The Default Identity Asserter can be configured to verify an X509 certificate passed to it by a client over a secure (SSL) connection. The Default Identity Asserter requires a separate user name mapper to map the associated client "certificate" to a user configured in the default security realm. You can use the default user name mapper installed with Converged Application Server, or you can create a custom user name mapper class. See the chapters on configuring a WebLogic credential mapping provider in Securing Oracle WebLogic Server the Oracle WebLogic Server Documentation for information on creating a custom user name mapper class.

Follow these instructions to configure the Default Identity Asserter:

1. Log in to the Administration Console for the Converged Application Server domain you want to configure.

2. In the left pane of the Console, select the Security Realms node.

3. Select the name of your security realm in the right pane from the Realms table.

4. Select the Providers tab and then select the Authentication subtab.

5. In the right pane of the Console, select DefaultIdentityAsserter from the Authentication Providers table.

6. Select the Configuration tab and then select the Common subtab.

7. Select X.509 in the Available column of the Active Types table and use the arrow to move it to the Chosen column.

8. Click Save to apply the change.

9. You can use either a custom Java class to map names in the X.509 certificate to user names in the built-in LDAP store, or you can use the default user name mapper. To specify a custom Java class to perform user name mapping:

   1. Select the Provider Specific subtab.

   2. Enter the name of the custom class in the User Name Mapper Class Name field.

   3. Click Save.

   To use the default user name mapper:

   1. Select the Provider Specific subtab.

   2. Select Use Default User Name Mapper.

   3. In the Default User Name Mapper Attribute Type list, select either CN (for Common Name) or E (for Email address) depending on the user name attribute you have stored in the security realm.

   4. In the Default User Name Mapper Attribute Delimiter field, accept the default delimiter of "@". This delimiter is used with the E (Email address) attribute type to extract the email portion from the client token. For example, a token of "joe@mycompany.com" would be mapped to a username "joe" configured in the default security realm.

   5. Click Save.

10. Restart the server.

Follow these steps to create and configure the X509 Authentication Provider.

1. Log in to the Administration Console for the Converged Application Server domain you want to configure.

2. In the left pane of the Console, select the Security Realms node.

3. Select the name of your security realm in the right pane from the Realms table.

4. Select the Providers tab and then select the Authentication subtab.

5. Click New.

6. Enter a name for the new provider, and select LDAPX509IdentityAsserter as the type.

7. Click OK.

8. In the list of providers, select the name of the provider you just created.

9. In the Configuration > Provider Specific tab, enter LDAP server information into the fields as follows:

   • User Field Attributes: Enter an LDAP search filter that Converged Application Server will use to locate a given username. The filter is applied to LDAP objects beneath the base DN defined in the Certificate Mapping attribute described below.

   • User Name Attribute: Enter the LDAP attribute that stores the user's name.

   • Certificate Attribute: Enter the LDAP attribute that stores the certificate for the user name.

   • Certificate Mapping: Specify how a query string to construct the base LDAP DN used to locate the LDAP object for the user.

   • Host: Enter the host name of the LDAP server to verify the incoming certificate. If you are using multiple LDAP servers for failover capabilities, enter the host name:port value for each server separated by spaces. For example: ldap1.mycompany.com:1050 ldap2.mycompany.com:1050

     See Securing Oracle WebLogic Server in the Oracle WebLogic Server documentation for more information about configuring failover.

   • Port: Enter the port number of the LDAP server.

   • SSL Enabled: Select this option if you are using SSL to communicate unencrypted passwords between Converged Application Server and the LDAP Server.

   • Principal: Enter the name of a principal that Converged Application Server uses to access the LDAP server.

   • Credential: Enter the credential for the above principal name (generally a password).

   • Confirm Credential: Re-enter the principal's credential.

   • Cache Enabled: Specifies whether a cache should be used with the associated LDAP server.

   • Cache Size: Specifies the size of the cache, in Kilobytes, used to store results from the LDAP server. By default the cache size is 32K.

   • Cache TTL: Specifies the time-to-live (TTL) value, in seconds, for the LDAP cache. By default the TTL value is 60 seconds.

   • Follow Referrals: Select this to specify that a search for a user or group within the LDAP X509 Identity Assertion provider should follow referrals to other LDAP servers or branches within the LDAP directory.

   • Bind Anonymously On Referrals: By default, the LDAP X509 Identity Assertion provider uses the same DN and password used to connect to the LDAP server when following referrals during a search. If you want to connect as an anonymous user, check this box.

   • Results Time Limit: Specifies the number of milliseconds to wait for LDAP results before timing out. Accept the default value of 0 to specify no time limit.

   • Connect Timeout: Specifies the number of milliseconds to wait for an LDAP connection to be established. If the time is exceeded, the connection times out. The default value of 0 specifies no timeout value.

   • Parallel Connect Delay: Specifies the number of seconds to delay before making concurrent connections to multiple, configured LDAP servers. If this value is set to 0, the provider connects to multiple servers in a serial fashion. The provider first tries to connect to the first configured LDAP server in the Host list. If that connection attempt fails, the provider tries the next configured server, and so on.

     If this value is set to a non-zero value, the provider waits the specified number of seconds before spawning a new thread for an additional connection attempt. For example, if the value is set to 2, the provider first tries to connect to the first configured LDAP server in the Host list. After 2 seconds, if the connection has not yet been established, the provider spawns a new thread and tries to connect to the second server configured in the Host list, and so on for each configured LDAP server.

   • Connection Retry Limit: Specifies the number of times the provider tries to reestablish a connection to an LDAP server if the LDAP server throws an exception while creating a connection.

10. Click Save to save your changes.

11. Restart the server.