Assume the OSCARS source tree is checked out in $OSCARS_HOME. "OH" for short, and that there is a domain-specific repository as well, "DH".
Running ant in OH/examples/javaClients will build all the client-side classes and populate ./repo in that directory with sec-client.{properties,jks} and axis2.xml. The properties file has the name and password for the keystore (sec-client.jks) and the keystore has to have the certificates for the CA's you trust. The examples in OH/conf/examples/client just have the OASIS interop CA in the keystore, as well as the cert/key for "alice" and "bob". alice is known to OSCARS, just for testing to ensure the server is up (you'll get an error message back that says you have no authorization to perform any operations).
The other client configuration file is ./repo/axis2.xml. This tells the code to sign and timestamp the outgoing message and to expect timestamps on the replies. It also says what user to run as. The example in OH/conf/examples/client has the user set to alice.
These files are copied from the domain specific repository from DH/domain/trunk/client, where you can set up your own versions of these files by importing certificates with your user names and keys into the keystores using keytool (see next section). Instructions for setting up that repository are here. In addition, once ./repo/axis2.xml is set up under the examples, you can override the signing user in that file. That file will not be overwritten after the repo directory is built.
Use the shell scripts to run the client programs. These will set the classpath first, and then run java with the right switches.
See this page for more information on the various clients and security setup.
The keytool command will do most of what you need: listing contents, setting aliases, adding new trust certificates. The one think it does not do is to import a trusted entry, e.g. cert and key. There is a class that comes with the jetty release that we have used. There may be tools in the Sun suite as well.
#NOTE: # Need both the cert and private key in the keystore so... # need to be in pem format so if it is in DER format openssl x509 -in mycert.der -inform DER -outform PEM -out mycert.pem #use openssl to make ONE pkcs12 file (combine both cert & private key) openssl pkcs12 -inkey jason.key.pem -in jason.cert.pem -export -out jason.pkcs12 # use jetty to load it (from http://jetty.mortbay.org/) # with jetty-6.0.2 the command is java -cp org.mortbay.jetty-6.0.2.jar org.mortbay.jetty.security.PKCS12Import jason.pkcs12 sec-client.jks
Now to rename the alias use:
keytool -keyclone -alias 1 -dest jason -keystore sec-client.jks
keytool -delete -alias 1 -keystore sec-client.jks
Then to import the DOEGrids CA cert:
keytool -import -keystore sec-client.jks -file ~mrt/certs/doeGridsCA.pem -trustcacerts -alias DOEGridsCA
keytool -import -keystore sec-client.jks -file ~mrt/certs/esnetRoot.pem -trustcacerts -alias esnetRoot