1. CollegeSource Security Application &
Supported Security Implementations
R1.02
Two parts to this presentation, one semi-functional (Security App) and one technical (Security Implementations)
Presented by: Zach Lewis, CollegeSource June 14, 2012

2. CollegeSource Security Application
Topics We’ll Cover
CollegeSource Security Application
Security Components
Application Functions, Permissions, & Roles
Domains
Groups
Users
Properties
Application Demo
Supported Security Implementations
Database Tables
LDAP
CAS
We’ll run through the components first then have a little demo to see them in action
Session ID R1.02

3. CollegeSource Security Application
For the technical folks, this is basically a front end to manage the groups, roles, etc in the security database tables
Security Component Administration

4. Security Component Definitions
Application Function – a predefined area available in CollegeSource applications where the level of access can be controlled
Permission – the level of access (Read, Update, Create , Delete) granted for a specific application function
Role – a functional grouping of permissions that simulates a real life capacity (i.e. Advisor, Student)
Domain – a hierarchy that defines an institution and can be used to limit permissions
Group – a list of roles to which users can be mapped
User – an individual given permission to use certain functions of one of the CollegeSource applications
Property – an attribute that can be assigned to a user or group to limit permissions
Each of these has a table or set of tables that corresponds them in the database
Session ID R1.02

5. Application Functions, Permissions, & Roles
This is a role named “Advisor”
The app function controls level of access to a predefined area within a particular CollegeSource app (i.e. u.direct).
There are 4 permission aspects: Read, Update, Create, Delete
There are 3 permission values: Full, Restricted, None
The entire set of the predefined application functions with permissions for each is a ROLE.
The “predefined areas” for app functions are used throughout the apps
For example, UDIR_Plans controls the plan functionality in u.direct and UDIR_Notes controls access to notes
Session ID R1.02

6. Domains
A domain can be used to limit permissions on a more narrow scope than a role can.
There can be anywhere from 1 to 6 levels in a domain, which must be defined in a database view.
There are group-level and user-level domains.
In order to use domains, you must implement a view in the database called DCP_PROGRAM that corresponds to the levels you want to use
Session ID R1.02

7. DCP_PROGRAM View Example
create view DCP_PROGRAM as
select
distinct a.instidq+a.instid as level_1,
a.college as level_2,
a.major as level_3,
a.degree as level_4,
null as level_5,
null as level_6,
dprog as program,
webtitle as program_name,
a.instidq as instidq,
a.instid as instid,
a.instcd as instcd
from
dprog a
where
a.instidq = '73'
and a.instid = '007104'
and a.dpstatus = 'T'
This view (this default version) is created when running the database scripts that come with the CollegeSource Security application, but it can be modified
Session ID xxxx

8. Groups A group is the place where users can be associated with roles.
A group is like a placeholder for users and roles. It is the main link used for authorization with the security implementations.
A group is the place where users can be associated with roles.
A group can have multiple roles and multiple users.
Group-level domains and properties can also be assigned.
Session ID R1.02

9. Users Users must be members of a group to be assigned roles.
There’s no way to assign a role directly to a user. The SIS Id is usually the student number used in your SIS. This is used when running audits if it is a student.
Users must be members of a group to be assigned roles.
Group-level domains will be applied to users assigned to a group that has a domain.
Session ID R1.02

10. Properties
Similar to a domain, a property can limit permissions in a more narrow way than a role can.
Properties can be combined to create more specific sets of limitations and aren’t dependent on a database view.
Properties can be user-level, group-level, application-level, or global.
There are defined properties that are allowed to be specified. These are available in the dropdown on this screen.
Session ID R1.02

11. Overview
A Role is a list of pairs consisting of an App Function and a Permission.
A Group is a container that can hold a list of many Roles and many Users. It can also contain group-level Properties and/or Domains.
Role examples are Student or Advisor. Group examples are UDIR_STUDENTS or SS_ADVISORS.
A User must belong to a Group to have Roles. It can, however, have
user-level Properties and/or Domains.
Session ID xxxx

12. Supported Security Implementations
There was some technical stuff sprinkled into the first half of the presentation, but here’s the bulk of it.
Getting Your Students & Staff Access

13. Implementations Supported by CollegeSource Security
The 3 implementations that are supported by CollegeSource Security are:
Database tables
LDAP
CAS
CollegeSource can also provide some interfaces for clients to attempt using other security implementations.
We use the Spring Security API, which plays well with Database, LDAP, and CAS.
It also has a hook for Pre-Authenticated implementations, but they come with additional considerations.
Session ID R1.02

14. Database Tables
By default, all CollegeSource applications are configured to use the database tables for security purposes. It will work “out of the box.”
CollegeSource provides the database schema necessary to use this security implementation.
When using this implementation, users and user properties and domains can be managed using the CollegeSource Security application.
The database schema will be created by u.achieve scripts if you have u.achieve. Otherwise, a create.sql script is included. A populate.sql populates a default user, group, and some roles.
Session ID R1.02

15. Lightweight Directory Access Protocol (LDAP)
CollegeSource Security provides an interface that can connect to and communicate with a university’s LDAP directory server.
An LDAP implementation can be used for both user authentication and authorization (what roles the user is granted).
Using LDAP, users are not managed in the CollegeSource Security application. They are managed in the LDAP directory and mapped to groups that are managed in the application.
CollegeSource Security supports any type of directory server that uses LDAP, including Active Directory, Oracle Virtual Directory, etc.
For more info, visit:
Session ID R1.02

16. LDAP – Mapping Users to Security Groups
One or more attributes from LDAP are configured to be the “group role attribute(s)” where the security interface will look to find assigned groups.
The security interface reformats the LDAP group name by adding “ROLE_” to the front and converting it to caps. Then it looks for a CollegeSource Security group that matches.
Note: All groups intended to be mapped to an LDAP attribute must start with “ROLE_” and be in all capital letters.
There is a property that you can use to specify whether you want it to convert the group names to all capital letters.
Session ID R1.02

17. Sample LDAP Properties
# Connection URL
dcp.security.ldap.url=ldap://domain:port/dc=value,dc=value
# User Authentication Options #
# Manager Service Account Credentials dcp.security.ldap.manager=cn=user,dc=value,dc=value
dcp.security.ldap.password=password
# User DN Pattern dcp.security.ldap.userDnPattern=cn={0},ou=people
# User Password Attribute dcp.security.ldap.passwordAttribute=userPassword
# Search Filters
# These filters are passed an array of parameters. In
# each, the {0} denotes the username field. You can also
# use {1} for the user DN in groupMemberSearchFilter.
dcp.security.ldap.userNameSearchFilter=(cn={0})
dcp.security.ldap.groupMemberSearchFilter=(cn={0})
dcp.security.ldap.sisIdSearchFilter=(eid={0})
# Name Result Limiting Filter
dcp.security.ldap.nameResultLimitingFilter=(field=value)
# Search Bases #
# Multiple search bases can be specified by
# providing a list separated by forward slash (“/”)
dcp.security.ldap.userSearchBase=ou=people
dcp.security.ldap.groupMemberSearchBase=ou=people
# User Information Attributes
dcp.security.ldap.userNameField=cn
dcp.security.ldap.firstNameField=givenName
dcp.security.ldap.lastNameField=sn
dcp.security.ldap. Field=mail
dcp.security.ldap.sisIdField=eid
dcp.security.ldap.passwordAttribute=userPassword
dcp.security.ldap.advisorNameField=advisorName
# Multiple group role attributes can be specified by
# providing a list separated by commas
dcp.security.ldap.groupRoleAttribute=memberOf
These property names have been tweaked and the newest version of CollegeSource Security ( ) has a security.properties that looks like this.
Session ID R1.02

18. Sample LDAP Properties - Explained
dcp.security.ldap.url – the URL to the LDAP server.
dcp.security.ldap.manager – the DN used for binding with a manager service account
dcp.security.ldap.password – the password used for binding with a manager service account
dcp.security.ldap.userDnPattern – a pattern that can be used to match a typical user DN
dcp.security.ldap.userNameSearchFilter – the filter used to do the user name search
dcp.security.ldap.groupMemberSearchFilter – the filter used to do the group member search
dcp.security.ldap.sisIdSearchFilter – the filter used to do the SIS Id search
dcp.security.ldap.nameResultLimitingFilter – an attribute/value filter that can limit the amount of LDAP search results
dcp.security.ldap.userSearchBase – the base location where the user search will be performed
dcp.security.ldap.groupMemberSearchBase – the base location where the group member search will be performed
dcp.security.ldap.sisIdField – the attribute in the user’s profile that contains the SIS Id
dcp.security.ldap.userNameField – the attribute in the user’s profile that contains the username
dcp.security.ldap.firstNameField – the attribute in the user’s profile that contains the first name
dcp.security.ldap.lastNameField – the attribute in the user’s profile that contains the last name
dcp.security.ldap. Field – the attribute in the user’s profile that contains the address
dcp.security.ldap.advisorNameField – the attribute in the user’s profile that contains the name of an advisor
dcp.security.ldap.passwordAttribute – the attribute in the user’s profile that contains the password value
dcp.security.ldap.groupRoleAttribute – the attribute in the user’s profile that contains the name of groups
Session ID R1.02

19. Central Authentication Service (CAS)
CollegeSource Security provides an interface that can connect to and communicate with a university’s CAS server.
CAS is the only Single Sign-On (SSO) provider that is fully supported by CollegeSource Security.
Since the CAS service only provides user authentication, an alternate means of authorization must be used.
With CAS, your users will login at your portal/homepage and be redirected to the CollegeSource application that is being accessed.
For more info, visit:
Session ID R1.02

20. CAS – User Authorization
There are 2 options for user authorization when using CAS:
Database tables
LDAP
If using the database tables for authorization, the users can be managed in the CollegeSource Security application and be assigned domains and properties.
If using LDAP for authorization, users will be managed in AD and linked to a CollegeSource Security group by using one or more group role attributes.
All of this is configurable through the XML config files that come with CollegeSource Security.
Session ID R1.02

21. Please remember to complete the session survey. Thank you!
Questions?
Zach Lewis
Please remember to complete the session survey. Thank you!
Session ID R1.02