J2EE Server Authentication

Example 7. A fragment of web.xml ?xml version=1.0 encoding=UTF-8? web-app display-nameRegistrydisplay-name ... context-param param-nameuse.request.userparam-name param-valuetrueparam-value context-param .... -- Added CLIENT-CERT authentication method -- login-config auth-methodCLIENT-CERTauth-method login-config -- Added security contraint that allow to access registry only via HTTPS -- security-constraint display-nameHTTPS required to access registrydisplay-name web-resource-collection web-resource-nameProtected Areaweb-resource-name url-patternurl-pattern http-methodDELETEhttp-method http-methodGEThttp-method http-methodPOSThttp-method http-methodPUThttp-method web-resource-collection user-data-constraint descriptionRequire confidentialitydescription transport-guaranteeCONFIDENTIALtransport-guarantee user-data-constraint security-constraint web-app

8.6. Internal SSL Client Authentication Mapping in J2EE

While J2EE application authentication can be configured in many ways, some configurations can be cumbersome on some application servers. Internal SSL client authentication mapping may be easier to configure for simple deployments. Internal client authentication mapping offers the same options for configuration as CertMapper as described in Section 8.3, SSL Client authentication with Embedded HTTPHTTPS Server . Installation steps: 1. Ensure that certificates are trusted by the J2EE server. Some servers have dedicated trust stores, while others use the cacerts java keystore file inside Java runtime. Add the certificate of the Certification Authority you are using to the servers trust store as a trusted certificate. 2. Set up your J2EE server SSL. You usually need to provide the Java trust store file with the server identity. Configure the server SSL to use the trust store by specifying file, alias and store password. 3. Set up your J2EE server to ask for or require Client Authentication. 4. Edit web.xml inside the deployed registry. • C h a n g e t a g s e r v l e t - c l a s s t o c o n t a i n com.systinet.transport.servlet.server.registry.RegistryServletTwoWaySSL . Page 138

8.6. Internal SSL Client Authentication Mapping in J2EE

• Add the CLIENT-CERT authentication method as described in Example 8, A fragment of web.xml . • Add context parameters. Set the context parameter twowayssl.use_user to value true. • Set the context parameter twowayssl.issuer to the X.509 Issuer DN of certificates you want to allow. • You can set the context parameter twowayssl.mapping to a regular expression for matching parts of Subject DN by default, it is set to the name part of the email address in the email field. • You can set the context parameter twowayssl.debug to true for run-time information about matching. All context parameters that you set correspond to parameters in Section 8.3, SSL Client authentication with Embedded HTTPHTTPS Server . For examples of these parameters, see Example 8, A fragment of web.xml . Example 8. A fragment of web.xml login-config auth-methodCLIENT-CERTauth-method login-config context-param param-nametwowayssl.use_userparam-name param-valuetrueparam-value context-param context-param param-nametwowayssl.issuerparam-name param-valueC=CZ, ST=Czech, L=Prague, O=Example company, OU=Security Team, CN=CAparam- value context-param

8.7. Disabling Normal Authentication

After you implement a custom authentication mechanism, such as a client SSL certificate, you may want to disable normal authentication. Disable normal authentication by removing permission for the get_authToken UDDI API from the systemeveryone group. The get_authToken API has this permission by default. To remove permission for the get_authToken UDDI API from the systemeveryone group: 1. Log into the WEB UI using your administrative account and open the Management tab. 2. Open the Permissions page. 3. Select the Group radio button. 4. Edit the group systemeveryone and remove the following permissions Permission type Api name Actions: • org.systinet.uddi.security.permission.ApiUserPermission org.systinet.uddi.client.v3.UDDI_Security_PortType get_authToken, • org.systinet.uddi.security.permission.ApiUserPermission org.systinet.uddi.client.v2.Publish get_authToken, • org.systinet.uddi.security.permission.ApiUserPermission org.systinet.uddi.client.v1.PublishSoap get_authToken. Page 139

8.7. Disabling Normal Authentication