February9
Have you ever being in a situation where you have a local security subsystem embedded in a CA GEN application without any integration to corporate security mechanisms like Active Directory or LDAP that cause you to maintain and synchronize manually both systems? Wouldn’t be fantastic to find a way to easy integrate your existing CA GEN security subsystems to your corporate Active Directory or LDAP security system?
Well QAT has faced this situation, but now with the use of some services provided by some of the leading QAT tools like QAT WebDaptive™ and QAT Function Manager™ we have solve this problem!
Yes! our QAT Flow ™ product has an internal set of tables used to manage the Employees that are going to use the process, now with the use of some QAT WebDaptive™ Web Services (WDAuthService) we can import, synchronize, or update these flow internal tables against an active directory or LDAP server, without using any externals, just by using CA Gen statements within Action Blocks.
The QAT WebDaptive™ Framework, is supported by several services implemented either as Java o .NET Web Services. The Authorization Service, provides user authentication to your enterprise active directory or LDAP server, and can be called using Custom Gen Functions (No externals) form inside your Gen Applications.
Solution Example for a Microsoft Windows Environment:
Authentication mode: Microsoft Active Directory
GEN Servers: Gen 7.6 .NET Comp_Services
WebDaptive .Net Version
Server Operating System: Windows 2003 64bits
A global SETTINGS database table is used to set some of the values that are required in order to query the Active Directory, the values that used in this case are:
WDPROXY = http://195.nnn.n.nn/WDAuthService/WDAuthService.asmx –> Basically this is the URL required to use the WebDaptive Authorization Server
AUTHPROP=samaccountname –> This is a property value used as part of the required query sent to the active directory
AUTHFILTER=(&(objectcategory=person)(objectclass=user)) –> A filter is required to get just the required data from the active directory. (This is a special syntax used for active directory queries)
First we read these settings from the Data Base:
+- READ p settings
| | WHERE DESIRED p settings name IS EQUAL TO “WDPROXY”
| +- WHEN successful
| | SET e qatwd_authorization_service_v2 auth_url TO p settings value_text
| +- WHEN not found
| | SET e_msg imh1_component return_code TO -0040
| | SET e_msg imh1_component reason_code TO 00001
| | SET e_msg imh1_component context_string TO “Error missing LDAP settings.”
| +–
| +- READ p settings
| | WHERE DESIRED p settings name IS EQUAL TO “AUTHPROP”
| +- WHEN successful
| | SET e qatwd_authorization_service_v2 auth_prop TO p settings value_text
| +- WHEN not found
| | SET e_msg imh1_component return_code TO -0040
| | SET e_msg imh1_component reason_code TO 00001
| | SET e_msg imh1_component context_string TO “Error missing LDAP settings.”
| +–
| +- READ p settings
| | WHERE DESIRED p settings name IS EQUAL TO “AUTHFILTER”
| +- WHEN successful
| | SET e qatwd_authorization_service_v2 auth_filter TO p settings value_text
| +- WHEN not found
| | SET e_msg imh1_component return_code TO -0040
| | SET e_msg imh1_component reason_code TO 00001
| | SET e_msg imh1_component context_string TO “Error missing LDAP settings.”
| +–
| +- IF e_msg imh1_component return_code IS EQUAL TO -0040
| | NOTE *** Error Handling:
| |
| | Set the appropriate values if an error has occurred, otherwise null
| | everything to prevent unnecessary data in the return transmission.
| |
| | +- IF e_msg imh1_component module_id IS EQUAL TO SPACES
| | | SET e_msg imh1_component module_id TO “IQFA1481_EMPLOYEE_LDAP_LIST”
| | +–
| | USE wf_error_handling
| | WHICH IMPORTS: Work View e_msg imh1_component TO Work View i_msg imh1_component
| | Work View i_link_receive qik TO Work View i_link_receive qik
| | WHICH EXPORTS: Work View e_msg imh1_component FROM Work View e_msg imh1_component
<——ESCAPE
| +–
Then we use a QAT Custom Function called qatwd_authorization_service2() to call the WebDaptive Authorization Service (this function is part of the custom QAT function Libraries and was registered to the model using the QAT Function Manager™ plug-in):
| SET e qatwd_authorization_service_v2 auth_command TO “SCH”
| NOTE Call the WEbDaptive Web service using qat custom function..
| SET w qatwd_authorization_service_v2 auth_value TO qatwd_authorization_service_v2(e qatwd_authorization_service_v2 auth_url, e qatwd_authorization_service_v2 auth_filter, e qatwd_authorization_service_v2
| auth_prop, e qatwd_authorization_service_v2 auth_str_enc, e qatwd_authorization_service_v2 auth_command)
| +- IF length(trim(w qatwd_authorization_service_v2 auth_value)) IS GREATER THAN 0
| | NOTE Do checking here of errors…
| | NOTE Get each user id
Parse the results of the query, get the data, and perform the required actions:
| | SET SUBSCRIPT OF e_group_listbox TO 0
| | SET e qatwd_authorization_service_v2 auth_value TO StringToken(w qatwd_authorization_service_v2 auth_value, “|”)
Create a list of existing users in the active directory:
| | += WHILE e qatwd_authorization_service_v2 auth_value IS NOT EQUAL TO SPACES
| | | SET SUBSCRIPT OF e_group_listbox TO SUBSCRIPT OF e_group_listbox + 1
| | | SET e_repeat_listbox iqfa1_employee identifier TO upper(e qatwd_authorization_service_v2 auth_value)
| | | SET e qatwd_authorization_service_v2 auth_value TO StringToken(“”, “|”)
| | +–
| | NOTE Using the list get each of the required attributes
| | += FOR SUBSCRIPT OF e_group_listbox FROM 1 TO LAST OF e_group_listbox BY 1
| | | NOTE Get First name
| | | SET e qatwd_authorization_service_v2 auth_filter TO StringPlusOperator(“(&(objectcategory=person)(samaccountname=”, e_repeat_listbox iqfa1_employee identifier, “))”, “”, “”, “”, “”, “”, “”, “”)
| | | SET e qatwd_authorization_service_v2 auth_prop TO “givenname”
| | | SET w qatwd_authorization_service_v2 auth_value TO qatwd_authorization_service_v2(e qatwd_authorization_service_v2 auth_url, e qatwd_authorization_service_v2 auth_filter,
| | | e qatwd_authorization_service_v2 auth_prop, e qatwd_authorization_service_v2 auth_str_enc, e qatwd_authorization_service_v2 auth_command)
| | | SET e_repeat_listbox iqfa1_employee first_name TO StringToken(w qatwd_authorization_service_v2 auth_value, “|”)
| | | NOTE Get Last Name
| | | SET e qatwd_authorization_service_v2 auth_prop TO “sn”
| | | SET w qatwd_authorization_service_v2 auth_value TO qatwd_authorization_service_v2(e qatwd_authorization_service_v2 auth_url, e qatwd_authorization_service_v2 auth_filter,
| | | e qatwd_authorization_service_v2 auth_prop, e qatwd_authorization_service_v2 auth_str_enc, e qatwd_authorization_service_v2 auth_command)
| | | SET e_repeat_listbox iqfa1_employee last_name TO StringToken(w qatwd_authorization_service_v2 auth_value, “|”)
Etc.
| +- ELSE
| | SET e_msg imh1_component return_code TO -0040
| | SET e_msg imh1_component reason_code TO 00001
| | SET e_msg imh1_component context_string TO “Error Accesing LDAP Server.”
| | NOTE *** Error Handling:
| |
| | Set the appropriate values if an error has occurred, otherwise null
| | everything to prevent unnecessary data in the return transmission.
| |
| | +- IF e_msg imh1_component module_id IS EQUAL TO SPACES
| | | SET e_msg imh1_component module_id TO “IQFA1481_EMPLOYEE_LDAP_LIST”
| | +–
| | USE wf_error_handling
| | WHICH IMPORTS: Work View e_msg imh1_component TO Work View i_msg imh1_component
| | Work View i_link_receive qik TO Work View i_link_receive qik
| | WHICH EXPORTS: Work View e_msg imh1_component FROM Work View e_msg imh1_component
| +–
Now that you have the data, you can proceed to update your local tables!
As you can see integrating your current CA GEN applications to active directory or LDAP and make use of Web Services is easy just combining the power of QAT WebDaptive ™, QAT Function Manager ™ and CA Gen.
More to come….
Francisco.