Next: Command line arguments, Previous: Configuring GIOP protocol stack for PolyORB, Up: Configuring a CORBA application [Contents][Index]
PolyORB provides support for some elements of the CORBA Security mechanisms. This sections lists the corresponding configuration parameters.
PolyORB provides support for the following security mechanisms:
To enable security support, applications must ‘with’ one of the predefined setup packages:
PolyORB.Setup.Secure_Client
- for client side support only;
PolyORB.Setup.Secure_Server
- for both client and server
side support.
This section details the configuration parameters for capsule configuration.
[security_manager] # List of sections for configure client's credentials #own_credentials=my_credentials # # Client requires integrity proteced messages #integrity_required=true # # Client requires confiodentiality protected messages #confidentiality_required=true # # Client requires security association to detect replay (not supported for now) #detect_replay_required=true # # Client requires security association to detect message sequence errors (not # supported for now) #detect_misordering_required=true # # Client requires target authentication #establish_trust_in_target_required=true # # Client requires client authentication (usually not applicable at all) #establish_trust_in_client_required=true # # (rare useful) #identity_assertion_required=true # # (rare useful) #delegation_by_client_required=true
This section details configuration parameters for defining a program’s credentials. Depending on the mechanisms used for the transport and authentication layers, the credentials configuration section may define configuration only for one transport mechanism and/or one authentication mechanism.
#[my_credentials] # # TLS protected transport mechanism used as transport mechanism #transport_credentials_type=tls # # Connection method. Available methods: tls1, ssl3, ssl2 #tls.method=tls1 # # Certificate file name #tls.certificate_file=my.crt # # Certificate chain file name #tls.certificate_chain_file= # # Private key file name #tls.private_key_file=my.key # # Name of file, at which CA certificates for verification purposes are #located #tls.certificate_authority_file=root.crt # # Name of directory, at which CA certificates for verification #purposes are # located #tls.certificate_authority_path= # # List of available ciphers #tls.ciphers=ALL # # Verify peer certificate #tls.verify_peer=true # # Fail if client don't provide ceritificate (server only) #tls.verify_fail_if_no_peer_certificate=true # # GSSUP (user/password) mechanism as authentication mechanism #authentication_credentials_type=gssup # # User name #gssup.username=username@domain # # User password #gssup.password=password # # Target name for which user/password pair is applicable #gssup.target_name=@domain
This section details configuration parameters for defining security characteristics of objects managed by POA. The POA’s name is used as the section name.
#[MySecurePOA] # # Unprotected invocations is allowed #unprotected_invocation_allowed=true # # Section name for configuration of used protected transport mechanism #(if any) #transport_mechanism=tlsiop # # Section name for configuration of used authentication mechanism (if #any) #authentication_mechanism=my_gssup # # Target require client authentication at authentication layer (in #addition # to authentication at transport layer) #authentication_required=true # # Name of file for backward trust evalutation rules #backward_trust_rules_file=file.btr # # Section name for configuration of authorization tokens authority #privilege_authorities=
This section details configuration parameters for the TLS protected transport mechanism. The section name for mechanism configuration is defined in the POA configuration.
[tlsiop] # List of access points #addresses=127.0.0.1:3456
This section details configuration parameters for the GSSUP authentication mechanism. The section name for mechanism configuration is defined in the POA configuration.
#[my_gssup] # # Authentication mechanism #mechanism=gssup # # Target name #gssup.target_name=@domain # # User name/password mapping file #gssup.passwd_file=passwd.pwd
Next: Command line arguments, Previous: Configuring GIOP protocol stack for PolyORB, Up: Configuring a CORBA application [Contents][Index]