Has anyone made Portal & SSL work?

Question

I posted the topic http://technet.oracle.com:89/ubb/Forum70/HTML/000680.html a couple of days ago but no response (got a second question added, though). Which makes me wonder - has anyone gotten Portal to work with SSL - not just the Login Server but the whole enchilada?

Answer 1

STEP 6
Now, there was a question as to how to restrict access to only HTTPS URLs. To do this, we can specify some Apache directives to restrict access to certain locations to HTTPS. However, recall that we said the Portal currently can only use HTTP to request some of the Login Server URLs. So, we need a workaround to let the Portal access those URLs over HTTP, but forcing all users to use HTTPS.
This can be achieved by the following steps:
Setup a DAD for use by the Portal when accessing the Login Server
Edit the %IAS_HOME%\Apache\modplsql\cfg\wdbsvr.app file and copy the DAD_portal30_sso section and rename it to portal30_ls (for example), so you wind up with 3 DADs - portal30, portal30_sso and portal30_ls.
In the sncookiename field, specify the same cookie name as used by portal30_sso -- 'portal30_sso'
[DAD_portal30_ls]
connect_string = pencarna
password = portal30_sso
username = portal30_sso
default_page = portal30_sso.wwsso_home.home
document_table = portal30_sso.wwdoc_document
document_path = docs
document_proc = portal30_sso.wwdoc_process.process_download
;upload_as_long_raw =
;upload_as_blob =
name_prefix =
;always_describe =
;after_proc =
;before_proc =
reuse = Yes
;connmax =
pathalias = url
pathaliasproc = portal30_sso.wwpth_api_alias.process_download
enablesso = Yes
sncookiename = portal30_sso
stateful = No
;custom_auth =
Specify Apache directives to require use of SSL
Edit the %IAS_HOME%\Apache\modplsql\cfg\plsql.conf file, adding the following directives after the top few lines...
# Enable handling of all virtual paths beginning with "/pls" by mod-plsql
<Location /pls>
SetHandler pls_handler
Order deny,allow
Allow from all
</Location>
# Have all accesses to /pls/portal30 require the use of HTTPS
<Location /pls/portal30>
SSLRequireSSL
</Location>
# Have all accesses to /pls/portal30_sso require the use of HTTPS
<Location /pls/portal30_sso>
SSLRequireSSL
</Location>
# Define a new DAD which will allow HTTP access, but only from the Portal DB
<Location /pls/portal30_ls>
Order deny,allow
Deny from all
Allow from localhost pencarna.us.oracle.com
</Location>
# Do not allow access to the following URLs from any browser
# These will be accessed by the Portal through the portal30_ls DAD
<Location /pls/portal30_sso/portal30_sso.wwsso_app_admin.validate_user*>
Order deny,allow
Deny from all
</Location>
<Location /pls/portal30_sso/portal30_sso.wwsso_app_admin.print_fapp_username*>
Order deny,allow
Deny from all
</Location>
<Location /pls/portal30_sso/portal30_sso.wwsso_app_admin.external_apps_list*>
Order deny,allow
Deny from all
</Location>
Instruct the Portal to use the "portal30_ls" DAD to contact the Login Server
Start the http server
Log into the Portal
click on the Administer tab
click on Global Settings
scroll down to the Login Server section
update the Query Path URL Prefix to use the portal30_ls DAD, e.g., http://pencarna.us.oracle.com/pls/portal30_ls/
That should do it. After these changes, the Portal and Login Server should be accessible over HTTPS, and the portal is able to do the necessary communication with the Login Server. If a user attempts to access the server with http, they should get a forbidden message from the server.