Architect Consultant blog

Introduction Unfortunately i did not went to the WSO2 Conference in Asia  but i went through the presentations and this blog item describes some interesting topics i came accross. There were a lot of different tracks: API Management  Cloud Strategy Integration' Security Governance Architecture Analytics DevOps Internet of Things (IoT) API API (Management) is a hot topic. Almost all reference architectures use APIs to expose functionality, either to mobile apps or other apps. It is used within Microservices as contracts, it is used in connected enterprises that want to expose their APIs into the API economy system and it is used internally to manage and govern services. IoT Internet of Things is a also a big thing, so also at the WSO2 conference. The WSO2 IoT Server was announced in 2016 Q2. Features of this product: Implementation of WSO2 IoT Reference Architecture Device Management Device Analytics Device adapters ...

Introduction In one of my previous Blog item about Cordys BOP4, I described how Apache WebServer and Cordys BOP must be configured for using secure two-way-SSL. I discovered some behavior of this set-up which i want to share in this blog. Behavior When you configure two-way-SSL in Apache Webserver, the client certificate is used by the Apache WebServer to check whether this client may access the WebServer. However this certificate is also used by Cordys BOP4 for the identification of the User within BOP4. For this you have to configure a User that has the client certificate attached to it. * Goto User Manager > Users Roles * Select a User, Right click Edit * Select as Authentication Type: Certificate * Click Use Certificate and import the public certificate of the client (X.501 compliant) When you sent a soap message to the platform you must NOT use wsse:Security tags in the soap header anymore    Roger Password ...

Introduction This blog item describes how I setup End-2-End security ebXML communication using the Hermes2 framework. The ebMS client is on a Tomcat installation and it communicates with an Apache WebServer (running on Linux and redirecting ebms communication to Tomcat instance on the same server). Prerequisite: Hermes2 (client) and Tomcat installed Hermes2 (server) and Tomcat installed Server certificates generated (self signed) Configuring Hermes2 (corvus webbapplication within Tomcat) When you change the partner agreement to use the https:// protocol towards the receiver you will get the following error (look in the ebms.log of the ebMS sender). hk.hku.cecid.ebms.spa.task.DeliveryException: Cannot send the message     by hk.hku.cecid.piazza.commons.net.ConnectionException: Unable to send HTTP SOAP request     by javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider...

Introduction I know there has been written a lot already about SSL configuration on Tomcat and Apache, but for my own registration I store some links I used to setup SSL. It also contains some handy commands I used to generate certificates. Links Client Certificate Authentication with Apache Apache webserver and SSL configuration Nice overview of SSL and OpenSSL OpenSSL and PKCS#12 FQA Description of Java keytool Most common keytool commands Configuration of Hermes2 (ebXML framework) with SSL Configuration of SSL in Tomcat Terms X.509 In cryptography, X.509 is an ITU-T standard for a public key infrastructure (PKI) for single sign-on (SSO) and Privilege Management Infrastructure (PMI). X.509 specifies, amongst other things, standard formats for public key certificates , certificate revocation lists , attribute certificates , and a certification path validation algorithm. PKCS#12 PKCS#12 is a standard for storing private keys and certificates securely. It define...

I was testing Basic Authentication with soapUI and got the following error: "Authenticator is not instantiated via the properties". <soapenv:Envelope xmlns:def="http://schemas.cordys.com/default" xmlns:mes="http://www.cvz.nl/csp/message" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">    <soapenv:Body>       <soapenv:Fault>          <faultcode xmlns:ns0="http://schemas.xmlsoap.org/soap/envelope/">ns0:Client</faultcode>          <faultstring xml:lang="en-US">User validation failed for: '5517'.</faultstring>          <detail>             <cordys:FaultDetails xmlns:cordys="http://schemas.cordys.com/General/1.0/">                <cordys:...

Introduction This blog item will show an example how to configure secure SSL with Apache 2.2.x and Cordys BOP4 (CU9) (on Windows). Creating Test Certificate First we will create a test certificate with Apache. Copy the <Apache>/conf/ openssl.cnf to a temportary directory (<temp>) Because the EventService of Cordys uses the IP address as an alternate domain, you have to change the openssl.cnf file in the <temp> directory. Add the following line behind [ v3_req ]: subjectAltName=DNS: www.example.com,DNS: 192.168.2.103 (Change localhost and IP address accordingly) First we will create the RSA Private Key: <Apache>/bin/openssl genrsa -des3 -out server.key 1024 Now we must generate a Certificate Signed Request (CSR). During the generation of the CSR, you will be prompted for several pieces of information. These are the X.509 attributes of the certificate. One of the prompts will be for "Common Name (e.g., YOUR name)". It is important that this field be fil...

Introduction The last week we had to implement some Authorization functionality on Cordys BOP4 (CU9) services. During this journey I discovered that there were several ways in defining the security and this makes it very complex (if you’re a first user just like me). So this blog item describes some ways to define the security and my experiences. Ways to Identify Cordys supports several ways to identify users: No identification is used, in this case this is mapped to an “anonymous” authenticated user within Cordys. Cordys. The credentials are put in the soap header request and are mapped to a Cordys user. WS-Security SAML. This can be used for single-sign-on WS-Security User name token. The user puts its identity (user and password, clear text or encrypted are possible) within the soap header This blog item uses the last with clear text user and password. You can set Cordys identification within the LDAP Explorer: Open LDAP Explorer Goto Organization (HRM) > soap nodes ...

Introduction With the setup using Cordys security an exposed BPM process as a webservice needs authentication. However it is possible to grant "anonymous" access to the service. This blog item shows how this is done. Authentication Within the Cordys framework there are several ways to handle authentication: WebServer - The authentication at the web server (Apache, IIS) (NTLM, Active Directory, or LDAP) and authorisation at the service group. WS-Security - The authentication/authorisation takes place in the service group. Anonymous - No authentication is done and authorisation in the service group. Anonymous user Identity is usually placed in the SOAP header, but for anonymous access this is not needed. The webserver should be configured to allow anonymous access though. Cordys uses the system defined user anonymous when anonymous access is used. The soap request will be executed when the anonymous user is granted. The ACL (Access Control Level) of a service can be s...

Ik moest toch naar de Oracle Fusion stack kijken, dus ik dacht laat ik maar direct een samenvatting maken van de verschillende producten. Het eerste is de Oracle Web Service Manager. Wat biedt het? • Centraal configuratie van policies m.b.t. web services (LDAP directory of Oracle’s Access Manager(OAM)) • Enforce deze policies runtime • Monitoren van runtime security evenst en SLAs in grafieken Bij web services security spelen de volgende zaken een rol: • Authenticatie – Is degene wel wie die zegt dat hij is, gebaseerd op credentials (user name, paswoord) • Authorisatie – Een gebruiker toegang geven tot bepaalde resources gebaseerd op de gebruiker entitlements (property/karakterestiek van een gebruiker). • Confidentiality – Zorgen dat de data niet gelezen kan worden, dmv encryptie. Ook hoort hierbij de identiteit van de sturende en ontvangende partij(privacy). • Integrity – Zorgen dat een bericht niet kan worden aangepast OWSM maakt gebruik van Public Key Infrastructure (PKI) omgevingen...