Changes between Version 22 and Version 23 of InstallDiscoveryBrowse

Timestamp:

11/10/07 10:10:44 (12 years ago)

Author:

pjkersha

Comment:

--

InstallDiscoveryBrowse

@@ -180 +180 @@
 === Security Configuration ===
 Security settings are organised under the `[NDG_SECURITY]` section of the config file.  Set-up includes the following steps:  
- * certificates are created to secure communication with security web services (WS-Security)
+ * certificates are created to secure communication with security web services (WS-Security and SSL Settings)
  * the Discovery service is set up to run over http and https Virtual Hosts and 
  * parameters are configured to enable the Gatekeeper to make access control decisions for secure data requests.
@@ -186 +186 @@
 For help contact [mailto:P.J.Kershaw@rl.ac.uk Phil].
 
-==== WS-Security Settings ====
-Create a Discovery Service certificate and private key to enable it communicate securely with security services.  First, generate a new private key:
+==== Secure Communication with Security Web Services ====
+Create a Discovery Service certificate and private key.  For the private key:
 {{{
 cd /etc/ndg/ows_server/conf/certs
@@ -237 +237 @@
 }}}
 
-In the above replace `password` with the password you set to protect the private key.  If no password was set leave this field blank.
+In the above, replace `password` with the password you set to protect the private key.  If no password was set leave this field blank.
+
+Finally, the field `sslCACertFilePathList` can be used to authenticate peers for SSL connections to ''security web services''.  In the current implementation this applies to the Session Manager web service.  This runs over https.  On a request to the Session Manager, the Discovery service can verify the Session Manager's X.509 certificate against a list of acceptable CA certificates.  If the Session Manager's X.509 certificate is not issued by any of the CA certificates in the list the connection is rejected.
+
+{{{
+# SSL Connections
+#
+# Space separated list of CA cert. files.  The peer cert.
+# must verify against at least one of these otherwise the connection is
+# dropped.
+sslCACertFilePathList: /etc/ndg/ows_server/conf/certs/cacert.crt
+}}}
 
 ==== Virtual Hosting of the Discovery Service over http and https ====