To enable an XMS C/C++ application to make secure connections to a WebSphere service integration bus messaging engine, the relevant properties must be defined in the ConnectionFactory object.
XMS provides SSL and HTTPS support for connections to a WebSphere service integration bus. SSL and HTTPS provide secure connections for authentication and confidentiality.
Like WebSphere security, XMS security is configured with respect to JSSE security standards and naming conventions, which include the use of CipherSuites to specify the algorithms that are used when negotiating a secure connection. The protocol used in the encryption negotiation can be either SSL or TLS, depending on which CipherSuite you specify in the ConnectionFactory object.
The security capabilities for XMS C/C++ application are provided by IBM's standard security enablement component, Global Security Kit (GSKit). XMS configures the relevant GSKit options by means of properties set on the XMS ConnectionFactory object. These properties must be specified regardless of whether the ConnectionFactory object is an administered object.
Table 1 lists the properties that must be defined in the ConnectionFactory object.
Name of property | Description |
---|---|
XMSC_WPM_SSL_CIPHER_SUITE | The name of the CipherSuite to be used on an SSL or TLS connection to a WebSphere service integration bus messaging engine. The protocol used in negotiating the secure connection depends on the specified CipherSuite. |
XMSC_WPM_SSL_KEY_REPOSITORY | A path to the file that is the keyring file containing the public or private keys to be used in the secure connection. |
XMSC_WPM_SSL_KEYRING_LABEL | The certificate to be used when authenticating with the server. |
XMSC_WPM_SSL_KEYRING_PW | The password for the keyring file. |
XMSC_WPM_SSL_KEYRING_STASH_FILE | The name of a binary file containing the password of the key repository file. |
XMSC_WPM_SSL_FIPS_REQUIRED | The value of this property determines whether an application can or cannot use non-FIPS compliant cipher suites. If this property is set to true, only FIPS algorithms are used for the client-server connection. |
cf.setStringProperty(XMSC_WPM_PROVIDER_ENDPOINTS, host_name:port_number:chain_name); cf.setStringProperty(XMSC_WPM_SSL_KEY_REPOSITORY, key_repository_pathname); cf.setStringProperty(XMSC_WPM_TARGET_TRANSPORT_CHAIN, transport_chain); cf.setStringProperty(XMSC_WPM_SSL_CIPHER_SUITE, cipher_suite); cf.setStringProperty(XMSC_WPM_SSL_KEYRING_STASH_FILE, stash_file_pathname);Where chain_name should be set to either BootstrapTunneledSecureMessaging or BootstrapSecureMessaging, and port_number is the number of the port on which the bootstrap server listens for incoming requests.
The following is an example of ConnectionFactory properties for secure connections to a WebSphere integration messaging engine with sample values inserted:
/* CF properties needed for an SSL connection */ cf.setStringProperty(XMSC_WPM_PROVIDER_ENDPOINTS,"localhost:7286:BootstrapSecureMessaging"); cf.setStringProperty(XMSC_WPM_TARGET_TRANSPORT_CHAIN,"InboundSecureMessaging"); cf.setStringProperty(XMSC_WPM_SSL_KEY_REPOSITORY,"C:\\Program Files\\IBM\\gsk7\\bin\\XMSkey.kdb"); cf.setStringProperty(XMSC_WPM_SSL_KEYRING_STASH_FILE,"C:\\Program Files\\IBM\\gsk7\\bin\\XMSkey.sth"); cf.setStringProperty(XMSC_WPM_SSL_CIPHER_SUITE,"SSL_RSA_EXPORT_WITH_RC4_40_MD5");