Portal Integration with PKI and CAC

Question

Hi, I'm hoping someone can point me in the right direction. I need to integrate 10g AS Rel 2 Portal and SSO with client-site PKI certs, specifically NMCI (Navy) CACs. Has anybody done this? I'm trying to find out just how much we can integrate, I'd like to be able to parse info on the server side such as username and supply it to the SSO server so that the user only as to enter a pin.
thanks!
Aaron

Answer 1

For anyone else who can't view the website (yeah, sorry about that... I do try to keep it family-friendly :) ), the following code should allow you to map your PKI certificate's username to any arbitrary user in Oracle Internet Directory:
<blockquote>/*
FILE:
SSOCertMapperCustom.java
DESCRIPTION
Use this to map your Certificate's CN to an arbitrary field in OID.
package oracle.security.sso.server.auth;
import java.security.Principal;
import java.security.cert.X509Certificate;
import javax.servlet.http.HttpServletRequest;
import oracle.security.sso.ias904.toolkit.IPASUserInfo;
import oracle.security.sso.ias904.toolkit.IPASUserMappingInterface;
import oracle.security.sso.ias904.toolkit.IPASException;
* The following classes must be imported to perform LDAP searches using the pre-configured
* OC4J connections.
import oracle.ldap.util.*;
import oracle.ldap.util.jndi.*;
import javax.naming.*;
import javax.naming.directory.*;
import java.io.*;
public class SSOCertMapperCustom implements IPASUserMappingInterface
// Name of the certificate attribute.
private static final String X509_CERT_CLASS = "javax.servlet.request.X509Certificate";
private InitialDirContext _context;
private Subscriber _mysub;
* Configuration for this Plugin
private static final String oidattribute = "description";
private static final String oidhost = "localhost";
private static final String oidport = "389";
private static final String oidsearch_base = "dc=domain,dc=com";
public SSOCertMapperTfsms()
try
// Notice that this will only bind anonymously...
context = ConnectionUtil.getDefaultDirCtx( oid_host, oidport, "", "" );
mysub = new Subscriber(context,Util.IDTYPE_DN,_oid_search_base,false);
catch( Exception e )
System.out.println(" * * * * There appears to be some kind of problem in the c'tor." );
* Use this method to strip out the "cn=" attribute from the DN provided.
private String getUserCn( String inputDn )
// In this example, the user certificate DN format is:
// CN=,CN=users,DC=acme,DC=com
// Get the first common name(CN) value as directory nickname
int l_indx1 = inputDn.indexOf('=');
int l_indx2 = inputDn.indexOf(',', l_indx1 + 2);
String userCn = inputDn.substring(l_indx1+1 , l_indx2);
return userCn;
* This method returns user information derived from the user certificate
* @param request The HttpServletRequest request object
* @return IPASUserInfo object that contains user directory nickname and
* optionally realm nickname obtained from the user certificate
* @exception IPASException if user information can not be obtained
public IPASUserInfo getUserInfo(HttpServletRequest request)
throws IPASException
IPASUserInfo l_usrInfo = null;
try
// Get the user certificate from the HTTP request object
X509Certificate [] l_usrBCerts
= (X509Certificate[])(request.getAttribute(X509_CERT_CLASS));
if( (l_usrBCerts != null) || (l_usrBCerts.length > 1) )
Principal l_usrPrincipal = l_usrBCerts[0].getSubjectDN();
String l_certDN = l_usrPrincipal.getName().toUpperCase();
String l_usrNickName = getUserCn( l_certDN );
// Search for "description=..." in the JAAS-configured LDAP tree.
// (Note: If this is not OC4J/JAAS/JAZN, it'd probably be best not
// to try using this method...)
String[] _attribs = { "dn", "description", "cn", "sn", _oid_attribute };
User[] _users;
try { _users = _mysub.getUsers( _context,
Util.IDTYPE_FILTER,
"(" + oidattribute + "=" +
l_usrNickName +
")", null, _attribs );
catch( Exception e )
throw new IPASException(
"Error obtaining user listing from OID.");
if( _users.length > 1 )
throw new IPASException( "Oops, found " +
_users.length +
" user(s), instead of 1. Perhaps your attribute selection is wrong?" );
else if( _users.length < 1 )
throw new IPASException( "User not found in OID." );
else
l_usrNickName = getUserCn( users[0].getDn(context) );
// Set the realm name to null to use the default realm
String l_realm = null;
l_usrInfo = new IPASUserInfo(l_usrNickName, l_realm);
return l_usrInfo;
else
// User certificate not found.
throw new IPASException("User certificate not found");
catch(Exception e)
throw new IPASException ("User certificate information not found. "
+ e.toString());
}</blockquote>
As an aside, if you need this to work behind an F5 (with backend traffic remaining unencrypted), the following iRule will make your life <i>much</i> easier. It's rudimentary, but should work until something better comes along:
<blockquote>when CLIENTSSL_HANDSHAKE
set cur [SSL::sessionid]
set ask [session lookup ssl $cur]
if { $ask eq "" } {
session add ssl [SSL::sessionid] [SSL::cert 0]
when HTTP_REQUEST
HTTP::header replace HTTPS on
set id [SSL::sessionid]
set the_cert [session lookup ssl $id]
if { $the_cert != "" }
HTTP::header insert SSL-Client-Cert [ join [string trim [string map { "-----BEGIN CERTIFICATE-----" "" "-----END CERTIFICATE-----" ""} [X509::whole $the_cert ] ] ] "" ]
} else {
HTTP::respond 200 content "&lt;html&gt;&lt;body&gt;
&lt;h1&gt;Access Denied&lt;/h1&gt;
Access to this resource is denied without a valid
DOD Common Access Card. If you do not have one,
please visit the &lt;a href=\"https://www.cac.mil/Home.do\"&gt;Common
Access&lt;/a&gt; website for information on obtaining a CAC
card. Otherwise, please insert your CAC card into your
reader, close this window, and try accessing this website again.
&lt;/body&gt;&lt;/html&gt;"
}</blockquote>
Sorry for the formatting... The original can be found at: http://www.snappedshot.com/archives/843-An-Endless-Pile-of-Technical-Cruft.html if it hurts your eyes too much.