Configuring Transport-Level Security

Transport-level security applies security checks as part of establishing a connection between service consumers, proxy services, and business services. The type of security checks that AquaLogic Service Bus can apply depends on the protocol that the proxy service or business service uses to communicate. Some protocols can also encrypt the communication between client and endpoint to prevent snooping from third parties.

Inbound transport-level secures the communication between clients and AquaLogic Service Bus proxy services. Outbound transport security secures all three techniques of sending outbound requests from AquaLogic Service Bus proxy services: route actions, publish actions, and callout actions.

Configuring Transport-Level Security for HTTPS

The HTTPS protocol uses SSL to secure communication. SSL can be used to encrypt communication, ensure message integrity, and to require strong server and client authentication. Before you can use HTTPS, you must configure SSL in WebLogic Server, see Configuring the WebLogic Security Framework: Main Steps.

The following sections describe configuring transport-level security for the HTTPS protocol:

HTTPS Authentication Levels

For each proxy service or business service that communicates over the HTTPS protocol, you can configure the service to require one of the following levels of authentication:

One-way SSL, no authentication

This level enables encrypted communication but does not require clients to provide credentials. To establish a one-way SSL connection, the client initiates the connection and AquaLogic Service Bus sends its certificate to the client. In other words, the client authenticates AquaLogic Service Bus.

One-way SSL, BASIC authentication

This level enables encrypted communication and requires clients to supply a user name and password after the one-way SSL connection is established. The client supplies a user name and password by encoding it in the HTTP request header (which is encrypted by SSL). When the proxy service receives the encrypted request, it passes the credentials to the domain’s authentication provider, which determines whether client’s credentials match a user account that you have created.

Two-way SSL, CLIENT CERT authentication

This level enables encrypted communication and strong client authentication (two-way SSL).

To establish a two-way SSL connection, the client initiates the connection and AquaLogic Service Bus sends its X.509 certificate to the client. Then, the client sends its certificate to AquaLogic Service Bus and AquaLogic Service Bus authenticates the client.

To get the user name from the client’s certificate, you configure an identity assertion provider, which extracts a field in the certificate to use as the client identity (X.509 token), typically the CN (common name) or E (email) of the SubjectDistinguishedName in the certificate. After extracting the X.509 token, the token is compared to the user accounts in the Security Configuration module of the AquaLogic Service Bus Console.

For more information about SSL and identity assertion providers, see Security Fundamentals in Understanding WebLogic Security.

Transport-Level Custom Credentials.

You can authenticate client requests at the transport-level via custom authentication tokens. Transport-level custom credentials are supported only on inbound requests. You specify a custom token in an HTTP header. The HTTPS-specific configuration pages of the service definition wizard allows you to configure client authentication. Custom authentication concepts are described in Configuring Custom Authentication.

Configuring Inbound HTTPS Security: Main Steps

Make sure that you have configured the WebLogic security framework to support SSL, an authentication provider, and an identity assertion provider, depending on the HTTPS authentication level that you want to use:

For no client authentication (anonymous requests), set Client Authentication to None.
For basic authentication, set Client Authentication to Basic. See “Adding a User” under Security Configuration in Using the AquaLogic Service Bus Console.
For SSL client authentication, set Client Authentication to Client Certificate, configure the WebLogic Identity Assertion provider and the WebLogic CertPath Provider.
For custom authentication token, set Client Authentication to Custom Authentication. The custom authentication token can be any active token type previously configured for an Identity Assertion provider that is carried in an HTTPS header. Custom authentication concepts are described in Configuring Custom Authentication.

Note:

You must first configure, or create and configure, a WebLogic Server Identity Assertion provider as described in Configuring Identity Assertion Providers for Custom Tokens, and add the user names and passwords of the clients that you want to allow access to the Security Configuration module of the AquaLogic Service Bus Console.

See Configuring the WebLogic Security Framework: Main Steps.

When you create a proxy service in the AquaLogic Service Bus Console, on the Transport Configuration page select HTTPS. Follow the prompts to choose an authentication level. See “Adding a Proxy Service” under Proxy Services in Using the AquaLogic Service Bus Console.
Modify the proxy service’s default transport-level access control policy, which specifies conditions under which users, groups, or roles can access a proxy service. See “Editing Transport-Level Access Policies” under Security Configuration in Using the AquaLogic Service Bus Console.

Configuring Outbound HTTPS Security: Main Steps

In outbound transport-level security, a proxy service is the client that opens a connection with a business service.

If you are configuring transport-level security for a production environment (as opposed to a development or testing environment), make sure that Host Name Verification is enabled. See “Using Host Name Verification” in Configuring SSL in Securing WebLogic Server.
When you create a business service in the AquaLogic Service Bus Console, on the Transport Configuration page select HTTPS. See “Adding a Business Service” under Business Services in Using the AquaLogic Service Bus Console. Follow the prompts to choose an authentication level.

If you configured the proxy service so that AquaLogic Service Bus does not authenticate clients, configure the enterprise system to authenticate clients by selecting an authentication level of one-way SSL, BASIC authentication.

If the business service uses HTTPS with BASIC authentication, create a service account to provide the user name and password that the business service requires.

You can add a user name and password directly to the service account, or configure the service account to pass through the credentials that it received from its client’s request, or you can map a client user name to an AquaLogic Service Bus user. If you configured the proxy service so that AquaLogic Service Bus does not authenticate clients, create a service account that passes through the credentials. See Service Accounts in Using the AquaLogic Service Bus Console.

If the business service uses HTTPS with CLIENT CERT authentication, do the following:

Create a proxy service provider to provide the key-pair that proxy services use for SSL client authentication with the business service. See Proxy Service Providers in Using the AquaLogic Service Bus Console.
Create a proxy service or edit an existing proxy service so that it specifies the proxy service provider. See “Viewing and Changing Proxy Services” under Proxy Services in Using the AquaLogic Service Bus Console.

Configuring Transport-Level Security for HTTP

The HTTP protocol does not encrypt communication between clients and proxy services or business services, but it does support BASIC authentication in which clients send user names and passwords in requests. HTTP also supports custom token authentication.

The following sections describe configuring transport-level security for the HTTP protocol:

Configuring Inbound HTTP Security: Main Steps

When you create a proxy service in the AquaLogic Service Bus Console, on the Transport Configuration page select HTTP. Choose the Client Authentication option None, Basic, or Custom Authentication. If you choose Custom Authentication, you must also specify the HTTP header that is to carry the token and the token type.

The steps for configuring transport-level custom credentials are described in “Adding a Proxy Service” under Proxy Services in Using the AquaLogic Service Bus Console. Custom authentication concepts are described in Configuring Custom Authentication.

The custom authentication token can be any active token type, previously configured for an Identity Assertion provider, that is carried in an HTTP header.

Note:

To use custom authentication you must first configure, or create and configure, a WebLogic Server Identity Assertion provider as described in Configuring Identity Assertion Providers for Custom Tokens.

Note:

If you want AquaLogic Service Bus to authenticate clients (Basic or Custom Authentication) you must create user accounts for the clients. See Configuring Administrative Security: Main Steps.

Modify the proxy service’s default transport-level access control policy, which specifies conditions under which users, groups, or roles can access a proxy service. See “Editing Transport-Level Access Policies” under Security Configuration in Using the AquaLogic Service Bus Console.

Configuring Outbound HTTP Security: Main Steps

In outbound transport-level security, a proxy service is the client that opens a connection with a business service.

When you create a business service in the AquaLogic Service Bus Console, on the Transport Configuration page select HTTP. When prompted, select Basic Authentication Required.

See “Adding a Business Service” under Business Services in Using the AquaLogic Service Bus Console.

Create a service account to provide the user name and password that the business service requires. See Service Accounts in Using the AquaLogic Service Bus Console.

Create a proxy service or edit an existing proxy service so that it specifies the service account.

Additional Context Properties for HTTP and HTTPS Transport-Level Authentication

The HTTP and HTTPS transport providers pass an AquaLogic Service Bus implementation of the WebLogic Server ContextHandler during transport-level custom token identity assertion. There is no user configuration required for this feature.

Table 4-1 Transport-Level Context Properties
Property Name	Property Value
`com.bea.contextelement.alsb.service-info`	An instance of `com.bea.wli.sb.services.ServiceInfo` that contains information about the proxy service.
`com.bea.contextelement.alsb.transport.endpoint`	An instance of `com.bea.wli.sb.transports.TransportEndPoint`. This is the HTTP or HTTPS endpoint.
`com.bea.contextelement.alsb.transport.http.http-request`	This is the `HttpServletRequest` object.
`com.bea.contextelement.alsb.transport.http.http-response`	This is the `HttpServletResponse` object.

Configuring Transport-Level Security for JMS

While transport-level security for JMS does not provide end-to-end security for JMS messaging, it does provide the following:

The option to use a secure SSL channel for communication between AquaLogic Service Bus and a JMS server for sending or receiving JMS messages.

AquaLogic Service Bus can communicate with local JMS servers or foreign JMS servers. The connection to JMS servers can be secured using the T3S protocol (T3 over SSL). T3 and T3S are proprietary BEA protocols.

The ability to specify the username and password that AquaLogic Service Bus proxy services use to authenticate while establishing a connection to a JMS server and/or while looking up JMS destinations in the JNDI tree.

Note:

JMS administrators use the WebLogic Server Administration Console to create access control policies that restrict access to WebLogic JMS servers and destinations in the JNDI tree. For more information, see Configuring JMS System Resources in Configuring and Managing WebLogic JMS and Securing WebLogic Resources.

Note:

If a JMS administrator configures or changes an access control policy for a JMS destination, WebLogic Server can take up to 60 seconds to recognize the changes.

Note: By default, WebLogic Server JMS checks the policy for each JMS destination every 60 seconds. To change this behavior, modify the WebLogic Server startup command so that it sets the following system property to the frequency (in seconds) that you want WebLogic Server JMS to check access control policies:
weblogic.jms.securityCheckInterval
A value of 0 (zero) for this property ensures that an authorization check is performed for every send, receive, and getEnumeration action on a JMS resource.

Configuring Inbound JMS Transport-Level Security: Main Steps

When you create or edit a JMS proxy service in the AquaLogic Service Bus Console, on the Transport Configuration page, under Advanced Settings, select the Use SSL check box. See Proxy Services in the Using the AquaLogic Service Bus Console.

AquaLogic Service Bus configures the JMS proxy service to use the T3S protocol.

If the JMS administrator created access control policies that restrict access to a JMS connection pool, configure the proxy service to authenticate when it connects to the JMS server:

Create a service account to provide the user name and password that the JMS server requires. See Service Accounts in Using the AquaLogic Service Bus Console.

You must add a user name and password directly in the service account. JMS cannot use a service account that passes through the credentials that it received from its client’s request or that maps a client user name to an AquaLogic Service Bus user. See Service Accounts in Using the AquaLogic Service Bus Console.

When you create or edit the proxy service in the AquaLogic Service Bus Console, on the Transport Configuration page, under Advanced Settings, click the Browse button next to JMS Service Account. Select the service account that you created in the previous step.

Configuring Outbound JMS Transport-Level Security: Main Steps

When you create or edit a JMS business service in the AquaLogic Service Bus Console, on the Transport Configuration page, under Advanced Settings, select the Use SSL check box. See “Adding a Business Service” under Business Services in Using the AquaLogic Service Bus Console.

AquaLogic Service Bus configures the JMS proxy service to use the T3S protocol.

If the JMS administrator created access control policies that restrict access to a JMS connection pool, configure the business service to authenticate when it connects to the JMS server:

Create a service account to provide the user name and password that the JMS server requires. See Service Accounts in Using the AquaLogic Service Bus Console.

When you create or edit the business service in the AquaLogic Service Bus Console, on the Transport Configuration page, under Advanced Settings, click the Browse button next to JMS Service Account. Select the business account that you created in the previous step.

If the JMS administrator has restricted access to JMS destinations in the JNDI tree, configure the business service to authenticate when it looks up entries in the JNDI tree:

(You can skip this step if the JNDI tree and JMS server require the same user name and password.) Create a service account to provide the user name and password that the JNDI tree requires. See Service Accounts in Using the AquaLogic Service Bus Console.
When you create or edit the business service in the AquaLogic Service Bus Console, on the Transport Configuration page, under Advanced Settings, click the Browse button next to JNDI Service Account. Select the service account that provides the credentials that the JNDI tree requires.

You can use the same service account for both the JMS server and the JNDI tree if both objects require the same credentials.

Email, FTP, and File Transport-Level Security

The following sections describe the security measures that are available for communication over the email, FTP, and file protocols:

Email and FTP Transport-Level Security

Email and FTP are not secure protocols. They support weak authentication, typically over insecure channels. The supported security method for email or FTP transport is the username and password needed to connect to the email or FTP server.

To secure email, you must designate a service account as an alias for the username and password in the AquaLogic Service Bus Console. The service will use the username and password to authenticate to the SMTP server.

To secure FTP, in the AquaLogic Service Bus Console, select external_user and designate a service account as an alias for the username and password. The service will use the username and password to authenticate to the FTP server.

For information about how to add security to email and FTP transport, see “Adding a Business Service” in Business Services in the Using the AquaLogic Service Bus Console.

File Transport Security

The supported security method for file transport is the user login to the computer on which the files are located.

Transport-Level Security Elements in the Message Context

If you configure a proxy service to authenticate clients, then you can access the client’s identity and the security groups to which the client belongs from the proxy service’s pipeline. The identity and group information is located in the message context at $inbound/ctx:security/ctx:transportClient/ctx:username
and
$inbound/ctx:security/ctx:transportClient/ctx:principals/ctx:group
(the message context contains one ctx:group element for each group the user belongs to)

If a proxy service does not authenticate clients, then the value of $inbound/ctx:security/ctx:transportClient/ctx:username is <anonymous> and there will not be any ctx:group elements.

For more information, see “Inbound and Outbound Variables” in Message Context in the AquaLogic Service Bus User Guide and “Message Flow” in Proxy Services in the Using the AquaLogic Service Bus Console.

Security Guide

Configuring Transport-Level Security