This TPI addresses Aphelion vulnerabilities for disallowing anonymous Aphelion LDAP access. The access control on Aphelion LDAP directory can be set with various ways. For additional detail, please refer to Access control section in the Aphelion Admin Guide. Starting with a functional working Windchill solution with Apache and Aphelion LDAP installed. In the example below two users are defined, one user can read/write in the directory i.e aphelionadmin and other one has only read access i.e. windchilluser. When the directory is accessed on behalf of the Windchill system or as an Administrator the write user is used. Otherwise, the read only user is used.

For Windchill 7.0 solutions see Additional Information below.
For Windchill 8.0 solutions refer to the section "Restricting Access to Aphelion" found in the Info*Engine Installation and Configuration Guide.

The following are the main steps:

Step 1-> Use the Windchill Principal Administrator to define two users or use the LDAP Browser to
define two users. Create users:

	uid=aphelionadmin,ou=people,cn=mymachine,cn=application services,o=mycompany and 
	uid=windchilluser,ou=people,cn= mymachine,cn=application services,o=mycompany

Here mymachine is the distinguished name and mycompany is machine name derived from network domain. These users must have a password defined in their entry. Here we are using passwd admin and user for ahelionadmin and windchilluser respectively.

Step 2-> Add the aphelionadmin user to the Administrators group with the Principal Administrator.

Step 3-> Modify <WT_HOME>/tasks/federation/MapCredentials.xml and add the users as shown in
the snippet below.

<ie:webject name="Create-Group" type="GRP">

  <% if ( isAdmin ) { %>
      <!------------------------------
        Create a credentials map for users with administrative privileges
        ------------------------------>
      <ie:param name="element"
                data="INSTANCE=com.ptc.ptcnet.Ldap:DBUSER=uid=aphelionadmin,ou=people,cn=mymach 
 ine,cn=application services,o=mycompany:PASSWD=admin"/>
      <!------------------------------
      PendingUserAdapter
        ------------------------------>
      <ie:param name="element"
                data="INSTANCE=com.ptc.ptcnet.Ldap-pending:DBUSER=uid=aphelionadmin,ou=people,c 
 n=mymachine,cn=application services,o=mycompany:PASSWD=admin"/>
   <!------------------------------
        ------------------------------>
   <% } else { %>
      <!------------------------------
        Create a credentials map for non-privileged users
        ------------------------------>
      <ie:param name="element"
                data="INSTANCE=com.ptc.ptcnet.Ldap:DBUSER=uid=windchilluser,ou=people,cn=mymach 
 ine,cn=application services,o=mycompany:PASSWD=user"/>
   <% } %>

   <ie:param name="delimiter" data=":"/>
   <ie:param name="group_out" data="map"/>

</ie:webject>

Step 4 -> Add the windchilluser to Apache configuration. For this example, this allows apache to access the directory in read only mode. Please make changes to <Apache loadpoint>/conf/app-Windchill.properties file for following lines:

apacheWebApp.bindDn=uid\=windchilluser,ou\=people,cn\=mymachine,cn\=application services,o\=mycompany
apacheWebApp.anonBind=false
apacheWebApp.bindPwd=user

From a shell, from the <Apache loadpoint> run:
ant -f webAppCon