Local Authentication Realm

The local realm stores its user information in its node's transactional memory. A local realm configuration is specified in a LocalAuthenticationRealm root object and is part of the security configuration type.

Each user in the realm has a password, a set of roles, and an account lock status. The password has an optional expiration time in days, after which the password must be changed. The default is for passwords to never expire. If an account is locked by an administrator, access is always denied.

Passwords are one-way hashed in shared memory.

The realm configuration can specify a set of initial users. When the realm is first activated, these users are placed in the realm, allowing administrators to bulk-load users rather than creating them individually. These users can only be added in the initial version of the configuration; subsequent versions ignore the users because you can also manage the realm by command line and it is preferable to avoid colliding intentions between the initial user list and any management commands invoked earlier.

The configuration can enable secure communication client authentication, which means that if a request is transported over a secure communication connection such as TLS and that connection uses client (mutual) authentication, then no password is required. The server network listener provides the authenticated user, which is responsible for mapping the client X.509 certificate's subject DN to a user name. See Secure Transport with TLS for more information on TLS security.

The configuration can require a password even if the request originates from a trusted host, if the administrator desires extra security. This behavior effectively disables trusted hosts unless the realm is configured to require that all requests originate from a trusted host. In that case, the configuration becomes a white list with required passwords, for maximum security.

The LocalAuthenticationRealm root configuration object defines the characteristics and initial principals in the local authentication realm for a node. Figure 1, “LocalAuthenticationRealm relationships” shows the relationships to other configuration objects.

Changing the failedLoginLockoutDurationMinutes or failedLoginLockoutThreshold configuration properties by activating a new version of this configuration causes this behavior:

LocalAuthenticationRealm relationships

A detailed description of the configuration object properties is in LocalAuthenticationRealm object properties and a snippet for these properties is in Example 1, “LocalAuthenticationRealm object snippet”.

name = "local-authentication-realm"
version = "1.0.0"
type = "com.tibco.ep.dtm.configuration.security"
configuration =
{
    LocalAuthenticationRealm =
    {
        name = "my-local-authentication-realm"
        requireTrustedHostMembership = true
        allowSecureCommunicationClientAuthentication = true
        requirePassword = false
        failedLoginLockoutDurationMinutes = 5
        failedLoginLockoutThreshold = 3
        initialPrincipals =
        [
            { ... }
            { ... }
        ]
    }
}

Local Authentication Realm user accounts can be locked and unlocked, whether or not a secure communications profile is configured for the same node. A separate realm such as LDAP or OIDC may have its own account lock and account login attempt timeout settings. The feature under discussion here applies only to Local Authentication Realms.

In a Local Authentication Realm, a user account might be locked:

epadmin --servicename=A.X update user --username=sbuser --locked=true
epadmin --servicename=A.X update user --username=sbuser --locked=false

passwordExpirationPeriodDays = 180

name = "newlocalrealm"
version = "1.0.0"
type = "com.tibco.ep.dtm.configuration.security"
configuration = {
  LocalAuthenticationRealm = {
    name = "newlocalrealm"
    allowSecureCommunicationClientAuthentication = true
    failedLoginLockoutThreshold = 5
    failedLoginLockoutDurationMinutes = 15
    requirePassword = false
    requireTrustedHostMembership = false
    initialPrincipals = [
      {
      userName = "sbuser"
      password = "sEcr3t1v3"
      passwordExpirationPeriodDays = 0
      locked = false
      roles = [ "administrator" ]
      }
    ]    
  }
}

Realm Name = default-realm
User Name = sbuser
Password Expiration (Days) = 0
Account Locked = true
Lock Reason = 5 consecutive login attempts
Time Remaining Before Auto-Unlock (minutes) = 7
Failed Login Lockout Threshold = 5
Failed Login Lockout Duration (minutes) = 15
Roles = administrator, switchadmin
Authentication via Secure Communication Allowed = true
Password Always Required = false
Trusted Host Membership Required of Client = false

The epadmin user target supports user management in any local authentication realm. Provide the realm name as a command line argument; it defaults to the default realm named default-realm if not specified. See the epadmin user reference page for detailed instructions.

See the epadmin realm reference page for detailed instructions on realm management. The following commands are especially important.

The Principal configuration object defines a principal managed by the local authentication realm. Figure 2, “Principal relationships” shows the relationships to other configuration objects.

Principal relationships

A detailed description of the configuration object properties is in Principal object properties and a snippet for these properties is in Example 2, “Principal object snippet”.

name = "local-authentication-realm"
version = "1.0.0"
type = "com.tibco.ep.dtm.configuration.security"
configuration =
{
    LocalAuthenticationRealm =
    {
        initialPrincipals =
        [
            {
                userName = "FredTheAdministrator"
                password = "LKJALISJDOIQUWEOIAJSLKDJALSJDL"
                roles =
                [
                      "administrator"
                ]
                passwordExpirationPeriodDays = 12
                locked = true
            }
        ]
    }
}