The client needs to have access to a private key and its matching X509 certificate for message signing, and the the X509 certificate chain of the server that it is contacting. The Tomcat server needs access to a private key and X509 certificate to identify itself to the client and to encrypt the SSL connection. The OSCARS service needs a private key and X509 certificate to sign responses and the X509 certificates of the CAs (Certificate Authority) that issued users certificate in order to authenticate the message signature.
There is an additional complication presented by the interdomain architecture. The OSCARS and OSCARSNotify servers in each domain will also act as a client when information about a reservation needs to be forwarded to an adjacent domain. Thus on an OSCARS server host there will be both server and client configurations.
Since all of the code is in Java, the private keys and certificates are kept in Java keystore files, and the configuration information is kept in properties files.
The rampart configuration file and keystore files contain information that is private to a domain or user. The source code available from our code repository includes samples of these files in the conf/examples directory. They need to be edited to add the host and server certificates and user keys from your own site.
KeyManagement.java
as System.setProperty("javax.net.ssl.trustStore",repo
+"/ssl-keystore.jks")
; where repo is an input string to setKeyStore(String
repo)
. It is copied from conf/axis-tomcat to
$CATALINA_HOME/shared/classes/repo by the setupServer ant
task and to examples/javaClient/repo by examples/javaClients/build.xml.
$CATALINA_HOME/conf/server.xml
as the keystoreFile. It must contain a keyEntry for the server with the
alias Tomcat e.g. oscars-dev.es.net and trustedCertEntries for the issuers
of that certificate. This file is created as part of the process of
configuring Tomcat for SSL.
org.apache.rampart.handler.WSDoAllSender.processMessage
.
sec-client.jks
.
Must be on classpath.
ssl-keystore.jks
file.copyKey.sh -a <alias of keyEntry>
[-inpkcs12 <filename of input
keyStore> | -injks
<filename of input
keyStore> ]
-out <filename of output keystore>
It will prompt for the password of the input keystore, the
password of the keyEntry in the input keystore and the password for the
output key store. Normally the password of a keyEntry is the same the
keystore. If this is the case just reply with a CR. If the -inpkcs12
option is used the entry will be imported from a pkcs12 file. If -injks
is used it will be imported from another jks keystore.
Services.xml
comes from conf/axis-tomcat/oscars-services.xml,
notify-services.xml and is installed in the META-INF directory of the respective aar
.
It inlcudes rampConfig.xml which defines the rampart specific ws-policy
including the name of the keystore file, user and password.
RampConfig.xml and the keystore file (OSCARS.jks) are installed at
${catalina_home}/shared/classes/repo and are domain specific. The
ones for ESnet are checked into
https://oscars.es.net/esnet/domain/server. The ant target "setupServer" will
copy
them from [conf/axis-tomcat|$DOMAIN_HOME/server]
into ${catalina_home}/shared/classes/repo
.
Examples of
these files can be found in conf/axis2-tomcat
. OSCARS.jks
needs trustedCertEntries
for all the authorized users' certificate issuers to validate request
messages and a keyEntry for the service to sign response
messages.
Tomcat needs the keystore referenced in
${catalina.home}/conf/server.xml
to do server-side ssl.
If no keystoreFile entry is specified in the https connector element of
server.xml
, the file ~/.keystore
is used. If
no keystorePass entry is specified the password is "changeit".
On the oscars servers the keystoreFile element is specified as
/root/.keystore. The keystore contains a keyEntry for the
oscars/oscars.es.net
cert/key with alias tomcat and the trustedCertEntries
for the CAs in its certificate chain.
Client
sideaxis2.xml
, rampConfig.xml and OSCARS.jks files to
generate signed messages.OSCARS.jks has the keyEntry for the user who will be signing messages and the trustedCertEntries for the issuers who signed the client cert and the certs of the OSCARS service that he is contacting. Keytool can be used to create a keyEntry and to enter trustedCertEntries. tools/utils/copyKey.sh can be used to copy a keyEntry from an existing
Needs ssl-keystore.jks
to hold the trustedCertEntries for the ssl
connection to the Tomcat server. The name and the password for this
file are hard-coded into net.es.oscars.client.security.KeyManagement.
Use keytool to add a trustedCertEntry for this
certificate.
.xml
to chose a a user to sign
the message and may want to add additional keyEntries to OSCARS.jks
.