SSL Client Authentication in Oracle WebLogic

Select the Keystores Tab. Select Custom Identity and Custom Trust. Provide values to your identity and trust stores. Click Save. a. b. Select the SSL Tab. Click the Advanced option. Fill in Identity Alias and Password. Select Client Certs Requested and enforced in Two Way Client Cert Behavior. Click Save. 5. Click Security Realms in Domain Structure. Select myrealm. a. Click Users and groups. Create a new user called admin. You can create other users here too. Their names are matched with the name part of emails in the certificate. b. Click the Providers tab. Create a new authentication provider. Name it mysslauthprovider and select DefaultIdentityAsserter . Click on the provider properties. Add the X.509 type. Click Save. Click the Provider specific tab. Check Use Default User Name Mapper. Leave default value for Default User Name Mapper Attribute Delimiter . Click Save. Note The last step may not work when another provider with DefaultIdentityAsserter is present. Either modify the old provider or delete the old and configure the new mysslauthprovider.

8.5. J2EE Server Authentication

The registry can be configured to let a J2EE application server perform authentication. Unlike Section 8.2, Netegrity SiteMinder and Section 8.1, HTTP Basic , the authentication takes place for the whole registry application. To allow J2EE server authentication: 1. Locate the EAR or WAR file produced by the installer. It is available in REGISTRY_HOMEconfporting or in the application server when deployed. Note that in case of an EAR file the actual WAR file is contained in it. Both files can be opened as ZIP archives. 2. Modify WEB-INFweb.xml file in the WAR file as follows: a. Change the value of context parameter use.request.user to true. b. Add a login-config element with a type of the chosen J2EE authentication. Example 7, A fragment of web.xml shows a login config that turns on the CLIENT-CERT authentication method, which is used for SSL client authentication. You may also add a security-constraint element to specify a set of resources where confidentiality andor integrity is required. Example 7, A fragment of web.xml contains a security-constraint that requires confidential communication between client and server for all registry resources, which typically means to allowing only HTTPS for communication with registry. c. Configure a J2EE application server for the authentication method of your choice. For SSL client authentication, this typically means setting up HTTPS transport to require client certificates and to map client certificates to user names. Consult your J2EE application server documentation for details. 3. Continue deployment of the modified war file. Page 137

8.5. J2EE Server Authentication

Example 7. A fragment of web.xml ?xml version=1.0 encoding=UTF-8? web-app display-nameRegistrydisplay-name ... context-param param-nameuse.request.userparam-name param-valuetrueparam-value context-param .... -- Added CLIENT-CERT authentication method -- login-config auth-methodCLIENT-CERTauth-method login-config -- Added security contraint that allow to access registry only via HTTPS -- security-constraint display-nameHTTPS required to access registrydisplay-name web-resource-collection web-resource-nameProtected Areaweb-resource-name url-patternurl-pattern http-methodDELETEhttp-method http-methodGEThttp-method http-methodPOSThttp-method http-methodPUThttp-method web-resource-collection user-data-constraint descriptionRequire confidentialitydescription transport-guaranteeCONFIDENTIALtransport-guarantee user-data-constraint security-constraint web-app

8.6. Internal SSL Client Authentication Mapping in J2EE

While J2EE application authentication can be configured in many ways, some configurations can be cumbersome on some application servers. Internal SSL client authentication mapping may be easier to configure for simple deployments. Internal client authentication mapping offers the same options for configuration as CertMapper as described in Section 8.3, SSL Client authentication with Embedded HTTPHTTPS Server . Installation steps: 1. Ensure that certificates are trusted by the J2EE server. Some servers have dedicated trust stores, while others use the cacerts java keystore file inside Java runtime. Add the certificate of the Certification Authority you are using to the servers trust store as a trusted certificate. 2. Set up your J2EE server SSL. You usually need to provide the Java trust store file with the server identity. Configure the server SSL to use the trust store by specifying file, alias and store password. 3. Set up your J2EE server to ask for or require Client Authentication. 4. Edit web.xml inside the deployed registry. • C h a n g e t a g s e r v l e t - c l a s s t o c o n t a i n com.systinet.transport.servlet.server.registry.RegistryServletTwoWaySSL . Page 138

8.6. Internal SSL Client Authentication Mapping in J2EE