Sun Microsystems 820433510 manual

Using Hardware Crypto Accelerator With Enterprise Server

Using Hardware Crypto Accelerator With Enterprise Server

You can use hardware accelerator tokens to improve the cryptographic performance and to furnish a secure key storage facility. Additionally, you can provide end users with mobile secure key storage through smart cards.

Sun Java System Application Server supports the use of PKCS#11 tokens for SSL or TLS communications and Network Security Services (NSS) tools for managing keys and PKCS#11 tokens. This section describes how Enterprise Server provides that support and walks you through the procedures for the related configurations.

J2SE 5.0 PKCS#11 providers can be easily integrated with the Enterprise Server runtime. Through these providers, you can use hardware accelerators and other PKCS#11 tokens in Enterprise Server to achieve fast performance and to protect the private key inherent in SSL or TLS communications.

This section contains the following topics:

■“About Configuring Hardware Crypto Accelerators” on page 120

■“Configuring PKCS#11 Tokens” on page 121

■“Managing Keys And Certificates” on page 122

■“Configuring J2SE 5.0 PKCS#11 Providers” on page 124

About Configuring Hardware Crypto Accelerators

Sun GlassFish Enterprise Server has been tested with Sun Crypto Accelerator 1000 (SCA-1000) and SCA-4000.

Enterprise Server can communicate with PKCS#11 tokens. Packaged with Enterprise Server are an NSS PKCS#11 token library (for the NSS Internal PKCS#11 Module, commonly known as the NSS soft token) and NSS command-line management tools. For more details, see “Using Network Security Services (NSS) Tools” on page 116.

Use the NSS tools to create keys and certificates on PKCS#11 tokens and J2SE PKCS#11 providers to access token keys and certificates at runtime. A PKCS#11 provider is a cryptographic service provider that acts as a wrapper around a native PKCS#11 library. A PKCS#11 token generally refers to all the hardware and software tokens with a native PKCS#11 interface. A hardware token is a PKCS#11 token implemented in physical devices, such as hardware accelerators and smart cards. A software token is a PKCS#11 token implemented entirely in software.

Note – If you run Enterprise Server on the J2SE 1.4.x platform, only one PKCS#11 token, the NSS soft token, is supported.

120	Sun GlassFish Enterprise Server 2.1 Administration Guide • December 2008

Image 120

Sun Microsystems 820433510 manual Using Hardware Crypto Accelerator With Enterprise Server

Contents

Sun GlassFish Enterprise Server 2.1 Administration Guide Sun Microsystems, Inc Network Circle Santa Clara, CA 090122@21808 Contents Java Business Integration Jdbc Resources Accessing Remote Servers Configuring JMS Provider PropertiesIBM Informix Type 4 Driver CloudScape 5.1 Type 4 Driver Foreign JMS Providers Configuring Security Web and EJB Containers 127 141 149Virtual Servers 149 Http Listeners 150 153 What is the ORB? 162 Iiop Listeners 158161 163 About Management Rules 215 Configuring Management Rules 216 Tuning the JVM Settings 219215 219 Asadmin Utility Profiler and SSL Commands231 244Page Figures Page Tables JVM Statistics for Java SE Runtime 189 Remote Commands Required Options 234 Server Lifecycle Commands 237List and Status Commands 238 Deployment Commands 239 Examples Page Preface Sun GlassFish Enterprise Server Documentation SetTable P-1Books in the Enterprise Server Documentation Set Default Paths and File Names Table P-2Default Paths and File Names Symbol Conventions Symbol ConventionsTypographic Conventions Table P-3Typographic Conventions Documentation, Support, and Training Third-Party Web Site ReferencesSun Welcomes Your Comments Enterprise Server Overview Enterprise Server Overview and ConceptsEnterprise Server Overview This section contains the following topics Tools for Administration Admin ConsoleFor example Http//hostnameport Command-line Interface asadmin Utility To list the commands available within asadminJConsole Domain Administration Server DAS Enterprise Server ConceptsDomain 1Features Available for Each Profile Usage Profiles Features Available for Each Profile ClusterNode Agent Server Instance 1Enterprise Server Instance Ports in the Enterprise Server 2Enterprise Server Listeners that Use Ports Basic Enterprise Server Commands Creating a DomainHttp//hostname5000 Deleting a Domain Listing DomainsStarting the Domain Starting the Default Domain on Windows Stopping the Default Domain on WindowsStopping the Domain Restarting the Domain Starting a Cluster Stopping a ClusterCreating a Node Agent Starting a Node Agent Stopping a Node Agent Starting an InstanceStopping an Instance Restarting an Instance Recreating the Domain Administration Server To migrate the DAS Change Page Service Engines Java Business IntegrationJBI Environment JBI Components Binding Components JBI Component Loggers Service Assemblies Shared Libraries JBI Descriptors Jdbc Resources Jdbc Resources Jdbc Connection Pools How Jdbc Resources and Connection Pools Work Together Setting Up Database Access Working with Jdbc Connection Pools Creating a Jdbc Connection Pool Click OK Change connection validation settings Editing a Jdbc Connection Pool By calling the con.getAutoCommit and con.getMetaData methods Editing Jdbc Connection Pool Advanced Attributes Creation Retry Attempts is greater than Configurations for Specific Jdbc Drivers Configurations for Specific Jdbc Drivers Java DB Type 4 Driver DataSource Classname Specify one of the following Sun GlassFish Jdbc Driver for DB2 Databases DataSource Classname com.sun.sql.jdbcx.db2.DB2DataSource Sun GlassFish Jdbc Driver for Microsoft SQL Server Databases IBM DB2 8.1 Type 2 Driver DataSource Classname com.ibm.db2.jcc.DB2SimpleDataSourceDeferPrepares Set to false DataSource ClassnameSpecify one of the following MySQL Type 4 Driver Inet Oraxo Jdbc Driver for Oracle 8.1.7 and 9.x DatabasesCom.mysql.jdbc.jdbc2.optional.MysqlDataSource Inet Merlia Jdbc Driver for Microsoft SQL Server Databases DataSource Classname com.inet.ora.OraDataSourceDataSource Classname com.inet.tds.TdsDataSource Jdbcinetoralocalhost1521payrolldb Inet Sybelux Jdbc Driver for Sybase Databases DataSource Classname com.inet.syb.SybDataSource OCI Oracle Type 2 Driver for Oracle 8.1.7 Databases Jdbcoraclethin@localhost1521customerdbJdbcoracleoci@localhost1521customerdb IBM Informix Type 4 Driver CloudScape 5.1 Type 4 DriverDataSource Classname com.ibm.db2.jcc.DB2DataSource Page Configuring Java Message Service Resources JMS Resources Relationship Between JMS Resources and Connector Resources JMS Connection Factories JMS Destination ResourcesJMS Physical Destinations Configuring JMS Provider Properties Accessing Remote Servers Foreign JMS Providers Configuring the Generic Resource Adapter Resource Adapter Properties False Foreign JMS Providers ManagedConnectionFactory Properties Administered Object Resource Properties Activation Spec Properties Configuring Java Message Service Resources Message causes a runtime exception Configuring JavaMail Resources Creating a JavaMail Session Creating a JavaMail Session Java EE Naming Services Jndi Resources Naming References and Binding Information Using Custom Resources Using External Jndi Repositories and Resources1JNDI Lookups and Their Associated References Using External Jndi Repositories and Resources Connector Resources An Overview of Connectors Managing Connector Connection Pools To Create a Connector Connection PoolSpecify this name when creating a connector resource To Edit a Connector Connection Pool Create-connector-connection-pool Same transaction level as that specified in resource To Edit Connector Connection Pool Advanced Attributes Pool. Default value is false To Delete a Connector Connection Pool To create security maps for connector connection poolsTo Edit Security Maps for Connector Connection Pools To Edit Connection Pool Properties Managing Connector Resources To Set Up EIS AccessTo Create a Connector Resource Delete-connector-connection-pool To Edit a Connector Resource To Delete a Connector ResourceCreate-connector-resource Managing Administered Object Resources To Configure the Connector ServiceDelete-connector-resource To Create an Administered Object Resource To Edit an Administered Object Resource To Delete an Administered Object ResourceCreate-admin-object Delete-admin-object Web and EJB Containers SIP Servlet Container Editing the Properties of the SIP Container Editing SIP Container General AttributesEditing SIP Container Session Properties Web Container EJB ContainerEditing SIP Container Session Manager Properties Page Configuring Security Understanding Application and System Security Tools for Managing Security Managing Security of Passwords Encrypting a Password in the domain.xml FileAsadmin create-password-alias --user admin alias-name Asadmin create-password-alias --user admin jms-password Protecting Files with Encoded Passwords Changing the Master PasswordRestart the Enterprise Server for the relevant domain Restart the Enterprise Server Changing the Admin Password Working with the Master Password and Keystores About Authentication and Authorization Authenticating Entities1Enterprise Server Authentication Methods Authorizing Users Specifying Jacc ProvidersVerifying Single Sign-On Configuring Message Security Understanding Users, Groups, Roles, and Realms Users Groups Roles Realms To Configure a Jdbc Realm for a Web, EJB Application Create a Jdbc realm Introduction to Certificates and SSL About Digital CertificatesFollowing topics are discussed in this section About Secure Sockets Layer About Certificate Chains Using Name-based Virtual Hosts About Ciphers About Firewalls About Certificate Files Using Java Secure Socket Extension Jsse Tools Using the keytool UtilityChanging the Location of Certificate Files Display certificate information from a keystore of type JKS Delete a certificate from a keystore of type JKS Generating a Certificate Using thekeytool Utility Deleting a Certificate Using thekeytool Utility Certificate was added to keystore Saving cacerts.jks Using Network Security Services NSS Tools Storepass passwordKeytool -delete Using the certutil Utility Verify the certificates generated in the previous bulletDisplay available certificates Certutil -L -d $CERTDBDIR Delete a certificate from an NSS certificate database Move a certificate from an NSS database to JKS format Modutil -list -dbdir $admin.domain.dir/$admin.domain/config Add a new PKCS11 module or tokenDelete a PKCS11 module from an NSS store List available token modules in an NSS store Using Hardware Crypto Accelerator With Enterprise Server About Configuring Hardware Crypto Accelerators Configuring PKCS#11 Tokens Standard output will look similar to the followingModutil -list -dbdir Asnssdb Managing Keys And Certificates This section describes the following topics Listing Keys and Certificates Standard output will be similar to the following Configuring J2SE 5.0 PKCS#11 Providers Configuration for the SCA 1000 hardware acceleratorWorking With Private Keys and Certificates Property name=mytoken value=&InstallDir/mypkcs11.cfg Name=HW1000 Library=/opt/SUNWconn/crypto/lib/libpkcs11.so 126 Configuring Message Security Overview of Message Security System Administrator Understanding Message Security in the Enterprise ServerAssigning Message Security Responsibilities Application Deployer Application DeveloperAbout Username Tokens About Digital Signatures About EncryptionAbout Message Protection Policies Glossary of Message Security Terminology Response Policy Securing a Web Service Configuring the Enterprise Server for Message Security Configuring Application-Specific Web Services SecuritySecuring the Sample Application Actions of Request and Response Policy Configurations Configuring Other Security Facilities Configuring a JCE ProviderAfter You Finish Save and close the file Security.provider.1=sun.security.provider.Sun Message Security Setup Enabling Providers for Message Security Configuring the Message Security Provider To specify the default server providerTo specify the default client provider Creating a Message Security Provider Enabling Message Security for Application Clients Further Information Response-policy Configuring the Diagnostic Service What is the Diagnostic Framework?Diagnostic Service Framework Generating a Diagnostic Report What is a Transaction? TransactionsAbout Transactions What is a Transaction? on Configuring Transactions on Transactions in Java EE Technology Admin Console Tasks for Transactions Configuring TransactionsThis section explains how to configure transaction settings Workarounds for Specific Databases To set a transaction timeout value Set any needed properties To set the location of the transaction logs Default value is To set the keypoint interval Configuring the Http Service Virtual Servers Http Listeners Configuring the Http Service 151 152 Managing Web Services Overview of Web Services Web Services Standards Java EE Web Service Standards Deploying and Testing Web Services Deploying Web Services Using Web Services Registries Viewing Deployed Web ServicesTesting Web Services Web Services Security Publishing a Web Service to a Registry Adding a Registry Monitoring Web Services Transforming Messages with Xslt Filters Viewing Web Service Statistics Monitoring Web Service Messages 160 Configuring the Object Request Broker An Overview of the Object Request Broker Configuring the ORB What is the ORB?Managing Iiop Listeners Iiop Listeners Thread Pools Working with Thread Pools Configuring Logging About LoggingLog Records Logger Namespace Hierarchy 1Enterprise Server Logger Namespaces Enterprise Server Logger Namespaces JTS Configuring Logging Configuring General Logging SettingsConfiguring Log Levels Viewing Server Logs 171000.000Details ThreadID=13 Monitoring Components and Services About MonitoringMonitoring in the Enterprise Server Overview of Monitoring About the Tree Structure of Monitorable ObjectsApplications Tree Following sections describe these sub-trees Http Service Tree Connector Service Tree JMS Service TreeResources Tree About Statistics for Monitored Components and Services ORB TreeThread Pool Tree Orb Connection-managers Connection-manager-1 EJB Container Statistics 1EJB Statistics 2EJB Method Statistics 3EJB Session Store Statistics EJB Session Store Statistics 4EJB Pool Statistics 5EJB Cache Statistics 6Timer Statistics Web Container Statistics7Web Container Servlet Statistics Http Service Statistics 8Web Container Web Module Statistics 9HTTP Service Statistics Developer Profile Jdbc Connection Pools Statistics 10JDBC Connection Pool Statistics JMS/Connector Service Statistics 11Connector Connection Pool Statistics 12Connector Work Management Statistics Statistics for Connection Managers in an ORB13Connection Manager in an ORB Statistics Transaction Service Statistics 15Transaction Service StatisticsThread Pools Statistics 14Thread Pool Statistics 15 Transaction Service Statistics Java Virtual Machine JVM StatisticsJVM Statistics 17JVM Statistics for Java SE- Class Loading 18JVM Statistics for Java SE- Compilation 19JVM Statistics for Java SE- Garbage Collection20JVM Statistics for Java SE- Memory Following table 21JVM Statistics for Java SE Operating System22JVM Statistics for Java SE Runtime 23JVM Statistics for Java SE Thread Info Enabling and Disabling Monitoring 24JVM Statistics for Java SE Threads Configuring Monitoring Levels Using the Admin Console To Configure Monitoring Levels Using asadminReturns Viewing Monitoring Data in the Admin Console Viewing Monitoring Data With the asadmin ToolTo Use the asadmin monitor Command to View Monitoring Data Viewing Monitoring Data 531628032 45940736 Command returns the following attributes and data Asadmin get --user adminuser --monitor server.jvmServer.http-service Understanding and Specifying Dotted Names Examples of the list and get Commands Server.applications.petstore Examples for the list --user admin-user --monitor Command Examples for the get --user admin-user --monitor CommandAsadmin list --user admin-user--monitor server Asadmin list --user admin-user--monitor server.applications Asadmin get --user admin-user--monitor server.jvm Attempt to get all attributes from a Java EE application Asadmin get --user admin-user--monitor server.jvm.badname To Use the PetStore ExampleAttempt to get a specific attribute from a subsystem Returns output will be similar to Server.http-service Server.resources Server.thread-pools Asadmin list -m server.applications.petstore.signon-ejbjarReturns with dotted name removed for space considerations Monitoring Components and Services 201 Expected Output for list and get Commands at All Levels Top Level Applications Level Application has been deployed. It is not applicable if a Monitoring Components and Services 205 List -m Server.applications.app1 28HTTP-Service Level 29Thread-Pools Level 31Transaction-Service Level Resources LevelORB Level Using JConsole LevelJVM Level Securing JConsole to Application Server Connection Prerequisites for Connecting JConsole to Application Server Connecting JConsole to Application Server Connecting JConsole Securely to Application Server Monitoring Components and Services 213 214 Configuring Management Rules About Management Rules Configuring Management Rules Configuring Management Rules 217 218 Java Virtual Machine and Advanced Settings Tuning the JVM Settings Configuring Advanced Settings Automatically Restarting a Domain or Node Agent Restarting Automatically on SolarisThis Appendix contains the following topics Restarting Automatically on Solaris Creating a Windows Service Restarting Automatically on the Microsoft Windows Platform Start= auto DisplayName= display-name Process name=as-service-name Sysproperty key=-Xrs Security for Automatic RestartsJvm-options-Xrs/jvm-options 226 Dotted Name Attributes for domain.xml Top Level Elements Top Level Elements Elements Not Aliased Elements Not Aliased 230 Asadmin Utility Asadmin Utility Appendix C The asadmin Utility 233 Common Options for Remote Commands Table C-1Remote Commands Required Options Multimode Command Prefix followed by the password name in uppercase letters Get, Set, and List Commands Server Lifecycle Commands Table C-2Server Lifecycle Commands List and Status Commands Table C-2 Server Lifecycle CommandsTable C-3List and Status Commands Deployment Commands Table C-4Deployment Commands Version Commands Message Queue Administration CommandsTable C-5Version Commands Table C-6Message Queue Commands Resource Management Commands Table C-7Resource Management Commands Table C-7 Resource Management Commands Configuration Commands Http and Iiop Listener CommandsLifecycle and Audit Module Commands Table C-8IIOP Listener Commands Profiler and SSL Commands JVM Options and Virtual Server CommandsTable C-9Lifecycle Module Commands Table C-10Profiler and SSL Commands Threadpool and Auth-Realm Commands Transaction and Timer CommandsTable C-11JVM Options and Virtual Server Commands Table C-12Threadpool and Auth-Realm Commands User Management Commands Registry CommandsTable C-13Transaction Commands Table C-14Transaction Commands Rules and Monitoring Commands Database CommandsTable C-16Rules and Monitoring Commands Diagnostic and Logging Commands Web Service CommandsTable C-17Database Commands Table C-18Diagnostic and Logging Commands Security Service Commands Table C-20Security Commands Password Commands Table C-21Password Commands Verify Command Custom MBean CommandsService Command Property Command Table C-25Property Command Index ACC JMS Logging ORB 256