Borland VisiBroker® 7.0 - Borland Technical Publications

Enabling certificate passthrough to the Borland web containerEnabling certificate passthrough to the Borland web containerBy enabling mod_ssl for your Apache web server, you can configure your web serverto handle “https” (SSL) type connections. As a result, any SSL authenticationinformation is consumed by the Apache web server. If you want your Borland webcontainer to manage the SSL authentication, the Apache web server and IIOPconnector need to pass the SSL authentication information through to the Borland webcontainer.By implementing the VisiBroker “certificate passthrough” feature, you can give yourBorland web container access to all the browser-supplied SSL information, as if theApache web server is not between the browser and the web container. Additionally,your Borland web container is given control of the SSL-based authorization. With thisfeature, the web applications can use the auth-method CLIENT_CERT_AUTH even when theApache web server is in between the browser and the Borland web container.Configuring Apache to “passthrough” the SSL certificate andrelated informationEnabling certificate passthrough consists of the following two steps:1 Configuring mod_ssl module of the httpd.conf file to export the SSL authenticationinformation passed to it by the browser into a shared environment.This shared environment allows the mod_iiop IIOP connector to obtain this data forsubsequent forwarding to the Borland web container.2 Configuring the mod_iiop IIOP connector to forward any SSL authenticationinformation to the Borland web container.Configuring the mod_ssl module of the httpd.conf file for certificate passthroughModify the httpd.conf file located in: /var/domains//configurations//mos//conf by uncommentingthe sslOptions +StdEnvVars +ExportCertData directive in the mod_sslsection. For example:BrowserMatch ^Mozilla/[2345] nokeepaliveSSLEngine onSSLRandomSeed startup builtinSSLRandomSeed connect builtinSSLCertificateFile C:\BDP(b414)\var\domains\base\configurations\j2eeSample/mos/ApacheWebServer/conf/ssl.crt/server.crtSSLCertificateKeyFile C:\BDP(b414)\var\domains\base\configurations\j2eeSample/mos/ApacheWebServer/conf/ssl.key/server.key# Uncomment the following to enable SSL certificate and related information tobe exported to the apache environment#SSLOptions +StdEnvVars +ExportCertDataChapter 8: Security for the Web components 81