Security

Table of contents

1. Managing Users
2. Managing User Accounts and Groups
3. Managing Permissions
4. Single Sign-On for JMap Pro
5. Managing Sessions
6. Using HTTPS with JMap

---

Security management in JMap encompasses several aspects.

Identity management can be handled by JMap Server or assigned to another system, such as Microsoft Active Directory, an LDAP directory, or identity managers with web-based single sign-on (SSO) such as OpenID Connect or SAML. See the Managing Users and Managing User Accounts and Groups sections for more information. JMap also supports single sign-on for JMap Pro users. See the Single Sign-On for JMap Pro section for more information.

Access management, or rather permission management, is applied to all the resources handled by JMap. This includes user access to JMap applications as well as the access permissions of JMap administrators. See the Managing Permissions section for more information.

JMap allows you to easily use the HTTPS protocol for JMap Admin and for the various applications. See section Using HTTPS with JMap for more information.

Managing Users

In JMap Admin, the user manager configuration can be accessed by clicking on Users / Groups in the JMap Server section. Select the User manager tab.

The user manager allows you to define how JMap will manage user accounts and groups. There are two ways to manage this information with JMap:

• Using the JMap user account database: you create and delete the user accounts directly from JMap Admin;

• By connecting to an existing database of user accounts such as a Windows Active Directory system, an LDAP compatible system or a relational database or by connecting to an identity manager using protocols such as SAML2 or Open Id Connect.

Several systems can also be combined to be used simultaneously (e.g. the JMap database and Windows Active Directory). These systems are then used as a single system. When JMap Server connects to an existing database, user account management is simplified because no account or user group needs to be created and managed in JMap.

The following sections describe each available option.

JMap DB user manager

This type of user account management records users and groups directly into JMap Server’s System database or in an external database containing the required tables and fields. The JMap administrator must create and manage all user accounts and groups.

Click on the User manager tab from the Users / Groups section. Select JMap DB user manager to indicate that user accounts will be managed within a relational database. To store information in JMap Server’s System database, select the JMap Server database option.

You can also use any relational database that contains at least the required tables and fields by selecting the External database option. When you do this, an interface displays, allowing you to define the configuration parameters. Using this configuration interface, select the database you wish to use. Afterwards, select the tables and fields containing the various information pertaining to users and groups. If needed, you can select Read-only mode to prevent account information from being modified by JMap Admin.

Once this configuration has been defined, you can create, modify and delete user accounts directly from JMap Admin.

Composite user manager

This type of user management allows you to combine several managers together. You can add as many user managers as necessary. All user managers will function as a single user manager. Refer to the previous sections for information on user manager configuration.

A composite user manager is recommended if your system integrates several managers or if you wish to transition towards a web-based single-sign on system.

Active Directory user manager

You can connect to Windows Active Directory (in read-only mode). In order for the Active Directory user manager option to be available in the User manager tab of the Users / Groups section in JMap Admin, you must include the following line in the JMAP_HOME/conf/jmapserver.properties file:

usermanager.ad=com.kheops.jmap.server.security.ActiveDirectoryUserManager

We recommend you use the Composite user manager instead of simply using the Active Directory user manager. This will allow you to maintain access to JMap Admin even if errors arise in the configuration of Active Directory.

In the User manager section, select the Composite user manager and add the Active Directory user manager. A new interface opens, allowing you to enter the settings to configure the connection to the Active Directory server.

JMap LDAP user manager

You can connect to any LDAP compliant directory (in read-only mode). Unix, Linux and Windows systems offer many LDAP compliant directories.

In order for the JMap LDAP user manager option to be available in the User manager tab of the Users / Groups section in JMap Admin, you must include the following line in the JMAP_HOME/conf/jmapserver.properties file:

usermanager.ldap=com.kheops.jmap.server.security.LDAPUserManager

We recommend you use the Composite user manager instead of simply using the LDAP user manager. This will allow you to maintain access to JMap Admin even if errors arise in the configuration of LDAP.

In the User manager section, select the Composite user manager and add the JMap LDAP user manager. A new interface opens, allowing you enter the settings to configure the connection to the LDAP server.

For more information on the LDAP protocol, refer to http://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol.

OpenID Connect (OIDC) user manager

You can allow users who already have an account in OpenID Connect (OIDC) user managers to connect to JMap Web and JMap NG applications using that account.

For detailed information on this protocol, visit the OpenID Connect 1.0 website.

Configuring an OIDC user manager is complex. Your organization’s IT department will provide the OIDC settings. The following table describes the settings related to JMap.

SAML2 user manager

You can allow users who already have an account in an identity manager that uses SAML2 to connect to JMap Web and JMap NG applications using that account.

SAML is an open standard that establishes a single sign-on between an identity manager and an application server such as JMap. This site provides details on SAML2.

Configuring a SAML2 user manager is complex. Your organization’s IT department will provide the settings related to SAML2. The following table describes the settings related to JMap.

Synchronizing user permissions

When you connect to a user or identity manager that is external to JMap (Active Directory, LDAP, OIDC, SAML2 or an external relational database), it is useful to synchronize JMap Server with the database for 2 reasons :

• When users or groups are deleted from the database and those deleted users or groups had been given permissions in JMap (e.g. to open a project or view certain layers), the permissions are not deleted from JMap Server permission lists. This can happen because JMap Server is not aware the users or groups have been deleted from the database. When synchronizing, JMap Server removes all existing permissions for deleted users and groups. However, even if you don’t synchronize, there is no security problem because deleted users will fail at login.

• When the contents of user groups are modified (members added or removed), so that JMap Server can reload the lists of users that belong to the groups. JMap Server keeps the group member lists in memory for performance reasons.

You can automate the synchronization by selecting the option Synchronize automatically every… and specifying a time period.

Managing User Accounts and Groups

In JMap, user accounts and groups are used for access control and collaboration purposes. You can manage users and groups in JMap Admin by clicking on Users / Groups from the JMap Server section.

Two special users and two special groups always exist in JMap: administrator, anonymous, everyone, and authenticated users.

Creating users and groups

You can create a new user or group by pressing Create from the Users / Groups section. This will bring you to the new user or group configuration section. Note that you can only create users and groups if you are using the JMap account database or an external database that is not in read-only mode.

Modifying users and groups

You can modify an existing user or group by clicking on its name in the list. Note that once a user is created, its user name cannot be modified. To add users to a group, press and a list of available users will be displayed. Select the users to add to the group and press Add. To remove users from a group, select the users to remove and press .

Deleting users and groups

You can delete a user or group by selecting it in the list and pressing Delete.

Managing Permissions

Permissions in JMap are divided into two families: permissions for the users of applications (Pro, Web and Survey) and permissions for the administrators (JMap Admin).

User permissions

User permissions determine what the users can do inside JMap Pro, JMap Web, and JMap Survey applications.

The following table presents the different permission groups that are available for the users.

Administrator permissions

Administrator permissions determine what JMap administrators are authorized to do in JMap Admin. Some permissions are global (permissions to do some tasks) while other permissions apply to specific resources.

Several of the global permissions are configured in the Permissions subsection of the JMap Server section.

The following table describes the global administration permissions.

Administration permissions that are specific to resources determine what an administrator can do with each resource. The following table describes those permissions.

Owners of a resource

Most resources managed in JMap Admin have one or more owners. Owners of a resource are the only ones that are allowed to:

• manage administration permissions for the resource;

• manage the list of owners for the resource;

• delete the resource.

Super administrators

Super administrators are special accounts that can do everything in JMap Admin. They are the only ones who are allowed to:

• manage the list of super administrators;

• manage global administration permissions;

• manage users and groups;

• modify JMap Server’s working parameters;

• display the log files;

• import and export configurations.

You can manage the list of super administrators from subsection Permissions in section JMap Server. Select the Super administrators tab.

The following table presents administration tasks with examples, and indicates which profile or permission is required to perform each task.

Permission reports

Permission reports allow you to view all the permissions that a user or a group has on a single report. A permission report is a convenient way to get the information without checking every resource. The reports are accessible from the Users and Groups tabs in the Users / Groups section, by clicking on .

Single Sign-On for JMap Pro

Single sign-on provides a secure way for users to access JMap Pro applications without authentication. The Windows session authentication is used to automatically launch the JMap session. Single sign-on is only available for Windows environments using Active Directory. A special configuration is required on the Windows server and on each computer where single sign-on is wanted. Note that the Enable single sign-on option must also be selected when deploying a JMap Pro application.

For more details on single sign-on configuration, refer to this article.

Managing Sessions

Each user that is connected to JMap Server using a JMap application has an open session on the server. The session remains open as long as the JMap application is not closed. Sessions contain information about the identity of the user. Depending on your license agreement, you may be limited to a certain number of simultaneous sessions.

To access the session management section, click on Sessions in the JMap Server section.

Five different types of sessions are possible. The following table describes each type of session.

Active sessions

You can view the list of open sessions. By selecting the Active sessions tab, the list of current sessions will be displayed along with useful information on each session. You can close open sessions by selecting them and clicking on Close session(s).

Reserved sessions

Reserved sessions are special sessions for users who have priority over the other users. These users can always open a JMap Pro, JMap Web or JMap Survey session, even if the maximum number of sessions is reached, according to your license. These reserved sessions are recorded separately from the rest of the sessions.

If your JMap user license permits it, you can assign a certain number of reserved sessions to the users of your choice. Press to select a user and assign him/her a reserved session. Once the maximum number of reserved sessions has been assigned, you cannot assign any to other users. You can remove a reserved session from a user by selecting that person’s name and clicking on .

Statistics

Session statistics provide basic information on user activity over time. You can determine the total number of sessions over a given period and the highest number of concurrent sessions reached over a period of time. Statistics are displayed in a bar graph. Click on Update to generate the graph.

The sessions information is stored in the JMap System database for a period of 18 months. Sessions that are older than 18 months are automatically deleted from the System database.

Using HTTPS with JMap

The HTTPS protocol allows you to use JMap in a more secure way by encrypting all communication between JMap applications, JMap Admin, and JMap Server.

Using HTTPS with JMap Admin

In order to use HTTPS with JMap Admin, you must install a security certificate in JMap Server. A security certificate is required for data encryption.

During the JMap installation process, an option is available to create and automatically install a temporary security certificate. This type of certificate ensures communication will be well secured, but it will cause warning messages to display in web browsers because it is not issued by a recognized security organization (CA or Certificate Authority).

You can also install a security certificate issued specifically for your organization, if you have one. For detailed steps on how to install a certificate, read the following article: https://k2geospatial.atlassian.net/wiki/x/EQAtAQ.

Once the security certificate has been installed in JMap Server, you can launch JMap Admin with a URL similar to the following:

https://myserverjmap (assuming the default port 443 is used)

At any time, if you wish to force the use of the HTTPS protocol for JMap Admin, you can enable automatic redirection. For more information, refer to the JMap Server Settings section.

Using HTTPS with JMap applications

When you deploy JMap Pro or Web applications with JMap Admin, you can indicate which protocol (HTTP or HTTPS) will be used for communication between the application and JMap Server. If the deployment type is local (app hosted on JMap Server), the HTTPS protocol is available only if a security certificate is installed on the JMap Server. It is the same certificate as that which is used for JMap Admin (read above). If the deployment type is external (app hosted on another Web server), the 2 protocols are always offered.

For JMap Pro, the HTTP and HTTPS protocols are used only if the Proxy connection option is selected during deployment.

---