Configuring SSL for Oracle WebCenter Client-Side SSL for Applications

6-24 Oracle Fusion Middleware Administrators Guide

6.5.6 Client-Side SSL for Applications

For information on how to write SSL-enabled applications, see Using SSL Authentication in Java Clients in Oracle Fusion Middleware Programming Security for Oracle WebLogic Server. For best practices, refer to Section 6.8.2, Best Practices for Application Developers.

6.6 Configuring SSL for the Data Tier

This section contains these topics: ■ Enabling SSL on Oracle Internet Directory Listeners ■ Enabling SSL on Oracle Virtual Directory Listeners ■ Configuring SSL for the Database

6.6.1 Enabling SSL on Oracle Internet Directory Listeners

Out of the box, Oracle Internet Directory nodes are SSL-enabled in no-auth mode. This section explains how to SSL-enable Oracle Internet Directory listeners using Fusion Middleware Control and the WLST command-line tool.

6.6.1.1 Enable Inbound SSL on an Oracle Internet Directory Listener Using Fusion Middleware Control

In this example, the following steps enable SSL in no-auth mode for an instance of Oracle Internet Directory using Fusion Middleware Control: 1. Select the Oracle Internet Directory instance in the navigation pane on the left. 2. Navigate to Oracle Internet Directory, then Administration, then Server Properties . 3. Click Change SSL Settings. 4. On the SSL Settings dialog: Configuring SSL in Oracle Fusion Middleware 6-25 ■ Select Enable SSL. ■ Set SSL Authentication to No Authentication. ■ Set Cipher Suite to All. ■ Set SSL protocol version to v3. ■ Click OK. 5. Restart the Oracle Internet Directory instance by navigating to Oracle Internet Directory , then Control, then Restart. 6. To verify that the instance is correctly SSL-enabled, execute an ldapbind command of the form: ldapbind -D cn=orcladmin -U 1 -h host -p SSL_port SSL Enabling in Other Authentication Modes The steps for SSL-enabling in other authentication modes are the same, except that in the SSL Settings dialog, you would set the appropriate authentication type.

6.6.1.2 Enabling Inbound SSL on an Oracle Internet Directory Listener Using WLST

Configure the listener with SSL properties in no-auth mode as follows: configureSSLinst1, oid1, oid, sslport1 Notes: -U 1 represents the no-auth mode. Note: Other authentication types need an Oracle wallet. Note: The Oracle Internet Directory port name is always sslport1. 6-26 Oracle Fusion Middleware Administrators Guide SSL Enabling in Other Authentication Modes You can do this by running the configureSSL command with a properties file as parameter and specifying an appropriate authentication type parameter value. For details, see the Oracle Fusion Middleware Administrators Guide for Oracle Internet Directory.

6.6.1.3 Enabling Outbound SSL from Oracle Internet Directory to Oracle Database

Two sets of procedures are needed to configure SSL connections from Oracle Internet Directory to Oracle Database: ■ Configure SSL for the Database ■ Configure Outbound Oracle Internet Directory Configure SSL for the Database The steps to configure Oracle Database for SSL are described in Section 6.6.3.1, SSL-Enable Oracle Database. Configure Outbound Oracle Internet Directory Take these steps to configure SSL for outbound traffic from Oracle Internet Directory to Oracle Database: 1. Stop the Oracle Internet Directory server instances whose outbound traffic to the database is to be configured with SSL using this opmnctl syntax: ORACLE_INSTANCEbinopmnctl stopproc ias-component=componentName For example: ORACLE_INSTANCEbinopmnctl stopproc ias-component=oid1 2. Configure Security Socket Layer authentication on the database to which the Oracle Internet Directory server instance is connecting. For details, see Oracle Database Advanced Security Administrators Guide. 3. Restart the databaselistener as required. 4. Start Oracle Internet Directory server instances using this opmnctl syntax: ORACLE_INSTANCEbinopmnctl startproc ias-component=componentName For example: ORACLE_INSTANCEbinopmnctl startproc ias-component=oid1 Note: ■ configureSSL can use defaults for all SSL attributes; see Table 6–5 for details. ■ We could also specify a properties file as a parameter to configureSSL; see Table 6–4 for details. Note: Only the no-authentication mode is supported. Configuring SSL in Oracle Fusion Middleware 6-27

6.6.2 Enabling SSL on Oracle Virtual Directory Listeners

This section explains how to enable SSL for an instance of Oracle Virtual Directory. The Oracle Fusion Middleware Administrators Guide for Oracle Virtual Directory provides additional information on these topics: ■ Configuring SSL for Listeners Using Fusion Middleware Control ■ Configuring SSL for Listeners Using WLST ■ Configuring a Mutual Authentication SSL Connection Between Oracle Virtual Directory and Oracle Internet Directory

6.6.2.1 Enable SSL for Oracle Virtual Directory Using Fusion Middleware Control

The steps to enable SSL are as follows the example illustrates the server-auth mode: 1. Select the Oracle Virtual Directory instance in the navigation pane on the left. 2. Select a keystore to use for the operation by navigating to Oracle Virtual Directory , then Security, then Keystores Choose from the list of keystores that appears. If you need to generate a new keystore, see Section 8.3.3.1, Creating a Keystore Using Fusion Middleware Control for details. 3. To SSL-enable the listener, navigate to Oracle Virtual Directory, then Administration , then Listeners. 4. Select the LDAP SSL Endpoint listener, and click Edit. The Edit Listener page appears: 5. Click Change SSL Settings. 6. On the SSL Settings dialog: