Creating A Self-Signed Oracle Wallet With orapki

Holy moly. Talk about the snake eating it's own tail.

Long story short: six years after developing a login module for Department of Defense Common Access Cards and an Oracle Forms application I was recently asked to do the same thing but on an Oracle 11g application server versus the Oracle 10g application server. Of course the Oracle 11g Middleware stack is almost completely different from the 10g version, but I still need an Oracle Wallet with a self-signed certificate. Six years is a long time to remember something like this but thanks to Google to answer was only a "Oracle Wallet self-signed certificate" search away.

And I found this: Oracle Wallet w/ Self-Signed Certificate on Tyler Muth's blog where a how-to I wrote six years ago on a now-defunct blog was re-posted. Thankfully Tyler re-posted the all of the steps and the links.

My method used OpenSSL to generate a trusted CA cert to sign a request generated by an Oracle Wallet and then importing the ca cert and the signed cert into the wallet. So, I downloaded cygwin, OpenSSL, the OpenSSL scripts and then I looked in the comments on Tyler's post and found another solution (thanks Frank!) using the orapki utility. This looked a lot easier, and it was, after I figured out how to translate it from 'nix to Windows-speak.

So here it is, how to use the orapki utility to create a wallet with a self-signed certificate on a Windows box:

1. orapki wallet create -wallet wallet_location -auto_login -pwd wallet_password
2. orapki wallet add -wallet wallet_location -dn “cn=server_hostname,cn=foo,dc=bar,dc=com” -keysize 1024 -self_signed -validity 3650 -pwd wallet_password

Notes:

• wallet_location is the directory the new wallet will be located in, not the wallet's filenname (Oracle likes its wallets to be named "ewallet.p12." Usually easier to leave it that way.)
• wallet_password is the wallet password. You specify it in the first step and will then use whenever you do soemething to the wallet, like add a certificate, using orapki or the Oracle Wallet Manager. Keep it in a safe place - no way to get into the wallet if you forget it in the future.

Finally, thanks Tyler - how did we get things done before the Internet?

Forms, RADs and Common Access Cards - It Works

After three weeks of twelve hour days, lost weekends, and two trips to our customer's location, we finally have an Oracle Forms application that can be accessed with Department of Defense Common Access Cards (CACs).

CACs are smart cards containing a PKI certificate. The military uses these for ID cards and for gaining access to the .mil domain. Users have to insert their CAC into a reader at a workstation to login to their local network.

We built a login module using two java servlets and a simple html form to read the users common name attribute from the card's distinguished name. The CAC's common name contains a unique identifier that is used to create an entry in Oracle Internet Directory. We use Oracle's sample forms_rad pl/sql package to create a Resource Access Descriptor for the user and store it in OID as well. After the user's OID entry and RAD are created, they are turned over to Forms, which is configured for Single Sign-On. Single Sign-on authenticates the user and Forms then pulls the RAD from OID and connects to their backend database account.

Although it was often frustrating, it was a great learning experience. My next project is to convert the servlets into .jsp pages. Now that we've got the configuration licked (about 75% of the effort was getting the Oracle Application Server 10g (10.1.2) configured correctly) this should be fairly simple.

Several folks posted helpful suggestions to previous entries in this blog and once again I'll say thanks to all for your help. If anyone has any questions about our configuration please post them here and I'll do my best to answer your questions.

Next: Build a JSP That Reads and Stores X.509 Certs

Now that my OAS 10g R2 10.1.2.0.2 App server is configured for client-side authentication, I am moving on to the next problem, which is figuring out how to register first-time users.

The Oracle Single Sign-On server requires a copy of the client certificate be stored in Oracle Internet Directory. That means each user must have an entry in OID to store the certificate in.

This is sequence of steps required to register a first-time user of our reduced sign-on enabled Forms application:

1. User opens JSP
2. JSP pulls user's X.509 certificate from the user's browser
3. JSP reads user's DN from certificate
4. JSP searches for user's DN in OID
5. If DN is found, cert is passed to SSO for authentication
6. If DN is NOT found, user is redirected to a registration page
7. User is prompted for their username (this step requires a personnel record containing the username be created for the user by an administrator in the backend database prior to registration)
8. Personnel records searched for username
9. If username not found, prompt user to re-enter username or contact administrator
   
10. If username found, create an entry in OID for user containing the following
1. DN
2. X.509 Cert
3. Resource Access Descriptor (database connect string for backend database)
11. User logged into account

I'm guessing the main page will be a JSP, the username prompt page either a JSP or a simple HTML form, and there will be a servlet that handles the OID and backend database queries and user entry creation on OID. At least that's the plan. . .

For experienced programmers, I'm sure this would be a trivial task. But because I've spent 98% of my time configuring and installing database and application servers, this is non-trivial for me. I have downloaded the latest version of JDeveloper, and am refreshing my scant knowledge by re-doing several of the beginning tutorials. Don't know how long this will take, but it at least its something new to work on.

It Works!

All that fiddling around with certificate authorities was for naught. I was trying to log in with a bad certificate stored in the browser. When I inserted a smartcard everything worked as advertised.

Following four files have to be updated to configure HTTP and SSO for client certifciates:

1. ORACLE_HOME\Apache\Apache\conf\ssl.conf
2. ORACLE_HOME\sso\conf\policy.properties
3. ORACLE_HOME\sso\conf\sso_apache.conf
4. ORACLE_HOME\j2ee\OC4J_SECURITY\application-deployments\sso\web\orion-web.xm

That's it - and don't confuse yourself trying to login with a bad certificate!