Next: Command line arguments, Previous: Configuring GIOP protocol stack for PolyORB, Up: Configuring a CORBA application
PolyORB provides support for some elements of the CORBA Security mechanisms. This sections lists the corresponding configuration parameters.
PolyORB provides support for the following security mechanisms:
To enable security support applications must "with" one of the predefined setup packages:
PolyORB.Setup.Secure_Client
- for client side support only;
PolyORB.Setup.Secure_Server
- for both client and server
side support.
This section details the configuration parameters for capsule configuration.
[security_manager] # List of sections for configure client's credentials #own_credentials=my_credentials # # Client requires integrity proteced messages #integrity_required=true # # Client requires confiodentiality protected messages #confidentiality_required=true # # Client requires security association to detect replay (not supported for now) #detect_replay_required=true # # Client requires security association to detect message sequence errors (not # supported for now) #detect_misordering_required=true # # Client requires target authentication #establish_trust_in_target_required=true # # Client requires client authentication (usually not applicable at all) #establish_trust_in_client_required=true # # (rare useful) #identity_assertion_required=true # # (rare useful) #delegation_by_client_required=true
This section details configuration parameters for defining program's credentials. Depending on used mechanisms for transport and authentication layers, credentials configuration section may define configuration only for one transport mechanism and/or one authentication mechanism.
#[my_credentials] # # TLS protected transport mechanism used as transport mechanism #transport_credentials_type=tls # # Connection method. Available methods: tls1, ssl3, ssl2 #tls.method=tls1 # # Certificate file name #tls.certificate_file=my.crt # # Certificate chain file name #tls.certificate_chain_file= # # Private key file name #tls.private_key_file=my.key # # Name of file, at which CA certificates for verification purposes are #located #tls.certificate_authority_file=root.crt # # Name of directory, at which CA certificates for verification #purposes are # located #tls.certificate_authority_path= # # List of available ciphers #tls.ciphers=ALL # # Verify peer certificate #tls.verify_peer=true # # Fail if client don't provide ceritificate (server only) #tls.verify_fail_if_no_peer_certificate=true # # GSSUP (user/password) mechanism as authentication mechanism #authentication_credentials_type=gssup # # User name #gssup.username=username@domain # # User password #gssup.password=password # # Target name for which user/password pair is applicable #gssup.target_name=@domain
This section details configuration parameters for defining security characteristics of objects managed by POA. POA's name is used as section name.
#[MySecurePOA] # # Unprotected invocations is allowed #unprotected_invocation_allowed=true # # Section name for configuration of used protected transport mechanism #(if any) #transport_mechanism=tlsiop # # Section name for configuration of used authentication mechanism (if #any) #authentication_mechanism=my_gssup # # Target require client authentication at authentication layer (in #addition # to authentication at transport layer) #authentication_required=true # # Name of file for backward trust evalutation rules #backward_trust_rules_file=file.btr # # Section name for configuration of authorization tokens authority #privilege_authorities=
This section details configuration parameters for the TLS protected transport mechanism. Section name for mechanism configuration is defined in POA configuration.
[tlsiop] # List of access points #addresses=127.0.0.1:3456
This section details configuration parameters for the GSSUP auithentication mechanism. Section name for mechanism configuration defined in POA configuration.
#[my_gssup] # # Authentication mechanism #mechanism=gssup # # Target name #gssup.target_name=@domain # # User name/password mapping file #gssup.passwd_file=passwd.pwd