WebSphere Commerce supports client certificate logon as a security mechanism, protecting both site and customer. The X.509 certificate supplements basic authentication for customers entering a site. A customer holding this certificate can access a secured WebSphere Commerce site, which has been enabled for client certificate authentication.
When creating a WebSphere Commerce instance, you select the Authentication Mode. The Authentication Mode is either Basic or X.509. The default is Basic authentication, which is logon authentication using a login ID and password. To activate logon authentication using X.509 certificates, select X.509 authentication.
Before you can begin using X.509 certificates, you must arrange for a trust relationship with an external certificate authority to handle electronic authentication of the X.509 certificates. If you are using Sun ONE Web Server as your Web server, you will need to follow additional steps to enable the X.509 certificates on your Web server. Refer to the Sun ONE Web Server product documentation for more information and complete instructions.
X.509 users are accessible through the WebSphere Commerce Accelerator. Before X.509 certificate authentication is enabled, the administrator must ensure there is a client certificate, which is recognized by the server certificate and installed on the browser. Otherwise, the administrator will be unable to logon. When the administrator accesses the WebSphere Commerce Administration Console login window for the first time, a certificate shopper record is created and a shopper cookie is issued, similar to when a normal shopper accesses a secure URL. After the administrator logs on to the WebSphere Commerce Administration Console using the correct ID and password, an administrator cookie is issued, replacing the shopper cookie. An administrator will then have two user records: the administrator user and the previous shopper user.
An error message is displayed when:
- A user's X.509 certificate has been revoked by a site
- A client certificate does not contain the necessary information to guarantee that the shopper is unique in WebSphere Commerce.
The X.509 error view task is registered as X509 ErrorView in the VIEWREG database table.
A typical authentication scenario
The following steps illustrate a typical authentication scenario for X.509 certificates:
- A shopper accesses:
- A non-secure URL through http://
No authentication is performed.
- A secure URL through https://
The shopper is prompted to select a client certificate.
- A URL command and is redirected to https:// because of the access mode of the URL command
The shopper is prompted to select a client certificate.
- A non-secure URL through http://
- The WebSphere Commerce Server uses the information from the client certificate to see if the shopper already exists in the WebSphere Commerce SHOPPER table:
- If the shopper exists with a valid certificate status, the shopper is authenticated and the shopping flow resumes.
- If the shopper does not exist:
- The shopper is automatically registered in the WebSphere Commerce database and the shopping flow resumes.
Note: Only the information found in the CERT_X509 table is taken from the certificate. However, shopper address information could be taken from the X.509 client certificate, if it is available.