normal plus Java exceptions.

Code example:

<init-param> 
   <param-name>CMPI_DCAS_TRACE_LEVEL</param-name> 
   <param-value>3</param-value> 
</init-param>

CMPI_DCAS_HOST_PORT

The DCAS host address is determined based on the destination host specified in the request. The default port address of 8990 is used, but you may override it using this parameter.

Code example:

<init-param> 
   <param-name>CMPI_DCAS_HOST_PORT</param-name> 
   <param-value>8990</param-value> 
</init-param>

CMPI_DCAS_USE_WELLKNOWN_KEYS

Prior to Host On-Demand 9.03, the parameter CMPI_DCAS_USE_WELLKNOWN_KEYS defaulted to true and indicated that the WellKnownTrustedCAs.p12 file should be used along with the CMPI_DCAS_KEYRING_FILE to look up the DCAS server certificate. Starting with Host On-Demand 9.03, This parameter defaults to false, and when it is true, it indicates that WellKnownTrustedCAs.p12 is the ONLY truststore that JSSE will use to look up the DCAS client and server certificates.

Code example:

<init-param> 
   <param-name>CMPI_DCAS_USE_WELLKNOWN_KEYS</param-name> 
   <param-value>true</param-value> 
</init-param>

CMPI_DCAS_WELLKNOWN_PASSWORD

If you choose to replace the provided WellKnownTrustedCAs.p12 with your own, you will need to specify the password here. Place your WellKnownTrustedCAs.p12 file in the same directory where the provided version was located.

This password should be encrypted using the encrypt password tool. For more information about the password encryption tool, refer to Password encryption tool.

Code example:

<init-param> 
   <param-name>CMPI_DCAS_WELLKNOWN_PASSWORD</param-name> 
   <param-value>tuBu9v8lHiJi1jt08UgHzA==</param-value> 
</init-param>

CMPI_DCAS_VERIFY_SERVER_NAME

This parameter indicates if the server host name in the certificate must be verified in addition to the certificate validation. The default is false.

Code example:

<init-param> 
   <param-name>CMPI_DCAS_VERIFY_SERVER_NAME</param-name> 
   <param-value>false</param-value> 
</init-param>

CMPI_DCAS_REQUEST_TIMEOUT

This parameter specifies the passticket request timeout in milliseconds. It should be less than the Host On-Demand macro time-out value. The default is 50000.

Code example:

<init-param> 
   <param-name>CMPI_DCAS_REQUEST_TIMEOUT</param-name> 
   <param-value>50000</param-value> 
</init-param>

The CMPI_DCAS_DB_PRESERVE_WHITESPACE and CMPI_DCAS_DB_CASE_SENSITIVE parameters are not used for Certificate-based Web Express Logon.

CMPI_DCAS_DB_PRESERVE_WHITESPACE

This parameter indicates whether to trim white spaces from the credential request parameters or not. If true, the white spaces are not trimmed. The default is false.

Code example:

<init-param> 
   <param-name>CMPI_DCAS_DB_PRESERVE_WHITESPACE</param-name> 
   <param-value>false</param-value> 
</init-param>

CMPI_DCAS_DB_CASE_SENSITIVE

This parameter specifies whether or not the DCAS plug-in converts the application ID and network ID of the user to lowercase characters and then uses the lcase() method to make SQL queries to the HCM database. This parameter should be set to true when using SQL applications that do not support the lcase() method.

Code example:

<init-param> 
   <param-name>CMPI_DCAS_DB_CASE_SENSITIVE</param-name> 
   <param-value>false</param-value> 
</init-param>

CMPI_DCAS_USE_DEFAULT_TRUSTSTORE

This parameter indicates that JSSE should use the default truststore to lookup the DCAS certificates. This parameter is overridden by the CMPI_DCAS_USE_WELLKNOWN_KEYS parameter when CMPI_DCAS_USE_WELLKNOWN_KEYS is set to true. The default is false.

CMPI_DCAS_NO_FIPS

This parameter indicates that the FIPS security provider should not be used. The default security provider will be used instead. The default is false.

• IBM Tivoli Access Manager: amcms.war
• Netegrity Siteminder: smcms.war
• Microsoft Active Directory (Windows Domain): wincms.war

If you have a different network security application, you will need to customize your own version of the CMS. For more information about how to do this, refer to Customizing Web Express Logon.

• web.xml: the servlet configuration file that you will edit in a later step
• Vault.xml: a sample file to help you better understand Vault parameters and their values
• was.policy: for IBM WebSphere Application Server users only, this file contains the required permissions for the CMS when Java 2 security is enabled (refer to Troubleshooting Web Express Logon for more information)

• Host Credential Mapper (HCM) plug-in: The name of the parameter is CMPICredentialMappers, and the parameter value is a compound value that contains the list of all available HCM plug-ins, for example, CMPIDCASPlugin CMPIVaultPlugin, and CMPIDCASELFPlugin. Currently, the value is echo, but you will eventually replace this with the name of your HCM plug-in.
  Code example:

  <init-param>
     <param-name>CMPICredentialMappers</param-name>          
     <param-value>echo</param-value>  
  </init-param>

• Network Security plug-in: The name of the parameter is CMPINetworkSecurity, and the parameter value is the full path name of the class that handles the CMS interface into the network security application. This example is taken from the amcms.war file, which is based on the Tivoli Access Manager network security application:
  Code example:

  <init-param>
       <param-name>CMPINetworkSecurity</param-name>
       <param-value>com.ibm.eNetwork.security.sso.cms.CMNPIAccessManager</param-value>      
  </init-param>

  The Network Security plug-in does not apply to Microsoft Active Directory (Windows Domain), Portal Server, or Certificate-based Web Express Logon. For Microsoft Active Directory, the Windows login ID is used to identify the user. For Portal Server, the Portal ID is used to identify the user. For Certificate-based Web Express Logon, the client certificate is used to identify the user.

• echo plug-in: The name of this INIT parameter (echo) is the same as the value for the HCM plug-in. In a future step, you will replace echo with the name of your HCM plug-in.
  Host On-Demand provides this optional echo plug-in in case you want to confirm that you are able to deploy the CMS correctly before you begin editing the web.xml file. For example, after you deploy your CMS to a Web server, you can test it by entering the following syntax in a workstation's browser address bar: https://web_application_server_name/context_root/CredMapper, where web_application_server_name is the name of the Web application server, context_root is the name of the context root that you specify when deploying the CMS, and CredMapper is the name of the CMS itself.

  Some Web application server products allow you to deploy the servlet first and then edit the XML file. Other products, such as WebSphere Application Server Version 5, work best when you deploy the servlet after you edit the XML code. Refer to your product's documentation for details.

  Code example:

  <init-param>
     <param-name>echo</param-name>
     <param-value>com.ibm.eNetwork.security.sso.cms.CMPINetEcho,AuthType_All,*
  		</param-value>
  </init-param>

Use the Vault.xml file located in the WAR file as a reference for adding parameters when editing the web.xml file.

1. The following parameters contain all the relevant information needed to connect to your HCM database, which in this example is a JDBC database table. You can either configure access to an existing database or point to a newly created database. The level of security for the database varies according to database vendor. Refer to the database application's documentation for details.

   CMPI_VAULT_DB_ADDRESS

   This is a URL string that provides the address of the database. An example of this string is jdbc:db2://dtagw:6789/HODSSO.

   Code example:

   <init-param> 
      <param-name>CMPI_VAULT_DB_ADDRESS</param-name>  
   	 <param-value>jdbc:db2://dtagw.raleigh.ibm.com:6789/HODSSO</param-value> 
   </init-param>

   CMPI_VAULT_DB_NET_DRIVER

   This string contains the name of the class that acts as the network database driver. An example of this string is COM.ibm.db2.jdbc.net.DB2Driver. The location of this class is assumed to be in the existing class path.

   Code example:

   <init-param> 
      <param-name>CMPI_VAULT_DB_NET_DRIVER</param-name> 
      <param-value>COM.ibm.db2.jdbc.net.DB2Driver</param-value> 
   </init-param>

   CMPI_VAULT_DB_USERID

   This is the ID of the user account to use when accessing the database.

   Code example:

   <init-param> 
      <param-name>CMPI_VAULT_DB_USERID</param-name> 
      <param-value>admin</param-value> 
   </init-param>

   CMPI_VAULT_DB_PASSWORD

   This is the password of the user account to use when accessing the database.

   This parameter should be encrypted using the encrypt password tool. It is decrypted by the HCM plug-in before using it. For more information about the password encryption tool, refer to Password encryption tool.

   Code example:

   <init-param> 
      <param-name>CMPI_VAULT_DB_PASSWORD</param-name> 
      <param-value>tuBu9v8lHiJi1jt08UgHzA==</param-value> 
   </init-param> 

   CMPI_VAULT_DB_TABLE

   This entry identifies the table to use for the needed query.

   Code example:

   <init-param> 
      <param-name>CMPI_VAULT_DB_TABLE</param-name> 
      <param-value>HACP</param-value> 
   </init-param>

2. The following parameters should correspond directly to the column headings in your HCM database and should clearly indicate the contents of the columns. With some databases, such as IBM DB2, the column headings must be in all upper-case letters, for example, NETWORKID, HOSTADDRESS, APPLICATIONID, HOSTID, and PASSWORD.

   Based on the information provided by the first three of these parameters (network ID, host address, and the host application ID), you can make a SQL query of the database to get the host ID. The result of the query is entered in the host ID (HOSTID) column. Assuming that the query is successful, a call is made to the DCAS to request the passticket.

   CMPI_VAULT_DB_NETID_COL_NAME

   This entry identifies the name of the column that contains the network ID value (NETWORKID).

   Code example:

   <init-param> 
      <param-name>CMPI_VAULT_DB_NETID_COL_NAME</param-name> 
      <param-value>NETWORKID</param-value> 
   </init-param>

   CMPI_VAULT_DB_HOSTADDR_COL_NAME

   This entry identifies the name of the column that contains the host address value (HOSTADDRESS).

   Code example:

   <init-param> 
      <param-name>CMPI_VAULT_DB_HOSTADDR_COL_NAME</param-name> 
      <param-value>HOSTADDRESS</param-value> 
   </init-param>

   CMPI_VAULT_DB_HOSTADDR_COL_NAME

   This entry identifies the name of the column that contains the host address value (HOSTADDRESS).

   Code example:

   <init-param> 
      <param-name>CMPI_VAULT_DB_HOSTADDR_COL_NAME</param-name> 
      <param-value>HOSTADDRESS</param-value> 
   </init-param>

   CMPI_VAULT_DB_HOSTAPP_COL_NAME

   This entry identifies the name of the column that contains the host application value (APPLICATIONID).

   Code example:

   <init-param> 
      <param-name>CMPI_VAULT_DB_HOSTAPP_COL_NAME</param-name> 
      <param-value>APPLICATIONID</param-value> 
   </init-param>

   CMPI_VAULT_DB_HOSTID_COL_NAME

   This entry identifies the name of the column that contains the user's host identification value (HOSTID).

   Code example:

   <init-param> 
      <param-name>CMPI_VAULT_DB_HOSTID_COL_NAME</param-name> 
      <param-value>HOSTID</param-value> 
   </init-param>

   CMPI_VAULT_DB_HOSTPW_COL_NAME

   This entry identifies the name of the column that contains the host password value (PASSWORD).

   Code example:

   <init-param> 
      <param-name>CMPI_VAULT_DB_HOSTPW_COL_NAME</param-name> 
      <param-value>PASSWORD</param-value> 
   </init-param>

CMPI_VAULT_TRACE_LEVEL

This parameter specifies the trace level for the Vault plug-in. The trace messages are logged to the log file specified by CMPI_TRACE_LOG_FILE parameter. Depending on your Web application server, they may or may not be logged to the console. Trace level values include the following:

• 0 = None: No tracing. This is the default.
• 1 = Minimum: Trace APIs and parameters, return values, and errors.
• 2 = Normal: Trace Minimum plus internal APIs and parameters and informational messages.
• 3 = Maximum: Trace Normal plus Java exceptions.

Code example:

<init-param> 
   <param-name>CMPI_VAULT_TRACE_LEVEL</param-name> 
   <param-value>3</param-value> 
</init-param>

CMPI_VAULT_DB_PRESERVE_WHITESPACE

This parameter indicates whether to trim white spaces from the credential request parameters or not. If true, the white spaces are not trimmed. The default is false.

Code example:

<init-param> 
   <param-name>CMPI_VAULT_DB_PRESERVE_WHITESPACE</param-name> 
   <param-value>false</param-value> 
</init-param>

CMPI_VAULT_DB_CASE_SENSITIVE

This parameter specifies whether or not the Vault plug-in converts the application ID and network ID of the user to lowercase characters and then uses the lcase() method to make SQL queries to the HCM database. This parameter should be set to true when using SQL applications that do not support the lcase() method.

Code example:

<init-param> 
   <param-name>CMPI_VAULT_DB_CASE_SENSITIVE</param-name> 
   <param-value>false</param-value> 
</init-param>

• IBM Tivoli Access Manager: amcms.war
• Netegrity Siteminder: smcms.war
• Microsoft Active Directory (Windows Domain): wincms.war

If you have a different network security application, you will need to customize your own version of the CMS. For more information about how to do this, refer to Customizing Web Express Logon.

• web.xml: the servlet configuration file that you will edit in a later step
• Vault.xml: a sample file to help you better understand Vault parameters and their values
• was.policy: for IBM WebSphere Application Server users only, this file contains the required permissions for the CMS when Java 2 security is enabled (refer to Troubleshooting Web Express Logon for more information)

• Host Credential Mapper (HCM) plug-in: The name of the parameter is CMPICredentialMappers, and the parameter value is a compound value that contains the list of all available HCM plug-ins, for example, CMPIDCASPlugin and CMPIVaultPlugin. Currently, the value is echo, but you will eventually replace this with the name of your HCM plug-in.
  Code example:

  init-param>
     <param-name>CMPICredentialMappers</param-name>          
     <param-value>echo</param-value>  
  </init-param>

• Network Security plug-in: The name of the parameter is CMPINetworkSecurity, and the parameter value is the full path name of the class that handles the CMS interface into the network security application. This example is taken from the amcms.war file, which is based on the Tivoli Access Manager network security application:
  Code example:

  <init-param>
       <param-name>CMPINetworkSecurity</param-name>
       <param-value>com.ibm.eNetwork.security.sso.cms.CMNPIAccessManager
  			</param-value>      
  </init-param>

  The Network Security plug-in does not apply to Microsoft Active Directory (Windows Domain), Portal Server, or Certificate-based Web Express Logon. For Microsoft Active Directory, the Windows login ID is used to identify the user. For Portal Server, the Portal ID is used to identify the user. For Certificate-based Web Express Logon, the client certificate is used to identify the user.

• echo plug-in: The name of this INIT parameter (echo) is the same as the value for the HCM plug-in. In a future step, you will replace echo with the name of your HCM plug-in.
  Host On-Demand provides this optional echo plug-in in case you want to confirm that you are able to deploy the CMS correctly before you begin editing the web.xml file. For example, after you deploy your CMS to a Web server, you can test it by entering the following syntax in a workstation's browser address bar: https://web_application_server_name/context_root/CredMapper, where web_application_server_name is the name of the Web application server, context_root is the name of the context root that you specify when deploying the CMS, and CredMapper is the name of the CMS itself.

  Some Web application server products allow you to deploy the servlet first and then edit the XML file. Other products, such as WebSphere Application Server Version 5, work best when you deploy the servlet after you edit the XML code. Refer to your product's documentation for details.

  Code example:

  <init-param>
     <param-name>echo</param-name>
     <param-value>com.ibm.eNetwork.security.sso.cms.CMPINetEcho,AuthType_All,*
  		</param-value>
  </init-param>

Use the Vault.xml file located in the WAR file as a reference for adding parameters when editing the web.xml file.

1. The following parameters contain all the relevant information needed to connect to your HCM database, which in this example is a JDBC database table. You can either configure access to an existing database or point to a newly created database. The level of security for the database varies according to database vendor. Refer to the database application's documentation for details.

   CMPI_VAULT_DB_ADDRESS

   This is a URL string that provides the address of the database. An example of this string is jdbc:db2://dtagw:6789/HODSSO.

   Code example:

   <init-param> 
      <param-name>CMPI_VAULT_DB_ADDRESS</param-name>  
   	 <param-value>jdbc:db2://dtagw.raleigh.ibm.com:6789/HODSSO
   		</param-value> 
   </init-param>

   CMPI_VAULT_DB_NET_DRIVER

   This string contains the name of the class that acts as the network database driver. An example of this string is COM.ibm.db2.jdbc.net.DB2Driver. The location of this class is assumed to be in the existing class path.

   Code example:

   <init-param> 
      <param-name>CMPI_VAULT_DB_NET_DRIVER</param-name> 
      <param-value>COM.ibm.db2.jdbc.net.DB2Driver</param-value> 
   </init-param>

   CMPI_VAULT_DB_USERID

   This is the ID of the user account to use when accessing the database.

   Code example:

   <init-param> 
      <param-name>CMPI_VAULT_DB_USERID</param-name> 
      <param-value>admin</param-value> 
   </init-param>

   CMPI_VAULT_DB_PASSWORD

   This is the password of the user account to use when accessing the database.

   This parameter should be encrypted using the encrypt password tool. It is decrypted by the HCM plug-in before using it. For more information about the password encryption tool, refer to Password encryption tool.

   Code example:

   <init-param> 
      <param-name>CMPI_VAULT_DB_PASSWORD</param-name> 
      <param-value>tuBu9v8lHiJi1jt08UgHzA==</param-value> 
   </init-param> 

   CMPI_VAULT_DB_TABLE

   This entry identifies the table to use for the needed query.

   Code example:

   <init-param> 
      <param-name>CMPI_VAULT_DB_TABLE</param-name> 
      <param-value>HACP</param-value> 
   </init-param>

2. The following parameters should correspond directly to the column headings in your HCM database and should clearly indicate the contents of the columns. With some databases, such as IBM DB2, the column headings must be in all upper-case letters, for example, NETWORKID, HOSTADDRESS, HOSTID, and PASSWORD.

   Based on the information provided by the first two of these parameters (network ID and host address), you can make a SQL query of the database to get the host ID. The result of the query is entered in the host ID (HOSTID) column. Assuming that the query is successful, a call is made to the vault-style database to request the password.

   CMPI_VAULT_DB_NETID_COL_NAME

   This entry identifies the name of the column that contains the network ID value (NETWORKID).

   Code example:

   <init-param> 
      <param-name>CMPI_VAULT_DB_NETID_COL_NAME</param-name> 
      <param-value>NETWORKID</param-value> 
   </init-param>

   CMPI_VAULT_DB_HOSTADDR_COL_NAME

   This entry identifies the name of the column that contains the host address value (HOSTADDRESS).

   Code example:

   <init-param> 
      <param-name>CMPI_VAULT_DB_HOSTADDR_COL_NAME</param-name> 
      <param-value>HOSTADDRESS</param-value> 
   </init-param>

   CMPI_VAULT_DB_HOSTADDR_COL_NAME

   This entry identifies the name of the column that contains the host address value (HOSTADDRESS).

   Code example:

   <init-param> 
      <param-name>CMPI_VAULT_DB_HOSTADDR_COL_NAME</param-name> 
      <param-value>HOSTADDRESS</param-value> 
   </init-param>

   CMPI_VAULT_DB_HOSTAPP_COL_NAME

   This entry identifies the name of the column that contains the host application value (APPLICATIONID).

   Code example:

   <init-param> 
      <param-name>CMPI_VAULT_DB_HOSTAPP_COL_NAME</param-name> 
      <param-value>APPLICATIONID</param-value> 
   </init-param>

   CMPI_VAULT_DB_HOSTID_COL_NAME

   This entry identifies the name of the column that contains the user's host identification value (HOSTID).

   Code example:

   <init-param> 
      <param-name>CMPI_VAULT_DB_HOSTID_COL_NAME</param-name> 
      <param-value>HOSTID</param-value> 
   </init-param>

   CMPI_VAULT_DB_HOSTPW_COL_NAME

   This entry identifies the name of the column that contains the host password value (PASSWORD).

   Code example:

   <init-param> 
      <param-name>CMPI_VAULT_DB_HOSTPW_COL_NAME</param-name> 
      <param-value>PASSWORD</param-value> 
   </init-param>

CMPI_VAULT_TRACE_LEVEL

This parameter specifies the trace level for the Vault plug-in. The trace messages are logged to the log file specified by CMPI_TRACE_LOG_FILE parameter. Depending on your Web application server, they may or may not be logged to the console. Trace level values include the following:

• 0 = None: No tracing. This is the default.
• 1 = Minimum: Trace APIs and parameters, return values, and errors.
• 2 = Normal: Trace Minimum plus internal APIs and parameters and informational messages.
• 3 = Maximum: Trace Normal plus Java exceptions.

Code example:

<init-param> 
   <param-name>CMPI_VAULT_TRACE_LEVEL</param-name> 
   <param-value>3</param-value> 
</init-param>

CMPI_VAULT_DB_PRESERVE_WHITESPACE

This parameter indicates whether to trim white spaces from the credential request parameters or not. If true, the white spaces are not trimmed. The default is false.

Code example:

<init-param> 
   <param-name>CMPI_VAULT_DB_PRESERVE_WHITESPACE</param-name> 
   <param-value>false</param-value> 
</init-param>

CMPI_VAULT_DB_CASE_SENSITIVE

This parameter specifies whether or not the Vault plug-in converts the application ID and network ID of the user to lowercase characters and then uses the lcase() method to make SQL queries to the HCM database. This parameter should be set to true when using SQL applications that do not support the lcase() method.

Code example:

<init-param> 
   <param-name>CMPI_VAULT_DB_CASE_SENSITIVE</param-name> 
   <param-value>false</param-value> 
</init-param>

<?xml version="1.0"?>
<hod-sso-credential version="1.0" >
   <userid>&^$#^&</userid>
   <password>&^$#^&</password>
   <status>0</status>
</hod-sso-credential>

public static String encrypt (String plainText)

This method returns an encrypted string passed as a parameter.

public static String decrypt (String cipherText)

This method reverses the encryption process by returning a decrypted string. If the cipherText was not encrypted using the encrypt method, it returns the original input string

public int Init(Properties p, String id)

This method is used to initialize the plug-in. Any configuration parameters needed to intialize the plug-in will be passed in with the properties object parameter. The parameters are specified in the servlet's web.xml file. The id parameter is the symbolic name of the plug-in specified in the CMS configuration portion of the web.xml file. This value may be used to qualify the instance of the plug-in in the event multiple instances of the plug-in are running.

public void Destroy()

This method is called when CMS is shutting down.

public CMResponse CMSGetUserCredentials(CMRequest req)

This method is called by the CMS when it has selected the plug-in to respond to a request. If the plug-in is a network security type, it is expected that the plug-in will return the user's network user id. If the plug-in is a host user credential type, then this method will need to return the user's host credentials.

public String getName();

This method returns a string that identifes the plug-in.

public String getDescription();

This method returns a string that contains information that describes the purpose and function of the plug-in.

public String getAuthor();

This method is needed to identify the originating company or person of the plug-in.

public String[] getParameters();

This method returns a string array containing the parameter tokens that may be used to configure this plug-in. These tokens are the keys specified in the initialization (INIT) parameters section of the web.xml file used to define the CMS servlet. If no tokens are needed for configuration, the method may return null.

public Properties getParameterInfo(String strParm);

Given a parameter token, this method returns a properties object with the list of properties for the given parameter. The current list of possible properties are as follows:

• cmiDefaultValue: This property contains the default value for the specified parameter.
• cmiEncrypted: This property determines if the parameter must be encrypted (true or false).
• cmiRequired: This property identifies whether or not a parameter is required for initialization of the plug-in.

• ID (Host ID or Network ID)
• Host Application ID
• Host Destination Address
• Authentication Type
• HTTP Servlet request object

public CMRequest()

public CMRequest(String id, String applID, String hostAddr, int authType, HttpServletRequest httpRequest)

public String getID()

public void setID(String id)

public String getHostApplID()

public void setHostApplID(String applID)

public String getHostDestination()

public void setHostDestination(String hostAddr)

public int getAuthType()

public void setAuthType(int authType)

public HttpServletRequest getHttpRequestObject()

public void setHttpRequestObject(HttpServletRequest httpRequest)

public String toString()

• Status Code
• ID (Host ID or Network ID)
• User Credentials (Password or Passticket)

public CMResponse()

public CMResponse(Object id, Object password, int status)

public int getStatus()

public void setStatus(int status)

public Object getID()

public String getIDasString()

public void setID(Object id)

public Object getPassword()

public String getPasswordasString()

public void setPassword(Object password)

public String toString()