Participant Technical Reference Manual - IESO

Participant Technical Reference Manual
2. Participant Workstation, Network & Security
IESO Java Policy File
62 A special IESO Java, policy file with the file name “.java.policy" (note the dot at the
beginning of the filename) is required for successful IESO PKI and MPI processing on
the workstation when using Internet Explorer as the browser for the MPI. It is not
required for use with the MIM IDK or IESO Portal. This is a simple text-format file
available from the IESO Technical Interfaces page. It must be installed in each user's
"C:\Documents and Settings\userID" (e.g. C:\Documents and Settings\smithj) directory
on the workstation where userID represents the login ID for the user. As of release
19.0the Verizon CA update in early March, this file will be updated to include the new
Verizon CA domain names for its replacement CA servers to handle the May 2010
issuing CA certificate replacement, to simplify the content and improve MPI login
performance while maintaining java security. Users can, if desired, still use the
original java policy file which is available on the Technical Interfaces, Software
downloads page. This version of the Java policy file has few security restrictions but
high login performance. The edited latest version of the .java.policy file has the
following content for java permissions:
grant {
permission java.lang.RuntimePermission "getProtectionDomain";
permission java.security.SecurityPermission "removeProvider.IAIK";
permission java.security.SecurityPermission "insertProvider.IAIK";
permission java.security.SecurityPermission "putProviderProperty.IAIK";
permission java.security.SecurityPermission "removeProvider.Entrust";
permission java.security.SecurityPermission "insertProvider.Entrust";
permission java.security.SecurityPermission "putProviderProperty.Entrust";
permission java.io.FilePermission "", "read, write";
permission java.util.PropertyPermission "*", "read, write";
permission java.lang.RuntimePermission "queuePrintJob";
permission java.net.SocketPermission "ccica1.idm.cybertrust.com", "connect,resolve";
permission java.net.SocketPermission "ccipdir.idm.cybertrust.com", "connect,resolve";
permission java.net.SocketPermission "ccica2.idm.cybertrust.com", "connect,resolve";
permission java.net.SocketPermission "ccipdir2.idm.cybertrust.com", "connect,resolve";
permission java.net.SocketPermission "cdp1.public-trust.com", "connect,resolve";
permission java.net.SocketPermission "crl.globalsign.net", "connect,resolve";
};
Without this java policy file with the above content in the home directory location for each user,
the MPI applet PKI java code will not function correctly when attempting to login. Under such
circumstances an "applet not inited" error on the browser status line at the bottom may display
and/or a dialogue box with an error message "Login failed: access denied
(java.security.SecurityPermission removeProvider.IAIK)".
63 To download the file from the Technical Interfaces page the user can right mouse
button click on the file's POL link on the web-site and choose to save to the required
location as show in Figure 2-15. This will activate the typical Windows "Save As"
window to allow the user to choose the directory location to save the file to.
Issue 21.1 – March 15, 2010 - estimated Public 29