Setting Up the Sun ONE Portal Server to Use Secure External LDAP Directory Server

In the default install, the Sun™ ONE Portal Server, the Sun™ ONE Identity Server, and the Sun™ ONE Directory Server software are all running on the same host. However, depending on the performance, security, and integration requirements of your deployment, you might want to run the directory server on a separate, external host and have the Portal Server access the directory over a secure connection using Secure Sockets Layer (SSL). In order to access the Directory Server over a secure connection, the Sun™ ONE Application Server must be configured to trust the certificate authority that signed the directory’s certificate.

Setting up the Sun ONE Portal Server to use an external LDAP directory, requires the following procedures:

Installing the Sun ONE Portal Server. See "Installing Sun ONE Portal Server"in Chapter 2 of this guide.

Configuring the Directory Server to run SSL. See "Configuring the Directory Server to Run in SSL."

Creating a certificate database. See "Creating a Certificate Database."

Installing a root Certificate Authority (CA) certificate. See "Installing A Root Certificate Authority (CA) Certificate."

Enabling SSL for the Directory Server. See "Enabling SSL for the Directory Server."

Configuring the Directory Server to Run in SSL

Verify that both the Directory Server (ns-slapd process) and the administration server (ns-httpd process) are started and running.

As root, in a terminal window start the directory server console by typing:

/var/opt/mps/serverroot/startconsole

In the login window that is displayed, enter admin as the user name and the passphrase for the Directory Server.

In the left pane of the console, expand the directory until you see the Directory Server instance under Server Group.

Select Directory Server instance and click Open.

Select Tasks and then Manage Certificates.

The first time you perform this task, you’ll be asked to create a certificate database by entering a password. Make a note of this password as you will need it later to start up the Directory Server.

Click Request.

The Certificate Request Wizard appears. Follow the wizard and complete the steps to generate a certificate request. The request is sent to a Certificate Management Server (CMS) for approval. The CMS returns the real certificate. Save a copy of the certificate request by copying the request data to a file.

After the certificate request is sent to the CMS, have the administrator of the CMS approve the request and send back the approved certificate.

Get the generated certificate for the DS and the CMS certificate.

Since the CMS generated the certificate for DS, the CMS will also have to be trusted by importing its certificate as a root CA.

Select Manage Certificates, Server Certificates and then click Install.

The Certificate Install Wizard appears.

Copy and paste the approved certificate data from Step 8 into the text area and follow the steps of the wizard to install the certificate.

When the certificate is successfully installed, the certificate displays as a line item on the Server Certificates tab.

Select Manage Certificates and CA Certificates, and then click Install.

Copy and paste the CMS certificate data into the text area and follow the steps of the wizard to install the certificate.

Click Close to close the Manage Certificates window.

Select Configuration.

In the right pane, select Settings.

Verify or specify a valid port number in the Encrypted port field and click Save.

The default is 636.

Click Encryption, check the Enable SSL for this server and Use the cipher family: RSA check boxes and click Save.

Restart the Directory Server and supply the certificate database password entered in Step 6.

Your Directory is now listening on port 636 (default) for SSL connections.

Creating a Certificate Database

When you create the certificate database, you specify a password that will be used for a key-pair file. You will also need this password to start a server using encrypted communications. For a list of guidelines to consider when changing a password, see Changing Passwords or PINs.

In the certificate database you create and store the public and private keys, referred to as your key-pair file. The key-pair file is used for SSL encryption. You will use the key-pair file when you request and install your server certificate. The certificate is stored in the certificate database after installation. The key-pair file is stored encrypted in:

The procedure for creating a certificate database depends on the type of web container that you are using. The following instructions are for creating a certificate database on the Sun ONE Web Server and can also be found in Sun ONE Web Server, Enterprise Edition Administrator’s Guide at http://docs.sun.com.

For instructions on creating a certificate database on the Sun ONE Application Server refer to Sun ONE Application Server 7 Administrator’s Guide to Security on http://docs.sun.com.

Creating a Certificate Database

To create a certificate database on the Sun ONE Web Server, perform the following steps:

Access either the Administration Server or the Server Manager and choose the Security tab.

For the Server Manager you must first select the server instance from the drop-down list.

Click on the Create Database link.

Enter a password for the database.

Repeat.

Click OK.

For the Server Manager, click Apply, and then Restart for changes to take effect.

Using the password.conf File

By default, the web server prompts the administrator for the key database password before starting up. If you want to be able to restart an unattended web server, you need to save the password in a password.conf file. Only do this if your system is adequately protected so that this file and the key databases are not compromised.

Normally, you cannot start an Unix SSL-enabled server with the /etc/rc.local or the /etc/inittab files because the server requires a password before starting. Although you can start an SSL-enabled server automatically if you keep the password in plain text in a file, this is not recommended. The server’s password.conf file should be owned by root or the user who installed the server, with only the owner having read and write access to them. On Unix, leaving the SSL-enabled server’s password in the password.conf file is a large security risk. Anyone who can access the file has access to the SSL-enabled server’s password. Consider the security risks before keeping the SSL-enabled server’s password in the password.conf file.

Installing A Root Certificate Authority (CA) Certificate

The procedure for installing a root CA certificate depends on the type of web container that you are using. The following procedure describes how to install a root CA on the Sun ONE Web Server, and can also be found in Sun ONE Web Server, Enterprise Edition Administrator’s Guide at http://docs.sun.com.

For instructions on installing a root CA certificate on the Sun ONE Application Server refer to Sun ONE Application Server 7 Administrator’s Guide to Security on http://docs.sun.com.

Go the Web Server console and click on Install Certificate.

Click on Certificate for this Server.

Enter the Certificate Database password in the Key Pair File Password field.

Paste the certificate into the provided text field, or check the radio button and enter the filename in the text box. Click Submit.

The browser will display the certificate, and provide a button to add the certificate.

Click Install Certificate.

Click Certificate for Trusted Certificate Authority.

Enabling SSL for the Directory Server

To enable SSL for the Directory server, edit the AMConfig.properties file. This step is container independent and must be done for Sun ONE Web Server as well as Sun ONE Application Server.

If you are using the Sun ONE Application Server as your web container, edit the AMConfig.properties file to point to the certificate database path and prefix used by Sun ONE Application Server.

Change the connection port and the connection type values in the serverconfig.XML file to change from open mode to SSL.

After making these changes to the configuration files (AMConfig.properties and serverconfig.xml) restart the web container

Or use the appropriate method for stopping and starting the application server on which Sun ONE Portal Server is installed.

Appendix E Setting Up the Sun ONE Portal Server to Use Secure External LDAP Directory Server

Configuring the Directory Server to Run in SSL

Creating a Certificate Database

Creating a Certificate Database

Using the password.conf File

Installing A Root Certificate Authority (CA) Certificate

Enabling SSL for the Directory Server

Appendix E
Setting Up the Sun ONE Portal Server to Use Secure External LDAP Directory Server