Copyright © Cloud Software Group, Inc. All Rights Reserved

Configure Secure Services with TIBCO API Exchange Gateway

TIBCO API Exchange Gateway provides the HTTPs transport for the secure communication with the webservices at the backend. You can access the target services with or without client authentication.

The backend services may or may not require X.509 client authentication. The Is Anonymous flag for a target service determines if the client authentication is required or not. The client authentication, also known as mutual SSL authentication is required if the Is Anonymous flag is set to false. If the Is Anonymous flag is set to true,the service does not require the authentication of client.

When the authentication policies are enforced on a SSL enabled target service, make sure to set the classpath in the ASG_HOME/bin/asg-engine.tra file. The classpath must include the TIBCO_HOME/tools/lib directory, and can be set using the following variable: tibco.env.CUSTOM_EXT_PREPEND_CP

Define DSS Properties for Services

To use the services, define the DSS properties in a file. The DSS properties file is used during the configuration of the service using the Config UI. See Configuring Services.

This section explains the properties required to use the back-end services using the HTTPs transport.

Properties For SSL Authentication (isAnonymous = true)

Trust Identity Provider (TIP) properties are used if the "Is Anonymous" flag is set to true for any target service. TIBCO API Exchange Gateway supports the one way SSL authentication , that is, when the service is accessed by the Core Engine and the service does not require the authentication of the client.

Use Case

Use service when no authentication of the client required (one way SSL).

Example Properties

See the following properties:

Properties

Table SSL Authentication Properties for Service explains the properties for SSL authentication (one way SSL authentication) for the service..

Table 99 SSL Authentication Properties for Service

Property	Description
com.tibco.trinity.runtime.core.provider.identity.trust.trustStoreServiceProvider
	Specifies that trust store service provider uses keystores for credentials. By default, this is configured to use internal implementation and should not be changed. It is configured as follows: class:com.tibco.trinity.runtime.core.provider.credential.keystore
com.tibco.trinity.runtime.core.provider.credential.keystore.truststore.keyStoreLocation
	Specifies the location(s) of the keystore.
com.tibco.trinity.runtime.core.provider.credential.keystore.truststore.keyStorePassword
	Specifies the password to unlock the keystore.
com.tibco.trinity.runtime.core.provider.credential.keystore.truststore.keyStoreRefreshInterval
	Specifies the refresh interval (milliseconds).
com.tibco.trinity.runtime.core.provider.credential.keystore.truststore.keyStoreType
	Specifies the keystore type. Supported formats are JKS,PKCS12.

Properties For Mutual SSL Authentication (isAnonymous = false)

Subject Identity Provider (SIP) properties are used if the "Is Anonymous" flag is set to false for any service. API Exchange Gateway supports the mutual SSL authentication to access the service.

Use Case

Using service when client authentication (mutual SSL authentication) required.

Example Properties

See the following properties:

Properties

Table Mutual Authentication SSL Properties For service explains the properties for mutual SSL authentication (client authentication) for a service.

Table 100 Mutual Authentication SSL Properties For service

Property	Description
com.tibco.trinity.runtime.core.provider.identity.trust.trustStoreServiceProvider
	Specifies that trust store service provider uses keystores for credentials. By default, this is configured to use internal implementation and should not be changed. It is configured as follows: class:com.tibco.trinity.runtime.core.provider.credential.keystore
com.tibco.trinity.runtime.core.provider.credential.keystore.truststore.keyStoreLocation
	Specifies the location(s) of the keystore.
com.tibco.trinity.runtime.core.provider.credential.keystore.truststore.keyStorePassword
	Specifies the password to unlock the keystore.
com.tibco.trinity.runtime.core.provider.credential.keystore.truststore.keyStoreRefreshInterval
	Specifies the refresh interval (milliseconds).
com.tibco.trinity.runtime.core.provider.credential.keystore.truststore.keyStoreType
	Specifies the keystore type. Supported formats are JKS,PKCS12.
com.tibco.trinity.runtime.core.provider.identity.subject.identityStoreServiceProvider
	Specifies that subject service provider uses keystores for credentials. By default, this is configured to use internal implementation and should not be changed. It is configured as follows: class:com.tibco.trinity.runtime.core.provider.credential.keystore
com.tibco.trinity.runtime.core.provider.identity.subject.keyAlias
	Specifies an alias name for the key corresponding to the private credentials in the credential store for establishing the subject's identity.
com.tibco.trinity.runtime.core.provider.identity.subject.keyPassword
	Specifies the protection parameter of the private credentials in the credential store for establishing the subject's identity.
com.tibco.trinity.runtime.core.provider.credential.keystore.keyStoreType
	Specifies the keystore type of the private credentials.
com.tibco.trinity.runtime.core.provider.credential.keystore.keyStoreLocation
	Specifies the location(s) of the keystore of the private credentials.
com.tibco.trinity.runtime.core.provider.credential.keystore.keyStorePassword
	Specifies the password to unlock the keystore.
com.tibco.trinity.runtime.core.provider.credential.keystore.keyStoreRefreshInterval
	Specifies the refresh interval in milliseconds.

 

Configuring Services

You can create and configure a service (target operation) using the Config UI.

To configure a target operation, provide a DSS properties file. See Define DSS Properties for Services.

To configure a service, follow these steps:

1.	Start the Config UI.

2.	Log in to the Config UI using your credentials.

3.	Create a new project configuration.

4.	Select and click the newly created configuration.

5.	Select ROUTING from the top menu bar.

6.	Select Target Operations tab.

7.	Create a new target operation using the "+" icon at the top menu bar.

8.	Select from the drop-down list for the Type field.

9.	Set the following fields:

a.	Is Anonymous: set this field to false for mutual SSL authentication. If you do not require client authentication, set this field to true.

b.	New Property File: select the DSS property file you created to define the properties as explained in Define DSS Properties for Services.

c.	Existing Property Files: select an existing DSS property file from the drop-down list if the file exists in the wss directory of the configuration.

10.	Save the changes to the target services configuration.

Copyright © Cloud Software Group, Inc. All Rights Reserved