IBM WebSphere V5.0 Security - CGISecurity

Using the exact Distinguished NameUsing the Disinguished Name (DN) from the certificate to look up the user meansthat the directory structure where the user can be found has to match the DN.For example, if the user DN is cn=user01,ou=ITSO,o=IBM,c=US, then user01has to be under the ITSO organizational unit (ou), IBM organization, US country(c) in this order.This section provides information on how to use the exact distinguished namefrom the certificate to map the user to an LDAP user entry.Acquiring a personal certificateIn this example, we will use the Java keytool utility from Sun to create thecertificate request and then import it into a JKS keystore. Using the Java keytoolprovides the flexibility to submit a request with the DN of our choice; IBM’sikeyman utility does not provide this flexibility at this moment.Follow the steps below to acquire a new certificate from a CA.1. Create the keystore for the user manager.keytool -genkey -keyalg RSA -dname "cn=manager01,o=itso" -alias manager01-keypass password -keystore testkeyring.jks -storepass password2. Create a certificate request for the user.keytool -v -certreq -alias manager01 -file managerReq.csr -keypass password-keystore testkeyring.jks -storepass password3. Send the request to the CA. This step requires some additional steps from thereader, where the managerReq.csr certificate request has to be sent to the CAfor signing.4. Get the CA public certificate. This step is a bit more complex; the user has toacquire the CA public certificate and import it into the keystore. The publiccertificate is either available as part of the Java Development Kit, or can bedownloaded from the CA’s Web site.keytool -import -alias "Trusted CA Certificate" -file CACert.cer -keystoretestkeyring.jks -storepass password5. Pick up the certificate from the CA. This is, again, a slightly more complexprocess, where the user has to get the signed certificate from the CA andsave it in a simple text file under the name of managerRespCert.arm.keytool -import -trustcacerts -alias manager -file managerRespCert.arm-keystore testkeyring.jks -storepass password6. You can use the JKS ikeyman tool to export the certificate in PKCS#12format, in order to import it into the Web browser of your choice. When theWeb site requires the user to present the certificate, the user can choose theright one from the browser’s keystore.Chapter 10. Administering WebSphere security 299