Secure Communication Profiles

Secure network connectivity is defined using secure communication profiles. These profiles define characteristics such as:

There are both client and server profiles. Client profiles define the security characteristics for outbound connections to external systems and nodes. Server profiles define the security characteristics for network listeners started by nodes and engines. This is shown in Figure 1, “Secure communication profiles”.

Secure communication profiles

Secure client communication profiles are configured using the SecureCommunicationClientProfile root configuration object described in Secure Communication Client Profile Configuration.

Secure server communication profiles are configured using the SecureCommunicationServerProfile root configuration object described in Secure Communication ServerProfile Configuration.

A secure server communication profile is used to control the security characteristics of these listeners:

See Communication for details on configuring a SecureCommunicationServerProfile for these listeners. See [Accessing a node section to be ported] for details on specifying credentials when using epadmin.

Key and trust stores are supported both for node security and epadmin client security.

These key and trust store encoding types are supported on nodes and can be specified in secure communication profiles:

These key and trust store encoding types are supported by the epadmin client:

The SecureCommunicationClientProfile root configuration object defines a secure communication profile for client connectivity. Figure 2, “SecureCommunicationClientProfile relationships” shows the relationships to other configuration objects.

SecureCommunicationClientProfile relationships

A detailed description of the configuration object properties is in SecureCommunicationClientProfile object properties and a snippet for these properties is in Example 1, “SecureCommunicationClientProfile object snippet”.

name = "my-secure-client-settings"
version = "1.0.0"
type = "com.tibco.ep.dtm.configuration.security"
configuration =
{
    SecureCommunicationClientProfile =
    {
        name = "my-secure-client-profile"
        keyStore = "/absolute/path/myKeyStore.jks"
        keyStorePassword = "secret"
        keyPassword = "anothersecret"
        keyStoreType = "jceks"
        trustStore = "/absolute/path/myTrustStore.jks"
        trustStorePassword = "athirdsecret"
        trustStoreType = "JCEKS"
        requireClientAuthentication = true
        excludedCipherSuitePatterns = [ "^.*_(MD5|SHA|SHA1)$" ]
        includedProtocols = [ ] // use JRE's supported protocols
    }
}

The SecureCommunicationServerProfile root configuration object defines a secure communication profile for listeners. Figure 3, “SecureCommunicationServerProfile relationships” shows the relationships to other configuration objects.

SecureCommunicationServerProfile relationships

A detailed description of the configuration object properties is in SecureCommunicationServerProfile object properties and a snippet for these properties is in Example 2, “SecureCommunicationServerProfile object snippet”.

name = "my-secure-server-settings"
version = "1.0.0"
type = "com.tibco.ep.dtm.configuration.security"
configuration =
{
    SecureCommunicationServerProfile =
    {
        name = "my-secure-server-profile"
        excludedCipherSuitePatterns = [ "^.*_(MD5|SHA|SHA1)$" ]
        includedProtocols = [ ] // use JRE's supported protocols
        keyPassword = "anothersecret"
        keyStorePassword = "secret"
        keyStore = "/absolute/path/myKeyStore.jks"
        keyStoreType = "jceks"
        requireClientAuthentication = true
        subjectNameElementToUserNameMappings =
        {   
            "subjectNameElementFoo" = "userNameFoo"
            "subjectNameElementBar" = "userNameBar"
        }
        trustStore = "/absolute/path/myTrustStore.jks"
        trustStorePassword = "athirdsecret"
        trustStoreType = "JCEKS"
        userNameObjectIdentifierSearchPath = [ "userID", "CN", "1.2.3.4", "DN" ]
    }
}