Author: buildbot
Date: Thu Aug 15 10:47:58 2013
New Revision: 874693
Log:
Production update by buildbot for cxf
Modified:
websites/production/cxf/content/cache/docs.pageCache
websites/production/cxf/content/docs/tls-configuration.html
Modified: websites/production/cxf/content/cache/docs.pageCache
==============================================================================
Binary files - no diff available.
Modified: websites/production/cxf/content/docs/tls-configuration.html
==============================================================================
--- websites/production/cxf/content/docs/tls-configuration.html (original)
+++ websites/production/cxf/content/docs/tls-configuration.html Thu Aug 15
10:47:58 2013
@@ -128,7 +128,7 @@ Apache CXF -- TLS Configuration
<!-- Content -->
<div class="wiki-content">
<div id="ConfluenceContent"><div>
-<ul><li><a shape="rect"
href="#TLSConfiguration-TLSParameterscommontobothClientsandServers">TLS
Parameters common to both Clients and Servers</a></li><li><a shape="rect"
href="#TLSConfiguration-ClientTLSParameters">Client TLS
Parameters</a></li><li><a shape="rect"
href="#TLSConfiguration-ServerTLSParameters">Server TLS
Parameters</a></li></ul></div>
+<ul><li><a shape="rect"
href="#TLSConfiguration-TLSParameterscommontobothClientsandServers">TLS
Parameters common to both Clients and Servers</a></li><ul><li><a shape="rect"
href="#TLSConfiguration-KeyManagers">Key Managers</a></li><li><a shape="rect"
href="#TLSConfiguration-TrustManagers">Trust Managers</a></li><li><a
shape="rect" href="#TLSConfiguration-CipherSuitesFilter">CipherSuites
Filter</a></li><li><a shape="rect"
href="#TLSConfiguration-CertConstraints">Cert Constraints</a></li></ul><li><a
shape="rect" href="#TLSConfiguration-ClientTLSParameters">Client TLS
Parameters</a></li><ul><li><a shape="rect"
href="#TLSConfiguration-DisableCNCheck">Disable CN Check</a></li></ul><li><a
shape="rect" href="#TLSConfiguration-ServerTLSParameters">Server TLS
Parameters</a></li><ul><li><a shape="rect"
href="#TLSConfiguration-ClientAuthentication">Client
Authentication</a></li></ul></ul></div>
<h1><a shape="rect"
name="TLSConfiguration-TLSParameterscommontobothClientsandServers"></a>TLS
Parameters common to both Clients and Servers</h1>
@@ -139,6 +139,82 @@ Apache CXF -- TLS Configuration
</div>
+<h2><a shape="rect" name="TLSConfiguration-KeyManagers"></a>Key Managers</h2>
+
+<p>The Key Managers configuration item is used to retrieve key information. It
is required for a Server, but is only required for a Client when the Server
requires Client Authentication.</p>
+
+<div class="code panel" style="border-width: 1px;"><div class="codeHeader
panelHeader" style="border-bottom-width: 1px;"><b>Key Manager
sample</b></div><div class="codeContent panelContent">
+<script class="theme: Default; brush: xml; gutter: false"
type="syntaxhighlighter"><![CDATA[
+ <httpj:tlsServerParameters>
+ ...
+ <sec:keyManagers keyPassword="stskpass">
+ <sec:keyStore type="jks" password="stsspass"
resource="stsstore.jks" />
+ </sec:keyManagers>
+ ...
+ </httpj:tlsServerParameters>
+]]></script>
+</div></div>
+
+<h2><a shape="rect" name="TLSConfiguration-TrustManagers"></a>Trust
Managers</h2>
+
+<p>The Trust Managers configuration item is used to validate trust in peer
X.509 certificates. It is required for both Servers and Clients. </p>
+
+<div class="code panel" style="border-width: 1px;"><div class="codeHeader
panelHeader" style="border-bottom-width: 1px;"><b>Trust Manager
sample</b></div><div class="codeContent panelContent">
+<script class="theme: Default; brush: xml; gutter: false"
type="syntaxhighlighter"><![CDATA[
+ <httpj:tlsServerParameters>
+ ...
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="stsspass"
resource="stsstore.jks" />
+ </sec:trustManagers>
+ ...
+ </httpj:tlsServerParameters>
+]]></script>
+</div></div>
+
+<h2><a shape="rect"
name="TLSConfiguration-CipherSuitesFilter"></a>CipherSuites Filter</h2>
+
+<p>The CipherSuites Filter is used to either include or exclude particular
CipherSuites.</p>
+
+<div class="code panel" style="border-width: 1px;"><div class="codeHeader
panelHeader" style="border-bottom-width: 1px;"><b>CipherSuites Filter
sample</b></div><div class="codeContent panelContent">
+<script class="theme: Default; brush: xml; gutter: false"
type="syntaxhighlighter"><![CDATA[
+ <httpj:tlsServerParameters>
+ ...
+ <sec:cipherSuitesFilter>
+ <sec:include>.*_EXPORT_.*</sec:include>
+ <sec:include>.*_EXPORT1024_.*</sec:include>
+ <sec:include>.*_WITH_DES_.*</sec:include>
+ <sec:include>.*_WITH_AES_.*</sec:include>
+ <sec:include>.*_WITH_NULL_.*</sec:include>
+ <sec:exclude>.*_DH_anon_.*</sec:exclude>
+ </sec:cipherSuitesFilter>
+ ...
+ </httpj:tlsServerParameters>
+]]></script>
+</div></div>
+
+<h2><a shape="rect" name="TLSConfiguration-CertConstraints"></a>Cert
Constraints</h2>
+
+<p>Cert constraints can be used by either the client or server to impose
constraints on the peer certificates. This can be done by specifying a set of
regular expressions on either the Subject DN (Distinguished Name) or the Issuer
DN (or both) of the certificate. A "combinator" attribute can also be specified
for either the SubjectDNConstraints or IssuerDNConstraints Elements. This
attribute can be either "ANY" or "ALL", and refers to whether any or all of the
defined regular expressions should apply. The default value is "ALL".</p>
+
+<div class="code panel" style="border-width: 1px;"><div class="codeHeader
panelHeader" style="border-bottom-width: 1px;"><b>CipherSuites Filter
sample</b></div><div class="codeContent panelContent">
+<script class="theme: Default; brush: xml; gutter: false"
type="syntaxhighlighter"><![CDATA[
+ <httpj:tlsServerParameters>
+ ...
+ <sec:certConstraints>
+ <sec:SubjectDNConstraints>
+
<sec:RegularExpression>.*OU=Morpit.*</sec:RegularExpression>
+ </sec:SubjectDNConstraints>
+ <sec:IssuerDNConstraints combinator="ALL">
+
<sec:RegularExpression>.*O=ApacheTest.*</sec:RegularExpression>
+
<sec:RegularExpression>.*O=OtherApacheTest.*</sec:RegularExpression>
+ </sec:IssuerDNConstraints>
+ </sec:certConstraints>
+ ...
+ </httpj:tlsServerParameters>
+]]></script>
+</div></div>
+
+
<h1><a shape="rect" name="TLSConfiguration-ClientTLSParameters"></a>Client TLS
Parameters</h1>
<p>In addition to the TLS Parameters common to both Clients and Servers, there
are some parameters that are <a shape="rect" class="external-link"
href="https://svn.apache.org/repos/asf/cxf/trunk/core/src/main/java/org/apache/cxf/configuration/jsse/TLSClientParameters.java";>specific</a>
to Clients:</p>
@@ -148,22 +224,16 @@ Apache CXF -- TLS Configuration
</div>
-<p>Note : <tt>disableCNCheck</tt> is a parameterized boolean, you can use a
fixed variable <tt>true</tt>|<tt>false</tt> as well as a <a shape="rect"
class="external-link"
href="http://static.springsource.org/spring/docs/3.0.x/spring-framework-reference/html/beans.html#beans-factory-placeholderconfigurer";
rel="nofollow">Spring externalized property</a> variable (e.g.
<tt>${disable-https-hostname-verification</tt>}) or a <a shape="rect"
class="external-link"
href="http://static.springsource.org/spring/docs/3.0.x/spring-framework-reference/html/expressions.html#expressions-beandef";
rel="nofollow">Spring expression</a> (e.g.
<tt>#{systemProperties['dev-mode']</tt>}).</p>
+<h2><a shape="rect" name="TLSConfiguration-DisableCNCheck"></a>Disable CN
Check</h2>
-<p>Sample : </p>
+<p><tt>disableCNCheck</tt> is a parameterized boolean, you can use a fixed
variable <tt>true</tt>|<tt>false</tt> as well as a <a shape="rect"
class="external-link"
href="http://static.springsource.org/spring/docs/3.0.x/spring-framework-reference/html/beans.html#beans-factory-placeholderconfigurer";
rel="nofollow">Spring externalized property</a> variable (e.g.
<tt>${disable-https-hostname-verification</tt>}) or a <a shape="rect"
class="external-link"
href="http://static.springsource.org/spring/docs/3.0.x/spring-framework-reference/html/expressions.html#expressions-beandef";
rel="nofollow">Spring expression</a> (e.g.
<tt>#{systemProperties['dev-mode']</tt>}).</p>
<div class="code panel" style="border-width: 1px;"><div class="codeHeader
panelHeader" style="border-bottom-width: 1px;"><b>HTTP conduit configuration
disabling HTTP URL hostname verification (usage of localhost,
etc)</b></div><div class="codeContent panelContent">
<script class="theme: Default; brush: xml; gutter: false"
type="syntaxhighlighter"><![CDATA[
- ...
- <http-conf:conduit
- name="{http://example.com/}HelloWorldServicePort.http-conduit">
-
<!-- deactivate HTTPS url hostname verification (localhost, etc)
-->
<!-- WARNING ! disableCNcheck=true should NOT be used in production
-->
<http-conf:tlsClientParameters disableCNCheck="true" />
...
- </http-conf:conduit>
- ...
]]></script>
</div></div>
@@ -175,7 +245,20 @@ Apache CXF -- TLS Configuration
<table class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1"
class="confluenceTh"> Attribute </th><th colspan="1" rowspan="1"
class="confluenceTh"> Default </th><th colspan="1" rowspan="1"
class="confluenceTh"> Description </th></tr><tr><td colspan="1" rowspan="1"
class="confluenceTd"> <tt>clientAuthentication</tt> </td><td colspan="1"
rowspan="1" class="confluenceTd"> Not "wanted" or "required" </td><td
colspan="1" rowspan="1" class="confluenceTd"> Allows you to configure whether
client authentication is "wanted" and/or "required. </td></tr></tbody></table>
</div>
-</div>
+
+<h2><a shape="rect" name="TLSConfiguration-ClientAuthentication"></a>Client
Authentication</h2>
+
+<p>This allows you to define whether client authentication is wanted and/or
required.</p>
+
+<div class="code panel" style="border-width: 1px;"><div class="codeHeader
panelHeader" style="border-bottom-width: 1px;"><b>Client Authentication
sample</b></div><div class="codeContent panelContent">
+<script class="theme: Default; brush: xml; gutter: false"
type="syntaxhighlighter"><![CDATA[
+ <httpj:tlsServerParameters>
+ ...
+ <sec:clientAuthentication want="true" required="true" />
+ ...
+ </httpj:tlsServerParameters>
+]]></script>
+</div></div></div>
</div>
<!-- Content -->
</td>
