Borland VisiBroker® 7.0 - Borland Technical Publications
Share Embed Flag
Download ePaper

Borland VisiBroker® 7.0 - Borland Technical Publications

Borland VisiBroker® 7.0 - Borland Technical Publications Borland VisiBroker® 7.0 - Borland Technical Publications

borland.com
11.07.2015 Views

Security Properties for JavaProperty Description Defaultvbroker.security.authentication.config This specifies the path to the configuration file used for nullauthentication.vbroker.security.authentication.retryCount Number of times to retry if remote authentication failed. 3vbroker.security.authentication.clearCredentialsOnFailurevbroker.security.loginvbroker.security.login.realmsvbroker.security.vaultvbroker.security.identity.reauthenticateOnFailureBy default, if the authorization realm finds the authenticator isincorrect after the maximum number of retries have beenattained, the ORB retains the authenticator. If you want theORB to clear the authenticator (the credential) after themaximum number of retries, set this property to true.If set to true, at initialization-time this property tries to login toall the realms listed by propertyvbroker.security.login.realms.This gives a list of comma-separated realms to login to. Thisis used when login takes place, either through propertyvbroker.security.login (set to true) or API login using login().This property is used to specify the path to the vault file. Thisproperty will take effect regardless of whethervbroker.security.login is set to true or false.When set to true the security service will attempt to reacquireauthentication information using the CallbackHandler. Thisproperty require the callback handler to be set either usingthe appropriate property or at runtime by calling theappropriate method.vbroker.security.identity.enableReactiveLogin When set to true, the security service behaves as follows: Ifthe security service cannot find an identity for any of thetargets supported by a server it is attempting to communicatewith, it will then attempt to acquire credentials for one of thetargets in the target object's IOR. If a correspondingauthentication realm is available for this target (that the userchooses to provide credentials for), then authentication isalso attempted locally.Reactive login requires a callback handler to be set eitherusing the appropriate property or at runtime by calling theappropriate method.vbroker.security.authDomainsvbroker.security.domain..rolemap_pathvbroker.security.domain..rolemap_enableRefreshvbroker.security.domain..rolemap_refreshTimeInSecondsvbroker.security.domain..runas.vbroker.security.peerAuthenticationModeSpecifies a comma-separated list of available authorizationdomains. For example:vbroker.security.authDomains=,…Specifies the location of the RoleDB file that describes theroles used for authorization. This is scoped within the domain specified in vbroker.security.authDomains.When set to true, enables dynamic loading of the RoleDB filespecified invbroker.security.domain..rolemap_path property.The interval of dynamic loading is specified by propertyvbroker.security.domain..rolemap_refreshTimeInSeconds.falsefalsen/an/afalsetruenulln/afalseSpecifies the rolemap refresh time in seconds. 300Specifies the name of the run-as role. The value can beeither use-caller-identity to have the caller principal be in therun-as role, or specify an alias for a run-as principal for therun-as role name.Sets the peer authentication Mode. Possible values are:REQUIREREQUIRE_AND_TRUSTREQUESTREQUEST_AND_TRUSTNONENote that the REQUEST and REQUEST_AND_TRUST modes cannotreceive peer certificate chains due to JSSE restrictions.n/aNONE88 VisiBroker Security Guide

Security Properties for JavaProperty Description Defaultvbroker.security.trustpointsRepositoryvbroker.security.defaultJSSETrustvbroker.security.assertions.trust.Specifies a path to the directory containing trustedcertificates and CRLs or to a trusted Keystore whose valuesare implementations of TrustedCertificateEntry. Defaultvalues are either a directory, given in the formatDirectory: or a Keystore, given in the formatKeystore:.If set to true, the JSSE default trust files like cacerts andjssecacerts, if present in JRE, will be used to load trustedcertificates.This property is used to specify a list of trusted roles(specified with the format @). is a uniquely identified for each trust assertion rule as a list ofdigits.For example, settingvbroker.security.assertions.trust.1=ServerAdmin@defaultmeans this process trusts any assertion made by theServerAdmin role in the default authorization domain.vbroker.security.assertions.trust.all Setting to true will trust all the assertion made by peers. falsevbroker.security.server.requireUPIdentity Set this to true if the server requires the client to send aUsername/Password for authentication (regardless ofcertificate-based authentication). This is a server-sideproperty.n/avbroker.security.cipherListvbroker.security.controlAdminAccessvbroker.security.serverManager.authDomainvbroker.security.serverManager.role.allvbroker.security.serverManager.role.vbroker.security.support.gatekeeper.replyForSASvbroker.security.domain..defaultAccessRulevbroker.se.iiop_tp.scm.ssl.listener.trustInClientvbroker.security.wallet.typevbroker.security.wallet.identityvbroker.security.wallet.passwordSet this to a list of comma-separated ciphers to be enabledby default on startup. If not set, a default list of ciphersuiteswill be enabled. These should be valid SSL Ciphers.Set this to true for enabling Server Manager operations on aSecure Server.Points to a security domain listed invbroker.security.authDomains. The specified domain is usedfor the Server Manager's role-based access control checks.A rolemap must be specified for the domain.Specifies the role name required for accessing all ServerManager operations.Specifies the role name required for accessing the specifiedmethod of the Server Manager.This property is used with GateKeeper with security enabled.When set to true, the username and password will not bedelegated to the backend server for authentication.Specifies whether to grant or deny access to the domain bydefault in the absence of security roles for the provideddomain. Acceptable values are grant or deny.A server side property. Set to true to have the server requirecertificates from the client. These certificates must also betrusted by the server by setting the appropriate server-sidetrust properties. For more information, see thevbroker.security.trustpointsRepository property and thevbroker.security.defaultJSSETrust property.A wallet is a set of directories containing encrypted privatekeys and certificate chains for each identity. Use thisproperty to point to the directory containing the directories forall identities, using the format: Directory:Use to point to a directory within the path defined invbroker.security.wallet.type that contains keys and/orcertificate information for a specific identity. Note that thevalue of this property must consist only of lower-case letters.Specifies the password used to decrypt the private key or thepassword associated with the login.n/afalsen/an/afalsen/an/an/afalsegrantfalsen/an/an/aChapter 9: Security Properties for Java 89

Security Properties for JavaProperty Description Defaultvbroker.security.authentication.config This specifies the path to the configuration file used for nullauthentication.vbroker.security.authentication.retryCount Number of times to retry if remote authentication failed. 3vbroker.security.authentication.clearCredentialsOnFailurevbroker.security.loginvbroker.security.login.realmsvbroker.security.vaultvbroker.security.identity.reauthenticateOnFailureBy default, if the authorization realm finds the authenticator isincorrect after the maximum number of retries have beenattained, the ORB retains the authenticator. If you want theORB to clear the authenticator (the credential) after themaximum number of retries, set this property to true.If set to true, at initialization-time this property tries to login toall the realms listed by propertyvbroker.security.login.realms.This gives a list of comma-separated realms to login to. Thisis used when login takes place, either through propertyvbroker.security.login (set to true) or API login using login().This property is used to specify the path to the vault file. Thisproperty will take effect regardless of whethervbroker.security.login is set to true or false.When set to true the security service will attempt to reacquireauthentication information using the CallbackHandler. Thisproperty require the callback handler to be set either usingthe appropriate property or at runtime by calling theappropriate method.vbroker.security.identity.enableReactiveLogin When set to true, the security service behaves as follows: Ifthe security service cannot find an identity for any of thetargets supported by a server it is attempting to communicatewith, it will then attempt to acquire credentials for one of thetargets in the target object's IOR. If a correspondingauthentication realm is available for this target (that the userchooses to provide credentials for), then authentication isalso attempted locally.Reactive login requires a callback handler to be set eitherusing the appropriate property or at runtime by calling theappropriate method.vbroker.security.authDomainsvbroker.security.domain..rolemap_pathvbroker.security.domain..rolemap_enableRefreshvbroker.security.domain..rolemap_refreshTimeInSecondsvbroker.security.domain..runas.vbroker.security.peerAuthenticationModeSpecifies a comma-separated list of available authorizationdomains. For example:vbroker.security.authDomains=,…Specifies the location of the RoleDB file that describes theroles used for authorization. This is scoped within the domain specified in vbroker.security.authDomains.When set to true, enables dynamic loading of the RoleDB filespecified invbroker.security.domain..rolemap_path property.The interval of dynamic loading is specified by propertyvbroker.security.domain..rolemap_refreshTimeInSeconds.falsefalsen/an/afalsetruenulln/afalseSpecifies the rolemap refresh time in seconds. 300Specifies the name of the run-as role. The value can beeither use-caller-identity to have the caller principal be in therun-as role, or specify an alias for a run-as principal for therun-as role name.Sets the peer authentication Mode. Possible values are:REQUIREREQUIRE_AND_TRUSTREQUESTREQUEST_AND_TRUSTNONENote that the REQUEST and REQUEST_AND_TRUST modes cannotreceive peer certificate chains due to JSSE restrictions.n/aNONE88 VisiBroker Security Guide

logo

products

Resources

Company

Terms of service
Privacy policy
Cookie policy
Cookie settings
Imprint
Change language
Made with love in Switzerland
© 2024 Yumpu.com all rights reserved

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!