Borland VisiBroker® 7.0 - Borland Technical Publications

Steps to secure clients and serversCertificate-based authentication, using APIsIf you do not want to use KeyStores directly, you can import certificates and privatekeys using the CertificateFactoryAPI. This class also supports the pkcs12 file format.CORBA::Object_var o = orb->resolve_initial_references("VBSecureSocketProvider");vbsec::SecureSocketProvider* ssp =dynamic_cast(o.in());const vbsec::CertificateFactory& cf = ssp->getCertificateFactory ();The first argument in the new Certificate wallet is an alias to the entry in the KeyStore,if any. If you are not using keystores, set this argument to null.pkcs12-based authentication, using KeyStoresYou can use the same APIs discussed in “Username/password authentication, usingAPIs” on page 72 to login using pkcs12 KeyStores. The realm name in theIdentityWallet should be CERTIFICATE#ALL, the username corresponds to an alias name inthe default KeyStore that refers to a Key entry, and the password refers to the passwordneeded to unlock the pkcs12 file. The property javax.net.ssl.KeyStore specifies thelocation of the pkcs12 file.pkcs12-based authentication, using APIsSee “Certificate-based authentication, using APIs” on page 73.Step Two: Setting properties and Quality of Protection (QoP)There are several properties that can be used to ensure connection Quality ofProtection. The VisiBroker ORB security properties for C++ can be used to fine-tuneconnection quality. For example, you can set the cipherList property for SSLconnections to set cryptography strength.QoP policies can be set using the ServerQoPConfig and the ClientQoPConfig APIs forservers and clients, respectively. These APIs allow you set target trust (whether or nottargets must authenticate), the transport policy (whether or not to use SSL or anothersecure transport mechanism specified separately), and, for servers, anAccessPolicyManager that can access the RoleDB to set access policies for POAobjects.Step Three: Setting up TrustSetting up of trust can be done through propertyvbroker.security.trustpointRepository=Directory:, where thedirectory contains the trusted certificates.Other trust policies are set in the QoP configurations. See “Step Two: Settingproperties and Quality of Protection (QoP)” on page 73.Chapter 7: Making Secure Connections (C++) 73