www.openxpki.org/trunk/htdocs/news/story-20070126.html

   1 <?xml version="1.0" encoding="iso-8859-1"?>
   2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
   4   <head>
   5     <title>OpenXPKI Project - Success story</title>
   6 <link rel="stylesheet" title="default" href="../css/openxpki.css" type="text/css" />
   7 <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
   8
   9
  10   </head>
  11   <body>
  12     <div id="page">
  13
  14       <div id="header">
  15         <a href="..">
  16   <img src="../images/openxpki_logo.png"
  17      alt="OpenXPKI Project"/>
  18 </a>
  19
  20       </div> <!-- header -->
  21
  22       <div id="navi">
  23         <div class="menu">
  24                   <div class="menu_item"><a href="..">Home</a></div>
  25         <div class="menu_item"><a href="../features/index.html">Features</a></div>
  26         <div class="menu_item"><a href="../secadvs/index.html">Security Advisories</a></div>
  27         <div class="menu_item"><a href="index.html">News</a></div>
  28         <div class="menu_item"><a href="../docs/index.html">Documentation</a></div>
  29         <div class="menu_item"><a href="../support/index.html">Support</a></div>
  30         <div class="menu_item"><a href="../download/index.html">Download</a></div>
  31         <div class="menu_item"><a href="http://wiki.openxpki.org">Wiki</a></div>
  32         <div class="menu_item"><a href="../resources/index.html">Resources</a></div>
  33         <div class="menu_item"><a href="../foundation/index.html">Foundation</a></div>
  34         <div class="menu_item"><a href="../legacy/index.html">OpenCA Legacy</a></div>
  35         <div class="w3c">
  36           <a href="http://sourceforge.net"><img src="http://sflogo.sourceforge.net/sflogo.php?group_id=150124&amp;type=1" width="88" height="31" alt="SourceForge.net Logo" /></a>
  37         </div>
  38         <div class="w3c">
  39           <a href="http://validator.w3.org/check?uri=http://www.openxpki.org/news/story-20070126.html"><img class="noborder" src="../images/valid-xhtml10.png" alt="Valid XHTML 1.0!" height="31" width="88" /></a>
  40         </div>
  41         <div class="w3c">
  42           <a href="http://www.masonhq.com/"><img class="noborder" src="../images/built-with-white1.png" alt="Built with Mason" height="31" width="88" /></a>
  43         </div>
  44
  45
  46         </div> <!-- menu -->
  47       </div> <!-- navi -->
  48
  49       <div id="content">
  50
  51 <h2>Success story: SmartCard personalization self-service application</h2>
  52 <p>
  53 The first production deployment of OpenXPKI was performed on Friday,
  54 2007-01-26 by <a href="http://www.cynops.de/">Cynops GmbH</a> for
  55 a customer.
  56 </p>
  57 <p>
  58 In the current implementation phase OpenXPKI is solely used for
  59 one single purpose - it implements a self-service application for
  60 SmartCard personalization.
  61 </p>
  62
  63 <h4>System environment</h4>
  64 <p>
  65 SuSE Linux SLES 8, Oracle 9, nCipher nC1002W/nC3022W/nC4032W HSM,
  66 Apache 1.3, RSA Access Manager, RSA SID-800 tokens
  67 </p>
  68
  69 <h4>Authentication</h4>
  70 <p>
  71 For user authentication a RSA token based Web
  72 Single-Sign-On solution implemented with RSA ClearTrust (now called RSA
  73 Access Manager) is used. The web server configuration looks very much like a
  74 basic authentication in front of the web application, and it also
  75 sets some environment variables that the application can evaluate to
  76 obtain login user information.
  77 </p>
  78
  79 <h4>Authorization</h4>
  80 <p>
  81 The OpenXPKI authorization configuration for users is using an
  82 "External Static" that only calls /bin/true and sets the role "User".
  83 (The actual authentication is performed by the authentication module
  84 configured in the web server config.)
  85 </p>
  86
  87 <p>
  88 RA and CA operator authentication also works via the SSO mechanism.
  89 However, the logged in user can pick "RA Operator" or "CA Operator"
  90 instead of "User". The configuration is again "External Static" but
  91 in this case it calls a shell script which checks the authenticated
  92 user name against LDAP groups that list acceptable RA/CA operators.
  93 If authorized, the user gets the corresponding role for the rest of
  94 the session.
  95 </p>
  96
  97 <h4>SmartCard personalization</h4>
  98 <p>
  99 The application uses the SmardCard Personalization workflow
 100 as shipped in rev 709.
 101 A User can either login normally to the application and pick
 102 "Personalize SmartCard" from the top level menu. However, using
 103 mod_rewrite a rewrite rule for https://servername/token was
 104 configured to a deep link into the application. It directly starts the
 105 personalization workflow and hides the user menu.
 106 </p>
 107 <p>
 108 The workflow queries user data from an LDAP directory and stores the
 109 required fields in the workflow instance context.
 110 The user is then prompted to insert a SmartCard token. If the correct
 111 Crypto Service Provider is installed (and the user is using MS
 112 IE...), a key pair is generated on the token. The browser sends the
 113 CSR to OpenXPKI which inserts the CSR into the workflow.
 114 </p>
 115 <p>
 116 The HSM-protected CA key is usually always online, so certificate
 117 issuance can happen right away. The personalization workflow forks a
 118 certificate issuance workflow and waits for its completion. Once the
 119 certificate is issued the workflow continues and instructs IE to
 120 install the certificate on the user's token.
 121 </p>
 122 <p>
 123 In this installations two certificates per user are created, and both are
 124 requested and installed in the same session. Due to the low speed of
 125 the used SmartCard tokens the full personalization process takes
 126 about 4 minutes.
 127 </p>
 128
 129       </div> <!-- content -->
 130
 131       <div id="footer">
 132         Last modified by svysh on Mon Jan 26 10:36:25 UTC 2009
 133  (based on rev. 1361). &copy; 2005 - 2008  OpenXPKI Foundation
 134
 135
 136       </div> <!-- footer -->
 137
 138     </div> <!-- page -->
 139   </body>
 140 </html>
 141
 142