Next: , Previous: , Up: Configuring a CORBA application   [Contents][Index]


6.7.3 Configuring Security services for PolyORB

PolyORB provides support for some elements of the CORBA Security mechanisms. This sections lists the corresponding configuration parameters.

6.7.3.1 Supported mechasnisms

PolyORB provides support for the following security mechanisms:

  1. SSL/TLS protected transport;
  2. GSSUP (user/password) authentication mechanism;
  3. identity assertion and backward trust evaluation.

6.7.3.2 Compile-time configuration

To enable security support, applications must ‘with’ one of the predefined setup packages:

  1. PolyORB.Setup.Secure_Client - for client side support only;
  2. PolyORB.Setup.Secure_Server - for both client and server side support.

6.7.3.3 Run-time configuration

  1. Capsule configuration

    This section details the configuration parameters for capsule configuration.

    [security_manager]
    # List of sections for configure client's credentials
    #own_credentials=my_credentials
    #
    # Client requires integrity proteced messages
    #integrity_required=true
    #
    # Client requires confiodentiality protected messages
    #confidentiality_required=true
    #
    # Client requires security association to detect replay (not supported
    for now)
    #detect_replay_required=true
    #
    # Client requires security association to detect message sequence
    errors (not
    # supported for now)
    #detect_misordering_required=true
    #
    # Client requires target authentication
    #establish_trust_in_target_required=true
    #
    # Client requires client authentication (usually not applicable at
    all)
    #establish_trust_in_client_required=true
    #
    # (rare useful)
    #identity_assertion_required=true
    #
    # (rare useful)
    #delegation_by_client_required=true
    
  2. Credentials configuration

    This section details configuration parameters for defining a program’s credentials. Depending on the mechanisms used for the transport and authentication layers, the credentials configuration section may define configuration only for one transport mechanism and/or one authentication mechanism.

    #[my_credentials]
    #
    # TLS protected transport mechanism used as transport mechanism
    #transport_credentials_type=tls
    #
    # Connection method. Available methods: tls1, ssl3, ssl2
    #tls.method=tls1
    #
    # Certificate file name
    #tls.certificate_file=my.crt
    #
    # Certificate chain file name
    #tls.certificate_chain_file=
    #
    # Private key file name
    #tls.private_key_file=my.key
    #
    # Name of file, at which CA certificates for verification purposes are
    #located
    #tls.certificate_authority_file=root.crt
    #
    # Name of directory, at which CA certificates for verification
    #purposes are
    # located
    #tls.certificate_authority_path=
    #
    # List of available ciphers
    #tls.ciphers=ALL
    #
    # Verify peer certificate
    #tls.verify_peer=true
    #
    # Fail if client don't provide ceritificate (server only)
    #tls.verify_fail_if_no_peer_certificate=true
    #
    # GSSUP (user/password) mechanism as authentication mechanism
    #authentication_credentials_type=gssup
    #
    # User name
    #gssup.username=username@domain
    #
    # User password
    #gssup.password=password
    #
    # Target name for which user/password pair is applicable
    #gssup.target_name=@domain
    
  3. POA configuration

    This section details configuration parameters for defining security characteristics of objects managed by POA. The POA’s name is used as the section name.

    #[MySecurePOA]
    #
    # Unprotected invocations is allowed
    #unprotected_invocation_allowed=true
    #
    # Section name for configuration of used protected transport mechanism
    #(if any)
    #transport_mechanism=tlsiop
    #
    # Section name for configuration of used authentication mechanism (if
    #any)
    #authentication_mechanism=my_gssup
    #
    # Target require client authentication at authentication layer (in
    #addition
    # to authentication at transport layer)
    #authentication_required=true
    #
    # Name of file for backward trust evalutation rules
    #backward_trust_rules_file=file.btr
    #
    # Section name for configuration of authorization tokens authority
    #privilege_authorities=
    
  4. TLS protected transport mechanism configuration

    This section details configuration parameters for the TLS protected transport mechanism. The section name for mechanism configuration is defined in the POA configuration.

    [tlsiop]
    # List of access points
    #addresses=127.0.0.1:3456
    
  5. GSSUP authentication mechanism

    This section details configuration parameters for the GSSUP authentication mechanism. The section name for mechanism configuration is defined in the POA configuration.

    #[my_gssup]
    #
    # Authentication mechanism
    #mechanism=gssup
    #
    # Target name
    #gssup.target_name=@domain
    #
    # User name/password mapping file
    #gssup.passwd_file=passwd.pwd
    

Next: , Previous: , Up: Configuring a CORBA application   [Contents][Index]