Installation & Configuration of OASIS- Module and Reference Signature Solution

Transcription

1 COMPETITIVENESS AND INNOVATION FRAMEWORK PROGRAMME ICT PSP Fifth Call for proposals Pilot Type A Towards a single European electronic identification and authentication area ICT PSP call identifier: CIP-ICT-PSP ICT PSP Theme/objective identifier: 4.2 Project acronym: STORK 2.0 Project full title: Secure identity across borders linked 2.0 Grant agreement no.: Installation & Configuration of OASIS- Module and Reference Signature Solution Deliverable Id : Deliverable Name : Status : Dissemination Level : Due date of deliverable : Actual submission date : Work Package : Organization name of lead contractor for this deliverable : Author(s): Partner(s) contributing : <Deliverable No.> <PU,CO,RE,PP> < WP No.> <name> Sandra Kreuzhuber, Alexander Marsalek, Andreas Reiter <name> Abstract: This is the abstract of the content of the document. This is the abstract of the content of the document. This is the abstract of the content of the document. This is the abstract of the content of the document. This is the abstract of the content of the document. This is the abstract of the content of the document. This is the abstract of the content of the document. This is the abstract of the content of the document. This is the abstract of the content of the document. This is the abstract of the content of the document. This is the abstract of the content of the document. This is the abstract of the content of the document. This is the abstract of the content of the document. Project co-funded by the European Community under the ICT Policy Support Programme Copyright by the STORK 2.0 Consortium

2 History Version Date Modification reason Modified by 0.1 Initial draft 0.9 Quality check 1.0 Final reviewed deliverable 2 P age

3 Table of contents History... 2 Table of contents Introduction Installation & Configuration of OASIS-module Build DataBase Application Server Application Deployment Installation & Configuration of Reference-Implementation Build Application Server Installation & Configuration of the Austrian implementation Application Server Conclusions P age

4 1 Introduction This document describes the installation and configuration of the OASIS-module and the reference signing solution. 4 P age

5 2 Installation & Configuration of OASIS-module This section describes the installation and configuration of the OASIS-module. The module receives OASIS-request and forwards them to the OASIS module of a different country or the local Service Provider Interface (SPI). The module needs a database and an application server to run. 2.1 Build This project is a Maven 3 project. Open a console and go to /path/to/svn/stork2/branches/wp4_signature/signature/oasis-dss/. Run the command mvn install. 2.2 DataBase It is recommend to use a MYSQL database. The name of the database needs to be configured on the application server. The further document will use stork2_signatures as database name. The project stork-database handles the database communication. If a different database name is used the persistence.xml file needs to be updated (<jta-datasource>jdbc/stork2_signatures</jta-data-source>). 2.3 Application Server Glassfish is the recommended application server, therefore the following document explains the configuration based on Glassfish Before configuring, it is necessary to add the MySQL connector s JDBC driver. The driver is available at and needs to be copied in the lib\ext folder of the used domain. The default path is glassfish3\glassfish\domains\domain1\lib\ext. We are using version of the driver. First open the Admin console (default: localhost:4848) and add a connection pool named STORK2_signatures at JDBC Connection Pools. Select javax.sql.datasource as resource and MySQL as Database driver vendor. 5 P age

6 Open General tab of the connection pool and set the DataSource Classname to com.mysql.jdbc.jdbc2.optional.mysqldatasource Open the Additional Properties tab and set the port number, databasename, servername, user and password. Now a JDBC Resource with the name and the pool STORK2_signatures needs to be added. The database connection can be tested using the Ping button at the JDBC connection pool site. 6 P age

7 # Configure the URL to the document transfer interface download_servlet_url= userdss_servlet_url= # Define the home country the DSS interface is running in home_country=de # Define forward_dss_countrycode=url to forward requests to COUNTRYCODE to the specified address forward_dss_at= forward_dss_local= # Define forward_dss_countrycode=url to forward requests to COUNTRYCODE to the specified address forward_userdss_at= forward_userdss_local= After the configuration of the database connection click on Configurations -> serverconfig -> System Properties and add an instance variable named config_oasis_dss which points to the configuration file. The following figure shows an example (test)-configuration file with only one other OASIS-module (or country) configured. This configuration file assumes that the local OASIS-DSS application will be deployed under the context root sd-dss-refpeps. 2.4 Application Deployment Click on Applications on the Glassfish Admin panel and then on Deploy. Select the oasisdss war file and set the context root name to sd-dss-ref-peps or adapt the configuration file. 7 P age

8 3 Installation & Configuration of Reference-Implementation 3.1 Build This project is a Maven 3 project. Open a console and go to /path/to/svn/stork2/branches/ wp4_signature/signature/spi-implementations/ref/. Run the command mvn install. 3.2 Application Server The reference implementation consists of three parts, the SPI implementation, the web service and the signature applet. The SPI implementation is a library that needs to be added to the OASIS-DSS applications lib folder. The web service and the signature applet need to be deployed on an application server. The applet signs the document and fetches the required document using the web service. The reference implementation is based on SD-DSS The web service needs no extra configuration. The SPI implementation needs a configuration file. Open the Glassfish Admin console and click on Configurations -> server-config -> System Properties and add an instance variable named config_signature_app_ref which points to the configuration file. The following figure shows an example test-configuration file. # Id of this SPI implementation, REQUIRED service_id=stork2_spi_test_reference_implemenation # URL that points to the signature applet applet_url= #Do not change, or adapt applet applet_signrequesturl_parameter_name=signrequesturl #URL of the GetSignRequest servlet in form # applet_signrequesturl= # URL of the website for manual signature verification VerificationAppURL= # milliseconds that indicate how long the app should poll # for a response from the signature web service # OPTIONAL, default is 4 minutes polling_duration= # ms that app should pause before polling again # OPTIONAL, default is 2000ms polling_interval=2000 The reference implementation accesses the same database as the OASIS-module, therefore no extra configuration is necessary. The java applet is based on the SD-DSS applet provided by the European Commission 1. Note: Currently there is no possibility to specify the location of the signature in case of enveloped XAdES signatures 2. 1 Visit for more information about SD-DSS. 2 See for more information on the progress of this issue. 8 P age

9 The applet requires the following applet parameters: usage: stork_sign tokentype: PKCS12, PKCS11, MSCAPI or PKCS12_TEST (uses a dummy keyfile distributed with the applet) digestalgorithm: SHA1 or SHA256 service_url: url where the SD-DSS service can be accessed, typically context path>/service You can change these parameters in the project dss-demo-webapp in the file dss-demowebapp/src/main/webapp/web-inf/jsp/signature.jsp. If you want to deploy the reference applet for signature verification set the applet parameters as follows: usage: verify tokentype: not needed digestalgorithm: not needed service_url: url where the SD-DSS service can be accessed, typically context path>/service Important: Verification currently works not with Java 7 in the browser due to some problem with the underlying SD-DSS applet 3. Note on Java 7 Security: Java 7 Update 21 brought some security changes. Therefor unsigned or self-signed Java applications will not be allowed to run on older versions (not the most recent update) of Java with the default Security level. If you modify the applet we recommend to sign the applet with a valid CA certificate and not to use self-signed certificates. Consider that also all other *.jar files that are added via the archive attribute have to be signed! If you do not modify the applet code, you can deploy a war file with the signed jar files provided in SPI- Implementations/ref/dss-src/apps/dss/demo/dss-demo-webapp-SIGNED/. For testing purposes you can set the Security level in the Java console from High (minimum recommended) to Medium. 3 See for more information. 9 P age

10 4 Installation & Configuration of the Austrian implementation 4.1 Application Server The Austrian implementation consists of two parts, the SPI implementation (project signature-app-at ) and a web service (project signature-web-at ) which embeds the Austrian Citizen Card solution. The SPI implementation has to be added as dependency to the oasis-dss project. The web service needs to be deployed on an application server. Both signature-app-at and signature-web-at need some extra configuration. Therefor open the Glassfish Admin console and click on Configurations -> server-config -> System Properties and add two system properties named config_signature_webservice_at and config_signature_app_at which point to the configuration files. The following figures show two sample configurations files. The values that are marked as bold have to be changed, if you plan on deploying the Austrian solution on your server. To enable PAdES signatures the Austrian solution uses PDF-AS 4, which requires additional configuration. A basic configuration is located at signature-app-at/src/main/resources/pdf-asdefaultconfig.zip. Extract the configuration to a location of your choice and specify the location using the config_pdf_as system property. Note: The dataurl in config_signature_webservice_at has to use SSL, otherwise the Austrian Citizen Card won t return a response. If using the Mobile Phone Signature Solution, please check that your CA s root certificate is supported by A-Trust 5. The reference implementation accesses the same database as the OASIS-module, therefore no extra configuration is necessary List of supported Root CA certificates: 10 P age

11 # application url app_url= # application context app_context=/signature-web-at # name of signature servlet signature_context=/signature # context and parameters where signature/attachment files # can be accessed filehoster_context=/getfile?reqid= # string that should be written in front of the request id # that represents the filename of the xml file with the signature, # OPTIONAL, default is "signature_" signature_file_prefix=signature_ # Url where BKU returns Signature and IdentityLink response dataurl= # Online BKU Url url_bku_online= # Mobile Phone Signature Url url_bku_mobile= # Local BKU Url url_bku_local= # milliseconds that indicate how long the webservice should poll, # in case a request has not yet been received from the SPI # OPTIONAL, default is 1 minute polling_duration=60000 # ms that webservice should pause before polling again # OPTIONAL, default is 2000ms polling_interval=2000 Figure 1: Configuration file "config_signature_web_at" 11 P age

12 # Id of this SPI implementation service_id=eu.stork.signature-app-at # Url to the signature web service web_service_url= # Servlet and param name for signing postfix_sign=/login?reqid= # milliseconds that indicate how long the app should poll # for a response from the signature web service # OPTIONAL, default is 4 minutes polling_duration= # ms that app should pause before polling again # OPTIONAL, default is 2000ms polling_interval=2000 #SOAP endpoint for verify SOAP_EndPoint= Figure 2: Configuration file "config_signature_app_at" 12 P age

13 5 Conclusions This document describes the installation and configuration of the OASIS-module and the reference signing solution. 13 P age