Configuring Security

Field	Description
Enabled check box	Enables SSL connections between WebLogic Integration and trading partners.
Listen Port Enabled check box	Enables use of the SSL protocol on the default port (7002) on the server. You can change the port on which WebLogic Server listens for SSL connections by setting the Listen Port attribute.
Listen Port	Specifies the dedicated port on which WebLogic Integration listens for SSL connections.
Server Private Key Alias	Alias for the keystore entry for a server private key.
Server Private Key Passphrase	Specifies a passphrase for a key in the keystore. (A passphrase is required for every key. In addition, you may also assign a passphrase to the keystore itself.)
Server Certificate File Name	Specifies the full pathname of the digital certificate for WebLogic Server. This location is also known as the root certificate authority, or root CA.
Client Certificate Enforced check box	Enables mutual authentication between WebLogic Integration and trading partners accessing WebLogic Integration resources.
Cert Authenticator	Specifies the certificate authenticator to be used to determine the validity of the trading partner digital certificate.
Client Certificate Enforced check box	Enables mutual authentication between WebLogic Integration and trading partners accessing WebLogic Integration resources.

Field

Description

Enabled check box

Enables SSL connections between WebLogic Integration and trading partners.

Listen Port Enabled check box

Enables use of the SSL protocol on the default port (7002) on the server. You can change the port on which WebLogic Server listens for SSL connections by setting the Listen Port attribute.

Listen Port

Specifies the dedicated port on which WebLogic Integration listens for SSL connections.

Server Private Key Alias

Alias for the keystore entry for a server private key.

Server Private Key Passphrase

Specifies a passphrase for a key in the keystore. (A passphrase is required for every key. In addition, you may also assign a passphrase to the keystore itself.)

Server Certificate File Name

Specifies the full pathname of the digital certificate for WebLogic Server. This location is also known as the root certificate authority, or root CA.

Client Certificate Enforced check box

Enables mutual authentication between WebLogic Integration and trading partners accessing WebLogic Integration resources.

Cert Authenticator

Specifies the certificate authenticator to be used to determine the validity of the trading partner digital certificate.

Client Certificate Enforced check box

Enables mutual authentication between WebLogic Integration and trading partners accessing WebLogic Integration resources.

Field	Description
System Password	Password for the WebLogic Integration system user. This password is set when you install the WebLogic Integration software; by default, it is wlisystem. However, if you want to change it, you can enter a new password in this field.
Audit Log Class	Java class that implements audit logging, which is used for nonrepudiation. You can use the audit log to reconstruct the sequence of events that have occurred during a conversation, along with the data exchanged. Depending on how you configure the audit log, the audit log may store each business message exchanged among trading partners along with digital signatures, timestamps, and other data. For more information about auditing, see Secure Audit Log Service.
Certificate Verification Class	Java class that calls out to software that verifies that a digital certificate submitted by a remote trading partner is valid. This class can call out to either the Online Certificate Status Protocol (OCSP) application that WebLogic Integration provides, or certificate verification provider software that you obtain from a trusted security vendor. For more information about the certificate verification class, see Trading Partner Certificate Verification.
Secure Timestamp Class	Java class that provides secure timestamping of business messages exchanged among trading partners. Timestamping is used for nonrepudiation. For more information about secure timestamping, see Secure Timestamp Service.
Certificate Authority Directory	Location that contains the Certificate Authorities of all the trading partner certificates configured in the WebLogic Integration repository.

Field

Description

System Password

Password for the WebLogic Integration system user. This password is set when you install the WebLogic Integration software; by default, it is wlisystem. However, if you want to change it, you can enter a new password in this field.

Audit Log Class

Java class that implements audit logging, which is used for nonrepudiation. You can use the audit log to reconstruct the sequence of events that have occurred during a conversation, along with the data exchanged. Depending on how you configure the audit log, the audit log may store each business message exchanged among trading partners along with digital signatures, timestamps, and other data. For more information about auditing, see Secure Audit Log Service.

Certificate Verification Class

Java class that calls out to software that verifies that a digital certificate submitted by a remote trading partner is valid. This class can call out to either the Online Certificate Status Protocol (OCSP) application that WebLogic Integration provides, or certificate verification provider software that you obtain from a trusted security vendor. For more information about the certificate verification class, see Trading Partner Certificate Verification.

Secure Timestamp Class

Java class that provides secure timestamping of business messages exchanged among trading partners. Timestamping is used for nonrepudiation. For more information about secure timestamping, see Secure Timestamp Service.

Certificate Authority Directory

Location that contains the Certificate Authorities of all the trading partner certificates configured in the WebLogic Integration repository.

Certificate	Description
Client certificate	Digital certificate of the remote or local trading partner. Configuring the client certificate is required when using the SSL protocol. Certificate is: Type X.509 version 1 or 3 Privacy Enhanced Mail (PEM) or Definite Encoding Rules (DER) encoded. (The filename extension specifies the encoding type: .pem or .der.) Required for all trading partner types when HTTPS with mutual authentication is used. Private Key is: PEM or DER encoded. (The filename extension specifies the encoding type: .pem or .der.) Required only for local trading partner type Password-protected or plain text Note: When importing a plain-text private key using the B2B Console, use the password of the private keystore.
Server certificate	Digital certificate of the remote trading partner. Configuring the server certificate is required when using the SSL protocol. Certificate is: Type X.509 version 1 or 3 PEM or DER encoded. (The filename extension specifies the encoding type: .pem or .der.) Required for remote trading partner types when HTTPS is used with mutual authentication
Signature certificate	Certificate required of each trading partner if digital signature support, a requirement for nonrepudiation, is configured for the e-market. For a description of digital signature support, see Digital Signature Support. Certificate is: Type X.509 version 1 or 3 DER encoded Read by using the RSA CertJ package Required for all trading partner types that use a digital signature service Private Key is: Presented only in PKCS8 format Always password-protected. (You specify the password as a system property in the startWeblogic script.)
Encryption certificate	Certificate required of each trading partner when business message encryption is configured for the e-market. Note that encryption support is available only with the RosettaNet protocols. For a description of message encryption, see Configuring Message Encryption. Certificate is: Type X.509 version 1 or 3 DER encoded Read by using the RSA CertJ package Required for all trading partner types that use an encryption service Private Key is: Presented only in PKCS8 format Always password-protected. (You specify the password as a system property in the startWeblogic script.)

Certificate

Description

Client certificate

Digital certificate of the remote or local trading partner. Configuring the client certificate is required when using the SSL protocol.

Certificate is:

Type X.509 version 1 or 3

Privacy Enhanced Mail (PEM) or Definite Encoding Rules (DER) encoded. (The filename extension specifies the encoding type: .pem or .der.)

Required for all trading partner types when HTTPS with mutual authentication is used.

Private Key is:

PEM or DER encoded. (The filename extension specifies the encoding type: .pem or .der.)

Required only for local trading partner type

Password-protected or plain text

Note: When importing a plain-text private key using the B2B Console, use the password of the private keystore.

Server certificate

Digital certificate of the remote trading partner. Configuring the server certificate is required when using the SSL protocol.

Certificate is:

Type X.509 version 1 or 3

PEM or DER encoded. (The filename extension specifies the encoding type: .pem or .der.)

Required for remote trading partner types when HTTPS is used with mutual authentication

Signature certificate

Certificate required of each trading partner if digital signature support, a requirement for nonrepudiation, is configured for the e-market. For a description of digital signature support, see Digital Signature Support.

Certificate is:

Type X.509 version 1 or 3

DER encoded

Read by using the RSA CertJ package

Required for all trading partner types that use a digital signature service

Private Key is:

Presented only in PKCS8 format

Always password-protected. (You specify the password as a system property in the startWeblogic script.)

Encryption certificate

Certificate required of each trading partner when business message encryption is configured for the e-market. Note that encryption support is available only with the RosettaNet protocols. For a description of message encryption, see Configuring Message Encryption.

Certificate is:

Type X.509 version 1 or 3

DER encoded

Read by using the RSA CertJ package

Required for all trading partner types that use an encryption service

Private Key is:

Presented only in PKCS8 format

Always password-protected. (You specify the password as a system property in the startWeblogic script.)

%JAVA_HOME%\bin\java -classic -ms64m -ms64m -classpath %START_WL_CLASSPATH%
-Dbea.home=%BEA_HOME% -Dweblogic.home=%WL_HOME%
-Dweblogic.system.home=%WLC_SAMPLES_HOME% -Dweblogic.Domain=samples
-Dweblogic.management.password=%SYSTEM_PASSWORD%
-Dweblogic.Name=myserver
-Djava.security.policy=%WL_HOME%\lib\weblogic.policy
-DKey.certificate-name.password=%PASSWORD% weblogic.Server

Table 4-4 Configuring Trading Partner Certificates

To configure . . .	Complete the following steps . . .
Client certificate	If you are configuring a local or remote trading partner: 1. In the Certificate Type selection box, select Client Certificate. 2. In the Certificate Name field, enter the name of the client certificate. 3. In the Certificate Location field, enter the pathname of the client certificate on your WebLogic Integration machine. 4. In the Private Key Location field, enter the pathname, on your WebLogic Integration machine, of the local trading partner's private key. (This step applies only to local trading partners.) 5. Click Add/Apply to add the certificate to the WebLogic Integration repository. 6. Select the check the box for Save Certificate to Keystore. The certificate is added to the private keystore. Note: You may configure only one client certificate for a given trading partner.
Server certificate	If you are configuring a remote trading partner: 1. In the Certificate Type selection box, select Server Certificate. 2. In the Certificate Name field, enter the name of the server certificate for the remote trading partner's WebLogic Integration system. 3. In the Certificate Location field, enter the pathname, on your machine, of the trading partner's server certificate. 4. Click Add/Apply to add the certificate to the WebLogic Integration repository. 5. Select the check box for Save Certificate to Keystore to add the certificate to the private keystore. Note: You may configure only one server certificate for a given remote trading partner.
Signature certificate	For trading partners using digital signature support: 1. In the Certificate Type selection box, select Signature Certificate. 2. In the Certificate Name field, enter the name of the signature certificate. 3. In the Certificate Location field, enter the pathname, on your machine, of the signature certificate. 4. In the Private Key Location field, enter the pathname, on your machine, for the local trading partner private key. (This step applies only to local trading partners.) 5. Click Add/Apply to add the certificate to the WebLogic Integration repository. 6. Select the check box for Save Certificate to Keystore to add the certificate to the private keystore. Note: You may configure multiple signature certificates for a given trading partner.
Encryption certificate	For trading partners using RosettaNet-based business message encryption: 1. In the Certificate Type selection box, select Encryption Certificate. 2. In the Certificate Name field, enter the name of the encryption certificate. 3. In the Certificate Location field, enter the pathname, on your machine, of the encryption certificate. 4. In the Private Key Location field, enter the pathname, on your machine, of the local trading partner's private key. (This step applies only to local trading partners.) 5. Click Add/Apply to add the certificate to the WebLogic Integration repository. 6. Select the check box for Save Certificate to Keystore to add the certificate to the private keystore. Note: You may configure multiple encryption certificates for a given trading partner.

Field	Description
Transport Name	The name of the trading partner transport. You can enter a name, or choose from the list of available transports displayed in the box labeled Available Transports. Note that each of the available transports has a security protocol bound to it, so if you choose from this list, the transport and security protocols are set automatically. For more information about specifying the transport name, see the online help for the Transport tab by clicking the question mark in the upper right.
Transport Protocol	The security protocol for the transport. You can choose between HTTP-1.1 and HTTPS-1.1. The HTTPS-1.1 protocol uses SSL. Note that if you choose HTTPS-1.1, the security protocol is displayed in the nonmodifiable field labeled Security Protocol.
URI Endpoint	The URI for the transport on the trading partner's B2B system. To specify the URI endpoint, you can enter a URI in this field, or choose from one of the available URIs displayed in the box below this field. When you enter the URI endpoint, click Set, to establish the URI, or Remove, to clear an existing entry in the URI Endpoint field. For more information about specifying the URI endpoint, see the online help for the Transport tab by clicking the question mark in the upper right.

Field

Description

Transport Name

The name of the trading partner transport. You can enter a name, or choose from the list of available transports displayed in the box labeled Available Transports. Note that each of the available transports has a security protocol bound to it, so if you choose from this list, the transport and security protocols are set automatically. For more information about specifying the transport name, see the online help for the Transport tab by clicking the question mark in the upper right.

Transport Protocol

The security protocol for the transport. You can choose between HTTP-1.1 and HTTPS-1.1. The HTTPS-1.1 protocol uses SSL. Note that if you choose HTTPS-1.1, the security protocol is displayed in the nonmodifiable field labeled Security Protocol.

URI Endpoint

The URI for the transport on the trading partner's B2B system. To specify the URI endpoint, you can enter a URI in this field, or choose from one of the available URIs displayed in the box below this field. When you enter the URI endpoint, click Set, to establish the URI, or Remove, to clear an existing entry in the URI Endpoint field. For more information about specifying the URI endpoint, see the online help for the Transport tab by clicking the question mark in the upper right.

Field	Description
Delivery Channel Name	The delivery channel name. You can enter a name in this field, or choose from the delivery channels listed in the Available Delivery Channels box below. For more information about specifying a delivery channel name, see the online help for the Delivery Channels page by clicking the question mark in the upper right.
Transport	The name of the transport configured in the trading partner transport tab. This field gives you an opportunity to bind the delivery channel to a transport that you secured when configuring the transport properties, as described in Configuring a Secure Transport.
Document Exchange	The name of the document exchange to which you want to bind the delivery channel. For more information about binding a document exchange to a delivery channel, see the online help for the Delivery Channels page by clicking the question mark in the upper right.
Routing Proxy	Check this box if you want the trading partner delivery to act as a routing proxy (hub). For more information about proxy servers, see Configuring WebLogic Integration B2B to Use an Outbound HTTP Proxy Server.

Field

Description

Delivery Channel Name

The delivery channel name. You can enter a name in this field, or choose from the delivery channels listed in the Available Delivery Channels box below. For more information about specifying a delivery channel name, see the online help for the Delivery Channels page by clicking the question mark in the upper right.

Transport

The name of the transport configured in the trading partner transport tab. This field gives you an opportunity to bind the delivery channel to a transport that you secured when configuring the transport properties, as described in Configuring a Secure Transport.

Document Exchange

The name of the document exchange to which you want to bind the delivery channel. For more information about binding a document exchange to a delivery channel, see the online help for the Delivery Channels page by clicking the question mark in the upper right.

Routing Proxy

Check this box if you want the trading partner delivery to act as a routing proxy (hub). For more information about proxy servers, see Configuring WebLogic Integration B2B to Use an Outbound HTTP Proxy Server.

In the field labeled . . .	Choose the following information . . .
Business Protocol Binding	The business protocol and version that supports the digital signature or message encryption capabilities that you want. The protocol you choose becomes bound to the trading partner document exchange identified at the top of the page.
Business Protocol Definition	The business protocol associated with the business protocol binding chosen in the preceding selection box.

In the field labeled . . .

Choose the following information . . .

Business Protocol Binding

The business protocol and version that supports the digital signature or message encryption capabilities that you want. The protocol you choose becomes bound to the trading partner document exchange identified at the top of the page.

Business Protocol Definition

The business protocol associated with the business protocol binding chosen in the preceding selection box.

Field	Description
Encryption Certificate	Enter the name of the encryption certificate configured in Configuring Trading Partner Certificates.
Encryption Level	Enter the parts of the business message that you want to have encrypted. Choose PAYLOAD if you want to encrypt only the XML business document(s) part of the message. Choose ENTIRE_PAYLOAD if you want to encrypt the business documents and all attachments in the message.
Cipher Algorithm	A nonmodifiable information field containing the name of the cipher algorithm used. In WebLogic Integration, the available cipher algorithms are: Rivest-Shamir-Adleman (RSA) Data Encryption Standard (DES) Triple Data Encryption Standard (3DES)

Field

Description

Encryption Certificate

Enter the name of the encryption certificate configured in Configuring Trading Partner Certificates.

Encryption Level

Enter the parts of the business message that you want to have encrypted. Choose PAYLOAD if you want to encrypt only the XML business document(s) part of the message. Choose ENTIRE_PAYLOAD if you want to encrypt the business documents and all attachments in the message.

Cipher Algorithm

A nonmodifiable information field containing the name of the cipher algorithm used. In WebLogic Integration, the available cipher algorithms are:

Rivest-Shamir-Adleman (RSA)

Data Encryption Standard (DES)

Triple Data Encryption Standard (3DES)

public User authenticate(String userName, Certificate[] certs, boolean ssl)
{

String user = null;

// If not using SSL, return
if (ssl == false)
{
return null;
}

// Verify that the certificate is either a c-hub certificate or a trading partner
// certificate, then return the corresponding WLS user.

if ((user = Security.isValidWLCCertificate(certs))!= null)
{
return realm.getUser(user);
}
// Certificate is not a valid WLC certificate.
// Check here for non-WLC certificate and return the corresponding user.
}

# LoadModule foo_module libexec/mod_foo.so
LoadModule weblogic_module libexec/mod_wl_ssl.<suffix>

<Location /weblogic>
SetHandler weblogic-handler
PathTrim /weblogic
WebLogicHost myhost
WebLogicPort 80
</Location>