Quick guide
to Oracle IRM 11g index
So far in this guide we have an IRM Server up and running, however I skipped over SSL configuration in the previous article because I wanted
to focus in more detail now. You can, if you wish, not bother with setting up SSL, but considering this is a security technology it is worthwhile doing.
Contents
Setting up a one way, self signed SSL certificate in WebLogic
Setting up an official SSL certificate in Apache 2.x
Configuring Apache
to proxy traffic
to the IRM server
There are two common scenarios in which an
Oracle IRM server is configured. For a development or evaluation system, people usually communicate directly
to the WebLogic Server running the IRM service. However in a production environment and for some proof of concept evaluations that require a setup reflecting a production system, the traffic
to the IRM server travels via a web server proxy, commonly Apache. In this guide we are building an
Oracle Enterprise Linux based IRM service and this article will go over the configuration of SSL in WebLogic and also in Apache.
Like in the past articles, we are going
to use two host names in the configuration below,irm.company.com will refer
to the public Apache server
irm.company.internal will refer
to the internal WebLogic IRM server
Setting up a one way, self signed SSL certificate in WebLogic
First lets look at creating just a simple self signed SSL certificate
to be used in WebLogic. This is a quick and easy way
to get SSL working in your environment, however the downside is that no browsers are going
to trust this certificate you create and you'll need
to manually install the certificate onto any machine's communicating with the server. This is fine for development or when you have only a few users evaluating the system, but for any significant use it's usually better
to have a fully trusted certificate in use and I explain that in the next section. But for now lets go through creating, installing and testing a self signed certificate.
We use a library in Java
to create the certificates, open a console and running the following commands. Note you should choose your own secure passwords whenever you see password below.
[oracle@irm /] source /oracle/middleware/wlserver_10.3/server/bin/setWLSEnv.sh
[oracle@irm /] cd /oracle/middleware/user_projects/domains/irm_domain/config/fmwconfig/
[oracle@irm /] java utils.CertGen -selfsigned -certfile MyOwnSelfCA.cer -keyfile MyOwnSelfKey.key -keyfilepass password -cn "irm.
oracle.demo"
[oracle@irm /] java utils.ImportPrivateKey -keystore MyOwnIdentityStore.jks -storepass password -keypass password -alias trustself -certfile MyOwnSelfCA.cer.pem -keyfile MyOwnSelfKey.key.pem -keyfilepass password
[oracle@irm /] keytool -import -trustcacerts -alias trustself -keystore TrustMyOwnSelf.jks -file MyOwnSelfCA.cer.der -keyalg RSA
We now have two Java Key Stores, MyOwnIdentityStore.jks and TrustMyOwnSelf.jks. These contain keys and certificates which we will use in WebLogic Server. Now we need
to tell the IRM server
to use these stores when setting up SSL connections for incoming requests. Make sure the Admin server is running and login into the WebLogic Console at http://irm.company.intranet:7001/console and do the following;
In the menu on the left, select the + next
to Environment
to expose the submenu, then click on Servers.
You will see two servers in the list, AdminServer(admin) and IRM_server1. If the IRM server is running, shut it down either by hitting CONTROL + C in the console window it was started from, or you can switch
to the CONTROL tab, select IRM_server1 and then select the Shutdown menu and then Force Shutdown Now.
In the Configuration tab select IRM_server1 and switch
to the Keystores tab. By default WebLogic Server uses it's own demo identity and trust. We are now going
to switch
to the self signed one's we've just created. So select the Change button and switch
to Custom Identity and Custom Trust and hit save.
Now we have
to complete the resulting fields, the setting's i've used in my evaluation server are below.
IdentityCustom Identity Keystore: /oracle/middleware/user_projects/domains/irm_domain/config/fmwconfig/MyOwnIdentityStore.jks
Custom Identity Keystore Type: JKS
Custom Identity Keystore Passphrase: password
Confirm Custom Identity Keystore Passphrase: password
TrustCustom Trust Keystore: /oracle/middleware/user_projects/domains/irm_domain/config/fmwconfig/TrustMyOwnSelf.jks
Custom Trust Keystore Type: JKS
Custom Trust Keystore Passphrase: password
Confirm Custom Trust Keystore Passphrase: password
Now click on the SSL tab for the IRM_server1 and enter in the alias and passphrase, in my demo here the details are;
IdentityPrivate Key Alias: trustself
Private Key Passphrase: password
Confirm Private Key Passphrase: password
And hit save.
Now lets test a connection
to the IRM server over HTTPS
using SSL. Go back
to a console window and start the IRM server, a quick reminder on how
to do this is...
[oracle@irm /] cd /oracle/middleware/user_projects/domains/irm_domain/bin
[oracle@irm /] ./startManagedWeblogic IRM_server1
Once running, open a browser and head
to the SSL port of the server. By default the IRM server will be listening on the URL https://irm.company.intranet:16101/irm_rights. Note in the example image on the right the port is 7002 because it's a system that has the IRM services installed on the Admin server, this isn't typical (or advisable). Your system is going
to have a separate managed server which will be listening on port 16101. Once you open this address you will notice that your browser is going
to complain that the server certificate is untrusted. The images on the right show how Firefox displays this error. You are going
to be prompted every time you create a new SSL session with the server, both from the browser and more annoyingly from the IRM Desktop.
If you plan on always
using a self signed certificate, it is worth adding it
to the Windows certificate store so that when you are accessing sealed content you do not keep being informed this certificate is not trusted. Follow these instructions (which are for Internet Explorer 8, they may vary for your version of IE.)
Start Internet Explorer and open the URL
to your IRM server over SSL, e.g. https://irm.company.intranet:16101/irm_rights. IE will complain that about the certificate, click on Continue
to this website (not recommended).
From the IE Tools menu select Internet Options and from the resulting dialog select Security and then click on Trusted Sites and then the Sites button.
Add
to the list of trusted sites a URL which mates the server you are accessing, e.g. https://irm.company.intranet/ and select OK. Now refresh the page you were accessing and next
to the URL you should see a red cross and the words Certificate Error. Click on this button and select View Certificates.
You will now see a dialog with the details of the self signed certificate and the Install Certificate... button should be enabled. Click on this
to start the wizard. Click next and you'll be asked where you should install the certificate.
Change the option
to Place all certificates in the following store. Select browse and choose the Trusted Root Certification Authorities location and hit OK. You'll then be prompted
to install the certificate and answer yes.
You also need
to import the root signed certificate into the same location, so once again select the red Certificate Error option and this time when viewing the certificate, switch
to the Certification Path tab and you should see a CertGenCAB certificate. Select this and then click on View Certificate and go through the same process as above
to import the certificate into the store.
Finally close all instances of the IE browser and re-access the IRM server URL again, this time you should not receive any errors.
Setting up an official SSL certificate in Apache 2.x
At this point we now have an IRM server that you can communicate with over SSL. However this certificate isn't trusted by any browser because it's path of trust doesn't end in a recognized certificate authority (CA). Also you are communicating directly
to the WebLogic Server over a non standard SSL port, 16101. In a production environment it is common
to have another device handle the initial public internet traffic and then proxy this
to the WebLogic server. The diagram below shows a very simplified view of this type of deployment. What i'm going
to walk through next is configuring Apache
to proxy traffic
to a WebLogic server and also
to use a real SSL certificate from an official CA.
First step is
to configure Apache
to handle incoming requests over SSL. In this guide I am configuring the IRM service in
Oracle Enterprise Linux 5 update 3 and Apache 2.2.3 which came with OpenSSL and mod_ssl components. Before I purchase an SSL certificate, I need
to generate a certificate request from the server.
Oracle.com uses Verisign and for my own personal needs I use cheaper certificates from GoDaddy. The following instructions are specific
to Apache, but there are many references out there for other web servers. For Apache I have OpenSSL and the commands are;
[oracle@irm /] cd /usr/bin
[oracle@irm bin] openssl genrsa -des3 -out irm-apache-server.key 2048
Generating RSA private key, 2048 bit long modulus
............................+++
.........+++
e is 65537 (0x10001)
Enter pass phrase for irm-apache-server.key:
Verifying - Enter pass phrase for irm-apache-server.key:
[oracle@irm bin] openssl req -new -key irm-apache-server.key -out irm-apache-server.csr
Enter pass phrase for irm-apache-server.key:
You are about
to be asked
to enter information that will be incorporated
into your certificate request.
What you are about
to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:US
State or Province Name (full name) [Berkshire]:CA
Locality Name (eg, city) [Newbury]:San Francisco
Organization Name (eg, company) [My Company Ltd]:Oracle
Organizational Unit Name (eg, section) []:Security
Common Name (eg, your name or your server's hostname) []:irm.company.com
Email Address []:
[email protected]
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:testing
An optional company name []:
You must make sure
to remember the pass phrase you used in the initial key generation, you will need this when later configuring Apache. In the /usr/bin directory there are now two new files. The irm-apache-server.csr contains our certificate request and is what you cut and paste, or upload,
to your certificate authority when you purchase and validate your SSL certificate. In response you will typically get two files. Your server certificate and another certificate file that will likely contain a set of certificates from your CA which validate your certificate's trust. Next we need
to configure Apache
to use these files. Typically there is an ssl.conf file which is where all the SSL configuration is done. On my
Oracle Enterprise Linux server this file is located in /etc/httpd/conf.d/ssl.conf and i've added the following lines.
<VirtualHost irm.company.com>
# Setup SSL for irm.company.com
ServerName irm.company.com
SSLEngine On
SSLCertificateFile /oracle/secure/irm.company.com.crt
SSLCertificateKeyFile /oracle/secure/irm.company.com.key
SSLCertificateChainFile /oracle/secure/gd_bundle.crt
</VirtualHost>
Restarting Apache (apachectl restart) and I can now attempt
to connect
to the Apache server in a web browser, https://irm.company.com/. If all is configured correctly I should now see an Apache test page delivered
to me over HTTPS.
Configuring Apache
to proxy traffic
to the IRM server
Final piece in setting up SSL is
to have Apache proxy requests for the IRM server but do so securely. So the requests
to Apache will be over HTTPS
using a legitimate certificate, but we can also configure Apache
to proxy these requests internally across
to the IRM server
using SSL with the self signed certificate we generated at the start of this article.
To do this proxying we use the WebLogic Web Server plugin for Apache which you can download here from
Oracle. Download the zip file and extract onto the server.
The file extraction reveals a set of zip files, each one specific
to a supported web server. In my instance I am
using Apache 2.2 32bit on an
Oracle Enterprise Linux, 64 bit server. If you are not sure what version your Apache server is, run the command /usr/sbin/httpd -V and you'll see version and it its 32 or 64 bit. Mine is a 32bit server so I need
to extract the file WLSPlugin1.1-Apache2.2-linux32-x86.zip. The from the resulting lib folder copy the file mod_wl.so into /usr/lib/httpd/modules/.
First we want
to test that the plug in will work for regular HTTP traffic. Edit the httpd.conf for Apache and add the following section at the bottom.
LoadModule weblogic_module modules/mod_wl.so
<IfModule mod_weblogic.c>
WebLogicHost irm.company.internal
WebLogicPort 16100
WLLogFile /tmp/wl-proxy.log
</IfModule>
<Location /irm_rights>
SetHandler weblogic-handler
</Location>
<Location /irm_desktop>
SetHandler weblogic-handler
</Location>
<Location /irm_sealing>
SetHandler weblogic-handler
</Location>
<Location /irm_services>
SetHandler weblogic-handler
</Location>
Now restart Apache again (apachectl restart) and now open a browser
to http://irm.company.com/irm_rights. Apache will proxy the HTTP traffic from the port 80 of your Apache server
to the IRM service listening on port 16100 of the WebLogic Managed server. Note above I have included all four of the Locations you might wish
to proxy. http://irm.company.internalirm_rights is the URL
to the management website, /irm_desktop is the URL used for the IRM Desktop
to communicate. irm_sealing is for web services based document sealing and irm_services is for IRM server web services. The last two are typically only used when you have the IRM server integrated with another application and it is unlikely you'd be accessing these resources from the public facing Apache server. However, just in case, i've mentioned them above.
Now let's enable SSL communication from Apache
to WebLogic. In the ZIP file we extracted were some more modules we need
to copy into the Apache folder. Looking back in the lib that we extracted, there are some more files. Copy the following into the /usr/lib/httpd/modules/ folder.
libwlssl.so
libnnz11.so
libclntsh.so.11.1
Now the documentation states that should only need
to do this, but I found that I also needed
to create an environment variable called LD_LIBRARY_PATH and point this
to the folder /usr/lib/httpd/modules/. If I didn't do this, starting Apache with the WebLogic module configured
to SSL would throw the error.
[crit] (20014)Internal error: WL SSL Init failed for server: (null) on 0
So I had
to edit the file /etc/profile and add the following lines at the bottom. You may already have the LD_LIBRARY_PATH variable defined, therefore simply add this path
to it.
LD_LIBRARY_PATH=/usr/lib/httpd/modules/
export LD_LIBRARY_PATH
Now the WebLogic plug in uses an
Oracle Wallet
to store the required certificates.You'll need
to copy the self signed certificate from the IRM server over
to the Apache server. Copy over the MyOwnSelfCA.cer.der into the same folder where you are storing your public certificates, in my example this is /oracle/secure. It's worth mentioning these files should ONLY be readable by root (the user Apache runs as).
Now lets create an
Oracle Wallet and import the self signed certificate from the IRM server. The file orapki was included in the bin folder of the Apache 1.1 plugin zip you extracted.
orapki wallet create -wallet /oracle/secure/my-wallet -auto_login_only
orapki wallet add -wallet /oracle/secure/my-wallet -trusted_cert -cert MyOwnSelfCA.cer.der -auto_login_only
Finally change the httpd.conf
to reflect that we want the WebLogic Apache plug-in
to use HTTPS/SSL and not just plain HTTP.
<IfModule mod_weblogic.c>
WebLogicHost irm.company.internal
WebLogicPort 16101
SecureProxy ON
WLSSLWallet /oracle/secure/my-wallet
WLLogFile /tmp/wl-proxy.log
</IfModule>
Then restart Apache once more and you can go back
to the browser
to test the communication. Opening the URL https://irm.company.com/irm_rights will proxy your request
to the WebLogic server at https://irm.company.internal:16101/irm_rights.
At this point you have a fully functional
Oracle IRM service, the next step is
to create a sealed document and test the entire system.
