Quick
guide to Oracle IRM 11g index
So far in this
guide we have an IRM Server up and running, however I skipped over SSL configuration in
the previous article because I wanted
to focus in more detail now. You can, if you wish, not bother with setting up SSL, but considering this is a security technology it is worthwhile doing.
Contents
Setting up a one way, self signed SSL certificate in WebLogic
Setting up an official SSL certificate in Apache 2.x
Configuring Apache
to proxy traffic
to the IRM server
There are two common scenarios in which an Oracle IRM server is configured. For a development or evaluation system, people usually communicate directly
to the WebLogic Server running
the IRM service. However in a production environment and for some proof of concept evaluations that require a setup reflecting a production system,
the traffic
to the IRM server travels via a web server proxy, commonly Apache. In this
guide we are building an Oracle Enterprise Linux based IRM service and this article will go over
the configuration of SSL in WebLogic and also in Apache.
Like in
the past articles, we are going
to use two host names in
the configuration below,irm.company.com will refer
to the public Apache server
irm.company.internal will refer
to the internal WebLogic IRM server
Setting up a one way, self signed SSL certificate in WebLogic
First lets look at creating just a simple self signed SSL certificate
to be used in WebLogic. This is a quick and easy way
to get SSL working in your environment, however
the downside is that no browsers are going
to trust this certificate you create and you'll need
to manually install
the certificate onto any machine's communicating with
the server. This is fine for development or when you have only a few users evaluating
the system, but for any significant use it's usually better
to have a fully trusted certificate in use and I explain that in
the next section. But for now lets go through creating, installing and testing a self signed certificate.
We use a library in Java
to create
the certificates, open a console and running
the following commands. Note you should choose your own secure passwords whenever you see password below.
[oracle@irm /] source /oracle/middleware/wlserver_10.3/server/bin/setWLSEnv.sh
[oracle@irm /] cd /oracle/middleware/user_projects/domains/irm_domain/config/fmwconfig/
[oracle@irm /] java utils.CertGen -selfsigned -certfile MyOwnSelfCA.cer -keyfile MyOwnSelfKey.key -keyfilepass password -cn "irm.oracle.demo"
[oracle@irm /] java utils.ImportPrivateKey -keystore MyOwnIdentityStore.jks -storepass password -keypass password -alias trustself -certfile MyOwnSelfCA.cer.pem -keyfile MyOwnSelfKey.key.pem -keyfilepass password
[oracle@irm /] keytool -import -trustcacerts -alias trustself -keystore TrustMyOwnSelf.jks -file MyOwnSelfCA.cer.der -keyalg RSA
We now have two Java Key Stores, MyOwnIdentityStore.jks and TrustMyOwnSelf.jks. These contain keys and certificates which we will use in WebLogic Server. Now we need
to tell
the IRM server
to use these stores when setting up SSL connections for incoming requests. Make sure
the Admin server is running and login into
the WebLogic Console at http://irm.company.intranet:7001/console and do
the following;
In
the menu on
the left, select
the + next
to Environment
to expose
the submenu, then click on Servers.
You will see two servers in
the list, AdminServer(admin) and IRM_server1. If
the IRM server is running, shut it down either by hitting CONTROL + C in
the console window it was started from, or you can switch
to the CONTROL tab, select IRM_server1 and then select
the Shutdown menu and then Force Shutdown Now.
In
the Configuration tab select IRM_server1 and switch
to the Keystores tab. By default WebLogic Server uses it's own demo identity and trust. We are now going
to switch
to the self signed one's we've just created. So select
the Change button and switch
to Custom Identity and Custom Trust and hit save.
Now we have
to complete
the resulting fields,
the setting's i've used in my evaluation server are below.
IdentityCustom Identity Keystore: /oracle/middleware/user_projects/domains/irm_domain/config/fmwconfig/MyOwnIdentityStore.jks
Custom Identity Keystore Type: JKS
Custom Identity Keystore Passphrase: password
Confirm Custom Identity Keystore Passphrase: password
TrustCustom Trust Keystore: /oracle/middleware/user_projects/domains/irm_domain/config/fmwconfig/TrustMyOwnSelf.jks
Custom Trust Keystore Type: JKS
Custom Trust Keystore Passphrase: password
Confirm Custom Trust Keystore Passphrase: password
Now click on
the SSL tab for
the IRM_server1 and enter in
the alias and passphrase, in my demo here
the details are;
IdentityPrivate Key Alias: trustself
Private Key Passphrase: password
Confirm Private Key Passphrase: password
And hit save.
Now lets test a connection
to the IRM server over HTTPS using SSL. Go back
to a console window and start
the IRM server, a quick reminder on how
to do this is...
[oracle@irm /] cd /oracle/middleware/user_projects/domains/irm_domain/bin
[oracle@irm /] ./startManagedWeblogic IRM_server1
Once running, open a browser and head
to the SSL port of
the server. By default
the IRM server will be listening on
the URL https://irm.company.intranet:16101/irm_rights. Note in
the example image on
the right
the port is 7002 because it's a system that has
the IRM services installed on
the Admin server, this isn't typical (or advisable). Your system is going
to have a separate managed server which will be listening on port 16101. Once you open this address you will notice that your browser is going
to complain that
the server certificate is untrusted.
The images on
the right show how Firefox displays this error. You are going
to be prompted every time you create a new SSL session with
the server, both from
the browser and more annoyingly from
the IRM Desktop.
If you plan on always using a self signed certificate, it is worth adding it
to the Windows certificate store so that when you are accessing sealed content you do not keep being informed this certificate is not trusted. Follow these instructions (which are for Internet Explorer 8, they may vary for your version of IE.)
Start Internet Explorer and open
the URL
to your IRM server over SSL, e.g. https://irm.company.intranet:16101/irm_rights. IE will complain that about
the certificate, click on Continue
to this website (not recommended).
From
the IE Tools menu select Internet Options and from
the resulting dialog select Security and then click on Trusted Sites and then
the Sites button.
Add
to the list of trusted sites a URL which mates
the server you are accessing, e.g. https://irm.company.intranet/ and select OK. Now refresh
the page you were accessing and next
to the URL you should see a red cross and
the words Certificate Error. Click on this button and select View Certificates.
You will now see a dialog with
the details of
the self signed certificate and
the Install Certificate... button should be enabled. Click on this
to start
the wizard. Click next and you'll be asked where you should install
the certificate.
Change
the option
to Place all certificates in
the following store. Select browse and choose
the Trusted Root Certification Authorities location and hit OK. You'll then be prompted
to install
the certificate and answer yes.
You also need
to import
the root signed certificate into
the same location, so once again select
the red Certificate Error option and this time when viewing
the certificate, switch
to the Certification Path tab and you should see a CertGenCAB certificate. Select this and then click on View Certificate and go through
the same process as above
to import
the certificate into
the store.
Finally close all instances of
the IE browser and re-access
the IRM server URL again, this time you should not receive any errors.
Setting up an official SSL certificate in Apache 2.x
At this point we now have an IRM server that you can communicate with over SSL. However this certificate isn't trusted by any browser because it's path of trust doesn't end in a recognized certificate authority (CA). Also you are communicating directly
to the WebLogic Server over a non standard SSL port, 16101. In a production environment it is common
to have another device handle
the initial public internet traffic and then proxy this
to the WebLogic server.
The diagram below shows a very simplified view of this type of deployment. What i'm going
to walk through next is configuring Apache
to proxy traffic
to a WebLogic server and also
to use a real SSL certificate from an official CA.
First step is
to configure Apache
to handle incoming requests over SSL. In this
guide I am configuring
the IRM service in Oracle Enterprise Linux 5 update 3 and Apache 2.2.3 which came with OpenSSL and mod_ssl components. Before I purchase an SSL certificate, I need
to generate a certificate request from
the server. Oracle.com uses Verisign and for my own personal needs I use cheaper certificates from GoDaddy.
The following instructions are specific
to Apache, but there are many references out there for other web servers. For Apache I have OpenSSL and
the commands are;
[oracle@irm /] cd /usr/bin
[oracle@irm bin] openssl genrsa -des3 -out irm-apache-server.key 2048
Generating RSA private key, 2048 bit long modulus
............................+++
.........+++
e is 65537 (0x10001)
Enter pass phrase for irm-apache-server.key:
Verifying - Enter pass phrase for irm-apache-server.key:
[oracle@irm bin] openssl req -new -key irm-apache-server.key -out irm-apache-server.csr
Enter pass phrase for irm-apache-server.key:
You are about
to be asked
to enter information that will be incorporated
into your certificate request.
What you are about
to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.',
the field will be left blank.
-----
Country Name (2 letter code) [GB]:US
State or Province Name (full name) [Berkshire]:CA
Locality Name (eg, city) [Newbury]:San Francisco
Organization Name (eg, company) [My Company Ltd]:Oracle
Organizational Unit Name (eg, section) []:Security
Common Name (eg, your name or your server's hostname) []:irm.company.com
Email Address []:
[email protected]
Please enter
the following 'extra' attributes
to be sent with your certificate request
A challenge password []:testing
An optional company name []:
You must make sure
to remember
the pass phrase you used in
the initial key generation, you will need this when later configuring Apache. In
the /usr/bin directory there are now two new files.
The irm-apache-server.csr contains our certificate request and is what you cut and paste, or upload,
to your certificate authority when you purchase and validate your SSL certificate. In response you will typically get two files. Your server certificate and another certificate file that will likely contain a set of certificates from your CA which validate your certificate's trust. Next we need
to configure Apache
to use these files. Typically there is an ssl.conf file which is where all
the SSL configuration is done. On my Oracle Enterprise Linux server this file is located in /etc/httpd/conf.d/ssl.conf and i've added
the following lines.
<VirtualHost irm.company.com>
# Setup SSL for irm.company.com
ServerName irm.company.com
SSLEngine On
SSLCertificateFile /oracle/secure/irm.company.com.crt
SSLCertificateKeyFile /oracle/secure/irm.company.com.key
SSLCertificateChainFile /oracle/secure/gd_bundle.crt
</VirtualHost>
Restarting Apache (apachectl restart) and I can now attempt
to connect
to the Apache server in a web browser, https://irm.company.com/. If all is configured correctly I should now see an Apache test page delivered
to me over HTTPS.
Configuring Apache
to proxy traffic
to the IRM server
Final piece in setting up SSL is
to have Apache proxy requests for
the IRM server but do so securely. So
the requests
to Apache will be over HTTPS using a legitimate certificate, but we can also configure Apache
to proxy these requests internally across
to the IRM server using SSL with
the self signed certificate we generated at
the start of this article.
To do this proxying we use
the WebLogic Web Server plugin for Apache which you can download here from Oracle. Download
the zip file and extract onto
the server.
The file extraction reveals a set of zip files, each one specific
to a supported web server. In my instance I am using Apache 2.2 32bit on an Oracle Enterprise Linux, 64 bit server. If you are not sure what version your Apache server is, run
the command /usr/sbin/httpd -V and you'll see version and it its 32 or 64 bit. Mine is a 32bit server so I need
to extract
the file WLSPlugin1.1-Apache2.2-linux32-x86.zip.
The from
the resulting lib folder copy
the file mod_wl.so into /usr/lib/httpd/modules/.
First we want
to test that
the plug in will work for regular HTTP traffic. Edit
the httpd.conf for Apache and add
the following section at
the bottom.
LoadModule weblogic_module modules/mod_wl.so
<IfModule mod_weblogic.c>
WebLogicHost irm.company.internal
WebLogicPort 16100
WLLogFile /tmp/wl-proxy.log
</IfModule>
<Location /irm_rights>
SetHandler weblogic-handler
</Location>
<Location /irm_desktop>
SetHandler weblogic-handler
</Location>
<Location /irm_sealing>
SetHandler weblogic-handler
</Location>
<Location /irm_services>
SetHandler weblogic-handler
</Location>
Now restart Apache again (apachectl restart) and now open a browser
to http://irm.company.com/irm_rights. Apache will proxy
the HTTP traffic from
the port 80 of your Apache server
to the IRM service listening on port 16100 of
the WebLogic Managed server. Note above I have included all four of
the Locations you might wish
to proxy. http://irm.company.internalirm_rights is
the URL
to the management website, /irm_desktop is
the URL used for
the IRM Desktop
to communicate. irm_sealing is for web services based document sealing and irm_services is for IRM server web services.
The last two are typically only used when you have
the IRM server integrated with another application and it is unlikely you'd be accessing these resources from
the public facing Apache server. However, just in case, i've mentioned them above.
Now let's enable SSL communication from Apache
to WebLogic. In
the ZIP file we extracted were some more modules we need
to copy into
the Apache folder. Looking back in
the lib that we extracted, there are some more files. Copy
the following into
the /usr/lib/httpd/modules/ folder.
libwlssl.so
libnnz11.so
libclntsh.so.11.1
Now
the documentation states that should only need
to do this, but I found that I also needed
to create an environment variable called LD_LIBRARY_PATH and point this
to the folder /usr/lib/httpd/modules/. If I didn't do this, starting Apache with
the WebLogic module configured
to SSL would throw
the error.
[crit] (20014)Internal error: WL SSL Init failed for server: (null) on 0
So I had
to edit
the file /etc/profile and add
the following lines at
the bottom. You may already have
the LD_LIBRARY_PATH variable defined, therefore simply add this path
to it.
LD_LIBRARY_PATH=/usr/lib/httpd/modules/
export LD_LIBRARY_PATH
Now
the WebLogic plug in uses an Oracle Wallet
to store
the required certificates.You'll need
to copy
the self signed certificate from
the IRM server over
to the Apache server. Copy over
the MyOwnSelfCA.cer.der into
the same folder where you are storing your public certificates, in my example this is /oracle/secure. It's worth mentioning these files should ONLY be readable by root (the user Apache runs as).
Now lets create an Oracle Wallet and import
the self signed certificate from
the IRM server.
The file orapki was included in
the bin folder of
the Apache 1.1 plugin zip you extracted.
orapki wallet create -wallet /oracle/secure/my-wallet -auto_login_only
orapki wallet add -wallet /oracle/secure/my-wallet -trusted_cert -cert MyOwnSelfCA.cer.der -auto_login_only
Finally change
the httpd.conf
to reflect that we want
the WebLogic Apache plug-in
to use HTTPS/SSL and not just plain HTTP.
<IfModule mod_weblogic.c>
WebLogicHost irm.company.internal
WebLogicPort 16101
SecureProxy ON
WLSSLWallet /oracle/secure/my-wallet
WLLogFile /tmp/wl-proxy.log
</IfModule>
Then restart Apache once more and you can go back
to the browser
to test
the communication. Opening
the URL https://irm.company.com/irm_rights will proxy your request
to the WebLogic server at https://irm.company.internal:16101/irm_rights.
At this point you have a fully functional Oracle IRM service,
the next step is
to create a sealed document and test
the entire system.
