Oracle Web Determinations does not have any in-built support for authentication or secure access. To configure secure access, Web Determinations relies upon the security framework of the host Applications Server. Some pointers and procedures for configuring secure access for some application servers can be found below:
The Microsoft IIS Community documentation for enabling SSL on IIS 7 can be found at http://learn.iis.net/page.aspx/144/how-to-setup-ssl-on-iis-70/
Configuration for IIS 6 is very similar.
While those instructions list several methods for configuring SSL access, this is a summary of the "IIS Manager" section intended to assist you to quickly configure a test server using a self-signed certificate. For a production server, you will want to thoroughly familiarize yourself with your server documentation.
Before starting these instructions, first verify that you have a working Web Determinations installation without SSL; point your web browser at the URL at which you have configured Web Determinations. This may be
http://localhost/web-determinations
If you are not yet able to connect normally to Web Determinations, please refer to the topic Deploying Oracle Web Determinations for .NET on IIS in the Oracle Policy Automation Installation Guide before proceeding to enable SSL.
To enable SSL on a default IIS 7 setup there are two key steps:
Create a certificate using the IIS Manager's Server Certificates panel, which can be reached by navigating the trees of the Server Manager as shown here:
Open the Server Certificates feature and select the Create Self-Signed Certificate... task shown outlined below; for production servers, you will most likely want to purchase or import a properly signed certificate using the Import... task instead, but using a self-signed certificate will allow you to proceed immediately with configuration and testing.
You will be asked for a friendly filename; for the purposes of this example we will use web-determinations, and click OK to complete the self-signed certificate.
Select the IIS Web Site which is serving Web Determinations, and click on the Edit Bindings... task in the Actions pane:
In the Site Bindings dialog, click the Add... button; the Add Site Binding dialog is presented.
Set the Type to "https" and the SSL certificate to the newly created self-signed certificate, or other existing certificate you wish to use:
Click OK to the Add Site Binding and Site Bindings dialogs, and restart your website using the Restart task from IIS Manager's Actions pane:
You should now be able to access Web Determinations via SSL.
In your browser, take whatever URL you normally use to access Web Determinations, and change "http:" to "https:"; for example, https://localhost/web-determinations. If you changed the port in the Add Site Binding dialog away from the default 443, you will need to include the non-default port in your URL, for example, https://localhost:8443/web-determinations.
Because you are using a self-signed certificate, users of all browsers will initially be warned that your website cannot be trusted.
Once you have the basic SSL access going, you should review the IIS documentation for more advanced options for production use, including importing a properly signed certificate from a known CA so that users will not be prompted to make a security exception, limiting access to authenticated users only, and disabling the default non-secure access.
Note:
If you are using Windows Server 2008 or later running IIS 7, attempts to view Oracle Web Determinations will bring up an error screen complaining about httpModules in a web.config file. The error screen suggests a number of resolutions, and the first and most preferable (according to the list) is to run a command line, approximately, "appcmd migrate config "Default Website/". Executing this command is safe and will resolve the problem
The official Apache documentation for enabling SSL on a standalone Tomcat 6 webserver can be found at: http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html
This is a summary of those instructions, for the case that your Tomcat installation is running only Web Determinations, and you have not previously configured SSL for any other web applications on this Tomcat instance. If your installation is more complicated than that, you will need to refer to the Tomcat documentation linked above.
Before starting these instructions, first verify that you have a working Web Determinations installation without SSL; point your web browser at the URL at which you have configured Web Determinations. This may be:
http://localhost/web-determinations
or it may be:
http://localhost:8080/web-determinations
If you are not yet able to connect normally to web determinations, please refer to the topic, Deploying Oracle Web Determinations for Java on Tomcat in the Oracle Policy Automation Installation Guide before proceeding to enable SSL.
Assuming a default installation of Tomcat, a brief summary of the Apache instructions referenced above is as follows:
keytool -genkey -alias tomcat -keyalg RSA
The tool will ask for a keystore password; by default, Tomcat expects the password "changeit" so you must use that password on your newly created keystore, or configure Tomcat to use a different one of your preference. The tool will then ask for the details of your organization for inclusion in the self-signed certificate, and finally a certificate password which tomcat requires to be the same as the keystore password you used before. This creates a .keystore file in your home directory (<drive letter>:\Documents and Settings\<user>\.keystore on windows) which is where Tomcat will look for it by default. See the Tomcat documentation if you wish to specify an alternate location for the keystore file in the case where Tomcat is running as a different user.
Note:
If you have already got a .keystore file in your home directory (with a certificate that you don't want to delete) see the Tomcat documentation referenced above for how to configure Tomcat to use it.
<!--<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true" maxThreads="150" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS" />-->
...and remove the <!-- --> from the ends.
Save, and restart Tomcat.
Note that your "port" value may be different from the one listed here.
You should now be able to access Web Determinations via SSL. In your browser, take whatever URL you normally use to access Web Determinations, change "http:" to "https:". If the port value is specified in your normal URL (for example, ":8080") you will need to change it to match the port value specified in the newly uncommented section of your config file (for example, http://localhost:8080/web-determinations/ becomes https://localhost:8443/web-determinations/)
Once you have the basic SSL access operational, you should review the Tomcat documentation for the more advanced options for production use, including importing a properly signed certificate from a known CA so that users will not be prompted to make a security exception, limiting access to authenticated users only, and disabling the default non-secure access.