Next: , Previous: Configuring GIOP protocol stack for PolyORB, Up: Configuring a CORBA application



6.7.3 Configuring Security services for PolyORB

PolyORB provides support for some elements of the CORBA Security mechanisms. This sections lists the corresponding configuration parameters.

6.7.3.1 Supported mechasnisms

PolyORB provides support for the following security mechanisms:

  1. SSL/TLS protected transport;
  2. GSSUP (user/password) authentication mechanism;
  3. identity assertion and backward trust evaluation.
6.7.3.2 Compile-time configuration

To enable security support applications must "with" one of the predefined setup packages:

  1. PolyORB.Setup.Secure_Client - for client side support only;
  2. PolyORB.Setup.Secure_Server - for both client and server side support.
6.7.3.3 Run-time configuration
  1. Capsule configuration

    This section details the configuration parameters for capsule configuration.

              [security_manager]
              # List of sections for configure client's credentials
              #own_credentials=my_credentials
              #
              # Client requires integrity proteced messages
              #integrity_required=true
              #
              # Client requires confiodentiality protected messages
              #confidentiality_required=true
              #
              # Client requires security association to detect replay (not supported
              for now)
              #detect_replay_required=true
              #
              # Client requires security association to detect message sequence
              errors (not
              # supported for now)
              #detect_misordering_required=true
              #
              # Client requires target authentication
              #establish_trust_in_target_required=true
              #
              # Client requires client authentication (usually not applicable at
              all)
              #establish_trust_in_client_required=true
              #
              # (rare useful)
              #identity_assertion_required=true
              #
              # (rare useful)
              #delegation_by_client_required=true
         
  2. Credentials configuration

    This section details configuration parameters for defining program's credentials. Depending on used mechanisms for transport and authentication layers, credentials configuration section may define configuration only for one transport mechanism and/or one authentication mechanism.

              #[my_credentials]
              #
              # TLS protected transport mechanism used as transport mechanism
              #transport_credentials_type=tls
              #
              # Connection method. Available methods: tls1, ssl3, ssl2
              #tls.method=tls1
              #
              # Certificate file name
              #tls.certificate_file=my.crt
              #
              # Certificate chain file name
              #tls.certificate_chain_file=
              #
              # Private key file name
              #tls.private_key_file=my.key
              #
              # Name of file, at which CA certificates for verification purposes are
              #located
              #tls.certificate_authority_file=root.crt
              #
              # Name of directory, at which CA certificates for verification
              #purposes are
              # located
              #tls.certificate_authority_path=
              #
              # List of available ciphers
              #tls.ciphers=ALL
              #
              # Verify peer certificate
              #tls.verify_peer=true
              #
              # Fail if client don't provide ceritificate (server only)
              #tls.verify_fail_if_no_peer_certificate=true
              #
              # GSSUP (user/password) mechanism as authentication mechanism
              #authentication_credentials_type=gssup
              #
              # User name
              #gssup.username=username@domain
              #
              # User password
              #gssup.password=password
              #
              # Target name for which user/password pair is applicable
              #gssup.target_name=@domain
         
  3. POA configuration

    This section details configuration parameters for defining security characteristics of objects managed by POA. POA's name is used as section name.

              #[MySecurePOA]
              #
              # Unprotected invocations is allowed
              #unprotected_invocation_allowed=true
              #
              # Section name for configuration of used protected transport mechanism
              #(if any)
              #transport_mechanism=tlsiop
              #
              # Section name for configuration of used authentication mechanism (if
              #any)
              #authentication_mechanism=my_gssup
              #
              # Target require client authentication at authentication layer (in
              #addition
              # to authentication at transport layer)
              #authentication_required=true
              #
              # Name of file for backward trust evalutation rules
              #backward_trust_rules_file=file.btr
              #
              # Section name for configuration of authorization tokens authority
              #privilege_authorities=
         
  4. TLS protected transport mechanism configuration

    This section details configuration parameters for the TLS protected transport mechanism. Section name for mechanism configuration is defined in POA configuration.

              [tlsiop]
              # List of access points
              #addresses=127.0.0.1:3456
         
  5. GSSUP authentication mechanism

    This section details configuration parameters for the GSSUP auithentication mechanism. Section name for mechanism configuration defined in POA configuration.

              #[my_gssup]
              #
              # Authentication mechanism
              #mechanism=gssup
              #
              # Target name
              #gssup.target_name=@domain
              #
              # User name/password mapping file
              #gssup.passwd_file=passwd.pwd