Setting Up the Sun ONE Portal Server to Use Secure External LDAP Directory Server

In the default install, the Sun™ ONE Portal Server, the Sun™ ONE Identity Server, and the Sun™ ONE Directory Server software are all running on the same host. However, depending on the performance, security, and integration requirements of your deployment, you might want to run the directory server on a separate, external host and have the portal server access the directory over a secure connection using Secure Sockets Layer (SSL). In order to access the directory server over a secure connection, the Sun™ ONE Application Server must be configured to trust the certificate authority that signed the directory’s certificate.

Setting up the Sun ONE Portal Server to use an external LDAP directory, requires the following procedures:

Configuring an existing directory server. This procedure is necessary only if the existing directory server was not installed using the pssetup script or the setup script for Identity. See "Configuring an Existing Directory Server."

Installing the Sun ONE Portal Server. See "Installing the Sun ONE Portal Server" in Chapter 2 of this guide.

Configuring the Directory Server to run SSL. See "Configuring the Directory Server to Run in SSL."

Creating a trust database. See "Creating a Trust Database."

Installing a root Certificate Authority (CA) certificate. See "Installing A Root Certificate Authority (CA) Certificate."

Enabling SSL for the Directory Server. See "Enabling SSL for the Directory Server."

Configuring an Existing Directory Server

If the remote directory server was not installed by using the pssetup installation script, the directory server must first be configured using the pssetup script. This procedure must be done prior to installing Sun ONE Portal Server 6.1.

Change directories to where the installation program is located.

Type:

./pssetup

Specify if you accept the license agreement. To accept, type yes.


Note	Although this product will run without a license, you must either purchase a Binary Code License from, or accept the terms of a Binary Software Evaluation license with Sun Microsystems, to legally use this product.

Select the option to configure the Directory Server.

See the section "Checklist for Sun™ ONE Directory Server" in Chapter 1 for a list of the information needed to configure the Directory Server.

Accept the default settings if they are correct by typing y. Otherwise, type n to change the values as necessary.

If you choose n, the script displays a list of settings for which you can enter your own values.

Enter and confirm the directory manager password.

Install the Sun ONE Portal Server.

Configuring the Directory Server to Run in SSL

Verify that both the Directory Server (ns-slapd process) and the Admin Server (ns-httpd process) are started and running.

As root, in a terminal window start the directory server console by typing:

# /usr/ldap/startconsole

In the login window that is displayed, enter admin as the user name and the passphrase for the Directory Server.

In the left pane of the console, expand the directory until you see the Directory Server instance under Server Group.

Select Directory Server instance and click Open.

Select Tasks and then Manage Certificates.

The first time you perform this task, you’ll be asked to create a certificate database by entering a password. Make a note of this password as you will need it later to start up the Directory Server.

Click Request.

The Certificate Request Wizard appears. Follow the wizard and complete the steps to generate a certificate request. The request is sent to a Certificate Management Server (CMS) for approval. The CMS returns the real certificate. Save a copy of the certificate request by copying the request data to a file.

After the certificate request is sent to the CMS, have the administrator of the CMS approve the request and send back the approved certificate.

Get the generated certificate for the DS and the CMS certificate.

Since the CMS generated the certificate for DS, the CMS will also have to be trusted by importing its certificate as a root CA.

Select Manage Certificates, Server Certificates and then click Install.

The Certificate Install Wizard appears.

Copy and paste the approved certificate data from Step 7 into the text area and follow the steps of the wizard to install the certificate.

When the certificate is successfully installed, the certificate displays as a line item on the Server Certificates tab.

Select Manage Certificates and CA Certificates, and then click Install.

Copy and paste the CMS certificate data into the text area and follow the steps of the wizard to install the certificate.

Click Close to close the Manage Certificates window.

Select Configuration.

In the right pane, select Settings.

Verify or specify a valid port number in the Encrypted port field and click Save.

The default is 636.

Click Encryption, check the Enable SSL for this server and Use the cipher family: RSA check boxes and click Save.

Restart the Directory Server and supply the certificate database password entered in Step 5.

Your Directory is now listening on port 636 (default) for SSL connections.

Creating a Trust Database

When you create the trust database, you specify a password that will be used for a key-pair file. You will also need this password to start a server using encrypted communications. For a list of guidelines to consider when changing a password, see Changing Passwords or PINs.

In the trust database you create and store the public and private keys, referred to as your key-pair file. The key-pair file is used for SSL encryption. You will use the key-pair file when you request and install your server certificate. The certificate is stored in the trust database after installation. The key-pair file is stored encrypted in:

The procedure for creating a trust database depends on the type of web container that you are using. The following instructions are for creating a trust database on the Sun ONE Web Server and can also be found in iPlanet Web Server, Enterprise Edition Administrator’s Guide at http://docs.sun.com.

For instructions on creating a trust database on the Sun ONE Application Server refer to Sun ONE Application Server 7 Administrator’s Guide to Security on http://docs.sun.com.

Creating a Trust Database

To create a trust database on the Sun ONE Web Server, perform the following steps:

Access either the Administration Server or the Server Manager and choose the Security tab.

For the Server Manager you must first select the server instance from the drop-down list.

Click on the Create Database link.

Enter a password for the database.

Repeat.

Click OK.

For the Server Manager, click Apply, and then Restart for changes to take effect.

Using the password.conf File

By default, the web server prompts the administrator for the key database password before starting up. If you want to be able to restart an unattended web server, you need to save the password in a password.conf file. Only do this if your system is adequately protected so that this file and the key databases are not compromised.

Normally, you cannot start an Unix SSL-enabled server with the /etc/rc.local or the etc/inittab files because the server requires a password before starting. Although you can start an SSL-enabled server automatically if you keep the password in plain text in a file, this is not recommended. The server’s password.conf file should be owned by root or the user who installed the server, with only the owner having read and write access to them. On Unix, leaving the SSL-enabled server’s password in the password.conf file is a large security risk. Anyone who can access the file has access to the SSL-enabled server’s password. Consider the security risks before keeping the SSL-enabled server’s password in the password.conf file.

Installing A Root Certificate Authority (CA) Certificate

The procedure for installing a root CA certificate depends on the type of web container that you are using. The following procedure describes how to install a root CA on the Sun ONE Web Server, and can also be found in iPlanet Web Server, Enterprise Edition Administrator’s Guide at http://docs.sun.com.

For instructions on installing a root CA certificate on the Sun ONE Application Server refer to Sun ONE Application Server 7 Administrator’s Guide to Security on http://docs.sun.com.

Go the Web Server console and click on Install Certificate.

Click on Certificate for this Server.

Enter the Certificate Database password in the Key Pair File Password field.

Paste the certificate into the provided text field, or check the radio button and enter the filename in the text box. Click Submit.

The browser will display the certificate, and provide a button to add the certificate.

Click Install Certificate.

Click Certificate for Trusted Certificate Authority.

Enabling SSL for the Directory Server

To enable SSL for the Directory server, edit the AMConfig.properties file. This step is container independent and must be done for Sun ONE Web Server as well as Sun ONE Application Server.

If you are using the Sun ONE Application Server as your web container, edit the AMConfig.properties file to point to the certificate database path and prefix used by Sun ONE Application Server.

Change the connection port and the connection type values in the serverconfig.XML file to change from open mode to SSL.

After making these changes to the configuration files (AMConfig.properties and serverconfig.xml) restart the web container

Or use the appropriate method for stopping and starting the application server on which Sun ONE Portal Server is installed.

Appendix E Setting Up the Sun ONE Portal Server to Use Secure External LDAP Directory Server

Configuring an Existing Directory Server

Configuring the Directory Server to Run in SSL

Creating a Trust Database

Creating a Trust Database

Using the password.conf File

Installing A Root Certificate Authority (CA) Certificate

Enabling SSL for the Directory Server

Appendix E
Setting Up the Sun ONE Portal Server to Use Secure External LDAP Directory Server