8 Signing On with Digital Certificates

8.3.1.1 Setting SSL Parameters

To set the required SSL parameters, complete the following steps:

1. Go to ssl.conf. The file is at ORACLE_HOME/Apache/Apache/conf.

2. In the SSL Virtual Host Context section of ssl.conf, add or edit the parameters listed in Table 8-1. At the same time, verify that the SSLEngine parameter has been set to on. This should have been done as part of configuring the Oracle HTTP Server for SSL.

SSLWallet

SSLWalletPassword

SSLVerifyClient

8.3.1.2 Choosing a Certificate Authority

If you have OracleAS Certificate Authority installed and want to use this CA to issue certificates, edit ssl.conf to point to the desired Oracle CA wallet. You can either use the Oracle CA wallet described in Table 8-1 or have the Oracle CA issue a wallet that is specifically for the single sign-on server. If you choose the first option, copy the wallets that are in the wallet directory for the Oracle CA to the default wallet directory. If you choose the second option, see Chapter 7 in Oracle Application Server Certificate Authority Administrator's Guide for instructions. The relevant section is "Server/SubCA Certificates Tab." This is a subsection of "End-User Tabs and Processes." Once you obtain the wallet, edit ssl.conf to point to the wallet's location.

You may, of course, elect to use a third-party CA. In this case, too, you must edit ssl.conf to point to the wallet's location as explained in Table 8-1.

Using OracleAS Single Sign-On in conjunction with OracleAS Certificate Authority simplifies the certificate provisioning process. You can configure the Oracle CA to broadcast the URL for its UI to single sign-on users. Users can then use this link to request a single sign-on certificate that is automatically linked to their entry in Oracle Internet Directory.

8.3.2.1 Configure policy.properties with the Default Authentication Plugin

Update the DefaultAuthLevel section of the policy.properties file with the correct authentication level for certificate sign-on. This file is at ORACLE_HOME/sso/conf. Set the default authentication level to this value:

DefaultAuthLevel = MediumHighSecurity

Then, in the Authentication plugins section, pair this authentication level with the default authentication plugin:

MediumHighSecurity_AuthPlugin = oracle.security.sso.server.auth.SSOX509CertAuth

For your convenience, policy.properties is available in Appendix C, "policy.properties".

8.3.2.2 Modify the Configuration File for the Authentication Plugin (Optional)

The X509CertAuth.properties file contains the parameters that follow. The file is in the same directory as policy.properties.

oracle.security.sso.server.auth.SSOCertMapperDn

oracle.security.sso.server.auth.SSOCertMapperNickname

#Allow authentication fallback
CertificateAuthFallback=true

8.3.2.3 Customize the User Name Mapping Module (Optional)

To customize the user name mapping module, implement a mapping module based on oracle.security.sso.ias904.toolkit.IPASUserMappingInterface. Refer to the example mapping modules shipped with this release. Again, these modules are SSOCertMapperDN.java and SSOCertMapperNickname.java.

The example modules contain the following classes:

• Mapping module Interface

  This interface contains the following methods:

  public IPASUserInfo getUserInfo(
         javax.servlet.http.HttpServletRequest request)
         throws IPASException;
  
  

• User information class

  This class contains user information such as the user nickname and user DN. The package name is oracle.security.sso.ias904.toolkit.IPASUserInfo. The constructor looks like this:

  Public IPASUserInfo(
         String userNickName
         String realmNickname)
  
  Public IPASUserInfo(
         String userNickName,
         String userDN,
         String userGUID,
         String realmNickname,
         String realmDN,
         String realmGUID)
  
  

• Exception class

  A problem with user name mapping raises this exception. The class name is oracle.security.sso.ias904.toolkit.IPASException. The super class is java.lang.Exception. The constructor looks like this:

  public IPASException()
  public IPASException(String Message)
  
  

1. Extract ipassample.jar, the file that contains the modules:

   ORACLE_HOME/jdk/bin/jar -xvf ORACLE_HOME/sso/lib/ipassample.jar
   
   

2. Create a Java class that implements the following interface:

   oracle.security.sso.ias904.toolkit.IPASUserMappingInterface
   
   

3. Compile your custom implementation:

   ORACLE_HOME/jdk/bin/javac -classpath ORACLE_HOME/sso/lib/
   ipastoolkit.jar:ORACLE_HOME/lib/servlet.jar -d class_directory
   java_file_name 
   
   

4. Jar your class file and place it into ORACLE_HOME/sso/plugin:

   ORACLE_HOME/jdk/bin/jar -cvf ORACLE_HOME/sso/plugin/CertMapImpl.jar class_directory
   
   

   This step assumes that you do not have individual class files in the plugin directory. If the directory contains the individual files, they may be duplicated.

5. Update x509CertAuth.properties with your implementation. See "Modify the Configuration File for the Authentication Plugin (Optional)".

8.3.2.4 Restart the Single Sign-On Middle Tier

After configuring the server, restart the middle tier:

ORACLE_HOME/opmn/bin/opmnctl restartproc process-type=HTTP_Server
ORACLE_HOME/opmn/bin/opmnctl restartproc process-type=OC4J_SECURITY