Securing the IIOP Listener/Handler with SSL

Question

Hi,
I am looking into securing CORBA client connections to ISL/ISH with SSL. Client authentication is not needed, just encryption and server authentication. Having looked through the documentation I have a couple of questions about this.
1. The "Using Security in CORBA Applications" manual says that an LDAP server is used as the certificate repository for the ISL/ISH server certificate. Are there alternatives to this such as using a keystore or is LDAP the only option?
2. Is it possible to configure the LDAP server (server name, port etc) without re-installing Tuxedo?
Regards
Ian

Answer 1

Ian,
Tuxedo uses a plugin framework architecture to manage certificates and it is possible to replace any of the plugin framework implementations.
In order to change the plugin framework interfaces you will need to obtain information about the epif* commands and the plugin framework interfaces and you will need to write some code. The plugin framework documentation is made available on an as-needed basis.
As documented at http://download.oracle.com/docs/cd/E15261_01/tuxedo/docs11gr1/sec/secadm.html#wp1239453 , "For more information about security plug-ins, including installation and configuration procedures, see your Oracle account executive."
The command "epifregedt -g" shows the current plugin framework settings.
The command "epifregedt -g -k SYSTEM/impl/security/BEA/certificate_lookup" shows just the settings for the security/BEA/certificate_lookup interface.
The command "epifregedt -g -k SYSTEM/impl/security/BEA/certificate_lookup -a Params" shows just the instantiation parameters for this interface.
Assume that the output from this command is
IMPLEMENTATION security/BEA/certificate_lookup
Instantiation Parameters :
"userCertificateLdap=ldap://localhost:389/"
"filterFileLocation=file:///home/tuxdir/udataobj/security/bea_ldap_filter.dat"
Then the command
epifregedt -s -k SYSTEM/impl/security/BEA/certificate_lookup \
-a Params=userCertificateLdap=ldap://abcxyz:1389/ \
-a Params=filterFileLocation=file:///home/tuxdir/udataobj/security/bea_ldap_filter.dat
will change the LDAP location to ldap://abcxyz:1389/
Note that it is necessary to respecify the filterFileLocation with this command even though it is not changing.
Thus, it is not necessary to reinstall Tuxedo in order to change the LDAP parameters.
Since the registry modification commands can be tricky to use, you may want to experiment with these commands on a development system or you may want to
export REG_KEY_SYSTEM=<TEMPORARY_DIRECTORY>/System.rdp
cp $TUXDIR/udataobj/System.rdp $REG_KEY_SYSTEM
before experimenting with epifregedt -s. (The value of REG_KEY_SYSTEM will override the default of $TUXDIR/udataobj/System.rdp .)
Regards,
Ed