DOCUMENT DESCRIPTION...

Transcription

1

2 Contents 1 DOCUMENT DESCRIPTION OVERVIEW GLOSSARY PREREQUISITES CONFIGURATION CREATE WEBLOGIC DOMAIN CONFIGURE WEBLOGIC MANAGED DOMAIN INSTALLATION AND DEPLOYMENT OF THE WEB SERVICE OPENSSL INSTALLATION GENERATING CERTIFICATES AND TRUSTS CONFIGURING WEBLOGIC TO REFERENCE THE NEW SERVER IDENTITY AND TRUST KEYSTORES ADDING HTTPS TO THE WEB SERVICE... 30

3 700 Civic Center Drive West 1 Document Description 1.1 Overview The Superior Court of California, County of Orange (SCOC, or the Court) Court Technology Services (CTS) in association with the Orange County Department of Probation (Probation) under the supervision of the Global Justice Information Sharing Initiative has been conscripted to create a proof of concept of the Global Federated Identity and Privilege Management (GFIPM) security technology using the Oracle Middleware product suite. In this proof of concept the Court will use Oracle WebLogic Server (WLS), and Oracle Database (ODB) to establish a service to service trust between The Court and Probation. The trust will use SSL and using the National Information Exchange Mode (NIEM). eprobation shall enable the electronic filing (e-filing) of Petitions for formal Probation Violations. Once approved the petition shall be pushed to the SCOC Filenet Imaging Repository (P8) and the appropriate docket codes shall be entered into the Court s criminal case management system (Vision). For more details on the project, please refer to the Court s eprobation Functional Requirements and Design Document. For the technical details of the project (Validation rules, specifics on the SOAP service design and configuration, etc.) please refer to the eprobation Technical Requirements and Design Document. The table below describes the steps to setting up a web server using the WLS and how these correlate with GFIPM requirements. 1.2 Glossary The table describes the terms used in the document: Term Field Drop-down Check box Radio button Table Column Row Cell Button Path OAS ODB OCA GFIPM Permission Policy SSPI XACML Description A field describes an area in which a user can enter information A drop-down describes a box which allows the user to choose from a list of selections A check box allows you to select multiple items in a list A radio button allows you to select a single item from a list A table is a group of data organized into columns, rows and cells A column is a vertical list of information usually used to describe cell type A row is a horizontal list of information usually used to describe related cells A cell is a single piece of information in a table A button allows a user to perform an action The full location of a file or folder e.g. C:\WINDOWS\system Oracle Application Server Oracle Database Oracle Application Server Certificate Authority Global Federated Identity and Privilege Management Permission refers to rights given to a user on an application A policy is any guide that establishes the parameters for decision making or actions OES Security Service Provider Interfaces extensible Access Control Markup Language 1

4 700 Civic Center Drive West 2

5 700 Civic Center Drive West 1.3 Prerequisites The highlighted areas in table 1.4a indicate the versions used in our installation. Component Table 1-2 Requirements for Microsoft Windows Server 2008 on 64-bit Xeon and AMD64 with 32-bit JDK Operating System Version and Patches Chip Architecture and Minimum Processor Speed JDK Version / Specification Windows Server 2008 (includes SP1+) Standard Edition Enterprise Edition Datacenter Edition AMD64 (1.3 GHz) 64-bit Xeon (1.3 GHz) JRockit 6.0 (R ) JDK (32-bit) and all later 6.0 releases of JRockit Sun Java 2 JDK 6.0 with the Java HotSpotTM Client and Server VMs (32-bit) and all later service packs of 6.0 (version 1.6.0_12) RAM Performance Pack Oracle Product Support 1 GB minimum (4 GB) server\native\win\32\wlntio.dll (Not being used) WebLogic Server (Only using basic WebLogic) WebLogic Portal 10.3 (supports JRockit only) WebLogic Integration 10.3, WebLogic Integration Workshop for WebLogic 10.3 (Runtime) 3

6 2 Configuration This section will provide the details that were followed in order to set up the server. It will be broken down in the following sections: Create WebLogic Domain Configure WebLogic Domain Installation and Deployment of the Web Service Open Secure Socket Layer (OSSL) Installation Generating Certificates and Trusts Configuring WebLogic to Reference the New Server Identity and Trust Keystores Adding HTTPS to the Web Service 2.1 Create WebLogic Domain The first step in the process is to create a WebLogic domain that will be the server domain which we will be using to verify Probation s x.509 certificate and where the SOAP servicee will reside. Once you ve completed the WLS installation you will be prompted to Create a new WebLogic domain. Select Create a newweblogic domain. Click Next. You now see the Select Domain Source screen. 4

7 JAX-WS is the JAVA type and version recommended by Oracle, so select Generate domain configured automatically to support the following products: and check WebLogic Advanced Web Services for JAX-WS Extension Click Next. You now see the Specific Domain Name and Location screen, for the project we chose the default settings. Click Next. 5

8 You now see the Configure Administrator User Name and Password. Select a user name and password. For the project we chose agyadmin for the user name. As this proof of concept will be transferred to a live environment when eprobation is prepared to go live, we will select Production Mode. Click Next. 6

9 Under JDK Selection, select JRockit SDK, as this is the SDKK recommended by Oracle. You now see the Select Optional Configuration screen. For this project will incorporate a web service to validate the submission, we need both an Administration Server and Managed Servers. So we select Administration Server and Managed Servers, Clusters, and Machines. Click Next. 7

10 You now see the Configure the Administration Server screen, for the project we use the default names and addresses. Make sure SSL Enabled: is checked. Click Next. You now see the Configure Clusterss screen. As we are not using clustering, click Next. You now see the Configure Managed Server screen, As the server must host our Web Service we will create a Managed Server. Click Add. 8

11 Enter the Name, Listen Address, and Ports and since we are using OpenSSL make sure the SSL Enabled is checked. Click Next. Since we are hosting the server on the same machine you will see this machine. Select the machine, for this example we will select cjcagencymachine. Click Next. 9

12 You now see the Assign Servers to Machines screen. Now we will add the servers to the machine we are using. Under the Machine section select the machine to which you will be adding the servers. Now we will add the servers to the machine. Select the first machine, for this example we select AdminServer. Click the right arrow. Repeat this step with any other servers you are adding. 10

13 For this example, we used cjcagencydev as the Managed Server. Once you ve moved both they should appear under the machine you selected. Click Next. You now see the configuration summary. Verify that the configuration is correct according to this document. Click Next. 11

14 You ll seee the Creating Domain screen. Once the creation is completed click Done. 2.2 Configure WebLogic Managed Domain In the previous section we configured the Admin Server. Now we need to configure the Managed Server. The first step in this process is to start our Managed Server. Click Start, and then click Start Admin Server for WebLogicc Server. 12

15 You now see the WebLogic DOS console. Enter your WLS username and password. Once WLS is started, open the Admin Server Console Login screen. Enter the Username and Password. Click Log In. You now see the WLS Admin Console main screen. Under Environments click Servers. 13

16 To begin editing the configuration on the server, we need to unlock the configuration. To do this, click Lock & Edit. You now see the Summary of Servers screen. You ll see that the state of our Managed Server (cjcagencydev) is currently SHUTDOWN. We need to start it up to begin configuration. Click the Control tab. 14

17 Select the Managed Server s check box. Click Start. You will see a confirmation window, click Yes. 15

18 This may take a few minutes. Click the Refresh to start a constant 10 second refresh interval. Note: You may have to do this repeatedly. You now see that the Managed Server is in a RUNNING statee and the Status of Last Action is TASK COMPLETED. Once you ve got the Managed Server running, click on it (cjcagencydev). 2.3 Installation and Deployment of the Web Service Once we ve configured WLS we must install and deploy the Web Service on the server. To begin this process click Deployments in the Domain Structure navigation menu. You now see the Summary of Deployments screen. From here we will install the.war file on the server and deploy it. Click Install. 16

19 Now we will install the web service. Navigate to the location you have placed the.war file and select it (For this example, we will select the file SecureWS.war.) Click Next. 17

20 Since the object being installed is a web service, we select Install this deployment as an application. Click Next. Now we will see the Select Deployment Targets screen. Heree we will select the server to which we will install the web service. Select the Managed Server (cjcagencydev). Click Next. 18

21 Now we will see the Optional Settings screen. Name the deployment (For this examplee we will use the name SecureWS). As this is a service to servicee solution, under Security we will select DD Only:. Under Source accessibility we will leave the selection as the default. Click Next. Now we will see the Review screen. As we are going to needd to configure the web service, select Yes, take me to the deployments configuration screen. Click Finish. 19

22 You will now see the Settings for SecureWS (The name of our WS) Overview tab. Review the summary information and click Activate Changes. Click Deployments in the Domain Structure menu. We now see the Summary of Deployments screen. You should see the web service we installed. Now we need to start the web service. 20

23 Select the web servicee (SecureWS) and click Start. A drop-down will appear, select Servicing all requests. 2.4 OpenSSL Installationn In order to ensure a secure connection between the Court andd Probation, we will be using a Windows x64 Open Secure Socket Layer (OpenSSL) transportt technology. OpenSSL is an open source version of the standard SSL. SSL is a cryptographic protocol that provides security for communications over the Internet. It encrypts the segments of network connections at the Application Layer enabling secure endonline. to-end transit. Initially you will need to download OpenSSL for Windows x64. It can be found in multiple locations Below is a list of sites from which you can find the executable file: /openssl.htmll For additional sites, simply perform an internet search on your preferred search engine. For the proof of concept we used Win64 OpenSSL v1.0.0a Light which can be found at: Important! Please note that all of the variables used in the commands use the file names and passwordss we used in the proof of concept, when implementing your solution, please replace any variable names with those you used on your implementation 21

24 700 Civic Center Drive West Browse to the OpenSSL installation file you downloaded File Name: Win64OpenSSL-1_0_0a.exe Follow the installation steps. (For this example we used the path: C:\OpenSSL-Win64) Copy this directory: C:\OpenSSL-Win64\bin\PEM\demoCA Into the following directory: C:\OpenSSL-Win64\bin Rename the directory: C:\OpenSSL-Win64\bin\demoCA to C:\OpenSSL-Win64\bin\openssl Now we must clear any information in the index file so that when we generate and import our certificates the correct data will be written. In the C:\OpenSSL-Win64\bin\openssl directory, open index.txt in a text editor and clear all text (should be a blank text file) and save the file. In the directory C:\OpenSSL-Win64\bin\openssl create a directory named certs. In the C:\OpenSSL-Win64\bin\openssl directory create a directory named newcerts. Now we must adjust the configuration file to fit with the structure we will be using. Open the following openssl configuration file: openssl.cfg in a text editor and make the following changes. Under the section [ CA_default ], change the line value below: dir =./democa to: dir =./openssl Save openssl.cfg. OpenSSL setup is now complete. To start OpenSSL, run the openssl.exe file located in C:\OpenSSL- Win64\bin. As this may need to be restarted from time to time, we suggest you create a desktop shortcut for easy access. 2.5 Generating Certificates and Trusts In order to create our keystores we must use the keytool command to do this, go to the Control Panel>System in Windows and in the Advanced tab and add the following path to the Windows Path Environment Variable: C:\Oracle\Middleware\jrockit_160_17_R \bin Launch the DOS Prompt and perform the following test to verify the Path Environment Variable has been set correctly: keytool If a list of options display on the screen, the path has been successfully set. Now we must create a Certificate Authority (CA) for signing request. Open the DOS prompt and run the following command to create a Certificate Authority (CA) for signing request: req -new -x509 -days newkey rsa:2048 -extensions v3_ca -keyout openssl/private/cakey.pem -out openssl/cacert.pem 22

25 700 Civic Center Drive West The prompt will ask for a password twice (For this example we use the following PEM pass phrase: mypasskey). A series of prompts will request certificate information. For the purposes of this project we used the following (Responses in bold): Country Name (2 letter code) [AU]:US State or Province Name (full name) [Some-State]:CA Locality Name (eg, city) []:Santa Ana Organization Name (eg, company) [Internet Widgits Pty Ltd]:County Of Orange Organizational Unit Name (eg, section) []:Superior Court Common Name (eg, YOUR name) []:camaster For , just hit the enter key to leave blank Address []: Create a new Server Identity Keystore for Weblogic create the following folder for the Java Keystore files: C:\Oracle\Middleware\keystore Now we need to create an Identity Keystore. The Identity Keystore is a public/private key pair that is wrapped in an X.509 certificate that is stored as a single-element certificate chain in a new keystore. Open a DOS Command prompt and navigate to the keystore folder (For this example we used the C:\Oracle\Middleware\keystore which is the default.). Run the following command in the keystore folder: keytool -keyalg RSA -keysize keystore ServerIdentity.jks -genkey -alias cjcagencyidentity -dname "CN=cjcagencydev,O=County Of Orange,ou=SuperiorCourt,ST=CA,C=US" -storepass mypasskey -keypass mypasskey Now we must create a CSR (Certificate Signing Request). The CSR contains information identifying the distinguished name and the public key. The private key is used to digitally sign the request, but is not included in the CSR. The CSR will then be incorporated into WLS. To generate the CSR enter the following command at the DOS prompt. keytool -keystore ServerIdentity.jks -certreq -alias cjcagencyidentity - keyalg rsa -file occert.csr Once the CSR is created, we need to place it in a folder where WLS can find it. Move the CSR file (occert.csr) in the following directory: C:\Oracle\Middleware\keystore\occert.csr To the following directory: C:\OpenSSL-Win64\bin\openssl\certs Now we must sign the CSR with the CA. Enter the following command at the DOS prompt to sign the CSR (occert.csr) with the CA: ca -policy policy_anything -out openssl/certs/occert.pem -infiles openssl/certs/occert.csr We are now prompted to verify the expiration time of the certificate (For this example we agreed and entered y.). 23

26 A second prompt asks if you want to commit to the certification. Type y and hit enter. If the signing is successful, you should see the following: Write out database with 1 new entries Data Base Updatedd Before the public key ( occert.pem) can be imported back into the Java keystore (serveridentity.jks), the CA Public Key (cacert. pem) must be imported into the Java keystore (serveridentity.jks). Copy the CA Public Key (cacert.pem) from the OpenSSL openssl directory (C:\OpenSSL- Then copy the Public Key (occert.pem) from the OpenSSL certs directory (C:\OpenSSL- Win64\bin\openssl\certs) to the Middleware keystore directoryy (C:\Oracle\Middleware\keystore). Now we need to import the CA Public Key into the Java keystore, launch the DOS prompt and navigate to Win64\bin\openssl\) to the Middleware keystore directory (C:\Oracle\Middleware\keystore). the Middleware keystore directory (C:\Oracle\Middleware\keystore) and run the following command. keytool -import -keystore ServerIden ntity.jks -file cacert.pem -alias CARoot - storepass mypasskey You will be prompted with the following Trust this certificate [no]: When prompted, type yes and press enter. The next step is to import the signed occert.pem file. Before the occert.pem file can be imported, extra information must be removed from the file or the import will fail. Open the Public Key (occert.pem) with a text editor and delete all informationn above the -----BEGIN CERTIFICATE----- heading. The remaining text should look similar to the text below BEGIN CERTIFICATE MIID0TCCArmgAwIBAgICAR4wDQYJKoZIhvcNAQEFBQAwdjELMAkGA1UEBhMCVVMx CzAJBgNVBAgMAkNBMRIwEAYDVQQHDAlTYW50YSBBbmExGTAXBgNVBAoMEENvdW50 esbpzibpcmfuz2uxfzavbgnvbasmdln1cgvyaw9yienvdxj0mriweaydvqqddalj amnhz2vuy3kwhhcnmtawotmwmja0nza0whcnmtewotmwmja0nza0wjbkmqswcqyd VQQGEwJVUzELMAkGA1UECBMCQ0ExGTAXBgNVBAoTEENvdW50eSBPZiBPcmFuZ2Ux FjAUBgNVBAsTDVN1cGVyaW9yQ291cnQxFTATBgNVBAMTDGNqY2FnZW5jeWRldjCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL+AdURPjH9UREiZ5n7+FlR4 rjg4nlrki07slqv04lxembzxbvdb2nhsvspbmmt5mbb6e4psksfbicqt+otqt874 or51bjmfplhctlaaqgzgapnif08wscttwnqngqvmhvutou0v+blvgjahpvuljbi0 Y2PM0bFm7C/zw7bpbTVsdGyJIF47z4+fGrvQsQ1/C2laJjK6xST9137mhv4tRBqU 24

27 QOScxPoRgl3DAYFJDu0akzb/YgY2rHxax3xqTDfWd1FuPhZzasgotJmhADVRs/NK k62fvvvfmmwgtsl5cymda4l8bfscuzadra1829djk33otta2ankt0fso/f1kowec AwEAAaN7MHkwCQYDVR0TBAIwADAsBglghkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5l cmf0zwqgq2vydglmawnhdguwhqydvr0obbyefbna3bnnvduxvetvzpdncmzuu8sj MB8GA1UdIwQYMBaAFII9itWk3+gcMKOQ6stgHecYHZiZMA0GCSqGSIb3DQEBBQUA A4IBAQAqVxQUhshC+ +a8mhx5gt0dg7066vekcj6rnpabpew+mlvleth12ilfntuq5 nfvwbi7ztwqfmtmw/ /7/FA3H0HBJdRep8jxk7dPT16aDamaImS/ShE6b7XCrPhaym 5MTz1CetVsA/fhXUAVudgNWqj/Ye5YJdAc2dHr6rE9GmgxhC8qBmzj71ekvEAlaz ucxa2yujht6qi/tswtapfbbwxsdpef6fc/dkmshfvvvai8c3gof2ttl50sq64z0v WXGx5bfkCaDMFe6xSS7LelzY6Saq+6ke+K3Hv6OojPjpHHJCnK9L68sJGcdsSVMc WoQy4+xuSfKQ5DrBT1/lh0bcbczz -----END CERTIFICATE----- Once the text is removed save the file. Now we need to import the signed certificate. Launch the DOS prompt and run the following command. keytool -import -keystore ServerIden ntity.jks -file occert.pem -alias cjcagencyidentityy -storepass mypasskey If the import was successful, you will see the following: Now we must create a new Trust Keystore for WLS and import the CA Public Key (cacert.pem). Launch the DOS Prompt and run the following command. keytool -import -keystore ServerTrus st.jks -file cacert. pem -alias CARoot - storepass mypasskey For this proof of concept Probation and the Court share the same CA which the Court will manage. If Probation were to create their own CA, then their CA Public Key would need to be imported into our trust keystore because their certificates would be signed by their CA. 2.6 Configuringg WebLogic to Referencee the New Server Identity and Trust Keystores In order to utilize the security available using OpenSSL, WLS must be able to referencee the Server Identity and Keystores. To do this, launch the WLS Admin Console and Log in. Once you see the main screen click Servers in the Environment section. 25

28 You now see the Summary of Servers screen. Under Server click on the Managed Server (cjcagencydev). You now see the Settings for <Managed Server Name> screen. Since we are configuring the keystores, click the Keystores tab. You now see the Keystores tab. By default, WebLogic creates a Demo keystore. Now we need to configure our new keystores. For security purposes, the settings are initially locked, click Lock & Edit to begin editing. 26

29 Since we are not using the Demo keystore, in the Keystore section click Change to addd our keystores. Since we menu.] have created our own keys, select Custom Identity and Trust from the Keystore drop-down Click Save. 27

30 You will now see the Keystores tab again. For this example, we entered the following into the Keystore fields: Custom Identity Keystore: C:\Oracle\Mid dleware\keystore\serveridentity.jks Custom Identity Keystore Type: JKS Custom Identity Keystore Passphrase: mypasskey Confirm Custom Identity Keystore Passphrase: mypasskey Custom Trust Keystore: C:\ Oracle\Middleware\keystore\ServerTrust.jks Custom Trust Keystore Type: JKS Custom Trust Keystore Passphrase: mypasskey Confirm Custom Trust Keystore Passphrase: mypasskey Click Save. 28

31 Now we need to update the SSL information, click the SSL tab. You now see the SSL tab. For this project, we entered the following information: Private Key Alias: cjcagencyidentity Private Key Passphrase: mypasskey Confirm Private Key Passphrase: mypasskey Click Save. Click Activate Changes to implement the updates we ve made. 29

32 2.7 Adding HTTPS to the Web Service Hypertextt Transfer Protocol Secure (HTTPS) is used to provide encrypted communication and secure identification of the network web server. To begin adding HTTPS click Deployments in the Domain Structure navigation menu. You will now see the Summary of Deployments screen. Clickk on the web service that you wish to add HTTPS to (For this example we used SecureWS). You will now see the Settings for <Name of Deployment> (SecureWS) screen. Under Web Services, click the active web service (For this example we used daitestwsservice) 30

33 You will now see the Settings for <Web Service Name> (daitestwsservice) screen. To begin configuring the web service, click the Configuration tab. Click the WS-Policy tab. Under Service Endpoints and Operations, click the web service endpoint (For this example we used daitestwsport). Under Available Endpoint Policies check the box to the left of Policy:Wss1.2-Https.xml. 31

34 Click the right arrow. The policy selected will now appear under Chosen Endpoint Policies. Click OK. You are now returned to the WS-Policies tab. To implement the changes, click Activate Changes. WLS set up is now complete. 32