Require SSL support in Mediator and CentraSite

Transcription

1 Require SSL support in Mediator and CentraSite Require SSL run-time policy in Mediator Introduction: We have to use the Require SSL run-time action only if we want to invoke the virtual service in secured port(https) and ensure that all messages use SSL protocol. Usage: When this policy action is set for the virtual service, Mediator ensures that requests are sent to the server using the HTTPS protocol (SSL). The policy also specifies whether the client certificate is required. This allows Mediator to verify the client sending the request. If the policy requires the client certificate and if it is not presented, Mediator rejects the message. When a client certificate is required by the policy, the Integration Server HTTPS port should be configured to request or require a client certificate. Configuration 1. Make sure that the security configuration is done in Mediator,For further guidance on that how to configure keystore and trust store refer the section below or look for Securing Communications with the Server in the webmethods Integration Server Administrator's Guide. 2. Enable the HTTPS port created in the Integration Server ports settings at the Mediator General page of the Mediator Administration screen. Asset Creation and Deployment 1. Create a run-time policy with action Require SSL applicable to virtual service deserved to be deployed with the desired option either to verify the client certificate or not. a. Client Certificate Required BooleanSpecifies whether client certificates are required for the purposes of: Verifying the signature of signed SOAP requests Encrypting SOAP responses Value Yes Description Require client certificates. No Default. Do not require client certificates.

2 2. Create the virtual service with SSL enabled in the entry protocol of the virtual service and then deploy it. Deploy the virtual service, Once the VS is deployed in the mediator you can endpoint with https port available in the Endpoints section of the summary profile. VSD Snippet of the Require SSL policy will be as follows VSD snippet <policy id="wssecuritypolicy"> <wsp:policy xmlns:wsp=" xmlns:wsu=" 1.0.xsd" wsu:id="requiressl"> <wsp:exactlyone> <wsp:all> <sp:transportbinding xmlns:sp=" <sp:transporttoken> <sp:httpstoken> <sp:requireclientcertificate /> </sp:httpstoken> </sp:transporttoken> <sp:algorithmsuite> <sp:basic256 />

3 </sp:algorithmsuite> <sp:layout> <sp:lax /> </sp:layout> </sp:transportbinding> <ramp:rampartconfig xmlns:ramp=" <!-- username of UsernameToken to be used --> <ramp:user /> <!-- alias of the key to be used to sign --> <ramp:usercertalias>partner1</ramp:usercertalias> <ramp:passwordcallbackclass>com.softwareag.pg.security.ispgpwcallback</ramp:passwordca llbackclass> <ramp:policyvalidatorcbclass>com.wm.app.b2b.server.wss.ispolicyvalidatorcallback</ramp :policyvalidatorcbclass> <ramp:encryptionuser>usereqsigcert</ramp:encryptionuser> <ramp:signaturecrypto> <ramp:crypto provider="org.apache.ws.security.components.crypto.merlin"> name="org.apache.ws.security.crypto.merlin.keystore.type">jks</ramp:property> name="org.apache.ws.security.crypto.merlin.file">c:\softwareag\integrationserver\packa ges\wmmediator\config\resources\security\pgkeystore.jks</ramp:property> name="org.apache.ws.security.crypto.merlin.keystore.password">********</ramp:property> </ramp:crypto> </ramp:signaturecrypto> <ramp:encryptioncrypto> <ramp:crypto provider="org.apache.ws.security.components.crypto.merlin"> name="org.apache.ws.security.crypto.merlin.keystore.type">jks</ramp:property> name="org.apache.ws.security.crypto.merlin.file">c:\softwareag\integrationserver\packa ges\wmmediator\config\resources\security\pgkeystore.jks</ramp:property> name="org.apache.ws.security.crypto.merlin.keystore.password">********</ramp:property> </ramp:crypto> </ramp:encryptioncrypto> </ramp:rampartconfig></wsp:all>

4 </wsp:exactlyone> </policy> Service invocation request should look like this. Raw SOAP Request POST HTTP/1.1 Accept-Encoding: gzip,deflate Content-Type: application/soap+xml;charset=utf-8;action="urn:sayhello" Content-Length: 289 Host: VMSPAR02W.eur.ad.sag:8888 Connection: Keep-Alive User-Agent: Apache-HttpClient/4.1.1 (java 1.5) <soap:envelope xmlns:soap=" xmlns:axis=" <soap:header/> <soap:body> <axis:sayhello> <!--Optional:--> <axis:name>sai</axis:name> </axis:sayhello> </soap:body> </soap:envelope> Configure keystore and truststore If we want to deploy virtual services with the security policies apply,we have to first setup the security configuration settings in Mediator. 1. Go to the Mediator and click on Security > Key store, By default you would not find any information related to keystore added out of the box. Click on create keystore alias and and provide the certificate information as given below in the screen shots a. By default, Mediator ship sample JKS keystore under the location: C:\SoftwareAG\IntegrationServer\instances\default\packages\WmMediator\config\resources\security\pgkeystore.jks b. password would be "password"

5 2. Once the key store alias is configured, you will find that information in the key store list. Now create a trust store alias by pointing to the "cacert" in the same location a. C:\SoftwareAG\IntegrationServer\instances\default\packages\WmMediator\config\resources\security\cacerts b. password would be "changeit"

6 3. Once the keystore and truststore are configured we should configure the client certificates by specifying the certificate path. a. In Mediator, if user authenticate against X.509 certificate, user has to map with certificate. Below is the configuration step to map the user. b. Go to location to get the certificate available by default C:\SoftwareAG\IntegrationServer\instances\default\packages\WmMediator\config\resources\security\partner1cert.der c. Select the user as "Administrator" or any valid IS user by searching the users in the configuration section by clicking the search icon next to search field. d. Once configured click on "Import Certificate" button and then the certificate would be added to the certificates list. 4. Now configure the security information in Mediator. Open the Mediator console Go to General Configured Keystore and truststore information will be listed here. Choose the appropriate one.

7 Troubleshooting: If we see the Access Denied exception, Look for the Access Mode if its set to Deny+ it should be Allow. What is configured under the "Security Configuration" in the ports section in IS. For debugging the issues relating to SSL Add the property "watt.ssl.iaik,debug=true and restart the IS get the logs from console if started in console or wrapper log/osgi.log if started in services mode. Check for the "IP Address" access / deny list in the ports page of IS. Ask for the listeners.cnf file available at \..\IntegrationServer\instances\default\packages\WmRoot\config