How End User Certificate Callback Handlers Work Creating a Certificate Callback Implementation

Configuring Identity and Trust 11-19 The following topics describe how a certificate callback handler works and how to implement and configure one: ■ Section 11.6.1, How End User Certificate Callback Handlers Work ■ Section 11.6.2, Creating a Certificate Callback Implementation ■ Section 11.6.3, Configuring the Certificate Callback with WebLogic Server

11.6.1 How End User Certificate Callback Handlers Work

When a client makes a secure RMI connection to a WebLogic Server instance that is configured with a certificate callback handler, WebLogic Server invokes the callback handler. The callback evaluates details about the end user that are contained in the connection request, then returns a boolean value indicating whether authentication is successful. The CertificateCallback interface calls the validate method on an CertificateCallbackInfo instance, which contains methods to obtain the following information from the end user that is contained in the RMI connection request: ■ Client host name, IP address, and port ■ Client domain name ■ Destination host name, IP address, and port ■ Authenticated Subject ■ Client certificate The callback implementation includes the logic that evaluates the client data that is obtained and returns true or false as follows: ■ If the callback returns true, authentication succeeds and the client connection to WebLogic Server is made. ■ If the callback returns false, a RemoteException is thrown containing the Authentication denied message.

11.6.2 Creating a Certificate Callback Implementation

The weblogic.security.SSL.CertificateCallback interface contains a single invocation on the validate method on a weblogic.security.SSL.CertificateCallbackInfo instance. The CertificateCallbackInfo instance contains methods to obtain details about the end user that are passed over the secure RMI connection. You implement logic that evaluates the data that is returned and returns a true or false. The logic does not need to evaluate all data that is returned. Typically, only the certificate is evaluated; for example, obtaining the common name cn or distinguished name dn. For more information, see the following Javadoc in the Oracle WebLogic Server API Reference: Note: If you use a certificate callback implementation in WebLogic Server, a callback is generated whenever a request is received over a secure port. As a result, using certificate callbacks may impose a performance overhead that should be taken into consideration. 11-20 Securing Oracle WebLogic Server ■ weblogic.security.SSL.CertificateCallback interface ■ weblogic.security.SSL.CertificateCallbackInfo class

11.6.3 Configuring the Certificate Callback with WebLogic Server