Infrastructure Series

Transcription

1 Infrastructure Series TechDc IBM Integratin Bus IIB Security Octber IBM Integratin Bus Security Authr(s): Glen Brumbaugh

2 Table f Cntents Intrductin... 3 Dcument Versin... 3 Security Intrductin... 4 Overview... 4 Administrative Security Setup... 5 Overview... 5 Enabling/Disabling Administrative Security... 6 Determining Access Rles... 6 Creating Lcal User IDs and Grups (Security Mde mq nly)... 8 Assigning Grup Privileges... 8 Assigning Administrative Access Using LDAP fr Authenticatin (Optinal) Using TLS fr Cmmunicatin Channels (Optinal) Default MQ Supprt fr Administrative Security SSL/TLS Security Setup Overview IIB Keystre and Truststre Files Enabling SSL/TLS Prtcl Cnfiguring IIB Keystre and Truststre Files Keystre/Truststre Creatin and Manipulatin Overview Cmmand Setup Cmmand Examples Simple Object Access Prtcl (SOAP) WS-Security Setup Overview Plicy Sets x.509 Authenticatin Tkens Binding Plicy Set Tkens Cmmand Line cmmands fr Plicy Sets & Bindings Security Prfiles BAR File Overrides Best Practices References Page 2 f 23

3 Intrductin Dcument Versin This dcument describes hw t setup security fr IBM Integratin Brker (IIB). This dcument assumes a familiarity with industry security standards such as SSL/TLS and WS-Security. These standards are cvered in depth in ther TechDcs and are nly referenced here at a high-level. The cntents f this dcument shuld be generally applicable t bth current and previus versins f IBM Integratin Bus. They have been specifically verified n the fllwing prductin versins: IBM Integratin Bus v This dcumentatin has been created and maintained by: Glen Brumbaugh This dcumentatin has been reviewed by: Glen Brumbaugh This dcumentatin was last updated: Versin 1.1 Octber 2017 Page 3 f 23

4 Security Intrductin Overview There are a number f different areas within IIB t cnfigure security. These areas include: Administrative security (e.g. Administrative Cnsle, Web Service interface, & Tlkit) HTTPS cmmunicatin level security (e.g. SSL/TLS) Message Flw security (e.g. SOAP WS-Security) Each f these security areas can be implemented independently f ne anther. In terms f pririty, IMPLEMENT ADMINISTRATIVE SECURITY FIRST. This security is relatively simple t setup and t manage. SSL/TLS transprt level (e.g. TCP) security des nt need t be setup until there are Message Flws that require this security. Nnetheless, preparatins shuld be made fr this eventuality. SSL/TLS shuld nt be cnsidered as extic, but as part f a rutine cnfiguratin. Keystres and Truststres shuld be created and cnfigured, even withut certificates. Plans shuld be made fr managing x.509 certificates. These plans shuld include: (1) Naming standards Keystre/Truststre names Certificate label names Passwrd management Certificate expiratin management Sme dcumentatin/tls shuld als be put int place fr verifying and debugging any SSL/TLS issues that will arise because they will arise; almst always at an incnvenient time. Frewarned is frearmed. Finally, WS-Security cnfiguratin will be required when Message Flws using SOAP ndes require this capability. The usage f these settings varies widely, depending upn the scpe and sphisticatin f the SOAP services in questin. Hwever, when required, this is arguably the mst cmplicated IIB security t cnfigure. Page 4 f 23

5 Administrative Security Setup Overview If Administrative Security is NOT enabled, then all users able t cnnect t the Integratin Nde (Brker) acrss the netwrk will ptentially be able t make cnfiguratin changes. Any user with desktp administratr privileges will be able t create a lcal accunt with the same name as the MQ r IIB Service Accunt. In practice, this means that many develpers can ptentially cnnect t the Brker frm their tlkits and have administrative privileges. This will bviusly nt be acceptable in mst envirnments. IIB administrative security wrks by assigning specific IIB privileges. These privileges (listed in Table 3) are assigned t an IIB Rle. This Rle can either be maintained internally by IIB r be assciated with a lcal User ID and Grup. All User IDs requiring administrative access are defined t the Brker and assciated with a Rle. Once this security has been enabled, users attempting t cnnect t the Brker thrugh either a Tlkit, a Web UI URL, r the assciated REST Web Services will have t authenticate themselves with bth a User ID and a passwrd. These User ID/passwrd cmbinatins can be stred and authenticated either within Brker itself r via LDAP. There are a number f steps required t implement IIB Administrative security. These steps are: 1) Enable IIB Administrative security Enable security fr the brker (Integratin Nde) - mqsichangeauthmde -s active Cnfigure security fr either MQ r File mde - mqsichangeauthmde -m mq file 2) Determine the necessary access Rles 3) Define lcal Operating System Users and Grups (if Security Mde is mq ) Define a lcal OS Grup fr each rle Define a lcal OS User ID fr each rle and add the User ID t the Grup 4) Assign access privileges t the apprpriate MQ queues r IIB Rles fr each Rle setmqaut -m qmgrname -t queue -n SYSTEM.BROKER.AUTH -r lcalrlegrup mqsichangefileauth brkername [-e egname ] -r rlename -p permissins 5) Assciate Glbal User IDs with a Rle mqsiwebuseradmin brker -c -r rle -u user -a passwrd mqsiwebuseradmin brker -c -r rle -u user -x (IIB authenticatin) (LDAP authenticatin) 6) Cnfigure the Brker LDAP cnnectin (if LDAP authenticatin used) mqsichangeprperties brkername -b webadmin - server -n ldapauthenticatinuri -v ldap://dns:prt/=ibm,u=gts?cn?sub mqsisetdbparms brkername -n ldap::servername -u ldapuserid -a passwrd These steps are illustrated in Figure 1. Each f these steps is described in mre detail in ne f the fllwing Sectins. Page 5 f 23

6 Figure 1 - Administrative Access Cnfiguratin Steps Enabling/Disabling Administrative Security Administrative Security must be explicitly enabled. Security can nly be changed when the Brker is stpped. T change the Administrative Security mde, the fllwing cmmands must be executed: mqsistp brkername mqsichangeauthmde brkername -s active -m mq -s (set) Administrative Security mde t active (n) r inactive (ff). -m (mde) is mq (IBM MQ) r file (File system) based security. Use mq, if available. mqsistart brkername mqsireprtauthmde brkername Determining Access Rles The permissins, and the Queues r Rles that hld thse permissins, are illustrated in Table 3 (shwn belw). As can be seen frm Table 3, there are three different kinds f access that may be granted. These access privileges are summarized in Table 1. IIB Administratrs will require all three types f access. Prductin Supprt r Operatrs might require Display and Start/Stp privileges. Sftware develpers supprting Prductin prcesses might require Display privileges. While there are seven pssible cmbinatins, nly sme f these cmbinatins are nrmally used fr business rles. These basic rles are summarized in Table 2. Page 6 f 23

7 Nte: The lwest privilege that can be specified (+inq / read+) allws sme administrative access! Refer t the References Sectin fr the URL relating IIB cmmands t their assciated privileges. Table 1 - Administrative Privileges Access Rle Type MQ Attribute File Attribute Display Brker settings View & Cntrl +inq read+ Change Brker settings/bjects Administratin +put write+ Start/Stp Brker cmpnents Operatinal +set execute+ Table 2 - Security Rles, Users, and Grups Rle Lcal User Lcal Grup MQ Attributes File Attributes IIB Administratr IIBAdmin IIBAdmin +inq +put +set read+ write+ execute+ All Queues All IIB cmpnents IIB Deplyment IIBDeply IIBDeply +inq (Brker) read+ (Brker) +put (all E.G.) write+ (all E.G.) IIB Operatins IIBOps IIBOps +inq +set read+ execute+ All Queues All IIB cmpnents Prductin Supprt IIBSupprt IIBSupprt +inq read+ All Queues All IIB cmpnents Area Permissin Queue Brker E.G. D.C. Read Create Delete Mdify Start Stp Read Create Delete Mdify Start Stp Table 3 Security Permissin Settings in IIB Cmmands SYSTEM.BROKER.AUTH SYSTEM.BROKER.AUTH. ExecutinGrup Queue Permissin +INQ +PUT +SET +INQ +PUT +SET Cmmand Parameter MessageBrker MessageBrker & -e ExecutinGrup Cmmand Permissin read+ write+ execute+ read+ write+ execute+ READ +INQ MessageBrker read+ SYSTEM.BROKER.DC. & REPLAY AUTH +SET execute+ - DataCapture Page 7 f 23

8 Creating Lcal User IDs and Grups (Security Mde mq nly) IIB uses bth lcal Operating System User IDs and Grups as cntainers fr specifying administrative privileges. Bth a lcal User ID and its crrespnding Grup are assciated with a Rle. Access privileges are granted t the lcal Grup assciated with the Rle. Users, either lcally r glbally defined, requiring Administrative access are assciated t the User ID assciated with the Rle (See Sectin Assigning Administrative Access ). The use f lcal Operating System User IDs and Grups allws IIB t specify Brker administrative privileges separately by server. Within a server (physical r virtual), access can further be cntrlled by Brker (Integratin Nde) r by Executin Grup (Integratin Server) simply be assciating Brkers r Executin Grups with different Rle names. This mechanism als prevents Operating System r LDAP administratrs frm directly granting access t Brker resurces thrugh Grup memberships. Only the IIB administratrs can directly grant administrative access t IIB. Lcal Operating System Rle Grups A lcal Operating System Grup used fr a Rle shuld have nly ne member, the lcal User ID assciated with the same Rle. Administrative users are assciated with a Rle User ID, nt the Grup. The nly purpse f this Grup is t hld (e.g. cntain ) the privileges f the rle it is assciated with. Nte: MQ nly assciates privileges with Grups, nt with User IDs! Lcal Operating System Rle User IDs A lcal Operating System User ID used fr a Rle shuld, if pssible, nt have Lg On privileges. This User ID is a member f the Grup assciated with the same Rle. Its nly functin is t supprt a mapping between a real User ID needing Administrative privileges and itself. This mapping allws Brker access t be determined internally within the Brker rather than externally thrugh Operating System grup membership. Assigning Grup Privileges There are three areas t which permissins may be granted. The permissins fr each f these areas are stred in a different Queue r IIB Rle. The areas are: Integratin Nde administratin (i.e. Message Brkers) Integratin Server administratin (i.e. Executin Grups) Data Capture bjects (i.e. Recrd / Replay capability) The access permissins that may be granted t these areas are: Read Create, Delete, Mdify Start, Stp Replay (Data Capture bjects nly) Fr a Security Mde f mq, lcal Operating System Grups supprting administrative Rles must be granted the apprpriate access (see Sectin Determining Access Rles ). Fr a Security mde f file, IIB Rles must be granted the apprpriate access. Hw this access is granted depends upn the Security Mde was selected. The necessary permissins t be granted are shwn in Table 3. T determine which cmmands require which privileges, the fllwing IBM Knwledge Center reference shuld be cnsulted: Page 8 f 23

9 3540_.htm Nte: Executin Grup (Integratin Server) level privileges are NOT inherited frm being granted Brker (Integratin Nde) level privileges! Executin Grup level privileges must still be granted. Assigning MQ permissins MQ permissins are nly used if Administrative Security has been enabled and the Security Mde has been set t mq. Fr a Security Mde f mq, a lcal User ID will represent the Rle while a lcal Grup cntaining the User ID will cntain the MQ privileges. MQ permissins are assciated with a specific queue. Each Brker (Integratin Nde) has ne r mre SYSTEM.BROKER.AUTH queues that cntain privileges. The fllwing queues are assciated with these privileges: SYSTEM.BROKER.AUTH (Brker privileges) SYSTEM.BROKER.AUTH. executingrupname (Executin Grup privileges) SYSTEM.BROKER.DC.AUTH (Brker Data Capture privileges) Privileges can be assciated with the AUTH queues using standard MQ cmmands. Tw different cmmands can be used. These cmmands are: setmqaut -m qmgr -t queue -n SYSTEM.BROKER -g grup +inq (Cmmand Line) SET AUTHREC PROFILE(SYSTEM.BROKER ) OBJTYPE(QUEUE) GROUP(grup) AUTHADD(INQ ) (MQSC Script) Here are sme ntes regarding the permissins that may be set r unset n the SYSTEM.BROKER queues: Multiple permissins may be set n a single line: Space separated list fr setmqaut. Cmma separated list fr SET AUTHREC. setmqaut cmmand ptins: Permissins may be added ( + ) r remved ( - ). These permissin indicatrs are prefix. The fllwing permissins may be used: all, inq, put, and set. Example (Add all permissins): -all +inq +put +set SET AUTHREC cmmand ptins: Permissins may be added ( AUTHADD ) r remved ( AUTHRMV ). The fllwing permissins may be used: all, inq, put, and set. Example (Add all permissins): AUTHRMV(all) AUTHADD(inq,put,set) T display the permissins that have been granted t a queue fr a specific grup, the fllwing cmmands may be executed: dspmqaut -m qmgr -t queue -n SYSTEM.BROKER. -g grup (Cmmand Line) DISPLAY AUTHREC PROFILE(SYSTEM.BROKER ) OBJTYPE(QUEUE) GROUP(grup) (MQSC Script) Assigning IIB Rle permissins IIB Rle permissins are nly used if Administrative Security has been enabled and the Security Mde has been set t file. Fr a Security Mde f file, IIB will internally cntain the Rles and Page 9 f 23

10 the privileges assciated with them. Rles are defined and privileges are assciated with thse Rles thrugh the fllwing cmmands: mqsichangefileauth brker -r rle -p +inq mqsichangefileauth brker -r rlegrup -e egname -p read+ mqsichangefileauth brker - r rlegrup - DataCapture -p read+ (Brker) (Executin Grup) (Data Capture) Here are sme ntes regarding the permissins that may be set r remved fr IIB rles: Multiple permissins may be set n a single line (space separated list). Permissins may be added ( + ) r remved ( - ). These permissin indicatrs are pstfix. The fllwing permissins may be used: all, read, write, and execute. Example (Add all permissins): all- read+ write+ execute+ Existing rles and permissins can be displayed using the fllwing cmmands: mqsireprtfileauth brker -r mqsireprtfileauth brker -e executingrup mqsireprtfileauth brker - DataCapture (Brker permissins) (Executin Grup permissins) (Data Capture permissins) -r rle -l (List permissins fr a Rle) (List permissins fr all Rles) Nte: The -r and -l parameters are mutually exclusive Assigning Administrative Access Once either lcal User IDs and Grups have been setup and permissins assigned (Security Mde mq ) r Rles and their permissins have been created (Security Mde file ), administrative users must be assciated with these bjects. Fr a Security Mde f mq, an administrative user must be assciated with a rle equal t a lcal User ID. Fr a Security Mde f file, an administrative user must be assciated with a rle equal t an IIB defined rle. Fr bth Security Mdes, the cmmands t manage administrative users are the same (mqsiwebuseradmin). This cmmand has fur different functins, as fllws: mqsiwebuseradmin mqsiwebuseradmin mqsiwebuseradmin mqsiwebuseradmin brkername brkername brkername brkername c m d l (Create a new Administrative user) (Mdify an existing Administrative user) (Delete an existing Administrative user) (List Administrative users) The administrative User Id and the Rle that the user is t be assciated with are defined by the fllwing cmmand parameters: mqsiwebuseradmin brkername -r rle mqsiwebuseradmin brkername -u userid (Specify the Rle ) (Specify the Administrative User ID) The authenticatin mechanism t be used fr authenticating the User ID is defined by the fllwing cmmand parameters: mqsiwebuseradmin brkername -a passwd mqsiwebuseradmin brkername -x Page 10 f 23 (Brker authenticated passwrd) (LDAP authenticated passwrd)

11 Using LDAP fr Authenticatin (Optinal) If LDAP has been chsen fr administrative User ID authenticatin (via the -x parameter f the mqsiwebuseradmin cmmand), then the Brker must be cnfigured t cmmunicate with the LDAP server and be prvided with the apprpriate credentials. The Brker can be cnfigured t either use brker default LDAP credentials r specific credentials fr the specific LDAP server. The LDAP cnnectin can als be cnfigured t use SSL/TLS certificates. The cmmands t perfrm this cnfiguratin are as fllws: mqsichangeprperties brker -b webadmin - server -n ldapauthenticatinuri -v ldap://dns:prt/=ibm,u=gts?cn?sub (HTTP) -n ldapauthenticatinuri -v ldaps://dns:prt/=ibm,u=gts? cn?sub (HTTPS) mqsisetdbparms brker -u userid -p passwrd -n ldap::ldap (Default LDAP credentials) -n ldap:: ldapserverdns (LDAP server credentials) Using TLS fr Cmmunicatin Channels (Optinal) If SSL/TLS cmmunicatins are required fr the administrative channels, then SSL/TLS will have t be enabled. Once this is enabled, standard PKI prcessing will be required. See Sectin Keystre/Truststre Creatin and Manipulatin fr further details n this prcess. The cmmand t require SSL/TLS fr administrative cnnectins is as fllws: mqsichangeprperties brker -b webadmin - server -n enablessl -v true Default MQ Supprt fr Administrative Security The SYSTEM.BROKER queues are created by IIB cmmands. When IIB administrative security is enabled, the queues described belw are autmatically created (if the User ID issuing the IIB cmmand is als in the mqm grup). When these queues are first created, permissins are granted t the mqbrkrs grup. The queues that define the security, and their default permissins, are as fllws: SYSTEM.BROKER.AUTH inq, put, and set permissins granted t mqbrkrs grup. SYSTEM.BROKER.AUTH.ExecutinGrup Alias queue pinting t the SYSTEM.BROKER.AUTH queue. inq, put, and set permissins granted t mqbrkrs grup. SYSTEM.BROKER.DC.AUTH inq, put, and set permissins granted t mqbrkrs grup. Used fr Recrd/Replay capability. Page 11 f 23

12 SSL/TLS Security Setup Overview An IIB Public Key Infrastructure (PKI) slutin requires multiple steps. These steps are: Create any necessary Keystre and Truststre JKS files (Nt cvered in this dcument). Obtain ne r mre Persnal Certificates (CA r Self-signed) (Als nt cvered). Lad the apprpriate Signer certificates int the Truststre/Keystre (Als nt cvered). Lad the Persnal certificate int the Keystre (Als nt cvered). Cnfigure the Integratin Nde t use SSL/TLS (Cvered in this Sectin). Cnfigure, if necessary, the Integratin Server(s) t use SSL/TLS (Cvered in this Sectin). IIB Keystre and Truststre Files Befre a PKI slutin (e.g. x.509 certificates) can be used, a Persnal Certificate fr the Integratin Nde r Integratin Server must be laded int a Keystre file. This Persnal Certificate must cntain bth the Public prtin f the Certificate t be used as well as the Private Key assciated with that certificate. The CA (Certificate Authrity) signers f the Persnal Certificate shuld als be stred. These may either be stred in the same r a different file. All IIIB certificate stre files must use the JKS (Java Key Stre) file frmat. IIB allws certificates t be separated by type. A Keystre file must stre the Persnal Certificate fr the Nde r Server. The CA Signer certificates, actually the public prtins f thse certificates, may als be stred in the Keystre file. In this case, there will nly be ne assciated file string certificates. The CA Signer certificates may ptinally be stred in a separate Truststre file. In this case, there will be tw files string certificates: a Keystre file string Persnal Certificates (with their assciated private keys) and a Truststre file cntaining CA Signer Certificates (withut any private keys). IIB supprts bth appraches. If a Truststre file is used, it must be specified in a manner similar t the way in which a Keystre file is specified. See the Sectin belw fr details. IIB can specify bth Keystre and Truststre files at three different levels: Integratin Nde (Message Brker) Default settings Integratin Nde (Message Brker) Override settings Integratin Server (Executin Grup) Override settings Enabling SSL/TLS Prtcl The usage f x.509 certificates fr either the Secure Scket Layer (SSL) r the Transprt Layer Security (TLS) must be enabled at the IIB Listener level. Nte that the newer TLS prtcl is the default selectin, the lder SSL prtcl must be specifically cnfigured in rder t be used. The SSL shuld nly be specifically enabled if an lder, and less secure, certificate must be used. All current certificates are under the TLS prtcl. The HTTP Listener in questin may either be at the Integratin Nde (aka Message Brker) r the Integratin Server (aka Executin Grup) level, depending upn where the SSL/TLS is t be used. The cmmands t enable x.509 certificate usage are as fllws: All Listeners mqsichangeprperties brkername -b httplistener HTTPListener (Enable SSL/TLS) Page 12 f 23

13 -n enablesslcnnectr -v true Integratin Nde (Message Brker) Listener Cnfiguratin mqsichangeprperties brkername -b httplistener HTTPSCnnectr -n prt -v 7083 (Set Brker SSL prt) mqsichangeprperties brkername -b httplistener HTTPSCnnectr -n clientauth -v true (Enable client authenticatin) Integratin Server (Executin Grup) Listener Cnfiguratin mqsichangeprperties brkername -e integratinservername ExecutinGrup -n sapndesuseembeddedlistener -v true (Enable SOAP Listener) mqsichangeprperties brkername -e integratinservername ExecutinGrup -n httpndesuseembeddedlistener -v true (Enable HTTP Listener) mqsichangeprperties brkername -e integratinservername HTTPSCnnectr -n prt -v 7083 (Set Brker SSL prt) mqsichangeprperties brkername -e integratinservername HTTPSCnnectr -n clientauth -v true (Enable client authenticatin) mqsichangeprperties brkername -e integratinservername HTTPSCnnectr -n sslprtcl -v SSL (Use the lder SSL prtcl) Nte: Either the Integratin Nde (Brker), the Integratin Server (Executin Grup), r bth will need t be restarted whenever any f these cnfiguratin changes are made t ne f these tw cmpnents. Cnfiguring IIB Keystre and Truststre Files Befre a PKI (e.g. x.509 certificates) can be used, the Integratin Nde (Message Brker) may need t be cnfigured fr the lcatin f the Key and Trust stre files. This cnfiguratin is accmplished using the fllwing cmmands: Default (Brker & Executin Grups) PKI Cnfiguratin Settings mqsireprtprperties brkername BrkerRegistry -r (Display SSL/TLS defaults) mqsichangeprperties brkername BrkerRegistry -r n brkerkeystrefile -v \path\filename.jks (Set Default Keystre lcatin) mqsisetdbparms brkername -n BrkerKeystre::passwrd (Default Keystre passwrd) Page 13 f 23

14 -u ignre -p keystrepasswrd mqsichangeprperties brkername (Set Truststre lcatin) BrkerRegistry -r n brkertruststrefile -v \path\filename.jks mqsisetdbparms brkername (Default Truststre passwrd) -n BrkerTruststre::passwrd -u ignre -p keystrepasswrd Integratin Nde (Message Brker) PKI Cnfiguratin Override Settings mqsireprtprperties brkername (Display SSL/TLS cnfiguratin) -b httplistener HTTPSCnnectr -a mqsichangeprperties brkername (Set Key stre file lcatin) -b httplistener HTTPSCnnectr -n keystrefile -v \path\filename.jks mqsichangeprperties brkername (Set Key stre passwrd) -b httplistener HTTPSCnnectr -n keystrepass -v passwrd mqsichangeprperties brkername (Set Trust stre file lcatin) -b httplistener HTTPSCnnectr -n truststrefile -v \path\filename.jks mqsichangeprperties brkername (Set Trust stre passwrd) -b httplistener HTTPSCnnectr -n truststrefile -v passwrd Integratin Server (Executin Grup) PKI Cnfiguratin Override Settings mqsireprtprperties brkername (Display SSL/TLS cnfiguratin) -e integratinservername CmIbmJVMManager -r mqsichangeprperties brkername (Set Key stre file lcatin) -e integratinservername CmIbmJVMManager -n keystrefile -v \path\filename.jks mqsichangeprperties brkername (Link Key stre passwrd) -e integratinservername CmIbmJVMManager -n keystrepass -v dbparmnamekeystre::passwrd mqsisetdbparms brkername (Define Key stre passwrd) -n dbparmnamekeystre::passwrd -u ignre -p keystrepasswrd mqsichangeprperties brkername (Trust Key stre file lcatin) -e integratinservername CmIbmJVMManager -n truststrefile -v \path\filename.jks mqsichangeprperties brkername (Link Trust stre passwrd) Page 14 f 23

15 -e integratinservername CmIbmJVMManager -n truststrepass -v dbparmnametruststre::passwrd mqsisetdbparms brkername (Define Trust stre passwrd) -n dbparmnametruststre::passwrd -u ignre -p keystrepasswrd Nte that bth the Integratin Nde (Brker) and Integratin Server (Executin Grup) must be restarted after any changes are made fr PKI cnfiguratin. Page 15 f 23

16 Keystre/Truststre Creatin and Manipulatin Overview X.509 Persnal certificates (Public certificate + Private Key) and CA Signer certificates (Public certificate nly) are stred in files. These files are called Keystre and Truststre files. A Truststre file is ptinal in IIB and, if present, nly cntains CA Signer certificates. A Keystre file is always required in IIB and will cntain the Persnal certificate fr the Brker. If there is n Truststre file present, the Keystre file will als cntain the CA Signer certificates. Nte that the CA Signer certificates mentined include bth the Signer fr the Persnal certificate as well as all ther Signer certificates required t validate freign certificates presented t IIB. While there are multiple industry standard frmats fr Keystre/Truststre files, IIB nly supprts JKS (Java Key Stre) frmatted files. There are multiple tls available t create and maintain Keystre/Truststre files. This dcument nly refers t the IBM tl supplied with IIB. This tl is the IBM Glbal Security (GSKit). Cmmand Setup T setup the GSKit cmmand line envirnment, the Envirnment variable JAVA_HOME must be set t pint t the apprpriate IIB Java Runtime Envirnment (JRE). Fr example, n Windws execute the fllwing cmmand: set JAVA_HOME=C:\Prgram File\IBM\IIB\ x\cmmn\jdk\jre Cmmand Examples See the SSL/TLS TechDc fr cmplete certificate management cmmand examples. What fllws is a shrt summary f the cmmands that may need t be executed: Build the JKS Keystre and Truststre files fr the Integratin Nde gsk7cmd -keydb -create -type jks -db ndenamedefaultkeystre.jks -pw passwrd gsk7cmd -keydb -create -type jks -db ndenamedefaulttruststre.jks -pw passwrd Nte that the file names chsen clearly indicate what the certificate stre is t be used fr. Creating a self-signed certificate gsk7cmd -cert -create -label ndename -db ndenamedefaultkeystre.jks -pw passwrd -dn CN=hstname,O=yurCmpany,OU=yurDivisin,L=yurCity,C=US Nte that this self-signed Persnal certificate is created and stred in the Keystre file. Request a persnal certificate gsk7cmd -certreq -create -label ndename -file csrfilename -size db ndenamedefaultkeystre.jks -pw passwrd -dn CN=hstname,O=yurCmpany,OU=yurDivisin,L=yurCity,C=US Nte that the Certificate Signing Request (CSR) is generated in the Keystre. The -file parameter specifies the file cntaining the CSR t be sent t the Certificate Authrity. Nte that the 2048 key length is the currently accepted minimum key length. Page 16 f 23

17 Extract the Public Prtin f a certificate (e.g. a self-signed certificate) gsk7cmd -cert -extract -label ndename -target certificatefilename -frmat ascii -db ndenamedefaultkeystre.jks -pw passwrd Nte that the certificate is extracted frm the Keystre file. Fr a self-signed certificate, this will represent the Signer certificate. The -target parameter specifies the file that will cntain the extracted certificate. Adding the certificate returned by a CA in respnse t a CSR gsk7cmd -cert -receive -label ndename -file certificatefilename -frmat ascii -db ndenamedefaulttruststre.jks -pw passwrd Nte that the certificate is received int the Keystre file. Nte that the -label parameter must match the CSR request label. The -file parameter specifies the file cntaining the certificate returned by the CA. This prcess will merge the certificate with its stred private key. Thus, this step can nly executed against the keystre that generated the CSR! Any necessary CA Signer certificates shuld first be added t the Truststre. Sign yur wn CSR Request gsk7cmd -cert -sign -label ndename -expire 365 -frmat ascii -file csrfilename -target certificatefilename -db ndenamedefaulttruststre.jks -pw passwrd Nte that the certificate is signed in the Keystre file. Nte that the -label parameter must match the CSR request label. The -file parameter specifies the file cntaining the CSR request. The -target parameter specifies the utput file cntaining the Signer f the certificate. The -expire parameter specifies the number f days until the certificate expires. This prcess will merge the certificate with its stred private key. Thus, this step can nly executed against the keystre that generated the CSR! Adding a Signer certificate t the Truststre gsk7cmd -cert -add -label cacertname -file certificatefilename -frmat ascii -db ndenamedefaulttruststre.jks -pw passwrd Nte that the certificate is added t the Truststre file. The -file parameter specifies the file cntaining the Signer certificate. Fr a self-signed certificate, this will represent the extracted certificate. Nte that mst Certificate Authrities will have a chain f Signers. Add frm the rt dwn. Page 17 f 23

18 Simple Object Access Prtcl (SOAP) WS-Security Setup Overview Implementing the WS-Security requirements fr the SOAP ndes can be fairly cmplex. This dcument des nt cver WS-Security in detail, but rather specifies the IIB cnfiguratin requirements fr setting up that security. Typically, crdinatin between the develper(s) and the administratr(s) is required t ensure that all business requirements are met and that the IIB Service is cfingured crrectly. Cnfiguring WS-Security requires a number f steps. These steps are summarized belw: 1. Create a Plicy Set t define the types f tkens used fr identificatin. Specify Identificatin tkens and tken types Assign any desired IIB internal name t the tken. Specify whether this is an inbund Request r an utbund Respnse flw. Specify the WS-Security versin (1.0 r 1.1). Nte: A Plicy Set is an IIB Cnfigurable Service. 2. Create a Plicy Set Binding t bind the types f tkens t actual resurces. Link the Plicy Set Binding t a specific Plicy Set. Specify whether this binding is fr Prvider r Cnsumer ndes. Bind each tken identified in the assciated Plicy Set. Fr example, binding an x.509 tken t an actual Keystre certificate. Fr certificates, the Key Name field is the cert s Distinguished Name. CN=cmmanName,O=rganizatin, Fr certificates, the Key Alias field is the Keystre label. Nte: A Plicy Set Binding is an IIB Cnfigurable Service. 3. Create a Security Prfile t define hw the Plicy Set prcessing will be implemented. Basic Authenticatin (User ID & Passwrd). LDAP. Nte: A Security Prfile is an IIB Cnfigurable Service. 4. Override Message Flw BAR file prperty t link the Message Flw with a Security Prfile. 5. Deply the Message Flw. Plicy Sets IIB Plicy Sets define the number and type f tkens used fr identificatin. T cnfigure a Plicy Set thrugh the IIB Tlkit: Right click n an Integratin Nde (Message Brker) and select Open Plicy Sets. Select Plicy Sets in the navigatr panel. Press the Add buttn t create a new Plicy Set (under the Plicy Sets tree). Select the newly created Plicy Set in the Plicy Sets tree. Specify whether this is an inbund Request r an utbund Respnse flw. Specify the WS-Security versin (1.0 r 1.1). Press the Add WS-Security buttn. Expand the WS-Security flder within the new Plicy Set. Select the Authenticatin Tkens flder within the WS-Security flder. Add the apprpriate tkens. Page 18 f 23

19 Nte: The types f tkens will be identified by the applicatin develper(s). Nte: The names f the tkens are used internally by IIB t bind the tkens. Nte: The Tken Names are linked t a resurce thrugh the Bindings panel. Since a Plicy Set is a cnfigurable service, nce a Plicy Set has been created, it may be displayed frm the cmmand line. Use the fllwing cmmand t display infrmatin abut a Plicy Set: mqsireprtprperties brkername -c PlicySets - plicysetname -r x.509 Authenticatin Tkens If x.509 certificates are used fr authenticatin, the Persnal Certificate used may itself be passwrd prtected (in additin t the Keystre passwrd). In this case, IIB must be cnfigured t be able t read the Persnal Certificate. This is enabled thrugh the fllwing cmmand: mqsisetdbparms integratinndename -n brkernametruststre ::keypass::aliasname -u anyuserid -p passwrd The -u User ID is ignred, and is nt used t access the Keystre. Any string may be used. The -p parameter specifies the passwrd fr the certificated labeled aliasname. Binding Plicy Set Tkens IIB Plicy Set Bindings map the tkens defined in a Plicy Set t actual IIB Resurces (e.g. x.509 certificates). T cnfigure a Plicy Set Binding thrugh the IIB Tlkit: Right click n an Integratin Nde (Message Brker) and select Open Plicy Sets. Select Plicy Set Bindings in the navigatr panel. Press the Add buttn t create a new Plicy Set Binding (under the tree). Select the newly created Plicy Set Binding in the Plicy Set Bindings tree. Set the Plicy Set that this Bindings is t be assciated with. Select Prvider radi buttn fr Input type ndes. Select Cnsumer radi buttn fr Request type ndes. Expand the WS-Security prtin f the tree. Select the Authenticatin Tkens flder within the WS-Security flder. Set the cnfiguratin data fr the necessary tkens. The binding fields required depend upn bth Plicy Set and the Binding cmbinatin: Request / Cnsumer Request / Prvider Respnse / Cnsumer Respnse / Prvider See the References Sectin fr the URL t the Bindings Fields table. Fr UserName tkens, select whether timestamps and nnces are required. Fr Certificate tkens, the Key Name field is the cert s DN field. DN Distinguished Name field. CN=cmmanName,O=rganizatin, Fr Certificate tkens, the Key Alias field is the Keystre label. Since a Plicy Set Binding is als a cnfigurable service, nce a Plicy Set Binding has been created, it may be displayed frm the cmmand line. Use the fllwing cmmand t display infrmatin abut a Plicy Set: mqsireprtprperties brkername -c PlicySetBindings - bindingname -r Page 19 f 23

20 Cmmand Line cmmands fr Plicy Sets & Bindings Since bth Plicy Sets and Plicy Set Bindings are IIB cnfigurable services, they can be mdified and displayed thrugh the cmmand line. The cmmands t manipulate these services are as fllws: mqsicreatecnfigurableservice brkername -c PlicySets - plicysetname mqsicreatecnfigurableservice brkername -c PlicySetBindings - bindingname mqsicreatechangeprperties brkername -c PlicySets - plicysetname -n ws-security -p /path/bindingsfile.xml mqsicreatechangeprperties brkername -c PlicySetBindings - bindingname -n ws-security -p /path/bindingsfile.xml mqsicreatechangeprperties brkername -c PlicySetBindings - bindingname -n assciatedplicyset -p plicysetname Security Prfiles IIB Security Prfiles define hw the type f authenticatin/authrizatin prcessing that will be perfrmed in SecurityPEP ndes and security enabled input and utput ndes will be handled (e.g. LDAP). Security Prfiles are als IIB cnfigurable services. These definitins separate the security implementatin frm the Message Flw design. Security Prfiles must be created prir t the deplyment f the Message Flw and are used at runtime by the IIB Security Manager. Message Flws are assciated with Security Prfiles thrugh BAR file verrides ( Security Prfile prperty). Security Prfiles can be created using the fllwing cmmands: mqsicreatecnfigurableservice brkername -c SecurityPrfiles - LDAP1 -n authenticatin,authrizatin,prpagatin -v LDAP,LDAP,TRUE mqsicreatecnfigurableservice brkername -c SecurityPrfiles - LDAP1 -n authenticatincnfig -v ldap://hstname:prt/cn= mqsicreatecnfigurableservice brkername -c SecurityPrfiles - LDAP1 -n authrizatincnfig -v ldap://hstname:prt/cn= mqsireprtprperties brkername -c SecurityPrfiles - LDAP1 -r BAR File Overrides IIB Security Prfiles define the type f prcessing that will be perfrmed in SecurityPEP ndes and security enabled input and utput ndes. Security Prfiles are created prir t the deplyment f the Message Flw and are used at runtime by the IIB Security Manager. Message Flws are assciated with Security Prfiles thrugh BAR file verrides ( Security Prfile prperty). mqsiapplybarverride -b barfilename - utputfilename [-k applicatinname] -m flwname#ndename.securityprfilename=ldap Page 20 f 23

21 Best Practices Administrative Security: Implement Administrative Security fr all supprted Integratin Ndes. Create Operatinal rles t allw activities such as BAR file deplyments. BAR file deplyments require read access t the Brker (Integratin Nde) and write access t the Executin Grup (Integratin Server). Lcal Users & Grups: The nly purpse f the lcal Operating System Users and Grups assciated with Administrative Rles is t define thse Rles. Keep the User ID and Grup names as similar as pssible fr ease f use. Sme Operating Systems, such as Windws, will nt permit identical names, s slight mdificatins (such as an s at the end f the Grup name) may be required. SSL/TLS: Prepare fr x.509 certificate management befre the need becmes urgent. There is a learning curve invlved and many failure pints. Errr messages and diagnstics are frequently misleading. Early experimentatin and knwledge acquisitin are keys t success. Passwrds: Bth keep yur passwrds secure and stred in a lcatin where they wn t be frgtten. SSL/TLS can result in a large number f passwrds t maintain. Sme srt f enterprise maintained Passwrd Safe sftware is an ideal slutin. The lss f these passwrds can be very burdensme. Als nte that sme f the cnfiguratin cmmands require these passwrds. The passwrds shuld NOT be embedded in a cnfiguratin script. DB Parm Names: Since there may be a separate Keystre and Truststre defined fr each Integratin Server (Executin Grup), there may be a number f DB Parameter entries. Each ne f these entries will have a name. Since this is where the passwrds fr the Integratin Servers will be stred, the name f the parameter shuld reflect where the Keystre/Truststre passwrd is used. Nte that the same stre may be used by multiple Integratin Servers! Als nte that there may be different entries fr the Keystres and Truststres. A recmmended naming cnventin might be similar t: integratinservernamekeystre integratinservernametruststre AllKeys r AllTrusts (Fr stres used by multiple Servers) Page 21 f 23

22 References IBM Knwledge Center IIB 10.0 Administratin Security Overview _.htm IBM Knwledge Center IIB 10.0 Cnfiguring Administrative Security _.htm IBM Knwledge Center IIB 10.0 MQ Queue/File System Attribute Cmmand mapping _.htm IBM Knwledge Center IIB 10.0 MQ Queue/File System Permissin Security mapping _.htm IBM Knwledge Center IIB 10.0 MQ Queue Permissins Security mapping _.htm IBM Knwledge Center IIB 10.0 IIB Cmmands and their required Permissins _.htm IBM Knwledge Center IIB 10.0 Rle-based Security _.htm IBM Knwledge Center IIB 10.0 PKI Setup (Keystre & IIB Cnfiguratin Cmmands) _.htm#ap34020_60 IBM Knwledge Center IIB 10.0 Securing Message Flws using SSL (Message Flw Ndes) _.htm IBM develperwrks Managing Certificates with IBM GSKit MQ Technical Cnference 2014 SSL/TLS Intrductin A_User_Perspective.pdf MQ Technical Cnference 2015 Certificate Management TLS_Using_and_Managing_Certificates.pdf Page 22 f 23

23 IBM Knwledge Center IIB 10.0 Message Flw Security (WS-Security) _.htm IBM Knwledge Center IIB 10.0 Hw IIB Cmplies with WS-Security (Fr the Develpers) _.htm IBM Knwledge Center IIB 10.0 Implementing WS-Security (Fr the Administratr) _.htm IBM Knwledge Center IIB 10.0 Implementing WS-Security required Binding Fields ab60190_.htm Page 23 f 23