Oracle® Communications Delegated Administrator

Security Guide

Release 7.0

E54916-02

February 2016

Oracle Communications Delegated Administrator Security Guide, Release 7.0

E54916-02

Copyright © 2014, 2016, Oracle and/or its affiliates. All rights reserved.

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

Contents

Preface

- Audience

- Related Documents

- Documentation Accessibility

- Document Revision History

1 Delegated Administrator Security Overview

- Basic Security Considerations

- Overview of Delegated Administrator Security

- Understanding the Delegated Administrator Environment

- Recommended Deployment Topologies

- Operating System Security

- Firewall Port Configuration

- GlassFish Server Security

- Secure Sockets Layer (SSL)

- LDAP Security

2 Performing a Secure Delegated Administrator Installation

- Installing GlassFish Server

- Installing Delegated Administrator Components

- Post Installation Configuration

3 Implementing Delegated Administrator Security

- The Security Model

- Configuring and Using Authentication

- Configuring and Using Access Control

- Detecting Security Attacks or Insecure Use

- Configuring GlassFish Server to Run Delegated Administrator in SSL Mode

- To Enable the Delegated Administrator Console and Utility to Use SSL Access

- Configuring Application Server to Run Delegated Administrator in SSL Mode

- To Enable the Delegated Administrator Console and Utility to use SSL Access

- Configuring Web Server to Run Delegated Administrator in SSL Mode

- To Enable the Delegated Administrator Console and Utility to Use SSL Access

- To Configure Web Server 6 to Enable Delegated Administrator to Run in SSL Mode

- To Configure Web Server 7.x to Enable Delegated Administrator to Run in SSL Mode

4 Configuring Delegated Administrator for LDAPS

- Enabling LDAPS

- Configuring Delegated Administrator for LDAPS

5 Secure Deployment Checklist

- Secure Deployment Checklist

Preface

This guide provides guidelines and recommendations for setting up Oracle Communications Delegated Administrator in a secure configuration.

Audience

This document is intended for system administrators or software technicians who work with Delegated Administrator.

Related Documents

For more information, see the following documents in the Delegated Administrator documentation set:

- Delegated Administrator Installation and Configuration Guide

- Delegated Administrator System Administrator's Guide

- Delegated Administrator Release Notes

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.

Document Revision History

The following table lists the revision history for this guide:

Version

Date

Description

E54916-02

February 2016

Minor formatting and text changes.

E54916-01

August 2014

Initial release.

1 Delegated Administrator Security Overview

This chapter provides an overview of Oracle Communications Delegated Administrator security.

Basic Security Considerations

The following principles are fundamental to using any application securely:

1. Keep software up to date. This includes the latest product release and any patches that apply to it.

2. Limit privileges as much as possible. Users should be given only the access necessary to perform their work. User privileges should be reviewed periodically to determine relevance to current work requirements.

3. Monitor system activity. Establish who should access which system components, how often they should be accessed, and who should monitor those components.

4. Install software securely. For example, use firewalls, secure protocols (such as SSL), and secure passwords. See "Performing a Secure Delegated Administrator Installation" for more information.

5. Learn about and use Delegated Administrator security features. See "Implementing Delegated Administrator Security" for more information.

6. Use secure development practices. For example, take advantage of existing database security functionality instead of creating your own application security.

7. Keep up to date on security information. Oracle regularly issues security-related patch updates and security alerts. You must install all security patches as soon as possible. See ”Critical Patch Updates and Security Alerts” on the Oracle Web site:
http://www.oracle.com/technetwork/topics/security/alerts-086861.html

Overview of Delegated Administrator Security

For an introduction to the features in Delegated Administrator, see the overview in Delegated Administrator System Administrator's Guide. To see Delegated Administrator's high-level architecture, see the information about the different scenarios for provisioning users in Delegated Administrator System Administrator's Guide. For an overview of operating system security, see Oracle Solaris Security for System Administrators.

Understanding the Delegated Administrator Environment

To better understand your security needs, ask yourself the following questions:

1. Which resources am I protecting?
In a Delegated Administrator production environment, consider which of the following resources you want to protect and what level of security you must provide:

- GlassFish Server

- Access Manager (optional): To provide authentication and authorization services when Delegated Administrator accesses the LDAP directory data.
The Delegated Administrator server must be deployed to the web container used by Access Manager.

- Directory Server: To store user, group, and domain data that Delegated Administrator provisions for the Communications Suite components.

- Oracle Communications Messaging Server: Required to provide mail service for users and groups provisioned by Delegated Administrator. Not required if you do not provision mail users.

- Oracle Communications Calendar Server: Required to provide calendar service for users and groups provisioned by Delegated Administrator 7. Not required if you do not provision calendar users.

2. From whom am I protecting the resources?
In general, resources must be protected from everyone on the Internet. But should the Delegated Administrator deployment be protected from employees on the intranet in your enterprise? Should your employees have access to all resources within the GlassFish Server environment? Should the system administrators have access to all resources? Should the system administrators be able to access all data? You might consider giving access to highly confidential data or strategic resources to only a few well trusted system administrators. On the other hand, perhaps it would be best to allow no system administrators access to the data or resources.

3. What will happen if the protections on strategic resources fail?
In some cases, a fault in your security scheme is easily detected and considered nothing more than an inconvenience. In other cases, a fault might cause great damage to companies or to users who use Delegated Administrator. Understanding the security ramifications of each resource helps you protect it properly.

Recommended Deployment Topologies

Delegated Administrator lets you provision users, groups, domains, and resources in an LDAP directory used by Communications Suite applications such as Messaging Server, Calendar Server, Instant Messaging Server, and Contacts Server. Delegated Administrator can be installed in one- and two-tier deployments. For more information, see the following information:

- Discussion of provisioning tools and schema in Installation and Configuration Guide.

- Discussion of Service Provider Administrator and Service Provider Organizations in Delegated Administrator System Administrator's Guide.

- Discussion of Messaging Server logical architecture in Installation and Configuration Guide for Messaging Server 8.0.1.
The general architectural recommendation is to use the well-known and generally accepted Internet-Firewall-DMZ-Firewall-Intranet architecture. For more information on addressing network infrastructure concerns, see the discussion about determining your Messaging Server network infrastructure needs in Installation and Configuration Guide for Messaging Server 8.0.1

Operating System Security

This section lists Delegated Administrator-specific OS security configurations. This section applies to all supported operating systems.

Firewall Port Configuration

Delegated Administrator communicates with various components on specific ports. Depending on your deployment and use of a firewall, you might need to ensure that the firewalls are configured to manage traffic for the following components:

- Delegated Administrator server port (default 8080)

- SSL port (default 433)

- Web Server HTTP port (default 80)

- Administration server port (default 8800)

Close all unused ports, especially non-SSL ports. Opt for SSL-enabled ports, instead of non-SSL ports, for all communications (for example: HTTPS, IIOPS, t3s).

For more information about securing your OS, see your OS documentation.

GlassFish Server Security

For information about securing GlassFish Server, see Oracle GlassFish Server Security Guide, at:

http://docs.oracle.com/cd/E18930_01/html/821-2435/index.html

Secure Sockets Layer (SSL)

SSL enables secure communication between applications connected through the Web. In a Delegated Administrator deployment, you can configure SSL between the following components:

- GlassFish Server and client connections

- Delegated Administrator and Directory Server

See "Implementing Delegated Administrator Security" for more information.

LDAP Security

To enhance client security in communicating with Directory Server, use a strong password policy for user authentication. For more information on securing Directory Server, see the discussion about Directory Server security in Oracle Directory Server Enterprise Edition Administration Guide.

2 Performing a Secure Delegated Administrator Installation

This chapter presents planning information for your Oracle Communications Delegated Administrator system and describes recommended deployment topologies that enhance security.

For more information about installing Delegated Administrator, see Delegated Administrator Installation and Configuration Guide.

Installing GlassFish Server

Delegated Administrator is deployed on Oracle GlassFish Server. For information on how to install and configure GlassFish Server, see Delegated Administrator Installation and Configuration Guide. To operate GlassFish Server in secure mode, see the discussion about managing administrative security in Oracle GlassFish Server Security Guide.

The GlassFish Server installation prompts for the following authentication and security protocols:

- Administration User and Administration User password

- Master password for SSL certificate

- Port number for HTTPS port

- Secure administration server instance

It is important to minimize the GlassFish installation by not installing components that you do not intend to use. During GlassFish installation, be sure to enter no when asked to install the following components:

- High Availability Database Server

- Load Balancing Plugin

- Sample Applications

Note:
By default, the GlassFish installation creates both a regular HTTP listener and an HTTPS (HTTP with SSL) listener. As a security practice, Oracle recommends that you disable the non-SSL (HTTP) listener for Delegated Administrator. See the discussion about configuring an HTTP listener for SSL in Oracle GlassFish Server Administration Guide for more information.

For more information on installing GlassFish Server for the Communications Suite product, see Delegated Administrator Installation and Configuration Guide.

Installing Delegated Administrator Components

Review the following installation documentation:

- Installation Scenario in Delegated Administrator Installation and Configuration Guide

- Delegated Administrator Initial Configuration in Delegated Administrator Installation and Configuration Guide

- Understanding Schema and Provisioning Options in Messaging Server in Communications Suite Deployment Planning Guide.

The Delegated Administrator installation and initial configuration program prompts for credentials of the following:

- Default SSL port for Delegated Administrator Server Host

- Administrator User ID and Password for the Delegated Administrator Console

- Secure Administrator Server Instance option for the Delegated Administrator Console

- Administrator User ID and Password for the Delegated Administrator Server

- Secure Administrator Server Instance option for the Delegated Administrator Server

- User/Group Directory Server manager (bind DN and password)

- Delegated Administrator Internal LDAP Username and Password

- Access Manager Top-level Administrator and Password

- Access Manager Internal LDAP Auth Username and Password

- Secure Administrator Server Instance option for the Delegated Administrator Console

- Top-level Administrator for Default Org and Password

Post Installation Configuration

In the post-configuration tasks in Delegated Administrator Installation and Configuration Guide, the following procedures are outlined:

- Adding ACIs for Schema 2 Compatibility Mode

- Running Delegated Administrator in SSL Mode on Web Server. In addition to running Delegated Administrator in SSL Mode on Web Server, you can also run it in SSL mode on GlassFish Server. For more information, see the discussion about certificates and SSL in Oracle GlassFish Server Security Guide.

3 Implementing Delegated Administrator Security

This section outlines the specific security mechanisms offered by Oracle Communications Delegated Administrator.

The Security Model

Security requirements arise from the need to protect data: first, from accidental loss and corruption, and second, from deliberate unauthorized attempts to access or alter that data. Secondary concerns include protecting against undue delays in accessing or using data, or even against interference to the point of denial of service. The global costs of such security breaches run up to billions of dollars annually, and the cost to individual companies can be severe, sometimes catastrophic.

The critical security features that provide these protections are:

- Authentication

- Access Control

Authentication is the way in which an entity (a user, an application, or a component) determines that another entity is who it claims to be. An entity uses security credentials to authenticate itself. The credentials might be a user name and password, a digital certificate, or something else. Usually, servers or applications require clients to authenticate themselves. Additionally, clients might require servers to authenticate themselves. When authentication is bidirectional, it is called mutual authentication.

Delegated Administrator supports LDAP authentication in that you are able to create administrative and end-user authentication. For more information on Directory Server security requirements, see the discussion about identifying security requirements in Directory Server Enterprise Edition Deployment Planning Guide.

Access Control, also known as authorization, is the means by which users are granted permission to access data or perform operations. After a user is authenticated, the user's level of authorization determines what operations the user can perform.

Configuring and Using Authentication

Delegated Administrator uses Oracle Directory Server for authentication. For more information, refer to the following Directory Server documentation:

- Creating a Directory Server Password Policy in Directory Server Enterprise Edition Deployment Planning Guide. This guide includes information on setting up password lengths, setting up password complexity, and preventing brute forcing.

- Setting Time Limits for Repeated Failed Logins in Directory Server Enterprise Edition Deployment Planning Guide.

To perform LDAP Authentication with Delegated Administrator, see:

- Provisioning Calendar Server Users in Delegated Administrator System Administrator's Guide.

- Provisioning Messaging Server Users in Delegated Administrator System Administrator's Guide.

- Provisioning Instant Messaging Server Users in Delegated Administrator System Administrator's Guide.

- Provisioning Contacts Server Users in Delegated Administrator System Administrator's Guide.

Configuring and Using Access Control

To configure access control in Delegated Administrator, see the following sections:

- Administrator Roles and the Directory Hierarchy in Delegated Administrator System Administrator's Guide.

- Configuring Administrator Access to Messaging Server in Messaging Server Administration Guide.

- Setting Calendar Server Advanced Rights with Delegated Administrator in Delegated Administrator System Administrator's Guide.

- Consolidating ACIs for Directory Server Performance in Delegated Administrator System Administrator's Guide.

For information on LDAP Access Control, see:

http://docs.oracle.com/cd/E20295_01/html/821-1220/bcalc.html#scrolltoc

Detecting Security Attacks or Insecure Use

Repeated login failures could be indicative of an external party trying to gain access to an account. For example, you see such activity in LDAP server logs. For more information, see Directory Server Logging in Directory Server Enterprise Edition Administration Guide.

In addition, you can use the following log files to look for similar security problems:

- Delegated Administrator Console Log

- Delegated Administrator Server Log

- Web Container Server Logs

- Directory Server and Access Manager Logs

For more information on Delegated Administrator log files, see Debugging Delegated Administrator in Delegated Administrator System Administrator's Guide.

Configuring GlassFish Server to Run Delegated Administrator in SSL Mode

If you have deployed the Delegated Administrator console to GlassFish Server, you can run the Delegated Administrator console in SSL mode, over a secure port.

To Enable the Delegated Administrator Console and Utility to Use SSL Access

1. Edit the daconfig.properties file, located in the DelegatedAdmin_home/data/da/WEB-INF/classes/com/sun/comm/da/resources directory.

2. Change the property values as follows:

commadminserver.port=port
commadminserver.usessl=true

where port is the HTTPS port, for example 8181.

3. Deploy the Delegated Administration Console web application to GlassFish by running the deploy script.
For example:

DelegatedAdmin_home/sbin/config-appsvr8x-da deploy

Configuring Application Server to Run Delegated Administrator in SSL Mode

If you have deployed the Delegated Administrator console to Application Server 8.x, you can run the Delegated Administrator console in SSL mode, over a secure port.

To Enable the Delegated Administrator Console and Utility to use SSL Access

1. Edit the daconfig.properties file, located in the DelegatedAdmin_home/data/da/WEB-INF/classes/com/sun/comm/da/resources directory.

2. Change the property values as follows:

commadminserver.port=port
commadminserver.usessl=true

where port is the HTTPS port, for example 8181.

3. Deploy the Delegated Administration Console web application to Application Server by running the deploy script.
For example:

DelegatedAdmin_home/sbin/config-appsvr8x-da deploy

Configuring Web Server to Run Delegated Administrator in SSL Mode

If you have deployed the Delegated Administrator console to Web Server 6 or Web Server 7.x, you can run the Delegated Administrator console in SSL mode, over a secure port.

If the Delegated Administrator server is deployed to Web Server 6 or Web Server 7.x, you can run the Delegated Administrator utility (commadmin) in SSL mode.

To Enable the Delegated Administrator Console and Utility to Use SSL Access

- For the console, complete all the steps in "Configuring GlassFish Server to Run Delegated Administrator in SSL Mode."

- For the utility, you only have to complete Step 1 in "Configuring GlassFish Server to Run Delegated Administrator in SSL Mode." Use the -s option with the commadmin commands to run in SSL mode.

For Web Server 6, follow this procedure:

- To Configure Web Server 6 to Enable Delegated Administrator to Run in SSL Mode

For Web Server 7.x, follow this procedure:

- To Configure Web Server 7.x to Enable Delegated Administrator to Run in SSL Mode

To Configure Web Server 6 to Enable Delegated Administrator to Run in SSL Mode

In this procedure, the certificate truststore is created in the Delegated Administrator configuration directory. For example: /var/DelegatedAdmin_home/config

1. Request and install a certificate.
In a production environment, you must request a certificate from a Certificate Authority (CA), which issues the certificate to you. Next, you install the certificate.

In a test environment, you can create and install a self-signed certificate.

For information about requesting and installing certificates for Web Server 6, see ”Using Certificates and Keys” in the Oracle iPlanet Web Server 6.1 SP6 Administrator's Guide.

After you complete this step, you can run the Delegated Administrator utility in SSL mode.

2. Export the specific certificate in ASCII encoding.
For example:

/opt/SUNWwbsvr/bin/https/admin/bin/certutil -L -n Server-Cert -d \
-P https-host.domain-host-
/opt/SUNWwbsvr/alias -a > /tmp/host.cert

where

- Server-Cert is the default name created by the Administration interface

- host is the host name of the machine where Web Server 6 is running. For example: myhost.

- domain-host is the host and domain name of the machine where Web Server 6 is running. For example: myhost.siroe.com.

3. Use the Java keytool utility to import the certificate into a truststore.
This step assumes that you are creating a new truststore in the Delegated Administrator configuration directory.

Import the certificate.

For example:

cd /var/DelegatedAdmin_home/configkeytool -import -alias Server-Cert -file /tmp/host.cert-keystore truststore

Enter a password when the keytool prompts you for one.

4. Define the ssl.truststore property in the JVM Setting for the Web Server 6 instance configuration.
For example

-Djavax.net.ssl.trustStore=/var/DelegatedAdmin_home/config/truststoreDjavax.net.ssl.trustStorePassword=password

where password is the password you entered at the keytool prompt.

5. Modify the following property in the JVM Setting for the Web Server 6 instance configuration. Change:

-Djava.protocol.handler.pkgs=com.iplanet.services.comm

to the following value:

-Djava.protocol.handler.pkgs=com.sun.identity.protocol

6. Change the following properties in the daconfig.properties file:
Open the daconfig.properties file in a text editor.

The daconfig.properties file is located by default in the Delegated Administrator configuration directory:

DelegatedAdmin_home/data/da/WEB-INF/classes/com/sun/comm/da/resources

(In a later step, you will deploy the daconfig.properties file to the Web Server 6 configuration directory.)

Change the property values as follows

commadminserver.host=host.domaincommadminserver.port=portcommadminserver.usessl=true

where host.domain is the host and domain name of the machine where Web Server 6 is running. For example: myhost.siroe.com.

And where port is the SSL port. For example: 443.

7. Deploy the Web Server 6 configuration and restart the instance:
Run the Web Server 6 deploy script:

DelegatedAdmin_home/sbin/config-wbsvr-da

Restart the Web Server 6 instance.

To Configure Web Server 7.x to Enable Delegated Administrator to Run in SSL Mode

In this procedure, the certificate truststore is created in the Delegated Administrator configuration directory. For example: /var/DelegatedAdmin_home/config

1. Request and install a certificate.
In a production environment, you must request a certificate from a Certificate Authority (CA), which issues the certificate to you. Next, you install the certificate.

In a test environment, you can create and install a self-signed certificate.

For information about requesting and installing certificates for Web Server 7.x, see Managing Certificates in Sun Java System Web Server Administrator's Guide.

After you complete this step, you can run the Delegated Administrator utility in SSL mode.

2. Run the certutil command to list all certificates in the certificate database.
For example:

cd /var/DelegatedAdmin_home/config/usr/sfw/bin/certutil -L -d /var/opt/SUNWwbsvr7/https-host.domain/config

where host.domain is the host and domain name of the machine where Web Server 7.x is running. For example: myhost.siroe.com

3. Export the specific certificate in ASCII encoding.
For example:

/usr/sfw/bin/certutil -L -n cert-host.domain -d/var/opt/SUNWwbsvr7/https-host.domain/config-a > host.cert

where host and host.domain are the host name or host and domain name of the machine where Web Server 7.x is running.

4. Use the java keytool utility to import the certificate into a truststore.
This step assumes that you are creating a new truststore in the Delegated Administrator configuration directory.

Import the certificate.

For example:

keytool -import -alias cert-host.domain -file host.cert-keystore truststore

Enter a password when the keytool prompts you for one.

5. Define the ssl.truststore property in the JVM Setting for the Web Server 7.x instance configuration.
For example:

-Djavax.net.ssl.trustStore=/var/DelegatedAdmin_home/config/truststore -Djavax.net.ssl.trustStorePassword=password

where password is the password you entered at the keytool prompt.

6. Modify the following property in the JVM Setting for the Web Server 7.x instance configuration.
Change

-Djava.protocol.handler.pkgs=com.iplanet.services.comm

to the following value:

-Djava.protocol.handler.pkgs=com.sun.identity.protocol

7. Change the following properties in the daconfig.properties file:
Open the daconfig.properties file in a text editor.

The daconfig.properties file is located by default in the Delegated Administrator configuration directory:

DelegatedAdmin_home/data/da/WEB-INF/classes/com/sun/comm/da/resources

(In a later step, you will deploy the daconfig.properties file to the Web Server 7.x configuration directory.)

Change the property values as follows:

commadminserver.port=portcommadminserver.usessl=true

where port is the SSL port. For example: 443.

8. Deploy the Web Server 7.x configuration and restart the instance:
Run the Web Server 7.x deploy script:

DelegatedAdmin_home/sbin/config-wbsvr7x-da

Restart the Web Server 7.x instance.

4 Configuring Delegated Administrator for LDAPS

This chapter describes how to configure Oracle Communications Delegated Administrator for LDAPS.

Enabling LDAPS

You can enable LDAP over SSL (LDAPS) for Delegated Administrator to communicate with Directory Server. This applies only to Direct LDAP mode.

Note:
If you are using Linux to complete this procedure, you must you must configure the LDAP client before you restart LDAP (shown in "Restart LDAP" in the instructions that follow). To do so follow these steps:

1. Open /etc/openldap/ldap.conf

2. Insert the following lines of code at the end of the file:

.
TLS_CACERT=CA certfile path
TLS_REQCERT never

Prior to configuring Delegated Administrator for LDAPS, you need to create a certificate with CN as FQDN, and enable SSL in ODSEE.

To create the required certificate and enable SSL in ODSEE:

1. Create the LDAP server certificate request:

dsadm request-cert --name FQDN - F ascii --org org --org-unit org unit name -o lDAP Server CSR File ldap instance

For example:

/da7/dsee7/bin/dsadm request-cert --name blr2262372.idc.example.com -F ascii --org example --org-unit example -o server.csr /var/ds7ins6

2. Create the CA Certificate. This involves three sub-steps:

1. Create the CA key:

openssl genrsa -des3 -out CA Key file 1024

Provide the key password in this step. For example:

openssl genrsa -des3 -out CA.key 1024

2. Create the CA certificate request:

openssl req -new -key CA Key file -x509 -days 365 -out CA CSR file

For example:

openssl req -new -key ./CA.key -x509 -days 365 -out ./CA.csr

3. Create the self signed CA certificate:

openssl x509 -in CA CSR file -out CA Cert file -signkey CA key file -days 365

For example:

openssl x509 -in CA.csr -out CA.cer -signkey CA.key -days 365

3. Sign the LDAP certificate using the CA file:

openssl x509 -req -days 365 -in lDAP Server CSR File -CA CA Cert file -CAkey CA key file -CAcreateserial -out lDAP Server Cert file -outform PEM

For example:

openssl x509 -req -days 365 -in ./server.csr -CA ./CA.cer -CAkey ./CA.key -CAcreateserial -out ./server.pem -outform PEM

4. Import the LDAP certificate back to ODSEE:

dsadm add-cert ldap instance ldap alias name LDAP Cert file

For example:

/da7/dsee7/bin/dsadm add-cert /var/ds7ins1/ servercert ./server.pem

5. Import the CA certificate to the ODSEE:

dsadm add-cert --ca ldap instance CA alias name CA cert file

For example:

dsadm add-cert --ca /var/ds7ins1/ CA ./ca.pem

6. Set the certificate to ODSEE:

/da7/dsee7/bin/dsconf set-server-prop -e -h FQDN -p ldap non ssl port ssl-rsa-cert-name:ldap alias name

For example:

/da7/dsee7/bin/dsconf set-server-prop -e -h blr2262372.idc.example.com -p 389 ssl-rsa-cert-name:servercert

7. Restart LDAP

8. Copy security database to DA-BASE/lib

cp ldap instance/alias/sladp-cert8.db DA-BASE/lib/cert8.db

cp ldap instance/alias/sladp-key3.db DA-BASE/lib/key3.db

cp ldap instance/alias/secmod.db DA-BASE/lib/secmod.db

For example:

cp /var/ds7ins1/alias/sladp-cert8.db /opt/sun/comms/da/lib/cert8.db

cp /var/ds7ins1/alias/sladp-key3.db /opt/sun/comms/da/lib/key3.db

cp /var/ds7ins1/alias/secmod.db /opt/sun/comms/da/lib/secmod.db

Configuring Delegated Administrator for LDAPS

1. Import the Directory Server certificate into an NSS truststore file.

2. Put the certificate and key files, cert8.db, key3.db, into the DelegatedAdmin_home/lib directory.

3. Run the config-commda initial configuration command.

DelegatedAdmin_home/da/sbin/config-commda

4. Step through the program by reentering the same values for your existing configuration.

5. When prompted for the Directory Server URL, type an entry similar to the following, to use LDAPS:

LDAPS://host:SSLport

For example:

LDAPS://ds1.example.com:636

This sets the ldaphost-usessl configuration parameter in the serverconfig.properties file to true (that is, enabled for LDAPS).

6. Complete the configuration by accepting Configure Now.

5 Secure Deployment Checklist

The following security checklist provides guidelines to help you secure Oracle Communications Delegated Administrator and its components.

Secure Deployment Checklist

- Install only the components you require.

- Lock and expire default user accounts.

- Use a strong LDAP password policy for user authentication.

- Restrict, control, and revisit user privileges:

- Grant only the necessary privileges to each user.

- Revoke unnecessary privileges from the PUBLIC user group.

- Restrict permissions on run-time facilities.

- Enforce the use of access controls by using the Authorization Policies.

- Require clients to authenticate.

- Restrict network access by doing the following:

- Use firewalls.

- Never leave an unnecessary hole in a firewall.

- Password-protect the Oracle listener against remote access.

- Monitor listener activity.

- Monitor who accesses your systems.

- Restrict system access by IP addresses.

- Encrypt network traffic.

- Apply all security patches and workarounds.

- Encrypt sensitive information.

- Contact Oracle Security Products if you discover a vulnerability in any Oracle product.

Oracle Legal Notices

Copyright Notice

Copyright © 1994-2016, Oracle and/or its affiliates. All rights reserved.

License Restrictions Warranty/Consequential Damages Disclaimer

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

Warranty Disclaimer

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

Restricted Rights Notice

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

Hazardous Applications Notice

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Trademark Notice

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

Third-Party Content, Products, and Services Disclaimer

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

Alpha and Beta Draft Documentation Notice

If this document is in preproduction status:

This documentation is in preproduction status and is intended for demonstration and preliminary use only. It may not be specific to the hardware on which you are using the software. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to this documentation and will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.

Private Alpha and Beta Draft Documentation Notice

If this document is in private preproduction status:

The information contained in this document is for informational sharing purposes only and should be considered in your capacity as a customer advisory board member or pursuant to your beta trial agreement only. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described in this document remains at the sole discretion of Oracle.

This document in any form, software or printed matter, contains proprietary information that is the exclusive property of Oracle. Your access to and use of this confidential material is subject to the terms and conditions of your Oracle Master Agreement, Oracle License and Services Agreement, Oracle PartnerNetwork Agreement, Oracle distribution agreement, or other license agreement which has been executed by you and Oracle and with which you agree to comply. This document and information contained herein may not be disclosed, copied, reproduced, or distributed to anyone outside Oracle without prior written consent of Oracle. This document is not part of your license agreement nor can it be incorporated into any contractual agreement with Oracle or its subsidiaries or affiliates.

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.