Configuring access with Certificate or AAA on ASA5520

Hi there!
I'm trying to configure a Cisco ASA 5520 to authenticate SSL VPN users via either certificate or local AAA, ie, normally the user will connect with a certificate but from time to time, users may forget their card at work and I would like to offer them an alternative way of logging via user and password.
When I try to configure this:
I access to Remote Access VPN > Clientless SSL VPN Access > Connection Profiles > Basic
The device gives 3 authentication methods: AAA, certificate and both
The question is: Is there anyway of configuring certificate as the main authentication method and AAA as a backup method?
Thank you in advance

This will be possible in the future, currently the following bug will be affecting you
CSCef16611
WebVPN configured for both AAA and Certificate Auth only does certs
Symptom:
If WebVPN authentication is configured for both AAA and certificates in the tunnel-group, only certificate authentication takes place.
Conditions:
WebVPN authentication is configured for both AAA and certificates.
Workaround:
None availble. Currently WebVPN auhenticaiton is by AAA or Certificates, and not both simultaneously.
It will always take CERT if both are configured.

Similar Messages

  • Configuring Mobile Access with single public ip in test environment

    Hi to all, I'm trying to configure a test lab environment for Lync 2013. Actually I installed DC+FE in 2 separate servers and domain and off-domain pc (with exported CA chain ad certificate) works perfectly. My goal is now to configure access for mobiles
    (iphone\ipad). In my country (Italy) Lync is not really diffused like in USA. Now my question. I've a lone public ip for testing, is it possible to make it works? What have i to install now? Edge? Reverse Proxy? Both?? I wanna have less resource possibile
    implicated in this lab environment also if this means "not supported".
    Thank you for the support.
    A.

    Edge server is needed when you need to support audio/video modality and push notification.
    You can deploy Lync mobility service without Edge Server in a lab environment.
    Lisa Zheng
    TechNet Community Support

  • Creating SSL certificate and configuring it with JBOSS 4.0.1

    I have to post some data to a secured site from my application.
    For this, I am creating connection to that site using URLConnection and to send data I create OutputStream using the connection.
    But, while creating the stream it is showing SSLException and message is No trusted certificate found.
    For this, I need to create SSL certificate (mostly using keytool command) and configure it with my application server which is JBOSS 4.0.1
    Now, my problem is that I don't know the exact steps to create a certificate and configure it with JBOSS. Please provide the steps in detail.

    I think you have this back to front. Unless this exception came from the server, in which case it is misconfigured, you don't have to create a certificate, you have to import the server's certificate, or that of one of its signers, into the client's truststore, and tell Java where the truststore is if it's in a non-standard location.
    See http://java.sun.com/j2se/1.5.0/docs/guide/security/jsse/JSSERefGuide.html. You'll have to ask about the JBoss part in a JBoss forum.

  • How to configure the wifi access with specific time slot for kids?

    how to configure the wifi access with specific time slot for kids?

    Which model of AirPort base station do you have? Which version of OS X is your MacBook Pro running?
    Wi-Fi access can be limited using the Timed Access feature of the AirPort routers. You would do so using the AirPort Utility.

  • Configuring Access Control with OIM 11gR2

    Hi,
    I have to configure Access Control resource with OIM 11gR2. Kindly share relevant pointers.
    Best Regards,
    Varun

    I think this link will be Helpful
    22.5.1 Configuring Oracle Application Access Controls Governor
    http://docs.oracle.com/cd/E27559_01/dev.1112/e27150/segduties.htm#OMDEV3394

  • Configured Nacs- how to restrict AAA client access by specified Password

    Hi all
    i hav given the below config in AAA Client& added the Client in User,Group, the NAR is configured for all Clients ,
    But my requirement is restrict AAA client access by specified Password
    aaa new-model
    aaa group server tacacs+ NACS_Group1
    server 10.x.x.x
    server 10.y.y.y
    aaa authentication login default group NACS_Group1 local
    aaa authentication enable default group NACS_Group1 enable
    aaa authorization config-commands
    aaa authorization exec default group NACS_Group1 if-authenticated
    aaa authorization exec NACS_Group1 group tacacs+ local
    aaa authorization commands 1 default group tacacs+ if-authenticated
    aaa authorization commands 15 default group tacacs+ if-authenticated
    aaa accounting commands 1 default start-stop group tacacs+
    aaa accounting commands 15 default start-stop group tacacs+

    You use the Network Access Restrictions table in the Advanced Settings area of User Setup to set NARs in three ways:
    Apply existing shared NARs by name.
    Define IP-based access restrictions to permit or deny user access to a specified AAA client or to specified ports on an AAA client when an IP connection has been established.
    Define CLI/DNIS-based access restrictions to permit or deny user access based on the CLI/DNIS that is used.
    Note: You can also use the CLI/DNIS-based access restrictions area to specify other values. See the Network Access Restrictions section for more information.

  • IKEv2 with certificates

    Example provided is on 1941 ISR routers with 15.2(2)T1 software.  One router has 15.3(1)T.
    IKEv2 with pre-shared key comes up fine.
    IKEv2 with certificates gives auth exchange fail error
    IKEv1 with same certificates comes up fine.
    The above were Microsoft CA certificates.
    I tried with IOS CA certificates, still auth exchange fail error.
    Same results with 3945 and 2911 routers on IOS 15.1(2)T

    This is details of how I got it working.
    sho   tech ipsec
    ------------------ show version ------------------
    Cisco IOS Software, C2900 Software (C2900-UNIVERSALK9-M), Version 15.2(2)T1, RELEASE SOFTWARE (fc1)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2012 by Cisco Systems, Inc.
    Compiled Wed 29-Feb-12 20:40 by prod_rel_team
    ROM: System Bootstrap, Version 15.0(1r)M15, RELEASE SOFTWARE (fc1)
    happy uptime is 30 minutes
    System returned to ROM by power-on
    System restarted at 20:26:58 UTC Fri Mar 1 2013
    System image file is "flash0:c2900-universalk9-mz.SPA.152-2.T1.bin"
    Last reload type: Normal Reload
    Last reload reason: power-on
    This product contains cryptographic features and is subject to United
    States and local country laws governing import, export, transfer and
    use. Delivery of Cisco cryptographic products does not imply
    third-party authority to import, export, distribute or use encryption.
    Importers, exporters, distributors and users are responsible for
    compliance with U.S. and local country laws. By using this product you
    agree to comply with applicable laws and regulations. If you are unable
    to comply with U.S. and local laws, return this product immediately.
    A summary of U.S. laws governing Cisco cryptographic products may be found at:
    http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
    If you require further assistance please contact us by sending email to
    [email protected].
    Cisco CISCO2911/K9 (revision 1.0) with 487424K/36864K bytes of memory.
    Processor board ID FTX1621AJFU
    3 Gigabit Ethernet interfaces
    1 terminal line
    1 Virtual Private Network (VPN) Module
    DRAM configuration is 64 bits wide with parity enabled.
    255K bytes of non-volatile configuration memory.
    250880K bytes of ATA System CompactFlash 0 (Read/Write)
    License Info:
    License UDI:
    Device#      PID            SN
    *0        CISCO2911/K9          FTX1621AJFU    
    Technology Package License Information for Module:'c2900'
    Technology    Technology-package           Technology-package
                  Current       Type           Next reboot 
    ipbase        ipbasek9      Permanent      ipbasek9
    security      securityk9    Permanent      securityk9
    uc            None          None           None
    data          None          None           None
    Configuration register is 0x2102
    ------------------ show running-config ------------------
    Building configuration...
    Current configuration : 6483 bytes
    ! Last configuration change at 20:56:07 UTC Fri Mar 1 2013 by csfc
    ! NVRAM config last updated at 20:55:05 UTC Fri Mar 1 2013 by csfc
    ! NVRAM config last updated at 20:55:05 UTC Fri Mar 1 2013 by csfc
    version 15.2
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname happy
    boot-start-marker
    boot-end-marker
    security passwords min-length 6
    logging buffered 51200 warnings
    no logging console
    enable secret 4 4Q5iiIH2YznVeGHA3p6Qjm8oBj4LWNDTHjsG21MxgXU
    no aaa new-model
    no ipv6 cef
    ip auth-proxy max-login-attempts 5
    ip admission max-login-attempts 5
    ip domain name csfc.com
    ip name-server 192.168.1.3
    no ip cef
    multilink bundle-name authenticated
    crypto pki token default removal timeout 0
    crypto pki trustpoint dc-ca
    enrollment terminal
    subject-name cn=happy.csfc,c=us
    revocation-check none
    crypto pki certificate map CRT 10
    issuer-name co csfc
    crypto pki certificate chain dc-ca
    certificate 3F51979A000000000012
      3082038E 30820333 A0030201 02020A3F 51979A00 00000000 12300A06 082A8648
      CE3D0403 02303B31 13301106 0A099226 8993F22C 64011916 03636F6D 31143012
      060A0992 268993F2 2C640119 16046373 6663310E 300C0603 55040313 0564632D
      6361301E 170D3133 30333031 31383532 35365A17 0D313530 33303131 38353235
      365A3022 310B3009 06035504 06130275 73311330 11060355 0403130A 68617070
      792E6373 66633059 30130607 2A8648CE 3D020106 082A8648 CE3D0301 07034200
      0429D4D8 F89E295B F7AF826F 86A3F29D EF48FCFF D2374B0F D39CD393 620D3EFD
      D484BFA4 3ED08E16 7FDF839D 0FF85690 26C0545C 1B56EC17 7A2E6C1D 5D1A6CD8
      DDA38202 36308202 32300B06 03551D0F 04040302 06C0301D 0603551D 0E041604
      142DCC8D 554A4853 C4C03B3D 2400E3EA 459406B5 AE301F06 03551D23 04183016
      80142389 F56583FC B73D3F11 79A47EAB 96721E76 81AA3081 BB060355 1D1F0481
      B33081B0 3081ADA0 81AAA081 A78681A4 6C646170 3A2F2F2F 434E3D64 632D6361
      2C434E3D 44432C43 4E3D4344 502C434E 3D507562 6C696325 32304B65 79253230
      53657276 69636573 2C434E3D 53657276 69636573 2C434E3D 436F6E66 69677572
      6174696F 6E2C4443 3D637366 632C4443 3D636F6D 3F636572 74696669 63617465
      5265766F 63617469 6F6E4C69 73743F62 6173653F 6F626A65 6374436C 6173733D
      63524C44 69737472 69627574 696F6E50 6F696E74 3081B406 082B0601 05050701
      010481A7 3081A430 81A10608 2B060105 05073002 8681946C 6461703A 2F2F2F43
      4E3D6463 2D63612C 434E3D41 49412C43 4E3D5075 626C6963 2532304B 65792532
      30536572 76696365 732C434E 3D536572 76696365 732C434E 3D436F6E 66696775
      72617469 6F6E2C44 433D6373 66632C44 433D636F 6D3F6341 43657274 69666963
      6174653F 62617365 3F6F626A 65637443 6C617373 3D636572 74696669 63617469
      6F6E4175 74686F72 69747930 3C06092B 06010401 82371507 042F302D 06252B06
      01040182 37150881 98D47A81 B6D74A87 A98B18DF C60887B8 D4794787 BCE00C86
      9D892C02 01640201 11301306 03551D25 040C300A 06082B06 01050508 0202301B
      06092B06 01040182 37150A04 0E300C30 0A06082B 06010505 08020230 0A06082A
      8648CE3D 04030203 49003046 022100E7 E5814B90 CE6EABE2 B12C818A 6323160D
      632C0551 B765DA29 0CA4BAAC 27325F02 2100E516 11985F3E CDB23FE7 BB91C836
      74C457BB 5EA87ED6 3D9DCF41 AE4CDD40 A28F
          quit
    certificate ca 2C8A76A7904BB4B341B3AAFA9ED387D3
      308201DC 30820183 A0030201 0202102C 8A76A790 4BB4B341 B3AAFA9E D387D330
      0A06082A 8648CE3D 04030230 3B311330 11060A09 92268993 F22C6401 19160363
      6F6D3114 3012060A 09922689 93F22C64 01191604 63736663 310E300C 06035504
      03130564 632D6361 301E170D 31333031 32333135 32383435 5A170D31 38303132
      33313533 3834345A 303B3113 3011060A 09922689 93F22C64 01191603 636F6D31
      14301206 0A099226 8993F22C 64011916 04637366 63310E30 0C060355 04031305
      64632D63 61305930 1306072A 8648CE3D 02010608 2A8648CE 3D030107 03420004
      EFA5B6B5 BC89C22A B91DDDBB 60034DB9 21655D71 3965177D 9D5956D0 8C45ABC9
      38EB4175 44AA06DC 19B94DAB 368AC06C 35077B97 24BE5879 758256FA 03838F2F
      A3693067 30130609 2B060104 01823714 0204061E 04004300 41300E06 03551D0F
      0101FF04 04030201 86300F06 03551D13 0101FF04 05300301 01FF301D 0603551D
      0E041604 142389F5 6583FCB7 3D3F1179 A47EAB96 721E7681 AA301006 092B0601
      04018237 15010403 02010030 0A06082A 8648CE3D 04030203 47003044 022010BD
      C2ADC8B7 C2C05DB2 CFE2E78A B3A47E2E 8A3193CA 607E4AE3 EEF105F0 42CE0220
      056C951C 45ECD966 DFA9BADB 9F1CC71E 8F029C12 F94593A6 21B50A49 C1E62581
          quit
    license udi pid CISCO2911/K9 sn FTX1621AJFU
    username csfc privilege 15 secret 4
    username admin privilege 15 secret 4
    username Happy privilege 15 secret 4
    redundancy
    crypto ikev2 proposal prop-1
    encryption aes-cbc-256
    integrity sha256
    group 19
    crypto ikev2 policy policy1
    proposal prop-1
    crypto ikev2 profile default
    match certificate CRT
    identity local dn
    authentication local ecdsa-sig
    authentication remote rsa-sig
    authentication remote ecdsa-sig
    pki trustpoint dc-ca
    no crypto ikev2 diagnose error
    no crypto ikev2 http-url cert
    crypto ikev2 certificate-cache 750
    crypto ikev2 fragmentation mtu 1400
    crypto logging ikev2
    crypto ipsec transform-set SEC esp-aes esp-sha256-hmac
    crypto ipsec profile default
    set transform-set SEC
    set ikev2-profile default
    interface Tunnel0
    no ip address
    interface Tunnel1
    ip address 192.168.100.1 255.255.255.0
    tunnel source GigabitEthernet0/1
    tunnel destination 192.168.11.42
    tunnel protection ipsec profile default
    interface Embedded-Service-Engine0/0
    no ip address
    shutdown
    interface GigabitEthernet0/0
    ip address 192.168.1.40 255.255.255.0
    duplex full
    speed auto
    interface GigabitEthernet0/1
    ip address 192.168.11.41 255.255.255.252
    duplex full
    speed auto
    interface GigabitEthernet0/2
    no ip address
    shutdown
    duplex auto
    speed auto
    ip forward-protocol nd
    ip http server
    ip http access-class 23
    ip http authentication local
    ip http secure-server
    ip http timeout-policy idle 60 life 86400 requests 10000
    ip route 192.168.2.0 255.255.255.0 Tunnel1
    no cdp advertise-v2
    control-plane
    banner login ^CCPLEEEESE!^C
    line con 0
    login local
    line aux 0
    line 2
    no activation-character
    no exec
    transport preferred none
    transport input all
    transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
    stopbits 1
    line vty 0 4
    privilege level 15
    password
    login local
    transport input ssh
    line vty 5 15
    access-class 23 in
    privilege level 15
    login local
    transport input telnet ssh
    scheduler allocate 20000 1000
    sntp server 192.168.1.3 version 3
    end
    ------------------ show crypto tech-support ------------------
    ------------------ show crypto isakmp sa count ------------------
    Active ISAKMP SA's: 0
    Standby ISAKMP SA's: 0
    Currently being negotiated ISAKMP SA's: 0
    Dead ISAKMP SA's: 0
    ------------------ show crypto ipsec sa count ------------------
    IPsec SA total: 2, active: 2, rekeying: 0, unused: 0, invalid: 0
    ------------------ show crypto isakmp sa detail ------------------
    Codes: C - IKE configuration mode, D - Dead Peer Detection
           K - Keepalives, N - NAT-traversal
           T - cTCP encapsulation, X - IKE Extended Authentication
           psk - Preshared key, rsig - RSA signature
           renc - RSA encryption
    IPv4 Crypto ISAKMP SA
    C-id  Local           Remote          I-VRF  Status Encr Hash   Auth DH Lifetime Cap.
    IPv6 Crypto ISAKMP SA
    ------------------ show crypto ipsec sa detail ------------------
    interface: Tunnel1
        Crypto map tag: Tunnel1-head-0, local addr 192.168.11.41
       protected vrf: (none)
       local  ident (addr/mask/prot/port): (192.168.11.41/255.255.255.255/47/0)
       remote ident (addr/mask/prot/port): (192.168.11.42/255.255.255.255/47/0)
       current_peer 192.168.11.42 port 500
         PERMIT, flags={origin_is_acl,}
        #pkts encaps: 271, #pkts encrypt: 271, #pkts digest: 271
        #pkts decaps: 275, #pkts decrypt: 275, #pkts verify: 275
        #pkts compressed: 0, #pkts decompressed: 0
        #pkts not compressed: 0, #pkts compr. failed: 0
        #pkts not decompressed: 0, #pkts decompress failed: 0
        #pkts no sa (send) 0, #pkts invalid sa (rcv) 0
        #pkts encaps failed (send) 0, #pkts decaps failed (rcv) 0
        #pkts invalid prot (recv) 0, #pkts verify failed: 0
        #pkts invalid identity (recv) 0, #pkts invalid len (rcv) 0
        #pkts replay rollover (send): 0, #pkts replay rollover (rcv) 0
        ##pkts replay failed (rcv): 0
        #pkts tagged (send): 0, #pkts untagged (rcv): 0
        #pkts not tagged (send): 0, #pkts not untagged (rcv): 0
        #pkts internal err (send): 0, #pkts internal err (recv) 0
         local crypto endpt.: 192.168.11.41, remote crypto endpt.: 192.168.11.42
         path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/1
         current outbound spi: 0x1DF8CFFA(502845434)
         PFS (Y/N): N, DH group: none
         inbound esp sas:
          spi: 0xBF473CF2(3209116914)
            transform: esp-aes esp-sha256-hmac ,
            in use settings ={Tunnel, }
            conn id: 5, flow_id: SW:5, sibling_flags 80000040, crypto map: Tunnel1-head-0
            sa timing: remaining key lifetime (k/sec): (4181836/3479)
            IV size: 16 bytes
            replay detection support: Y
            Status: ACTIVE(ACTIVE)
         inbound ah sas:
         inbound pcp sas:
         outbound esp sas:
          spi: 0x1DF8CFFA(502845434)
            transform: esp-aes esp-sha256-hmac ,
            in use settings ={Tunnel, }
            conn id: 6, flow_id: SW:6, sibling_flags 80000040, crypto map: Tunnel1-head-0
            sa timing: remaining key lifetime (k/sec): (4181837/3479)
            IV size: 16 bytes
            replay detection support: Y
            Status: ACTIVE(ACTIVE)
         outbound ah sas:
         outbound pcp sas:
    ------------------ show crypto session summary ------------------
    ------------------ show crypto session detail ------------------
    Crypto session current status
    Code: C - IKE Configuration mode, D - Dead Peer Detection    
    K - Keepalives, N - NAT-traversal, T - cTCP encapsulation    
    X - IKE Extended Authentication, F - IKE Fragmentation
    Interface: Tunnel1
    Uptime: 00:02:00
    Session status: UP-ACTIVE    
    Peer: 192.168.11.42 port 500 fvrf: (none) ivrf: (none)
          Phase1_id: cn=grumpy.csfc,c=us
          Desc: (none)
      IKEv2 SA: local 192.168.11.41/500 remote 192.168.11.42/500 Active
              Capabilities:(none) connid:3 lifetime:23:58:00
      IPSEC FLOW: permit 47 host 192.168.11.41 host 192.168.11.42
            Active SAs: 2, origin: crypto map
            Inbound:  #pkts dec'ed 275 drop 0 life (KB/Sec) 4181836/3479
            Outbound: #pkts enc'ed 271 drop 0 life (KB/Sec) 4181837/3479
    ------------------ show crypto isakmp peers ------------------
    ------------------ show crypto ruleset detail ------------------
    Mtree:
    199 VRF 0  11 192.168.11.41/500 ANY Forward, Forward
    299 VRF 0  11 192.168.11.41/4500 ANY Forward, Forward
    200000199 VRF 0  11 ANY/848 ANY Forward, Forward
    200000299 VRF 0  11 ANY ANY/848 Forward, Forward
    6553700000000000101 VRF 0  2F 192.168.11.41 192.168.11.42 Discard/notify, Encrypt
    6553700000000000199 VRF 0  2F 192.168.11.41 192.168.11.42 Discard/notify, Discard/notify
    ------------------ show processes memory | include  Crypto IKMP ------------------
    260   0       5432        880      18424          3          3 Crypto IKMP    
    ------------------ show processes cpu |  include Crypto IKMP ------------------
    260           0           6          0  0.00%  0.00%  0.00%   0 Crypto IKMP     
    ------------------ show crypto eli ------------------
    Hardware Encryption : ACTIVE
    Number of hardware crypto engines = 1
    CryptoEngine Onboard VPN details: state = Active
    Capability    : IPPCP, DES, 3DES, AES, IPv6, GDOI, FAILCLOSE, HA
    IPSec-Session :     0 active,  3200 max, 0 failed
    ------------------ show cry engine accelerator statistic ------------------
    Device:   Onboard VPN
    Location: Onboard: 0
        :Statistics for encryption device since the last clear
         of counters 1826 seconds ago
                      0 packets in                           0 packets out          
                      0 bytes in                             0 bytes out            
                      0 paks/sec in                          0 paks/sec out         
                      0 Kbits/sec in                         0 Kbits/sec out        
                      0 packets decrypted                    0 packets encrypted    
                      0 bytes before decrypt                 0 bytes encrypted      
                      0 bytes decrypted                      0 bytes after encrypt  
                      0 packets decompressed                 0 packets compressed   
                      0 bytes before decomp                  0 bytes before comp    
                      0 bytes after decomp                   0 bytes after comp     
                      0 packets bypass decompr               0 packets bypass compres
                      0 bytes bypass decompres               0 bytes bypass compressi
                      0 packets not decompress               0 packets not compressed
                      0 bytes not decompressed               0 bytes not compressed 
                      1.0:1 compression ratio                1.0:1 overall
            Last 5 minutes:
                      0 packets in                           0 packets out          
                      0 paks/sec in                          0 paks/sec out         
                      0 bits/sec in                          0 bits/sec out         
                      0 bytes decrypted                      0 bytes encrypted      
                      0 Kbits/sec decrypted                  0 Kbits/sec encrypted  
                      1.0:1 compression ratio                1.0:1 overall
    ------------------ show cry isakmp diagnose error ------------------
    Exit Path Table - status: disable, current entry 0, deleted 0, max allow 10
    ------------------ show cry isakmp diagnose error count ------------------
    Exit Trace counters
    ------------------ show crypto call admission statistics ------------------
                   Crypto Call Admission Control Statistics
    System Resource Limit:        0 Max IKE SAs:     0 Max in nego:  1000
    Total IKE SA Count:           0 active:          0 negotiating:     0
    Incoming IKE Requests:        0 accepted:        0 rejected:        0
    Outgoing IKE Requests:        0 accepted:        0 rejected:        0
    Rejected IKE Requests:        0 rsrc low:        0 Active SA limit: 0
                                                       In-neg SA limit: 0
    IKE packets dropped at dispatch:        0
    Max IPSEC SAs:     0
    Total IPSEC SA Count:           0 active:          0 negotiating:     0
    Incoming IPSEC Requests:        0 accepted:        0 rejected:        0
    Outgoing IPSEC Requests:        0 accepted:        0 rejected:        0
    Phase1.5 SAs under negotiation:         0
    sho ip int bri
    Interface                  IP-Address      OK? Method Status                Protocol
    Embedded-Service-Engine0/0 unassigned      YES NVRAM  administratively down down   
    GigabitEthernet0/0         192.168.1.40    YES NVRAM  up                    up     
    GigabitEthernet0/1         192.168.11.41   YES NVRAM  up                    up     
    GigabitEthernet0/2         unassigned      YES NVRAM  administratively down down   
    Tunnel0                    unassigned      YES unset  up                    down   
    Tunnel1                    192.168.100.1   YES NVRAM  up                    up     
    happy#
    happy#sho crypto pki cert verb
    Certificate
      Status: Available
      Version: 3
      Certificate Serial Number (hex): 3F51979A000000000012
      Certificate Usage: Signature
      Issuer:
        cn=dc-ca
        dc=csfc
        dc=com
      Subject:
        Name: happy.csfc
        cn=happy.csfc
        c=us
      CRL Distribution Points:
        ldap:///CN=dc-ca,CN=DC,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=csfc,DC=com?certificateRevocationList?base?objectClass=cRLDistributionPoint
      Validity Date:
        start date: 18:52:56 UTC Mar 1 2013
        end   date: 18:52:56 UTC Mar 1 2015
      Subject Key Info:
        Public Key Algorithm: rsaEncryption
        EC Public Key:  (256 bit)
      Signature Algorithm: SHA256 with ECDSA
      Fingerprint MD5: BF234623 9E7F2C73 EBE07B0A 9E89FC76
      Fingerprint SHA1: DB8A8D50 23D9E2DD AC2ED2DC 5A857569 279F44D5
      X509v3 extensions:
        X509v3 Key Usage: C0000000
          Digital Signature
          Non Repudiation
        X509v3 Subject Key ID: 2DCC8D55 4A4853C4 C03B3D24 00E3EA45 9406B5AE
        X509v3 Authority Key ID: 2389F565 83FCB73D 3F1179A4 7EAB9672 1E7681AA
        Authority Info Access:
        Extended Key Usage:
            1.3.6.1.5.5.8.2.2
      Associated Trustpoints: dc-ca
      Storage: nvram:dc-ca#12.cer
      Key Label: happy.csfc.com
      Key storage device: private config
    CA Certificate
      Status: Available
      Version: 3
      Certificate Serial Number (hex): 2C8A76A7904BB4B341B3AAFA9ED387D3
      Certificate Usage: Signature
      Issuer:
        cn=dc-ca
        dc=csfc
        dc=com
      Subject:
        cn=dc-ca
        dc=csfc
        dc=com
      Validity Date:
        start date: 15:28:45 UTC Jan 23 2013
        end   date: 15:38:44 UTC Jan 23 2018
    --More--           Subject Key Info:
        Public Key Algorithm: rsaEncryption
        EC Public Key:  (256 bit)
      Signature Algorithm: SHA256 with ECDSA
      Fingerprint MD5: 1F937411 4DB57036 73D54124 E50E83FC
      Fingerprint SHA1: E78FE0BF DF5F168A 67860C48 78EC427C 66FE551A
      X509v3 extensions:
        X509v3 Key Usage: 86000000
          Digital Signature
          Key Cert Sign
          CRL Signature
        X509v3 Subject Key ID: 2389F565 83FCB73D 3F1179A4 7EAB9672 1E7681AA
        X509v3 Basic Constraints:
            CA: TRUE
        Authority Info Access:
      Associated Trustpoints: dc-ca
      Storage: nvram:dc-ca#87D3CA.cer
    happy#sho crypt key mypubkey all
    % Key pair was generated at: 18:44:07 UTC Mar 1 2013
    Key name: eckey
    Key type: EC KEYS
    Storage Device: private-config
    Usage: Signature Key
    Key is not exportable.
    Key Data:
      30593013 06072A86 48CE3D02 0106082A 8648CE3D 03010703 4200049A 28E9709A
      2F81DEE9 9ED27787 B790D3B4 487B3F2D DBA06E95 43298A54 19A3B0B7 E9107223
      5CB9F3CD 9D8BD0E9 9AB9FFC4 698C1912 CBADC469 9E7CD6D3 46E5A2
    % Key pair was generated at: 18:49:21 UTC Mar 1 2013
    Key name: happy.csfc.com
    Key type: EC KEYS
    Storage Device: private-config
    Usage: Signature Key
    Key is not exportable.
    Key Data:
      30593013 06072A86 48CE3D02 0106082A 8648CE3D 03010703 42000429 D4D8F89E
      295BF7AF 826F86A3 F29DEF48 FCFFD237 4B0FD39C D393620D 3EFDD484 BFA43ED0
      8E167FDF 839D0FF8 569026C0 545C1B56 EC177A2E 6C1D5D1A 6CD8DD
    happy#  sho crypto ike2 v2 session detail
    IPv4 Crypto IKEv2 Session
    Session-id:1, Status:UP-ACTIVE, IKE count:1, CHILD count:1
    Tunnel-id Local                 Remote                fvrf/ivrf            Status
    3         192.168.11.41/500     192.168.11.42/500     none/none            READY 
          Encr: AES-CBC, keysize: 256, Hash: SHA256, DH Grp:19, Auth sign: ECDSA, Auth verify: ECDSA
          Life/Active Time: 86400/339 sec
          CE id: 1084, Session-id: 1
          Status Description: Negotiation done
          Local spi: 239BE9D173BFD509       Remote spi: C7A295975E26147B
          Local id: cn=happy.csfc,c=us
          Remote id: cn=grumpy.csfc,c=us
          Local req msg id:  0              Remote req msg id:  2        
          Local next msg id: 0              Remote next msg id: 2        
          Local req queued:  0              Remote req queued:  2        
          Local window:      5              Remote window:      5        
          DPD configured for 0 seconds, retry 0
          NAT-T is not detected 
          Cisco Trust Security SGT is disabled
    Child sa: local selector  192.168.11.41/0 - 192.168.11.41/65535
              remote selector 192.168.11.42/0 - 192.168.11.42/65535
              ESP spi in/out: 0xBF473CF2/0x1DF8CFFA 
              AH spi in/out: 0x0/0x0 
              CPI in/out: 0x0/0x0 
              Encr: AES-CBC, keysize: 128, esp_hmac: SHA256
              ah_hmac: None, comp: IPCOMP_NONE, mode tunnel
    IPv6 Crypto IKEv2 Session
    happy#sho crypto ikev2 session sa detail
    IPv4 Crypto IKEv2  SA
    Tunnel-id Local                 Remote                fvrf/ivrf            Status
    3         192.168.11.41/500     192.168.11.42/500     none/none            READY 
          Encr: AES-CBC, keysize: 256, Hash: SHA256, DH Grp:19, Auth sign: ECDSA, Auth verify: ECDSA
          Life/Active Time: 86400/386 sec
          CE id: 1084, Session-id: 1
          Status Description: Negotiation done
          Local spi: 239BE9D173BFD509       Remote spi: C7A295975E26147B
          Local id: cn=happy.csfc,c=us
          Remote id: cn=grumpy.csfc,c=us
          Local req msg id:  0              Remote req msg id:  2        
          Local next msg id: 0              Remote next msg id: 2        
          Local req queued:  0              Remote req queued:  2        
          Local window:      5              Remote window:      5        
          DPD configured for 0 seconds, retry 0
          NAT-T is not detected 
          Cisco Trust Security SGT is disabled
    IPv6 Crypto IKEv2  SA
    happy#sho crypto ikev2 sa detail         stats
                              Crypto IKEv2 SA Statistics
    System Resource Limit:   0        Max IKEv2 SAs: 0        Max in nego: 1000   
    Total IKEv2 SA Count:    1        active:        1        negotiating: 0    
    Incoming IKEv2 Requests: 34       accepted:      34       rejected:    0      
    Outgoing IKEv2 Requests: 50       accepted:      50       rejected:    0      
    Rejected IKEv2 Requests: 0        rsrc low:      0        SA limit:    0      
    IKEv2 packets dropped at dispatch: 0      
    Incoming IKEV2 Cookie Challenged Requests: 0      
        accepted: 0        rejected: 0        rejected no cookie: 0      
    happy#exit

  • 3rd party Certificate and AAA Authentication

    I am using a cisco asa5520 and i have set up remote access vpn with an AnyConnect connection profile.
    In the connection profile i have set up that users should authenticate using both certificate and AAA.
    Due to a high security requirement, the user certificate is issued from a 3rd party.
    This is working fine and the user now need a valid certificate and a username/password to authenticate successfully.
    I added the CA certificate as a associated trustpoint on the ASA box to get the certificate verification working.
    Problem:
    If Jane and Joe both have a valid certificate AND a valid username/password, Jane could authenticate using a combo of Joes certificate, and Janes username/password. Both are valid (isolated), but i only want jane to be able to authenticate with her username/password and her personal certificate.
    I got an idea that i could put the Serial Number of the users certificate on the user object in AD (on the users department field or something like that) and check if this value match during authentication.
    So, to sum things up, i want to compare the Serial Number (SER) field of the users certificate with a field on the user object in AD during authentication. As far as i can see the user would need a valid certificate and a valid username/password to authenticate. The user would also be authenticated only if the serial field match the value on the user object in AD.
    I am happy for any help that could point me in the right direction on how to accomplish this.
    Best regards,
    Kenneth

    I actually got a better idea, and i think this will work great!
    One of the guys at work pointed out that the sAMAAccountName is still used in many areas even though it is called pre-windows 2000.
    After some trying and failing i got the idea that should try to change the "Naming Attribute(s)" on the defined AAA (ldap) server under "AAA server groups".
    So i change the Naming attribute to "department", and put in the certificate serial number. I changed the connection profile and specified that it should use the "SER" value from the certificate as username. After that i tried to log in, and voila:
    [123] LDAP Search:
            Base DN = [dc=Testlab,dc=local]
            Filter  = [department=xxxx-xxxx-xxxxxxxxx]
            Scope   = [SUBTREE]
    [123] User DN = [CN=Peter Pan,OU=Wonderland,DC=testlab,DC=local]
    The ldap debug is clear, the ldap query during authentication is now searching for the user using the department field, and looking for the value of the serial number from my certificate.
    I wasnt quite happy about using the "department" field and i took a look at the user object looking for a more suitable attribute. To my surprise the user has got a "serialNumber" attribute, and it can hold multiple values. I changed the "Naming Attribute(s)" from "department" to "serialNumber" and added the serial number from the certificat to the "serialNumber" attribute on the user object:
    [138] LDAP Search:
            Base DN = [dc=Testlab,dc=local]
            Filter  = [serialNumber=xxxx-xxxx-xxxxxxxxx]
            Scope   = [SUBTREE]
    [138] User DN = [CN=Peter Pan,OU=Wonderland,DC=testlab,DC=local]
    Worked like a charm!
    I will settle for this solution, i cant see any issues regarding security, and it will be a breeze to admin. I will make a tool now so i can search for users in AD and update/view this attribute on the user objects.
    Thank you for the input Marcin

  • How to configure sso with SSL step by step

    Purpose
    In this document, you can learn how to configure SSO with SSL. After user have certificate installed in browser, he can login without input username and password.
    Overview
    In this document we will demonstrate:
    1.     How to configure OHS support SSL
    2.     How to Register SSO with SSL
    3.     Configure SSO for certificates
    Prerequisites
    Before start this document, you should have:
    1.     Oracle AS 10g infrastructure installed (10.1.2)
    2.     OCA installed
    Note:
    1.     “When you install Oracle infrastructure, please make sure you have select OCA.
    2.     How Certificate-Enabled Authentication Works:
    a.     The user tries to access a partner application.
    b.     The partner application redirects the user to the single sign-on server for authentication. As part of this redirection, the browser sends the user's certificate to the login URL of the server (2a). If it is able to verify the certificate, the server returns the user to the requested application.
    c.     The application delivers content. Users whose browsers are configured to prompt for a certificate-store password may only have to present this password once, depending upon how their browser is configured. If they log out and then attempt to access a partner application, the browser passes their certificate to the single sign-on server automatically. This means that they never really log out. To effectively log out, they must close the browser.
    Enable SSL on the Single Sign-On Middle Tier
    The following steps involve configuring the Oracle HTTP Server. Perform them on the single sign-on middle tier. In doing so, keep the following in mind:
    l     You must configure SSL on the computer where the single sign-on middle tier is running.
    l     You are configuring one-way SSL.
    l     You may enable SSL for simple network encryption; PKI authentication is not required. Note though that you must use a valid wallet and server certificate. The default wallet location is ORACLE_HOME/Apache/Apache/conf/ssl.wlt/default.
    1.     Back up the opmn.xml file, found at ORACLE_HOME/opmn/conf
    2.     In opmn.xml, change the value for the start-mode parameter to ssl-enabled. This parameter appears in boldface in the xml tag immediately following.
    <ias-component id="HTTP_Server">
    <process-type id="HTTP_Server" module-id="OHS">
    <module-data>
    <category id="start-parameters">
    <data id="start-mode" value="ssl-enabled"/>
    </category>
    </module-data>
    <process-set id="HTTP_Server" numprocs="1"/>
    </process-type>
    </ias-component>
    3.     Update the distributed cluster management database with the change: ORACLE_HOME/dcm/bin/dcmctl updateconfig -ct opmn
    4.     Reload the modified opmn configuration file:
    ORACLE_HOME/opmn/bin/opmnctl reload
    5.     Keep a non-SSL port active. The External Applications portlet communicates with the single sign-on server over a non-SSL port. The HTTP port is enabled by default. If you have not disabled the port, this step requires no action.
    6.     Apply the rule mod_rewrite to SSL configuration. This step involves modifying the ssl.conf file on the middle-tier computer. The file is at ORACLE_HOME/Apache/Apache/conf. Back up the file before editing it.
    Because the Oracle HTTP Server has to be available over both HTTP and HTTPS, the SSL host must be configured as a virtual host. Add the lines that follow to the SSL Virtual Hosts section of ssl.conf if they are not already there. These lines ensure that the single sign-on login module in OC4J_SECURITY is invoked when a user logs in to the SSL host.
    <VirtualHost ssl_host:port>
    RewriteEngine on
    RewriteOptions inherit
    </VirtualHost>
    Save and close the file.
    7.     Update the distributed cluster management database with the changes:
    ORACLE_HOME/dcm/bin/dcmctl updateconfig -ct ohs
    8.     Restart the Oracle HTTP Server:
    ORACLE_HOME/opmn/bin/opmnctl stopproc process-type=HTTP_Server
    ORACLE_HOME/opmn/bin/opmnctl startproc process-type=HTTP_Server
    9.     Verify that you have enabled the single sign-on middle tier for SSL by trying to access the OracleAS welcome page, using the format https://host:ssl_port.
    Reconfigure the Identity Management Infrastructure Database
    Change all references of http in single sign-on URLs to https within the identity management infrastructure database. When you change single sign-on URLs in the database, you must also change these URLs in the targets.xml file on the single sign-on middle tier. targets.xml is the configuration file for the various "targets" that Oracle Enterprise Manager monitors. One of these targets is OracleAS Single Sign-On.
    1.     Change Single Sign-On URLs
    Run the ssocfg script, taking care to enter the command on the computer where the single sign-on middle tier is located. Use the following syntax:
    UNIX:
    $ORACLE_HOME/sso/bin/ssocfg.sh protocol host ssl_port
    Windows:
    %ORACLE_HOME%\sso\bin\ssocfg.bat protocol host ssl_port
    In this case, protocol is https. (To change back to HTTP, use http.) The parameter host is the host name, or server name, of the Oracle HTTP listener for the single sign-on server.
    Here is an example:
    ssocfg.sh https login.acme.com 4443
    2. Restart OC4J_SECURITY instance and verify the configuration
    To determine the correct port number, examine the ssl.conf file. Port 4443 is the port number that the OracleAS installer assigns during installation.
    If you run ssocfg successfully, the script returns a status 0. To confirm that you were successful, restart the OC4J_SECURITY instance:
    ORACLE_HOME/opmn/bin/opmnctl restartproc process-type=OC4J_SECURITY
    Then try logging in to the single sign-on server at its SSL address:
    https://host:ssl_port/pls/orasso/
         3. Back up the file targets.xml:
    cp ORACLE_HOME/sysman/emd/targets.xml ORACLE_HOME/sysman/emd/targets.xml.backup
    4. Open the file and find the target type oracle_sso_server. Within this target type, locate and edit the three attributes that you passed to ssocfg:
    ·     HTTPMachine—the server host name
    ·     HTTPPort—the server port number
    ·     HTTPProtocol—the server protocol
    If, for example, you run ssocfg like this:
    ORACLE_HOME/sso/bin/ssocfg.sh http sso.mydomain.com:4443
    Update the three attributes this way:
    <Property NAME="HTTPMachine" VALUE="sso.mydomain.com"/>
    <Property NAME="HTTPPort" VALUE="4443"/>
    <Property NAME="HTTPProtocol" VALUE="HTTPS"/>
    5.Save and close the file.
    6.     Reload the OracleAS console:
         ORACLE_HOME/bin/emctl reload
    7. Issue these two commands:
    ORACLE_HOME/opmn/bin/opmnctl restartproc process-type=HTTP_Server
    ORACLE_HOME/opmn/bin/opmnctl restartproc process-type=OC4J_SECURITY
    Registering mod_osso
    1.     This command sequence that follows shows a mod_osso instance being reregistered with the single sign-on server.
    $ORACLE_HOME/sso/bin/ssoreg.sh
         -oracle_home_path $ORACLE_HOME
         -config_mod_osso TRUE
         -mod_osso_url https://myhost.mydomain.com:4443
    2.     Restarting the Oracle HTTP Server
    After running ssoreg, restart the Oracle HTTP Server:
    ORACLE_HOME/opmn/bin/opmnctl restartproc process-type=HTTP_Server
    Configuring the Single Sign-On System for Certificates
    1.     Configure policy.properties with the Default Authentication Plugin
    Update the DefaultAuthLevel section of the policy.properties file with the correct authentication level for certificate sign-on. This file is at ORACLE_HOME/sso/conf. Set the default authentication level to this value:
    DefaultAuthLevel = MediumHighSecurity
    Then, in the Authentication plugins section, pair this authentication level with the default authentication plugin:
    MediumHighSecurity_AuthPlugin = oracle.security.sso.server.auth.SSOX509CertAuth
    2.     Restart the Single Sign-On Middle Tier
    After configuring the server, restart the middle tier:
    ORACLE_HOME/opmn/bin/opmnctl restartproc process-type=HTTP_Server
    ORACLE_HOME/opmn/bin/opmnctl restartproc process-type=OC4J_SECURITY
    Bringing the SSO Users to OCA User Certificate Request URL
    The OCA server reduces the administrative and maintenance cost of provisioning a user certificate. The OCA server achieves this by authenticating users by using OracleAS SSO server authentication. All users who have an Oracle AS SSO server account can directly get a certificate by using the OCA user interface. This reduces the time normoally requidred to provision a certificate by a certificate authority.
    The URL for the SSO certificate Request is:
    https://<Oracle_HTTP_host>:<oca_ssl_port>/oca/sso_oca_link
    You can configure OCA to provide the user certificate request interface URL to SSO server for display whenever SSO is not using a sertificate to authenticate a user. After the OracleAS SSO server authenticates a user, it then display the OCA screen enabling that user to request a certificate.
    To link the OCA server to OracleAS SSO server, use the following command:
    ocactl linksso
    opmnctl stoproc type=oc4j instancename=oca
    opmnctl startproc type=oc4j instancename=oca
    You also can use ocactl unlinksso to unlink the OCA to SSO.

    I have read the SSO admin guide, and performed the steps for enabling SSL on the SSO, and followed the steps to configure mod_osso with virtual host on port 4443 as mentioned in the admin guide.
    The case now is that when I call my form (which is developed by forms developer suite 10g and deployed on the forms server which is SSO enabled) , it calls the SSO module on port 7777 using http (the default behaviour).
    on a URL that looks like this :
    http://myhostname:7777/pls/orasso/orasso.wwsso_app_admin.ls_login?Site2pstoreToken=.......
    and gives the error :
    ( Forbidden
    You don't have permisission to access /sso/auth on this server at port 7777)
    when I manually change the URL to :
    https://myhostname:4443/pls/orasso/orasso.wwsso_app_admin.ls_login?Site2pstoreToken=.......
    the SSO works correctly.
    The question is :
    How can I change this default behaviour and make it call SSO on port 4443 using https instead ?
    Any ideas ?
    Thanks in advance

  • ISE Admin Access with AD Credentials fails after upgrade 1.2.1 to 1.3.0

    Hello,
    After upgrading ISE VM from 1.2.1 to 1.3.0.876, I can't connect on ISE with AD Credentials (Invalid Username or Password). It worked find before upgrading to 1.3.
    On another ISE VM in 1.3.0.876 version (w/o upgrade) with this kind of configuration, it's OK.
    I have double check the Post-upgrade tasks (particularly rejoining Active Directory). Everything worked find after this upgrade except the admin access with AD credentials.
    I don't use user certificate-based authentication for admin access. So I didn't execute application start ise safe CLI.
    My 802.1x wireless users passed authentication with AD credentials. So the ISE had correctly join my AD.
    I didn't find anything related to this admin access with AD credentials failure in the output of show logging application ise and show logging.
    I don't find anything related to this in bug search on Cisco tools.
    I tried to :
    - update the SID of my Admin AD Group, the result is still the same.
    - delete my admin access with AD credentials configuration then make this configuration again, but still the same error.
    Any ideas on this ? Could I find elements in another log ?
    Regards.

    Dear Markus,
    After logging as user "prdadm"
    su - prdadm
    bssltests% bash-3.00$ ls -a
    .                            .dbenv_bssltests.sh-old      .sapenv_bssltests.sh         startdb.log
    ..                           .dbenv_bssltests.sh-old10    .sapenv_bssltests.sh-new     startsap_.log
    .bash_history                .dbsrc_bssltests.csh         .sapenv_bssltests.sh-old10   startsap_DVEBMGS00.log
    .cshrc                       .dbsrc_bssltests.sh          .sapsrc_bssltests.csh        startsap_DVEBMGS01.log
    .dbenv_bssltests.csh         .login                       .sapsrc_bssltests.sh         stopdb.log
    .dbenv_bssltests.csh-new     .profile                     dev_sapstart                 stopsap_.log
    .dbenv_bssltests.csh-old     .sapenv_bssltests.csh        local.cshrc                  stopsap_DVEBMGS00.log
    .dbenv_bssltests.csh-old10   .sapenv_bssltests.csh-new    local.login                  stopsap_DVEBMGS01.log
    .dbenv_bssltests.sh          .sapenv_bssltests.csh-old    local.profile                trans.log
    .dbenv_bssltests.sh-new      .sapenv_bssltests.csh-old10  sqlnet.log
    bash-3.00$
    bash-3.00$
    I have changed envt settings in .dbenv_bssltests.csh & .dbenv_bssltests.sh
    .sapenv_bssltests.sh & .sapenv_bssltests.csh  [4 files]
    Regards,
    Ankita

  • ActiveSync with Certificate-Based Authentication

    We are trying to setup ActiveSync with certificate-based authentication against Exchange 2010 SP2, but with no luck.
    What has been done so far:
    OWA over https works fine. A public, trusted certificate is in place.
    Setup ActiveSync against this Exchange server: works fine, using user name/password.
    Issued a user cert, signed with an internal CA, CA-cert successfully imported into al client devices.
    Created a new OWA-site with cert-based authentication (just to make sure it works), imported user certificate into a mac, visit this OWA site - cert-based authentication works fine.
    Now, with the configuration utility, created configuration profile with that user cert and an ActiveSync account, left password blank and chose the imported cert (p12) as authentication means.
    After installing that last profile the device keeps asking for a password and refuses to synchronize. Logs on the server show error 401.2, so I assume iPhone is ignoring the cert and is trying to use password-authentication instead.
    The devices tested were iPhone 3G with IOS 4 and iPad 2 with IOS 5.
    Any help will be greatly appreciated.
    Roman.

    No-one with this experience?
    We've done some network analysis (as much as was possible to decrypt) and could see, that the server sends an SSL-Alert (rejection?) to the client after the client presents the certificate.
    That explains why the client falls back to password-authentication, but it does not tell us why the server rejects the cert (that is accepted perfectly when accessed from a browser) in first place.

  • I don't Configuring Access Manager in SSL Mode

    i only install am7.1 and ws7.0 in windows2003 pack 1.
    then, i read "Sun Java SystemAccess Manager 7.1 Postinstallation Guide" .
    it said that "Login to theWeb Server console.The default port is 8888." but i can't find the default port .
    i think my web server console's default port is 8989.

    Hi,
    As a part of my requirement, I need to Configure Access Manager in SSL Mode. For that, I followed all the steps(Change http to https in web server instance in Access Manager, Install Certificate, Modify AMConfig.properties) mentioned in the PostInstallation Guide of Sun Access Manager to configure the SSL using Selfsigned certificate. so, after doing all these steps, as soon as the hit the Access Manager URL httsp://machinename:portno/amserver/UI/Login, it shows "page cannot be displayed" error. I have checked the web server with SSL enabled in it and its running fine.
    On one of forum post, I read that you need to set this property to true "com.sun.am.jssproxy.trustAllServerCerts" if you are not installing the ROOTCA certificate however this is not listed in the AM documentation.
    Any help on this would be highly appreciated. Let me know if am missing any steps.

  • Can't sign adobe html5 extension - problem with certificate

    1. I want to package my html extension for photoshop CC.
    2. I have tried to use ZXPSignCmd to build and sign extension package.
    3. For self-signed certificate it works.
    4. Now we bought root signed certificate from GlobalSign but ZXPSignCmd fails when we try to use it:
    Output from ZXPSignCmd:
    Unable to build a valid certificate chain. Please make sure that all certificates are included in the certificate file.
    We are sure that our certificate & password are correct (inside .p12 file we have 3 certs - root, intermediate and ours).
    We tried to use Adobe packaging tools: Configurator / Packager and each of them returns error that there is a problem with certificate. On the other side I was able to use ucf.jar to package another plugin with our certificate - so certificate is correct I guess.
    How we can package HTML5 Extension with manifest.xml and sign it with our certificate for Photoshop CC?
    We are trying to solve this for few hours so far but nothing seems to work...
    Please help.

    I know this is a late reply, but I thought I would chime in as I was getting the same "Unable to build a valid certificate chain. Please make sure that all certificates are included in the certificate file." error with our new Comodo code signing certificate.
    I originally received the code-signing certificate from Comodo as a .p7s file by downloading it from Comodo using Safari on Mac OS X Mavericks. I then imported it into Keychain Access (KA) by double-clicking the .p7s file after it was downloaded. From KA, I selected all of the certificates in the chain (by command-clicking each cert) and then exported them as single .p12 file.
    When using this the KA generated .p12 file I got the "certificate chain" error when using the ZXPSignCmd or ucf.jar tool. After way too many hours of head scratching, I decided to import the .p12 file created from KA into FireFox on Mac (v33.0.2) and re-export it from there. To import the .p12 into FireFox go to the import dialog: FireFox > Preferences > Advanced > Certificates Tab > View Certificates Button > Your Certificates Tab > Import Button. Once imported, export it back out as a .p12 file using the "Backup" button in the same dialog box. Yes, you are importing the .p12 just to re-export it as a .p12!
    Using the FireFox created .p12 works without error when using ZXPSignCmd and ucf.jar. I don't know if this a Keychain Access issue or if Adobe is just picky about how the .p12 file is created, but having FireFox do the .p12 creation worked for me.
    I hope this helps!
    -- Jim Birkenseer
    www.premediasystems.com

  • Issue with SharePoint foundation 2010 to use Claims Based Auth with Certificate authentication method with ADFS 2.0

    I would love some help with this issue.  I have configured my SharePoint foundation 2010 site to use Claims Based Auth with Certificate authentication method with ADFS 2.0  I have a test account set up with lab.acme.com to use the ACS.
    When I log into my site using Windows Auth, everything is great.  However when I log in and select my ACS token issuer, I get sent, to the logon page of the ADFS, after selected the ADFS method. My browser prompt me which Certificate identity I want
    to use to log in   and after 3-5 second
     and return me the logon page with error message “Authentication failed” 
    I base my setup on the technet article
    http://blogs.technet.com/b/speschka/archive/2010/07/30/configuring-sharepoint-2010-and-adfs-v2-end-to-end.aspx
    I validated than all my certificate are valid and able to retrieve the crl
    I got in eventlog id 300
    The Federation Service failed to issue a token as a result of an error during processing of the WS-Trust request.
    Request type: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
    Additional Data
    Exception details:
    Microsoft.IdentityModel.SecurityTokenService.FailedAuthenticationException: MSIS3019: Authentication failed. ---> System.IdentityModel.Tokens.SecurityTokenValidationException:
    ID4070: The X.509 certificate 'CN=Me, OU=People, O=Acme., C=COM' chain building failed. The certificate that was used has a trust chain that cannot be verified. Replace the certificate or change the certificateValidationMode. 'A certification chain processed
    correctly, but one of the CA certificates is not trusted by the policy provider.
    at Microsoft.IdentityModel.X509CertificateChain.Build(X509Certificate2 certificate)
    at Microsoft.IdentityModel.Tokens.X509NTAuthChainTrustValidator.Validate(X509Certificate2 certificate)
    at Microsoft.IdentityModel.Tokens.X509SecurityTokenHandler.ValidateToken(SecurityToken token)
    at Microsoft.IdentityModel.Tokens.SecurityTokenElement.GetSubject()
    at Microsoft.IdentityServer.Service.SecurityTokenService.MSISSecurityTokenService.GetOnBehalfOfPrincipal(RequestSecurityToken request, IClaimsPrincipal callerPrincipal)
    --- End of inner exception stack trace ---
    at Microsoft.IdentityServer.Service.SecurityTokenService.MSISSecurityTokenService.GetOnBehalfOfPrincipal(RequestSecurityToken request, IClaimsPrincipal callerPrincipal)
    at Microsoft.IdentityServer.Service.SecurityTokenService.MSISSecurityTokenService.BeginGetScope(IClaimsPrincipal principal, RequestSecurityToken request, AsyncCallback callback, Object state)
    at Microsoft.IdentityModel.SecurityTokenService.SecurityTokenService.BeginIssue(IClaimsPrincipal principal, RequestSecurityToken request, AsyncCallback callback, Object state)
    at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract.DispatchRequestAsyncResult..ctor(DispatchContext dispatchContext, AsyncCallback asyncCallback, Object asyncState)
    at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract.BeginDispatchRequest(DispatchContext dispatchContext, AsyncCallback asyncCallback, Object asyncState)
    at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract.ProcessCoreAsyncResult..ctor(WSTrustServiceContract contract, DispatchContext dispatchContext, MessageVersion messageVersion, WSTrustResponseSerializer responseSerializer, WSTrustSerializationContext
    serializationContext, AsyncCallback asyncCallback, Object asyncState)
    at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract.BeginProcessCore(Message requestMessage, WSTrustRequestSerializer requestSerializer, WSTrustResponseSerializer responseSerializer, String requestAction, String responseAction, String
    trustNamespace, AsyncCallback callback, Object state)
    System.IdentityModel.Tokens.SecurityTokenValidationException: ID4070: The X.509 certificate 'CN=Me, OU=People, O=acme., C=com' chain building
    failed. The certificate that was used has a trust chain that cannot be verified. Replace the certificate or change the certificateValidationMode. 'A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider.
    at Microsoft.IdentityModel.X509CertificateChain.Build(X509Certificate2 certificate)
    at Microsoft.IdentityModel.Tokens.X509NTAuthChainTrustValidator.Validate(X509Certificate2 certificate)
    at Microsoft.IdentityModel.Tokens.X509SecurityTokenHandler.ValidateToken(SecurityToken token)
    at Microsoft.IdentityModel.Tokens.SecurityTokenElement.GetSubject()
    at Microsoft.IdentityServer.Service.SecurityTokenService.MSISSecurityTokenService.GetOnBehalfOfPrincipal(RequestSecurityToken request, IClaimsPrincipal callerPrincipal)
    thx
    Stef71

    This is perfectly correct on my case I was not adding the root properly you must add the CA and the ADFS as well, which is twice you can see below my results.
    on my case was :
    PS C:\Users\administrator.domain> $root = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("C:\
    cer\SP2K10\ad0001.cer")
    PS C:\Users\administrator.domain> New-SPTrustedRootAuthority -Name "domain.ad0001" -Certificate $root
    Certificate                 : [Subject]
                                    CN=domain.AD0001CA, DC=domain, DC=com
                                  [Issuer]
                                    CN=domain.AD0001CA, DC=portal, DC=com
                                  [Serial Number]
                                    blablabla
                                  [Not Before]
                                    22/07/2014 11:32:05
                                  [Not After]
                                    22/07/2024 11:42:00
                                  [Thumbprint]
                                    blablabla
    Name                        : domain.ad0001
    TypeName                    : Microsoft.SharePoint.Administration.SPTrustedRootAuthority
    DisplayName                 : domain.ad0001
    Id                          : blablabla
    Status                      : Online
    Parent                      : SPTrustedRootAuthorityManager
    Version                     : 17164
    Properties                  : {}
    Farm                        : SPFarm Name=SharePoint_Config
    UpgradedPersistedProperties : {}
    PS C:\Users\administrator.domain> $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("C:\
    cer\SP2K10\ADFS_Signing.cer")
    PS C:\Users\administrator.domain> New-SPTrustedRootAuthority -Name "Token Signing Cert" -Certificate $cert
    Certificate                 : [Subject]
                                    CN=ADFS Signing - adfs.domain
                                  [Issuer]
                                    CN=ADFS Signing - adfs.domain
                                  [Serial Number]
                                    blablabla
                                  [Not Before]
                                    23/07/2014 07:14:03
                                  [Not After]
                                    23/07/2015 07:14:03
                                  [Thumbprint]
                                    blablabla
    Name                        : Token Signing Cert
    TypeName                    : Microsoft.SharePoint.Administration.SPTrustedRootAuthority
    DisplayName                 : Token Signing Cert
    Id                          : blablabla
    Status                      : Online
    Parent                      : SPTrustedRootAuthorityManager
    Version                     : 17184
    Properties                  : {}
    Farm                        : SPFarm Name=SharePoint_Config
    UpgradedPersistedProperties : {}
    PS C:\Users\administrator.PORTAL>

  • Can not configure Access Manager

    Hi all,
    1. I istalled Sun java messaging server 6.
    2. I edit amsamplesilent to prepare amsamplesilent.my:
    # cd /opt/SUNWam/bin
    #mv amsamplesilent amsamplesilent.my
    3. I configure Access Manager:
    #./amconfig -s amsamplesilent.my but get the following error:
    # ./amconfig amsamplesilent.my
    Usage: amconfig -s <silentinputfile>
    ./amconfig: Sourcing ./amutils
    ln: cannot create /opt/SUNWam/lib/jaxrpc-spi.jar: File exists
    chown: jaxrpc-spi.jar: No such file or directory
    full install
    ./amdsconfig: Sourcing ./amutils
    LD_LIBRARY_PATH is --- /usr/lib/mps/secv1:/usr/lib/mps/secv1:/usr/lib/mps/secv1:/opt/SUNWam/lib:/opt/SUNWam/ldaplib/ldapsdk
    CLASSPATH is --- /opt/SUNWam/locale:/etc/opt/SUNWam/config:/opt/SUNWam/lib:/opt/SUNWam/lib/am_services.jar:/opt/SUNWam/lib/ldapjdk.jar:/usr/share/lib/mps/secv1/jss3.jar:/opt/SUNWam/lib/am_sdk.jar
    ldap_simple_bind: Can't connect to the LDAP server - No route to host
    ldap_simple_bind: Can't connect to the LDAP server - No route to host
    ldap_simple_bind: Can't connect to the LDAP server - No route to host
    ldap_simple_bind: Can't connect to the LDAP server - No route to host
    sleep 3
    ldap_simple_bind: Can't connect to the LDAP server - No route to host
    ldap_simple_bind: Can't connect to the LDAP server - No route to host
    ldap_simple_bind: Can't connect to the LDAP server - No route to host
    sleep 4
    ldap_simple_bind: Can't connect to the LDAP server - No route to host
    ldap_simple_bind: Can't connect to the LDAP server - No route to host
    ldap_simple_bind: Can't connect to the LDAP server - No route to host
    sleep 5
    ldap_simple_bind: Can't connect to the LDAP server - No route to host
    ldap_simple_bind: Can't connect to the LDAP server - No route to host
    ldap_simple_bind: Can't connect to the LDAP server - No route to host
    sleep 6
    ERROR : Loading of Access Manager schema into the Directory failed
    Starting the tag swapping of the install.ldif and installExisting.ldif
    ROOT_SUFFIX is dc=iplanet,dc=com
    People_NM_ROOT_SUFFIX is People_dc=iplanet_dc=com
    SERVER_HOST sample.red.iplanet.com
    DIRECTORY_SERVER sample.red.iplanet.com
    DIRECTORY_PORT 389
    USER_NAMING_ATTR uid
    ORG_NAMING_ATTR o
    CONSOLE_DEPLOY_URI /amconsole
    ORG_OBJECT_CLASS sunismanagedorganization
    RS_RDN iplanet
    USER_OBJECT_CLASS inetorgperson
    ldap_simple_bind: Can't connect to the LDAP server - No route to host
    ldap_simple_bind: Can't connect to the LDAP server - No route to host
    sleep 3
    ERROR : Configuring/Loading of the default DIT in the Directory Server failed
    ldap_simple_bind: Can't connect to the LDAP server - No route to host
    ldap_simple_bind: Can't connect to the LDAP server - No route to host
    sleep 3
    Warning : Plugins and Indexes already exist.
    ./amsvcconfig: Sourcing ./amutils
    LD_LIBRARY_PATH is --- /usr/lib/mps/secv1:/usr/lib/mps/secv1:/usr/lib/mps/secv1:/opt/SUNWam/lib:/opt/SUNWam/ldaplib/ldapsdk
    CLASSPATH is --- /opt/SUNWam/locale:/etc/opt/SUNWam/config:/opt/SUNWam/lib:/opt/SUNWam/lib/am_services.jar:/opt/SUNWam/lib/ldapjdk.jar:/usr/share/lib/mps/secv1/jss3.jar:/opt/SUNWam/lib/am_sdk.jar
    ldap_simple_bind: Can't connect to the LDAP server - No route to host
    Loading service schema XML files ...
    Info 112: Entering ldapAuthenticate method!
    Error 15: Cannot authenticate user.
    LDAP authentication failed.
    Error 9: Operation failed: Error 15: Cannot authenticate user.
    Error occured while loading: /etc/opt/SUNWam/config/ums/ums.xml
    ./amws61config: Sourcing ./amutils
    /opt/SUNWam/console.war: No such file or directory
    current web app is applications
    copying files from sunwamconsdk
    Swapping tag swap in index.html files ...
    Making amconsole.war
    Successfully done making warfile ...
    Deploying from /opt/SUNWam/web-src/applications (/opt/SUNWam/amconsole.war) to /opt/SUNWwbsvr/https-sample.red.iplanet.com/is-web-apps/applications for /amconsole
    wdeploy deploy -u /amconsole -i https-sample.red.iplanet.com -v https-sample.red.iplanet.com -d /opt/SUNWwbsvr/https-sample.red.iplanet.com/is-web-apps/applications /opt/SUNWam/amconsole.war
    [wdeploy] The war file name is /opt/SUNWam/amconsole.war
    [wdeploy] Fatal error in parsing XML file ..Premature end of file.
    [wdeploy] (-1, -1) in file null
    [wdeploy] Error encountered while parsing /opt/SUNWwbsvr/https-sample.red.iplanet.com/config/server.xml
    Failed deploying /amconsole
    /opt/SUNWam/services.war: No such file or directory
    current web app is services
    Swapping tag swap in index.html files ...
    Making amserver.war
    Successfully done making warfile ...
    Deploying from /opt/SUNWam/web-src/services (/opt/SUNWam/amserver.war) to /opt/SUNWwbsvr/https-sample.red.iplanet.com/is-web-apps/services for /amserver
    wdeploy deploy -u /amserver -i https-sample.red.iplanet.com -v https-sample.red.iplanet.com -d /opt/SUNWwbsvr/https-sample.red.iplanet.com/is-web-apps/services /opt/SUNWam/amserver.war
    [wdeploy] The war file name is /opt/SUNWam/amserver.war
    [wdeploy] Fatal error in parsing XML file ..Premature end of file.
    [wdeploy] (-1, -1) in file null
    [wdeploy] Error encountered while parsing /opt/SUNWwbsvr/https-sample.red.iplanet.com/config/server.xml
    Failed deploying /amserver
    /opt/SUNWam/password.war: No such file or directory
    current web app is password
    Swapping tag swap in index.html files ...
    Making ampassword.war
    Successfully done making warfile ...
    Deploying from /opt/SUNWam/web-src/password (/opt/SUNWam/ampassword.war) to /opt/SUNWwbsvr/https-sample.red.iplanet.com/is-web-apps/password for /ampassword
    wdeploy deploy -u /ampassword -i https-sample.red.iplanet.com -v https-sample.red.iplanet.com -d /opt/SUNWwbsvr/https-sample.red.iplanet.com/is-web-apps/password /opt/SUNWam/ampassword.war
    [wdeploy] The war file name is /opt/SUNWam/ampassword.war
    [wdeploy] Fatal error in parsing XML file ..Premature end of file.
    [wdeploy] (-1, -1) in file null
    [wdeploy] Error encountered while parsing /opt/SUNWwbsvr/https-sample.red.iplanet.com/config/server.xml
    Failed deploying /ampassword
    /opt/SUNWam/introduction.war: No such file or directory
    current web app is common
    Swapping tag swap in index.html files ...
    Making amcommon.war
    Successfully done making warfile ...
    Deploying from /opt/SUNWam/web-src/common (/opt/SUNWam/amcommon.war) to /opt/SUNWwbsvr/https-sample.red.iplanet.com/is-web-apps/common for /amcommon
    wdeploy deploy -u /amcommon -i https-sample.red.iplanet.com -v https-sample.red.iplanet.com -d /opt/SUNWwbsvr/https-sample.red.iplanet.com/is-web-apps/common /opt/SUNWam/amcommon.war
    [wdeploy] The war file name is /opt/SUNWam/amcommon.war
    [wdeploy] Fatal error in parsing XML file ..Premature end of file.
    [wdeploy] (-1, -1) in file null
    [wdeploy] Error encountered while parsing /opt/SUNWwbsvr/https-sample.red.iplanet.com/config/server.xml
    Failed deploying /amcommon
    Checking if Web Server is already configed with Access Manager
    Configuring Web Server
    Mime type: 'type=text/vnd.wap.wml' already exists: Skipping ....
    Mime type: 'type=image/vnd.wap.wbmp' already exists: Skipping ....
    I tried again but I still get this error.
    Any Ideas for this problem?
    Thanks.

    ldap_simple_bind: Can't connect to the LDAP server - No route to host
    i would consider this a fatal error.
    The system cannot locate where your Directory Server is. "no route to host" means that it's trying to get to the host, but your networking isn't set up correctly, and it doesn't find any route to get to the specified host.

Maybe you are looking for