{"id":4964,"date":"2013-01-24T19:45:46","date_gmt":"2013-01-24T23:45:46","guid":{"rendered":"http:\/\/onlineappsdba.com\/?p=4964"},"modified":"2016-04-26T13:39:34","modified_gmt":"2016-04-26T17:39:34","slug":"configure-ssl-for-oracle-internet-directory-oid","status":"publish","type":"post","link":"https:\/\/onlineappsdba.com\/index.php\/2013\/01\/24\/configure-ssl-for-oracle-internet-directory-oid\/","title":{"rendered":"Configure SSL for Oracle Internet Directory (OID)"},"content":{"rendered":"

Oracle Internet Directory<\/strong> (OID) by default listens on two ports LDAP<\/strong> (non secure) and LDAPS<\/strong> (secure LDAP), In this post I am going to cover in detail how to configure SSL in OID 11g and key points related to SSL in OID.<\/p>\n

1.<\/strong> OID listens on two ports (LDAP<\/strong> and LDAPS<\/strong>) and list of port used is displayed by opmnctl status -l<\/strong> (In example below, OID is listening on SSL port 3131<\/span>)<\/p>\n

[aiam@innowave21 ~]$ opmnctl status -l<\/p>\n

Processes in Instance: asinst_1
\n———————————+——————–+———+——-
\nias-component | process-type | pid | status | uid | memused | uptime | ports
\n———————————+——————–+———+——-
\noid1 | oidldapd | 26253 | Alive | 412548771 | 662564 | 371:51:57 | N\/A
\noid1 | oidldapd | 26213 | Alive | 412548770 | 374372 | 371:51:58 | N\/A
\noid1 | oidmon | 26145 | Alive | 412548769 | 298736 | 371:52:02 | LDAPS:3131<\/strong>,LDAP:3060
\nEMAGENT | EMAGENT | 26144 | Alive | 412548768 | 63824 | 371:52:02 | N\/A<\/p>\n

\"\"<\/a><\/p>\n

2.<\/strong> OID on LDAPS (secure) port \u00a0can be configured in one of three modes (controlled by attribute orclSSLAuthentication<\/span>)<\/p>\n

a) SSL with No Authentication<\/strong> (orclSSLAuthentication<\/strong> = 1<\/strong>) – In this mode neither client (making connection to OID) nor Server (OID) presents SSL certificate . Data is transferred on SSL<\/p>\n

b)\u00a0SSL with Server Authentication Only<\/strong> (orclSSLAuthentication = 32<\/strong>)\u00a0– In this mode Server (OID) presents its SSL certificate to client (making connection to OID) but client doesn’t present any certificate to Server\u00a0. Data is transferred on SSL<\/p>\n

c)\u00a0SSL with Client and Server Authentication<\/strong> (orclSSLAuthentication = 64<\/strong>)\u00a0– In this mode both Server (OID) and client (making connection to OID) presents their SSL certificate to\u00a0each other. Data is transferred on SSL<\/p>\n

Note<\/strong>: Default setting is SSL with No Authentication i.e. orclSSLAuthentication value 1. Common practice is to change this to SSL with Server Authentication Only i.e.\u00a0orclSSLAuthentication = 32<\/strong><\/span><\/p>\n

 <\/p>\n

\"\"<\/a><\/p>\n

3.<\/strong> When OID is configured in Server Authentication (orclSSLAuthentication = 32<\/strong>) or\u00a0(orclSSLAuthentication = 64<\/strong>) then SSL certificate and Certifying Authority’s (CA) certificates are stored in WALLETS<\/strong> (More on wallets here<\/a> and\u00a0here<\/a>). Wallet can be managed by EM<\/strong> (Enterprise Manager) or WLST<\/strong> or orapki<\/strong> or OWM<\/strong><\/p>\n

Note<\/strong>: To manage wallets in OID 11g using EM or WLST, OID must be integrated with WebLogic with Enterprise Manager (EM)<\/span>.<\/p>\n

 <\/p>\n

\"\"<\/a><\/p>\n

4.<\/strong> For SSL certificated of OID, you can generate self signed certificates<\/strong> or create certificate request file and submit to Certifying Authority like verisign and store certificates in wallet.<\/p>\n

.<\/p>\n

To configure SSL in OID<\/strong><\/span><\/p>\n

1.<\/strong> Configure Wallet to store SSL certificate and Certifying Authority’s certificates using EM or WLST or OWM or orapki<\/p>\n

2.<\/strong> Create Certificate Request File -> Get Certificate from Certifying Authority (CA) -> Import certificate in Wallet<\/p>\n

or<\/strong><\/p>\n

2.<\/strong> Generate Self Signed Certificate<\/strong> in Wallet<\/p>\n

3.<\/strong> Configure SSL parameter using EM<\/strong> or WLST<\/strong> or update SSL related attributes for OID instance<\/strong> (orclSSLAuthentication, orclSSLVersion, orclSSLWalletURL<\/span>)<\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

a)<\/strong> Ensure that Enable SSL<\/strong> is checked<\/p>\n

b)<\/strong> Select Wallet from drop down (list will be based on wallets created in previous step – You can have more than one wallet but only one wallet will be used)<\/p>\n

c)<\/strong> Select SSL Authentication Mode (orclSSLAuthentication 1 or 32 or 64<\/strong>)<\/p>\n

d)<\/strong> Select ciphers (it is recommended to select ciphers based on enterprise security requirements<\/span>)<\/p>\n

e)<\/strong> Select SSL version (version 3 is recommended<\/span>)<\/p>\n

4.<\/strong> Restart OID using opmnctl stopall; opmnctl startall<\/p>\n

5.<\/strong> Test SSL connection from ldapbind or ODSM or using LDAP browser<\/p>\n

 <\/p>\n

Here is OID instance configuration after configuring \u00a0SSL<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

More on OID SSL configuration in \u00a0OID Administrators Guide<\/a><\/p>\n