test

Sun OpenSSO Enterprise 8.0 Installation and Configuration Guide

Chapter 21 Configuring OpenSSO Enterprise 8.0 in FIPS Mode

This chapter describes how to configure Sun OpenSSO Enterprise in Federal Information Processing Standards (FIPS) 140 mode, including:

This chapter described how to enable FIPS mode for Sun Java System Web Server 7.0. To enable FIPS mode for other web containers, refer to the product documentation for the specific web container.

Enabling FIPS Mode for the NSS Database

ProcedureTo Enable FIPS Mode for the NSS Database

  1. Enable FIPS mode for the NSS database using the Security Module Database Tool (modutil). For example:

    modutil -fips true -dbdir path-to-nss-database

    where path-to-nss-database represents the path to the NSS database.

    For example, by default, for Web Server 7.0, the NSS database is in the config directory of the Web Server 7.0 instance.

    For information about using modutil, see http://www.mozilla.org/projects/security/pki/nss/tools/modutil.html.

Configuring FIPS Mode for Sun Java System Web Server 7.0

These procedures use Sun Java System Web Server 7.0 as the OpenSSO Enterprise web container with the NSS Certificate DB (certdb) as the key/certificate store.

Enabling FIPS Mode for Web Server 7.0

ProcedureTo Enable FIPS Mode for Web Server 7.0

  1. If Web Server 7.0 has the Java Security Manager enabled, add the following additional permissions to the Web Server 7.0 server.policy file:

    permission java.security.SecurityPermission "insertProvider.Mozilla-JSS";
permission java.security.SecurityPermission "putProviderProperty.Mozilla-JSS";
permission java.security.SecurityPermission "removeProvider.Mozilla-JSS";

  2. Set the password for the internal PKCS11 token using either the Web Server 7.0 Administration Console or CLI command.

    For the password requirements in FIPS mode, see http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp814.pdf

    For example, to set the password using the Web Server 7.0 wadm command:

    wadm> set-token-pin --user=admin --password-file=admin.pwd
--host=serverhost --port=8989 --config=config1 --token=internal

    Or, to set the password using the Web Server 7.0 Administration Console:

    1. In the Administration Console, go to the Configuration page.

    2. Click Certificates and then PKCS11 Tokens.

    3. Click the PKCS11 token name (default is internal).

    4. Check the Token State box.

    5. Enter the password information.

    6. Click Save.

  3. If you modified files in the Web Server 7.0 config directory using modutil or certutil, pull the changes into the Web Server 7.0 Admin Server. For example:

    wadm pull-config --user=admin --password-file=path-to-password-file
--host=server-host --port=8989 --config=config1 node1

  4. Confirm that FIPS is enabled by restarting the Web Server 7.0 instance. You should see a new prompt for the certdb password or PIN. For example:

    > Please enter the PIN for the "NSS FIPS 140-2 Certificate DB" token:

Configuring the Web Server 7.0 Transport Layer Security (TLS) to be FIPS 140 Compliant

ProcedureTo Configure the Web Server 7.0 TLS to be FIPS 140 Compliant

  1. Log in to the Web Server 7.0 Administration Console.

  2. Click Configuration.

  3. Click the server instance you want to configure.

  4. Click the HTTP Listeners tab and then click the listener instance you want to configure.

  5. Select the SSL tab in new popup window.

  6. Disable SSL2 and SSL3, leaving only TLS.

  7. Disable all non-FIPS Compliant TLS Cipher suite by removing them from the Selected list.

    See the following list for the FIPS compliant TLS cipher suites.

  8. Save your changes.

FIPS Compliant TLS Cipher Suites

Configuring FIPS Mode for OpenSSO Enterprise 8.0

ProcedureTo Configure FIPS Mode for OpenSSO Enterprise 8.0

Before You Begin

  1. Log in to the OpenSSO Administration Console.

  2. Click Configuration, Servers and Sites, and then the Server Name instance.

  3. Click Security.

  4. Click Inheritance Settings.

  5. Uncheck the Encryption class, FIPS Mode, and Secure Random Factory Class properties.

  6. Click Save and then Back to Server Profile.

  7. Change Encryption class to com.iplanet.services.util.JSSEncryption.

  8. Change Secure Random Factory Class to com.iplanet.am.util.JSSSecureRandomFactoryImpl.

  9. Check Yes for FIPS Mode.

  10. Click Save and then the Advanced tab.

  11. Change the com.iplanet.security.SSLSocketFactoryImpl property to com.iplanet.services.ldap.JSSSocketFactory.

  12. Click Add and add following property and value:

    • Property Name: opensso.protocol.handler.pkgs

    • Property Value: com.iplanet.services.comm

  13. Click Add and add following property and value:

    • Property Name: com.iplanet.am.admin.cli.certdb.dir

    • Property Value: path-to-FIPS-enabled-NSS-database

  14. Click Save.

  15. Restart the OpenSSO Enterprise 8.0 server instance.

OpenSSO Enterprise 8.0 FIPS Compliant Algorithms

OpenSSO Enterprise 8.0 uses the following FIPS compliant algorithms: