Got X509 Certs - Finally!

Yesterday's problems were caused by, um, operator error, and have been resolved. I can now use a servlet to extract all the details of a client certificate.

Next up: Learning how to use the Subject DN of the certificate to search the Oracle Internet Directory LDAP Server.

X509Certificates - Getting Closer

Found a sample Java servlet that reads client certificates. Loaded it into JDev 10.1.3, configured it for OAS 10.1.2, deployed it successfully to a new OC4J container, and connected to it successfully, but it reported that no client certificate was present. This was a head scratcher, so I reviewed the Java API for the X509Certificate class and the HTTPRequest interface, tried a couple of things, didn't get anything to work, and then somehow ended up on the Sun Developer Network, where I found this post: Obtaining an X509Certificate from a Web App. The post mentions adding the directive "Oc4jExtractSSL On" to the Apache mod_oc4j.conf file. Apparently, you have to explicitly tell the Oracle HTTP Server to pass the client certificate to the OC4J. So I tried it - but still not getting the certificate. But I think I'm getting closer - still googling and hopefully I'll have an answer by the end of the day.

Update: Found another missing piece of the puzzle in an OTN post. Enabled the SSLOptions +ExportCert +StdEnvVars directives in ssl.conf, but the servlet is still not getting the certificates. Posted a plea for help in the OTN OC4J/J2EE forum here. Hope I hear from someone soon.

Another Update: I hate the Metalink interface so much I usually leave it as my last resource, but lo and behold I found Note 256244.1 Sample code to read Client Certificate details in a Servlet/JSP. It links to Note 255965.1 Configuration steps to read Client Certificate details from a Servlet/JSP (sorry - Oracle CSI required to access). The configuration steps have added nothing new to what I've already done with mod_oc4j.conf and ssl.conf. But I thought I'd give the sample code a try. Opened a new application in JDev 10.1.3, changed to the 1.4.2 library, created a servlet, copied and pasted the code, no errors, ran it in the embedded OC4J and got the expected result: A web page stating the connection was not made via HTTPS so no certificate data available. Yippee! Created my deployment descriptors and profile, deployed it to an .EAR, copied the .EAR to the applications directory of my configured OC4J, deployed successfully and all I get is a #@!&^! 404 Page Not Found Error.


Slamming head on desk. . .

Next: Build a JSP That Reads and Stores X.509 Certs

Now that my OAS 10g R2 10.1.2.0.2 App server is configured for client-side authentication, I am moving on to the next problem, which is figuring out how to register first-time users.

The Oracle Single Sign-On server requires a copy of the client certificate be stored in Oracle Internet Directory. That means each user must have an entry in OID to store the certificate in.

This is sequence of steps required to register a first-time user of our reduced sign-on enabled Forms application:

1. User opens JSP
2. JSP pulls user's X.509 certificate from the user's browser
3. JSP reads user's DN from certificate
4. JSP searches for user's DN in OID
5. If DN is found, cert is passed to SSO for authentication
6. If DN is NOT found, user is redirected to a registration page
7. User is prompted for their username (this step requires a personnel record containing the username be created for the user by an administrator in the backend database prior to registration)
8. Personnel records searched for username
9. If username not found, prompt user to re-enter username or contact administrator
   
10. If username found, create an entry in OID for user containing the following
1. DN
2. X.509 Cert
3. Resource Access Descriptor (database connect string for backend database)
11. User logged into account

I'm guessing the main page will be a JSP, the username prompt page either a JSP or a simple HTML form, and there will be a servlet that handles the OID and backend database queries and user entry creation on OID. At least that's the plan. . .

For experienced programmers, I'm sure this would be a trivial task. But because I've spent 98% of my time configuring and installing database and application servers, this is non-trivial for me. I have downloaded the latest version of JDeveloper, and am refreshing my scant knowledge by re-doing several of the beginning tutorials. Don't know how long this will take, but it at least its something new to work on.

It Works!

All that fiddling around with certificate authorities was for naught. I was trying to log in with a bad certificate stored in the browser. When I inserted a smartcard everything worked as advertised.

Following four files have to be updated to configure HTTP and SSO for client certifciates:

1. ORACLE_HOME\Apache\Apache\conf\ssl.conf
2. ORACLE_HOME\sso\conf\policy.properties
3. ORACLE_HOME\sso\conf\sso_apache.conf
4. ORACLE_HOME\j2ee\OC4J_SECURITY\application-deployments\sso\web\orion-web.xm

That's it - and don't confuse yourself trying to login with a bad certificate!