Fuse ESB - Security Guide - Enable SSL/TLS on the LDAP Connection

Enable SSL/TLS on the LDAP Connection

Overview

This tutorial explains how to enable SSL/TLS security on the connection between the LDAP login module and the Apache Directory Server.

The Apache Directory Server is already configured with an SSL endpoint. The default configuration creates an LDAPS endpoint that listens on the IP port 10636. The directory server automatically generates a self-signed X.509 certificate which it uses to identify itself during the SSL/TLS handshake.

	Important
	You can use the default SSL configuration for simple demonstrations, but it is not suitable for real deployments. For advice on how to configure a real deployment, see Tightening up security.

Procedure

To enable SSL/TLS security on the connection to the Apache Directory Server:

Obtain a copy of the server's self-signed certificate.
Convert the DER format certificate into a keystore.
1. From a command prompt, change directory to the directory where you have stored the ApacheDS.der file.
2. Enter the following keytool command:
```
keytool -import -file ApacheDS.der -alias server -keystore truststore.ks -storepass secret
```
Copy the newly created keystore file, truststore.ks, into the Fuse ESB etc/ directory.
Open the ldap-module.xml file you created in Enable LDAP Authentication in the OSGi Container in a text editor.
Edit the connection.url to use ldaps://localhost:10636.

Add the highlighted lines in Example 8.3.

Example 8.3. LDAP Configuration for Using SSL/TLS

<?xml version="1.0" encoding="UTF-8"?>
<blueprint xmlns="http://www.osgi.org/xmlns/blueprint/v1.0.0"
  xmlns:jaas="http://karaf.apache.org/xmlns/jaas/v1.0.0"
  xmlns:ext="http://aries.apache.org/blueprint/xmlns/blueprint-ext/v1.0.0">

  <!-- Example configuration for using LDAP based authentication.
  	   This example uses an JAAS LoginModule from Karaf. 
  	   It supports authentication of users and also supports
  	   retrieving user roles for authorization.

       Note, this config overwrite the default karaf domain
	   that is defined inside some JAR file
       by using a rank > 0 attribute.
  -->
  <jaas:config name="karaf" rank="1">
    <jaas:module className="org.apache.karaf.jaas.modules.ldap.LDAPLoginModule" flags="required">
      initialContextFactory=com.sun.jndi.ldap.LdapCtxFactory
      connection.username=uid=admin,ou=system
      connection.password=secret
      connection.protocol=
      connection.url = ldaps://localhost:10636
      user.base.dn = ou=users,ou=system
      user.filter = (uid=%u)
      user.search.subtree = true
      role.base.dn = ou=users,ou=system
      role.filter = (uid=%u)
      role.name.attribute = ou
      role.search.subtree = true
      authentication = simple
      ssl.protocol=SSL
      ssl.truststore=truststore
      ssl.algorithm=PKIX
    </jaas:module>
  </jaas:config>
  
  <jaas:keystore name="truststore"
        path="file:///ESBInstallDir/etc/truststore.ks"
	keystorePassword="secret" />
</blueprint>