Netegrity SiteMinder Authentication Configuration

Example 3. package.xml - Netegrity SiteMinder Enabled ..... -- Netegrity SiteMinded security provider preferences for the server side -- securityProviderPreferences xmlns=http:systinet.comwasppackageextension name=Siteminder loginNameHeadersm-userdnloginNameHeader groupHeadersm-rolegroupHeader delimiterdelimiter securityProviderPreferences -- Netegrity SiteMinded interceptor-- interceptor name=SiteMinderInterceptor implementation-class=com.systinet.uddi.security.siteminder.SmInterceptor config:loginNameHeadersm-userdnconfig:loginNameHeader config:groupHeadersm-roleconfig:groupHeader config:delimiterconfig:delimiter interceptor .....

8.3. SSL Client authentication with Embedded HTTPHTTPS Server

Oracle Service Registry used with Embedded HTTPHTTPS Server can be configured to perform authentication using client certificate obtained via 2-way SSL, where the client must also authenticate itself to a server. Setup instructions are different for an embedded HTTPHTTPS server and a registry deployed to an application server. This section is focused on Embedded HTTPHTTPS Server onlys, see Section 8.5, J2EE Server Authentication for instruction of how to configure SSL client authentication for deployed registry. To allow SSL client authentication for a standalone registry: 1. Make sure that the registry is not running. 2. Modify REGISTRY_HOMEconfserverconf.xml as follows: • Under httpsPreferences name=https, change needsClientAuth to true. This configures HTTPS transport to require client certificates. • U n d e r s e c u r i t y P r e f e r e n c e s n a m e = m a i n , a d d acceptingSecurityProviderSSLacceptingSecurityProvider . This ensures the mapping of client certificates to a user name. A fragment of changed REGISTRY_HOMEconfserverconf.xml is shown in Example 4, A fragment of serverconf.xml with 2-way SSL turned on . 3. Trust the certificate of a certification authority that is used to issue client certificates. Run the PStoreTool tool from the REGISTRY_HOMEbin directory to import this certificate to a truststore that is used by registry. PStoreTool add -certFile client certificates authority certificate file -config path to pstore.xml 4. Configure how a client certificate is mapped to a user name. Registry comes with JAAS login module that extracts the user name out of a subject that is necessary part of a client certificate. The login module that performs this mapping Page 133 8.3. SSL Client authentication with Embedded HTTPHTTPS is configured under the CertsMapping entry of the REGISTRY_HOMEconfjaas.conf file. An example of CertsMapping entry is shown in Example 5, CertsMapping JAAS configuration . You can configure the following options: • debug - if set to true, debug actions of the login module are printed to an error stream. False by default. • issuer - issuer name. If set, mapped certificate must be issued by a certification authority with this subject name recommended. • pattern - regular expression as per java.util.regexp that is used to get user names. The first capturing group of a specified pattern is used as a user name. When there is no capturing group and the pattern matches, the whole subject becomes a user name. Used regular expressions are case-insensitive. Examples are: • The default is ?\\,\s?EMAILADDRESS=.+. It matches a name listed in EMAILADDRESS. This regular expression ignores the case of EMAILADDRESS possibly contained in another part of subject. • CN=[,]+ matches common name. • . matches every subject. Since it has no capturing group, the whole subject DN is used. You can configure more than one login module to perform certificate mapping. This is useful when you have to accept different issuers andor provide a fallback to a failed certificate mapping of the first configured login module. An example of a CertsMapping entry that allows the mapping of certificates issued by 2 issuers with different mappings is shown in Example 6, CertsMapping JAAS configuration with 2 possible issuers . 5. The registry is now configured for SSL client authentication. You may also change the applicability of SSL client authentication by changing the configuration of SSL security providers. This configuration is in the securityProviderPreferences name=SSL element of the REGISTRY_HOMEconfserverconf.xml file. An example is shown in Example 4, A fragment of serverconf.xml with 2-way SSL turned on . Page 134

8.3. SSL Client authentication with Embedded HTTPHTTPS Server