Authenticating against LDAP users in Documentum

Farhan

I ve added users from Active Directory in repository.

I ve a ASP web application and I want to get some results from Documentum into it through DFS.

I want to authenticate based on the current web application user without having to get password from the user.

How to get it done?

Find more posts tagged with

Comments

MVK4SA

did you got any success ?

abc123

Relying on a 5-year old thread usually does not get any response..

What specific problems to you meet for authentication? If the web application does not want Documentum Content Server to passthrough the password on behalf of the end user, it needs to consider SSO integration for Documentum where Content Server can accept a 3rd party SSO token to create the user session.

Regards,

William

MVK4SA

Thank you for your response.. we are not going to use SSO.

I have created new thread on similar line - I want to use the LDAP users from 3rd party system, due to Audit and security reason - cannot use Admin or Inline user of Documentum.

I will be using DFS and for authentication will use those LDAP user, I have following queries.

a. Do i must need to provide password in DFS while consuming services ?

b. If yes, can I provide Encryoted password placed on 3rd party app server to use and decrypt before use? not allowed to keep in text form in any files - again for security.

c what is the good approach, where I will be having 1000 concurrent user accesing same account and creating and reading objects from Documentum uising DFS.

is 1 user account enough ? or multiple account required - to handle 1 vs. 1000 consurrent access to repository for DFS calls ?

abc123

a. If SSO is not an option, you have to send password in DFS. Otherwise, how does LDAP tell Content Server that the user has been authenticated? LDAP is not an authentication service.

b. Content Server allows to validate the password to the LDAP server for LDAP users. And Content Server itself does not store or verify the password. Therefore, ideally you would be able to shield the password as long as the LDAP server knows how to decrypt it. But frankly speaking, any immature security patch could be a security vulnerability.

c. From your description, it looks like there is only one Content Server user on the web server tier. It is no problem to execute concurrent requests for one user. But there are still some issues with this approach. Does DFS allow client requests to create multiple private sessions for a single user? The answer matters the performance. Do you require strict audit? How do you track which humanbeing is doing what operation?

If it is a new application to be developed, Documentum REST Services may be the alternative API you can look at, which provides a lot of flexible security configurations.

Regards,

William

MVK4SA

Thank you William

a. OK

b. My thought was to for security reason - keep cnryppted passwd on file system and reas while DFS authentication (decrypt before use).

c.No Audit w.r.t Documentum. There might be some configuration on web servevr tier to handle the same.

d. I checked - due to license constraint - not using it, we want to leverage the existing environment and license.

can you brief on how security requirements can be achieved without issue .. as you got my requirement clearly now.

thank you again..

abc123

I don't think I understand your requirement clearly yet

If you store the encrypted password on the web server tier, how do you sync the password change from LDAP server? Who will take responsibiity to encryt the updated password again? Can anybody have the opportunity to hijack the DFS SOAP request as the password in the SOAP is still plaintext? A lot of security conerns...

Do not invest large effort to reinvent a new security scheme as there are a lot SSO solutions that can meet your scenario.

Regards,

William

MVK4SA

Ok but , If I say LDAP user password never expire from LDAP server.

SSO need to be implemented for 3rd party system as well , right ? along with Documentum ?

Third party systems are OOTB and not the custom and if I have to implemet SSO , need to make sure to be supported for all 3rd party and Documentum both.