Configuring Web Services Security

25 Configuring Web Services Security

Configure Web Services Security (WS-Security) for WebCenter Portal and related services and components.

Note:

Oracle WebCenter Portal has deprecated the support for Jive features (announcements and discussions/discussion forums). Hence, Jive features are not available in 14.1.2 instances.

WS-Security, using an OPSS Key Store Service (KSS) keystore, provides a mechanism for retrieving and managing the security credentials of a WebCenter Portal application and ancillary applications and components across one or more domains. The KSS keystore provides information about available public and private keys that can be used for authentication and data integrity.

The following topics show how to configure a typical topology with WS-Security (where the WebCenter Portal application and the WSRP producers share the same domain, but the BPEL server is in an external SOA domain), and how to extend that configuration for more complex environments (where, for example, a BPEL server is in a separate SOA domain and one WSRP producer is in an external portlet domain):

Permissions:

To perform the tasks in this chapter, you must be granted the WebLogic Server Admin role through the Oracle WebLogic Server Administration Console. Users with the Monitor or Operator roles can view security information but cannot make changes.

Topics:

25.1 Configuring WS-Security for a Typical Topology

This section describes how to configure WS-Security for a topology where the WebCenter Portal application, and WSRP producers share the same domain, but the BPEL (SOA) server is in an external domain.

Typical Topology

Domain 1 : WebCenter Portal , Portlet Producers
Domain 2 : SOA

The steps to configure WS-Security for a typical two-domain topology are described in the following topics:

25.1.1 Creating the WebCenter Portal Domain Keystore

This section describes how to use the OPSS Keystore Service (KSS) to create the WebCenter Portal keystore and keys. A keystore is a file that provides information about available public and private keys. Keys are used for a variety of purposes, including authentication and data integrity. User certificates and the trust points needed to validate the certificates of peers are also stored securely in the keystore. After creating the keystore, the security credentials of WebCenter Portal, BPEL servers, and WSRP producers can be retrieved and managed using the KSS. For more information about the OPSS Keystore Service, see Managing Keys and Certificates with the Keystore Service in Securing Applications with Oracle Platform Security Services.

To create the WebCenter Portal domain keystore:

Run the following WLST commands:
svc = getOpssService(name='KeyStoreService')
Create the keystore using the following WLST command:
```
svc.createKeyStore(appStripe='appStripe', name='producer', password='password', permission=true/false))
```
Where:
- appstripe — The keystore stripe name. Keys and certificates created in the keystore reside in an application stripe or product, and each stripe in a domain is uniquely named
- name — Keystore name
- password — Keystore password
- permission — false if protected by both permission and password (true if keystore is protected by permission only)
For example:
```
svc.createKeyStore(appStripe='WCPortalStripe', name='producer', password='welcome1', permission=true))
```

Generate the key pair for this newly created keystore:

svc.generateKeyPair(appStripe='appstripe', name='name', password='password', dn='CN=Producer, OU=Producer, O=MyOrganization, L=MyTown, ST=MyState, C=US', keysize='2048', alias='producer', keypassword='keypassword')

Where:

appstripe — The keystore stripe name. Keys and certificates created in the keystore reside in an application stripe or product, and each stripe in a domain is uniquely named
name — Keystore name
password — Keystore password
dn — Domain name (for example, dn='CN=webcenter_certificate')
alias — Public Key Alias
keypassword — Password for new public key

For example:

svc.generateKeyPair(appStripe='WCPortalStripe', name='producer', password='welcome1', dn='CN=Producer, OU=Producer, O=MyOrganization, L=MyTown, ST=MyState, C=US', keysize='2048', alias='producer', keypassword='welcome1')

Export the producer certificate (which will be used by the consumer):
```
svc.exportKeyStoreCertificate(appStripe='appstripe', name='name', password='password', alias='alias', type='TrustedCertificate',filepath='filepath')
```
Where:
- appstripe — The keystore stripe name. Keys and certificates created in the keystore reside in an application stripe or product, and each stripe in a domain is uniquely named
- name — Keystore name
- password — Keystore password
- alias — Public Key Alias
- keypassword — Password for new public key
- filepath — Certificate path
For example:
```
svc.exportKeyStoreCertificate(appStripe='WCPortalStripe', name='producer', password='welcome1', alias='producer', type='TrustedCertificate',filepath='/scratch/certificate/webcenter.cer')
```

25.1.2 Creating the SOA Domain Keystore

This section describes how to create a SOA domain keystore and keys using an OPSS keystore (KSS). For syntax and reference information about the KSS commands, see OPSS Keystore Service Commands in Oracle Fusion Middleware Infrastructure Security WLST Command Reference.

To create the SOA domain keystore:

Using the following WLST command, get an OPSS service command object:
```
svc = getOpssService(name='KeyStoreService')
```
Create the keystore:
```
svc.createKeyStore(appStripe='appStripe', name='name', password='password', permission=true/false))
```
Where:
- appstripe — The keystore stripe name. Keys and certificates created in the keystore reside in an application stripe or product, and each stripe in a domain is uniquely named
- name — Keystore name
- password — Keystore password
- permission — false if protected by both permission and password (true if keystore is protected by permission only)
For example:
```
svc.createKeyStore(appStripe='SOAStripe', name='bpel', password='welcome1', permission=true))
```
Generate key pair for the newly created keystore:
```
svc.generateKeyPair(appStripe='appstripe', name='name', password='password', dn='CN=Producer, OU=Producer, O=MyOrganization, L=MyTown, ST=MyState, C=US', keysize='2048', alias='bpel', keypassword='keypassword')
```
Where:
- appstripe — The keystore stripe name. Keys and certificates created in the keystore reside in an application stripe or product, and each stripe in a domain is uniquely named
- name — Keystore name
- password — Keystore password
- dn — Domain name (for example, dn='CN=webcenter_certificate')
- alias — Public Key Alias
- keypassword — Password for new public key
For example:
```
svc.generateKeyPair(appStripe='SOAStripe', name='bpel', password='welcome1', dn='CN=BPEL, OU=Consumer, O=MyOrganization, L=MyTown, ST=MyState, C=US', keysize='2048', alias='bpel', keypassword='welcome1')
```
Import the certificate exported by the producer:
```
svc.importKeyStoreCertificate(appStripe='appStripe', name='name', password='password', alias='webcenter_spaces_ws', keypassword='keypassword', filepath='filepath',type='TrustedCertificate')
```
Where:
- appstripe — The keystore stripe name. Keys and certificates created in the keystore reside in an application stripe or product, and each stripe in a domain is uniquely named
- name — Keystore name
- password — Keystore password
- keypassword — Password for new public key
- filepath — Certificate path
Note:

The alias for the importKeyStoreCertificate command must always be set to webcenter_spaces_ws. Do not attempt to change this alias or the SOA usecases will fail.

For example:
```
svc.importKeyStoreCertificate(appStripe='SOAStripe', name='bpel', password='welcome1', alias='webcenter_spaces_ws', keypassword='welcome1', filepath='/scratch/certificate/webcenter.cer',type='TrustedCertificate')
```
Export the public certificate that will be imported by the producer:
```
svc.exportKeyStoreCertificate(appStripe='appstripe', name='name', password='password', alias='alias', filepath='filepath',type='TrustedCertificate')
```
Where:
- appstripe — The keystore stripe name. Keys and certificates created in the keystore reside in an application stripe or product, and each stripe in a domain is uniquely named
- name — Keystore name
- password — Keystore password
- alias — Public Key Alias
- filepath — Certificate path
For example:
```
svc.exportKeyStoreCertificate(appStripe='SOAStripe', name='bpel', password='welcome1', alias='bpel', filepath='/scratch/certificate/bpel.cer',type='TrustedCertificate')
```
Register the newly created stripe in SOA domain:
```
configureWSMKeystore('/WLS/base_domain','KSS', 'kss://appstripe/bpel', signAlias='bpel', cryptAlias='bpel', signAliasPassword='signAliasPassword',cryptAliasPassword='cryptAliasPassword')
```
Where:
- WLS/base_domain — The domain name and should follow the format: WLS/<domainName>
- kss://appstripe/bpel — The KSS keystore name
- cryptAlias — The public key alias
- appstripe — The keystore stripe name. Keys and certificates created in the keystore reside in an application stripe or product, and each stripe in a domain is uniquely named
- signAliasPassword — The password for the public key
- cryptAlias — The public key alias
- cryptAliasPassword — The password for the public key
For example:
```
configureWSMKeystore('/WLS/base_domain','KSS', 'kss://SOAStripe/bpel', signAlias='bpel', cryptAlias='bpel', signAliasPassword='signAliasPassword',cryptAliasPassword='cryptAliasPassword')
```

Grant keystore permission to newly created bpel stripe in the SOA domain:

grantPermission(permClass="oracle.security.jps.service.keystore.KeyStoreAccessPermission", permTarget="stripeName=SOAStripe,keystoreName=bpel,alias=*", permActions="read")

Import the consumer certificate to WebCenter:

svc.importKeyStoreCertificate(appStripe='appstripe', name='name', password='password', alias='bpel', keypassword='keypassword', filepath='filepath', type='TrustedCertificate')

Where:

appstripe — The keystore stripe name. Keys and certificates created in the keystore reside in an application stripe or product, and each stripe in a domain is uniquely named
name — Keystore name
password — Keystore password
alias — Public Key Alias
keypassword — Password for new key
filepath — Certificate path

For example:

svc.importKeyStoreCertificate(appStripe='WCPortalStripe', name='producer', password='welcome1', alias='bpel', keypassword='welcome1', filepath='/scratch/certificate/bpel.cer', type='TrustedCertificate')

configureWSMKeystore('/WLS/wc_domain','KSS', 'kss://appstripe/producer', signAlias='producer', signAliasPassword='signAliasPassword', cryptAlias='cryptAlias', cryptAliasPassword='cryptAliasPassword')

Where:

wc_domain — The WebCenter Portal domain
signAliasPassword — The password for the public key
cryptAlias — The public key alias
cryptAliasPassword — The password for the public key

For example:

configureWSMKeystore('/WLS/WLS_SOAWC','KSS', 'kss://WCPortalStripe/producer', signAlias='producer', signAliasPassword='welcome1', cryptAlias='producer', cryptAliasPassword='welcome1')

Grant Keystore Permission for the newly created stripe:

grantPermission(permClass="oracle.security.jps.service.keystore.KeyStoreAccessPermission", permTarget="stripeName=WCPortalStripe,keystoreName=producer,alias=*", permActions="read")

25.2 Configuring WS-Security for Multiple Domains

This section describes how to extend the WS-security configuration for a typical topology for topologies where, for example, the WebCenter Portal application, BPEL (SOA) server, and a WSRP producer server are each in their own domain.

Multiple Domain Topology

Domain 1 : WebCenter Portal
Domain 2 : SOA (BPEL) server
Domain 3 : WSRP producers

The steps to configure WS-Security for a topology with multiple domains are described in the following topics:

25.2.1 Setting Up the WebCenter Portal Domain Keystore

To create the WebCenter Portal domain keystore, follow the steps for a configuring WS-security for a typical topology as described in Creating the WebCenter Portal Domain Keystore. After creating the keystore, the security credentials of WebCenter Portal, BPEL servers, and WSRP producers can be retrieved and managed using the KSS. For more information about the OPSS Keystore Service, see Managing Keys and Certificates with the Keystore Service in Securing Applications with Oracle Platform Security Services.

25.2.2 Creating the SOA Domain Keystore

Create the SOA domain keystore and keys using an OPSS keystore (KSS) as described in Creating the SOA Domain Keystore. For syntax and reference information about the KSS commands, see OPSS Keystore Service Commands in Oracle Fusion Middleware Infrastructure Security WLST Command Reference.

25.2.3 Creating the External Portlet Domain Keystore

To create the external portlet domain keystore:

Go to JDK_HOME/jdk/bin and open a command prompt.

Using keytool, generate the keystore by importing the WebCenter Portal domain's public certificate:

keytool -importcert -alias webcenter_public -file webcenter_public.cer -keystore producer.jks -storepass keystore_password

Where:

keystore_password is the keystore password

Example: Importing the Certificate

keytool -importcert -alias webcenter_public -file webcenter_public.cer -keystore producer.jks -storepass MyPassword

Using keytool, generate a key pair:
```
keytool -genkeypair -keyalg RSA -dname "consumer_dname" -alias producer  -keypass key_password -keystore producer.jks -storepass keystore_password  -validity days_valid
```
Where:
- consumer_dname is the name of the consumer (for example, cn=producer,dc=example,dc=com)
- key_password is the password for the new public key, (for example, MyPassword)
- keystore is the keystore name, (for example, webcenter.jks)
- keystore_password is the keystore password, (for example, MyPassword)
- days_valid is the number of days for which the key password is valid (for example, 1064).
  
  Example: Generating the Keypair
```
keytool -genkeypair -keyalg RSA -dname "cn=producer,dc=example,dc=com" -alias  producer -keypass MyPassword -keystore producer.jks -storepass MyPassword  -validity 1064
```
Note:

You must use the -keyalg parameter and specify RSA as its value as shown above as the default algorithm (DSA) used by keytool for generating the key is incompatible with Oracle Web Services Security Manager requirements.
Export the certificate containing the public key so that it can be imported into the WebCenter Portal domain's keystore:
```
keytool -exportcert -v -alias producer -keystore producer.jks -storepasskeystore_password -rfc -file producer_public_key.cer
```
Where:
- keystore_password is the keystore password, (for example, MyPassword)
Example: Exporting the Certificate Containing the Public Key
```
keytool -exportcert -v -alias producer -keystore producer.jks -storepass MyPassword  -rfc -file producer_public_key.cer
```
Import the certificate to the WebCenter Portal domain with a different alias (choose Yes when prompted whether to overwrite the existing certificate with the alias producer_public_key):
```
keytool -importcert -alias producer_public_key -file producer_public_key.cer  -keystore webcenter.jks -storepass keystore_password
```
Where:
- keystore_password is the keystore password (for example, MyPassword)
Example: Importing the Certificate
```
keytool -importcert -alias producer_public_key -file producer_public_key.cer  -keystore webcenter.jks -storepass MyPassword
```

25.3 Securing WebCenter Portal for Applications Consuming WebCenter Portal Client API with WS-Security

This section describes the administrator tasks required to configure WS-Security for WebCenter Portal so that the communication between an application exposing the WebCenter Portal API (the consumer) and WebCenter Portal (the producer) is secure, and that the identity of the user invoking the API is protected.

This section includes the following topics:

25.3.1 Configuring a Typical Topology for Applications Consuming WebCenter Portal Client API

If your client application is part of the same domain as WebCenter Portal, you only need to specify the following for the GroupSpaceWSContext():

GroupSpaceWSContext context = new GroupSpaceWSContext();
context.setRecipientKeyAlias("producer");

Note:

The alias here should always be the public key.

If your client application is JDeveloper and you have access to the WebCenter Portal server's configured keystore, copy the same keystore to JDeveloper's DefaultDomain/config/fmwconfig/dir and configure the JDeveloper domain to use this keystore. The steps are exactly same as those in Creating the WebCenter Portal Domain Keystore, and you would then also need to specify the following on your client stub:

GroupSpaceWSContext context = new GroupSpaceWSContext();
context.setRecipientKeyAlias("producer");

25.3.2 Configuring a Multiple Domain Topology for Applications Consuming the WebCenter Portal Client API

If your client application is part of the same domain as WebCenter Portal, you only need to specify the following for the GroupSpaceWSContext():

GroupSpaceWSContext context = new GroupSpaceWSContext();
context.setRecipientKeyAlias("producer");

Note:

The alias here should always be the public key.

If your client application is JDeveloper, copy the same keystore to JDeveloper's DefaultDomain/config/fmwconfig/dir and configure the JDeveloper domain to use this keystore. The steps are exactly same as those in Creating the WebCenter Portal Domain Keystore, and you would then also need to specify the following on your client stub:

GroupSpaceWSContext context = new GroupSpaceWSContext();
context.setRecipientKeyAlias("producer");

25.4 JKS Command Summary for a Typical Topology

Use the following command summary to quickly configure the keystore for a typical topology. These commands explain how to configure a JKS keystore.

WebCenter Side

Use the following keytool commands to generate the keystore, replacing the values in bold with those for your local environment:

keytool -genkeypair -keyalg RSA -dname "cn=spaces,dc=example,dc=com" -alias webcenter -keypass MyPassword -keystore webcenter.jks -storepass MyPassword -validity 1064
keytool -exportcert -v -alias webcenter -keystore webcenter.jks -storepass MyPassword -rfc -file webcenter_public.cer

SOA Side

keytool -genkeypair -keyalg RSA -dname "cn=bpel,dc=example,dc=com" -alias bpel -keypass MyPassword -keystore bpel.jks -storepass MyPassword -validity 1024
keytool -exportcert -v -alias bpel -keystore bpel.jks -storepass MyPassword -rfc -file bpel.cer
keytool -importcert -alias webcenter_spaces_ws -file webcenter_public.cer -keystore bpel.jks -storepass welcome1

WebCenter Side

keytool -importcert -alias bpel -file bpel.cer -keystore webcenter.jks -storepass welcome1

Copy the webcenter.jks file to your domain_home/config/fmwconfig directory, and the bpel.jks file to your soa_domain_home/config/fmwconfig directory.

Configure the SOA Domain Keystore

Run the following WLST command to register the keystore:

configureWSMKeystore('/WLS/WC_Domain',JKS, 'webcenter.jks', signAlias='producer', signAliasPassword='signAliasPassword', cryptAlias='cryptAlias', cryptAliasPassword='cryptAliasPassword')

Where:

WC_Domain — TheWebCenter Portal domain
signAliasPassword — The password for the public key
cryptAlias — The public key alias
cryptAliasPassword — The password for the public key

For example:

configureWSMKeystore(context='/WLS/WC_Domain', keystoreType='JKS', location='./consumer.jks',keystorePassword='welcome1', signAlias='consumer', signAliasPassword='welcome1', cryptAlias='consumer', cryptAliasPassword='welcome1')

25.5 JKS Command Summary for Extensions to a Typical Topology

Use the following command summary to quickly configure the keystore and DF properties for a multi-domain topology.

WebCenter Side

Use the following keytool commands to generate the keystore, replacing the values in bold with those for your local environment:

keytool -genkeypair -keyalg RSA -dname  "cn=spaces,dc=example,dc=com" -alias webcenter -keypass MyPassword -keystore webcenter.jks -storepass MyPassword -validity 1064

keytool -exportcert -v -alias webcenter -keystore webcenter.jks -storepass MyPassword -rfc -file webcenter_public.cer

SOA Side.

keytool -genkeypair -keyalg RSA -dname "cn=bpel,dc=example,dc=com" -alias bpel -keypass MyPassword -keystore bpel.jks

keytool -exportcert -v -alias bpel -keystore bpel.jks -storepass MyPassword -rfc -file bpel.cer

keytool -importcert -alias webcenter_spaces_ws -file webcenter_public.cer -keystore bpel.jks -storepass welcome1

When prompted to trust the certificate, say yes.

keytool -importcert -alias webcenter_spaces_ws -file bpel.cer -keystore bpel.jks -storepass MyPassword

Note:

Maintain the name of the alias as 'webcenter_spaces_ws'.

Configure the SOA Domain Keystore

Run the following WLST command to register the keystore:

configureWSMKeystore(context='/WLS/wc_domain',keystoreType='JKS',location='./bpel.jks',keystorePassword='welcome1',signAlias='producer',signAliasPassword='welcome1',cryptAlias='producer',cryptAliasPassword='welcome1')

Where:

wc_domain — TheWebCenter Portal domain
signAliasPassword — The password for the public key
cryptAlias — The public key alias
cryptAliasPassword — The password for the public key