Multiple LDAP Services LDAP

6.1.4. LDAP over SSLTLS

It is only a matter of configuration to setup LDAP over SSL or TLS with a directory server of your choice. We recommend that you first install Oracle Service Registry with a connection to LDAP that does not use SSL. You can then verify the configuration by logging in as a user defined in this directory before configuring use of SSL. The configuration procedure assumes that you have already installed Oracle Service Registry with an LDAP account provider. Oracle Service Registry must not be running. LDAP over SSL Without Client Authentication In this case only LDAP server authentication is required. This is usually the case. Edit the REGISTRY_HOMEappuddiconfdirectory.xml file in one of the following ways depending on the version of Java used to run Oracle Service Registry: • If Oracle Service Registry will always be running with Java 1.4.2 or later: 1. Change the java.naming.provider.url property to use the ldaps protocol and the port on which the directory server accepts SSLTLS connections. For example ldaps:sranka.in.idoox.com:636; • Otherwise, if Oracle Service Registry may be run with a Java version less than 1.4.2: 1. Change the java.naming.provider.url property to the appropriate URL using the ldap protocol. For example ldap:sranka.in.idoox.com:636 ; 2. Add a new property, after the java.naming.provider.url property, with name java.naming.security.protocol and value ssl; This is shown in the following example: Example 1. Directory configuration config name=directory savingPeriod=5000 directory -- LDAP over SSLTLS unprotected connection -- -- property name=java.naming.provider.url value=ldap:hostname:47361 -- -- LDAP over SSLTLS for Java 1.4.2 and later -- -- property name=java.naming.provider.url value=ldaps:hostname:636 -- -- LDAP over SSLTLS for Java where LDAP over SSL is supported -- property name=java.naming.provider.url value=ldap:hostname:636 property name=java.naming.security.protocol value=ssl ... ... ... directory config In both cases, be sure that the hostname specified in the java.naming.provider.url property matches the name that is in the directory server certificates subject common name CN part of certificates Subject. Otherwise you will get an Page 112 LDAP over SSL Without Client Authentication exception during startup of Oracle Service Registry. It will inform you of a hostname verification error. The stacktrace contains the hostname that you must use. LDAP over SSL With Mutual Authentication Oracle Service Registry does not support LDAP over SSL with mutual authentication. Ensuring Trust of the LDAP Server The client that connects to the SSLTLS server must trust the server certificate in order to establish communication with that server. The configuration of LDAPS explained above inherits the default rule for establishing trust from JSSE the Java implementation of SSLTLS. This is based on trust stores. When a trust store is needed to verify a clientserver certificate, it is searched for in the following locations in order: 1. The file specified by the javax.net.ssl.trustStore system property, if defined; 2. Otherwise the file JAVA_HOME\jre\lib\security\jssecacerts if it exists; 3. Otherwise the file JAVA_HOME\jre\lib\security\cacerts if it exists; It is recommended to use the first option to define a trust store specifically for the application you are running. In this case, you have to change the command that starts the registry or the JVM environment of the ported registry to define the following Java system properties: Description Property Absolute path of your trust store file. javax.net.ssl.trustStore Password for the trust store file. javax.net.ssl.trustStorePassword To ensure that the server certificate is trusted, you have to: 1. Contact the administrator of the LDAP server and get the certificate of the server or the certificate of the authority that signed it; 2. Import the certificate into the trust store of your choice using the Java keytool: keytool -import -trustcacerts -alias alias -file file -keystore keystore -storepass storepass where the parameters are as follows: alias A mandatory, unique alias for the certificate in the trust store; The file containing the certificate usually with .crt extension; The keystore file of your choice; A password designed to protect the keystore file from tampering. Java level keystores cacerts and jssecacerts usually require the password changeit; file The file containing the certificate usually with .crt extension; The keystore file of your choice; Page 113 Ensuring Trust of the LDAP Server