F External Access to Protected OCA

Secure processes protected behind a firewall, like OCA, can still serve customers outside the firewall by using a proxy server.

This intermediary server securely intercepts all user requests for OCA services and forwards them to OCA. The proxy server uses only two ports: port 443 (for SSL communications) and port 80 (for non-SSL communications).

Since OCA has two virtual hosts, one for server authentication and one for mutual authentication, two proxy servers are required, as illustrated by the following example:

Example F-1 Proxy Server Example

• A proxy server for server authentication could use this URL:

  https://myproxy_server1.acme.com (with default SSL port 443)

  which maps to

  https://myoca.acme.com:4400 (server authentication)

and

• A second proxy server, for mutual authentication, could use this URL:

  https://myproxy_server2.acme.com (with default SSL port 443)

  which maps to

  https://myoca.acme.com:4401 (mutual authentication)

This Appendix explains how you enable OCA to support proxy servers and how to map a proxy server to an OCA virtual host.

Enabling OCA to Support Proxy Servers

The following steps enable OCA to support proxy servers:

1. Log on to the database as an OCA user.

2. Run script $ORACLE_HOME/oca/sql/ocabigipon.sql.

3. Enter the proxy server's hostname and SSL port that maps to the OCA mutual authentication port (in Proxy Server Example, it's myproxy_server2.acme.com and port 443)

4. Map the proxy server to the OCA virtual host.

Disabling OCA's Support for Proxy Servers

The following steps disable OCA's support for proxy servers:

1. Log on to the database as OCA user.

2. Run script $ORACLE_HOME/oca/sql/ocabigipoff.sql.