IBM WebSphere V5.0 Security - CGISecurity

3. WebSphere will validate your entries and display the Global Security page.Enable global security.4. Scroll down the Configuration panel and select LDAP for the Active UserRegistry selection.5. Click the OK button. Once WebSphere validates your configuration, andreturns with no errors, save your current configuration. You will then need tostop and restart your WebSphere server before proceeding.Once you have restarted your WebSphere server, open the WebSphereAdministrative Console in your browser. You will now see that, in addition to auser ID field, a Password field is displayed. To log in, use a valid user ID andpassword. You have now successfully configured WebSphere to use theNetScape iPlanet Directory Server as its user registry.Note: In our case, we used the user ID and password we defined for theServer User ID on the LDAP User Registry’s panel . Under the SecurityCenter, you can select Manage Console Users to define additional user IDs,however, they must first be defined in your directory server.Configuring WebSphere SSL access to iPlanet Director ServerNow that we have configured WebSphere, we will proceed, as we did with theIBM Directory Server, to secure our connection using SSL. As with the IBMDirectory Server scenario, we need to establish a trusted relationship betweenWebSphere and our iPlanet Directory Server. Unlike IBM Directory Server,however, the iPlanet Directory Server does not allow us to generate a self-signedkey for use with its server. We will have to obtain a server certificate from aCertificate Authority (CA). In our scenario, we used our own CA to generate thecertificates being used. In your environment, you may well be using acommercial CA to accomplish this task. Regardless, the steps are basically thesame; only the details as to how to obtain your certificate and your root CAcertificate will differ.Obtaining a server certificate for iPlanet Directory ServerIn order to obtain a digital certificate for our iPlanet Server, we must first build acertificate request to send to a CA. This certificate request will contain theidentity information of our iPlanet Directory Server, as well as the public key forthe corresponding private key that the Directory Server will generate for ourrequest. The process of obtaining a certificate from our CA is what establishestrust; the CA will verify by some means the identity of the requestor for acertificate, and will sign the certificate, establishing its authenticity. Thereafter,any entity which receives the certificate, can, by virtue of the signing CA,establish that the certificate is indeed valid, presuming of course that therecipient also trusts the signing CA.474 IBM WebSphere V5.0 Security Handbook