How Registry Interfaces With Active Directory - Revision history

Vmurrell at 11:33, 30 March 2024

2024-03-30T11:33:25Z

Vmurrell at 12:49, 25 March 2024

2024-03-25T12:49:12Z

Vmurrell at 12:11, 23 March 2024

2024-03-23T12:11:58Z

Vmurrell at 16:37, 21 March 2024

2024-03-21T16:37:38Z

Vmurrell at 08:11, 22 August 2022

2022-08-22T08:11:15Z

Plazarou: /* User has no Permissions within the Registry */

2022-05-31T16:32:37Z

‎User has no Permissions within the Registry

Plazarou at 16:31, 31 May 2022

2022-05-31T16:31:34Z

Plazarou at 16:31, 31 May 2022

2022-05-31T16:31:23Z

Plazarou: /* User has no Permissions within the Registry */

2022-05-31T16:23:49Z

‎User has no Permissions within the Registry

Plazarou: /* Succesfull Access */

2022-05-31T16:23:41Z

‎Succesfull Access

@@ Line 1: / Line 1: @@
-[[Category:Draft_-_Installation_and_Configuration]]
+[[Category:Installation_and_Configuration]]
 [[Category:RegistrySecurity]]
 [[Category:FMR_Configuration_Reference]]

@@ Line 1: / Line 1: @@
 [[Category:Draft_-_Installation_and_Configuration]]
+[[Category:RegistrySecurity]]
 [[Category:FMR_Configuration_Reference]]
 [[Category:How_To]]

← Older revision		Revision as of 12:11, 23 March 2024
Line 1:		Line 1:
		+	[[Category:Draft_-_Installation_and_Configuration]]
		+
	[[Category:FMR_Configuration_Reference]]		[[Category:FMR_Configuration_Reference]]
	[[Category:How_To]]		[[Category:How_To]]

@@ Line 3: / Line 3: @@
 Active Directory can be used as the security manager for Fusion Metadata Registry which is defined [[Security_Configuration|here]]. Once Active Directory has been set as the security manager, the role mappings which associate Active Directory groups to roles in the Registry needs to be defined and this is explained [[Active_Directory_-_Set_up_Role_Mappings|here]].
-For a Fusion Metadata Registry which has an Active Directory succsessfully configured, this page explains how the two systems communicate.
+For a Fusion Metadata Registry which has an Active Directory successfully configured, this page explains how the two systems communicate.
 =Invalid Credentials=
@@ Line 12: / Line 12: @@
 ) The Registry receives an HTTP (or HTTPS) Servlet Request from the browser. This request carries the username and password as supplied from the login page of the Registry.<br>
 ) From this request object, an Authentication token is created within the Registry and sent as an LDAP (or LDAPS) connection to the Active Directory server.  This token only contains the userid and password as supplied in the previous stage.
-The Naming Manager apect of Active Directory attempts to resolve the supplied credentials.
+The Naming Manager aspect of Active Directory attempts to resolve the supplied credentials.
 <br>
 ) Since the credentials were not authorised by the Naming Manager, Active Directory responds with an LDAP (or LDAPS) response informing of the incorrect credentials <br>
-) Fusion Registry responds to the browser with an HTTP Servlet Response containing the information that the authentication request was unsuccesful, along with a status code for the reason.<br>
+) Fusion Registry responds to the browser with an HTTP Servlet Response containing the information that the authentication request was unsuccessful, along with a status code for the reason.<br>
-=Succesful Access=
+=Successful Access=
 If the user provides the correct credentials to the Fusion Registry and a valid mapping has been defined to map the user's Active Directory groups to that of Fusion Registry, the following communication takes place:
@@ Line 25: / Line 25: @@
 ) The Registry receives an HTTP (or HTTPS) Servlet Request from the browser. This request carries the username and password as supplied from the login page of the Registry.<br>
 ) From this request object, an Authentication token is created within the Registry and sent as an LDAP (or LDAPS) connection to the Active Directory server.  This token only contains the userid and password as supplied in the previous stage.
-The Naming Manager apect of Active Directory attempts to resolve the supplied credentials.
+The Naming Manager aspect of Active Directory attempts to resolve the supplied credentials.
 <br>
 ) The credentials are authorised within Active Directory and it responds with an LDAP (or LDAPS) response stating the credentials are correct.<br>
 ) The Fusion Registry issues another request to Active Directory, specifying the search and filter criteria (along with the authenticated Principal).<br>
 ) Active Directory uses the search information, which was supplied when the Active Directory connection was definied in the Fusion Registry, to obtain information regarding the user.  This is essentially which groups the user is a member of.<br>
-) Fusion Registry constructs a UsernamePasswordAuthenticationToken which defines what organisations the user can access, and responds to the browser with an HTTP Servlet Response containing the information that the authentication request was succesful.<br>
+) Fusion Registry constructs a UsernamePasswordAuthenticationToken which defines what organisations the user can access, and responds to the browser with an HTTP Servlet Response containing the information that the authentication request was successful.<br>
 =User has no Permissions within the Registry=
-In the scenario where a user provides valid Active Directory credentials but the user, as defined within Active Directory, has no permissions in Fusion Registrym then the flow of communication follows the same sequence of events as succesful access up to stage 5. This is because the user has provided credentials that Active Directory has validated as correct.  The groups for this user are supplied back to Fusion Registry and are checked within the "Fusion Granted Authority" of the Registry.  Since there are no roles for this user to perform, a "NoRolesException" is thrown and a response is sent from the Fusion Registry to the web browser that this user has no permissions within Fusion Registry. The user is therefore not granted access to Fusion Metadata Registry.
+In the scenario where a user provides valid Active Directory credentials but the user, as defined within Active Directory, has no permissions in the Registry then the flow of communication follows the same sequence of events as successful access up to stage 5. This is because the user has provided credentials that Active Directory has validated as correct.  The groups for this user are supplied back to Fusion Registry and are checked within the "Fusion Granted Authority" of the Registry.  Since there are no roles for this user to perform, a "NoRolesException" is thrown and a response is sent from the Fusion Registry to the web browser that this user has no permissions within Fusion Registry. The user is therefore not granted access to Fusion Metadata Registry.

← Older revision		Revision as of 08:11, 22 August 2022
Line 1:		Line 1:
		+	[[Category:FMR_Configuration_Reference]]
		+	[[Category:How_To]]
	Active Directory can be used as the security manager for Fusion Metadata Registry which is defined [[Security_Configuration\|here]]. Once Active Directory has been set as the security manager, the role mappings which associate Active Directory groups to roles in the Registry needs to be defined and this is explained [[Active_Directory_-_Set_up_Role_Mappings\|here]].		Active Directory can be used as the security manager for Fusion Metadata Registry which is defined [[Security_Configuration\|here]]. Once Active Directory has been set as the security manager, the role mappings which associate Active Directory groups to roles in the Registry needs to be defined and this is explained [[Active_Directory_-_Set_up_Role_Mappings\|here]].

← Older revision		Revision as of 16:32, 31 May 2022
Line 32:		Line 32:
	=User has no Permissions within the Registry=		=User has no Permissions within the Registry=

−	~~For~~ the scenario where ~~the~~ user provides valid credentials but the user, as defined within Active Directory, has no permissions in Fusion ~~Registry~~ then the flow of communication follows the same sequence of events as succesful access up to stage 5. This is because the user has provided credentials that Active Directory has validated as correct. The groups for this user are supplied back to Fusion Registry and are checked within the "Fusion Granted Authority" of the Registry. Since there are no roles for this user to perform, a "NoRolesException" is thrown and a response is sent from the Fusion Registry to the web browser that this user has no permissions within Fusion Registry. The user is therefore not granted access.	+	In the scenario where a user provides valid Active Directory credentials but the user, as defined within Active Directory, has no permissions in Fusion Registrym then the flow of communication follows the same sequence of events as succesful access up to stage 5. This is because the user has provided credentials that Active Directory has validated as correct. The groups for this user are supplied back to Fusion Registry and are checked within the "Fusion Granted Authority" of the Registry. Since there are no roles for this user to perform, a "NoRolesException" is thrown and a response is sent from the Fusion Registry to the web browser that this user has no permissions within Fusion Registry. The user is therefore not granted access to Fusion Metadata Registry.

← Older revision		Revision as of 16:31, 31 May 2022
Line 2:		Line 2:

	For a Fusion Metadata Registry which has an Active Directory succsessfully configured, this page explains how the two systems communicate.		For a Fusion Metadata Registry which has an Active Directory succsessfully configured, this page explains how the two systems communicate.
−

	=Invalid Credentials=		=Invalid Credentials=

← Older revision		Revision as of 16:23, 31 May 2022
Line 31:		Line 31:
	=User has no Permissions within the Registry=		=User has no Permissions within the Registry=

−	For the scenario where the user provides valid credentials but the user, as defined within Active Directory, has no permissions in Fusion Registry then the flow of communication follows the same sequence of events as ~~succesfull~~ access up to stage 5. This is because the user has provided credentials that Active Directory has validated as correct. The groups for this user are supplied back to Fusion Registry and are checked within the "Fusion Granted Authority" of the Registry. Since there are no roles for this user to perform, a "NoRolesException" is thrown and a response is sent from the Fusion Registry to the web browser that this user has no permissions within Fusion Registry. The user is therefore not granted access.	+	For the scenario where the user provides valid credentials but the user, as defined within Active Directory, has no permissions in Fusion Registry then the flow of communication follows the same sequence of events as succesful access up to stage 5. This is because the user has provided credentials that Active Directory has validated as correct. The groups for this user are supplied back to Fusion Registry and are checked within the "Fusion Granted Authority" of the Registry. Since there are no roles for this user to perform, a "NoRolesException" is thrown and a response is sent from the Fusion Registry to the web browser that this user has no permissions within Fusion Registry. The user is therefore not granted access.