11.1 在 Identity Applications 和 Identity Reporting 上設定 FIPS 模式

為 FIPS 建立一個新資料夾。例如 /home/fips

在建立的資料夾中備份以下檔案：

導覽至 /mnt/osp/packages/misc/ 目錄，並將 osp-tomcat8-pwd-handler-<version>.jar 複製到 /opt/netiq/idm/apps/tomcat/lib 目錄。

導覽至 /opt/netiq/idm/apps/tomcat/bin/ 目錄，並按照以下方式編輯 setenv.sh 檔案：

導覽至 /opt/netiq/idm/apps/tomcat/conf/ 目錄，並執行以下指令：

keytool -importkeystore -srckeystore idm.jks -srcstorepass novell -srcstoretype PKCS12 -destkeystore idm.bcfks -deststorepass novell -deststoretype BCFKS -providerclass  org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath $CLASSPATH

keytool -importkeystore -srckeystore tomcat.ks -srcstorepass novell -srcstoretype PKCS12 -destkeystore tomcat.bcfks -deststorepass novell -deststoretype BCFKS -providerclass  org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath $CLASSPATH

keytool -importkeystore -srckeystore idm.jks -srcstorepass novell -srcstoretype PKCS12 -destkeystore /opt/netiq/idm/apps/osp/osp.bcfks -deststorepass novell -deststoretype BCFKS -providerclass  org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath $CLASSPATH

keytool -importkeystore -srckeystore tomcat.ks -srcstorepass novell -srcstoretype PKCS12 -destkeystore /opt/netiq/idm/apps/osp/osp.bcfks -deststorepass novell -deststoretype BCFKS -providerclass  org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath $CLASSPATH --noprompt

java -jar <mount-location>/osp/packages/misc/osp-keymanager-6.7.7.jar -genkeys -keystore /opt/netiq/idm/apps/osp/osp.bcfks -storepass novell -storetype BCFKS -application idm -providerClass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerPath $CLASSPATH -keypass novell -use Encrypting,Signing,TLS

keytool -importkeystore -srckeystore encrypt-keys.pkcs12 -srcstorepass novell -srcstoretype PKCS12 -destkeystore encrypt-keys.bcfks -deststorepass -deststoretype BCFKS -providerclass  org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath $CLASSPATH

按照以下方式編輯 server.xml 檔案：

<! --Connector port="8543" protocol="org.apache.coyote.http11.Http11NioProtocol" maxThreads="150" SSLEnabled="true" scheme="https" secure="true" clientAuth="false" sslProtocol="TLSv1.3" keystoreFile="conf/tomcat.ks" keystorePass="novell" maxHttpHeaderSize="65536" sslEnabledProtocols="TLSv1.3" /--> <Connector protocol="com.microfocus.osp.tomcat.http.PasswordHttp11NioProtocol" port="8543" maxThreads="150" maxHttpHeaderSize="65536" SSLEnabled="true" scheme="https" secure="true"> <SSLHostConfig protocol="TLS" protocols="TLSv1.3" ciphers="TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,TLS_DHE_DSS_WITH_AES_256_GCM_SHA384,TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,TLS_DHE_DSS_WITH_AES_256_CBC_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_CCM,TLS_RSA_WITH_AES_256_CCM,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA" truststoreFile="/opt/netiq/idm/apps/osp/osp.bcfks" truststorePassword="novell" truststoreType="BCFKS" > <Certificate certificateKeystoreFile="/opt/netiq/idm/apps/tomcat/conf/tomcat.bcfks" certificateKeystorePassword="novell" certificateKeyAlias="ssl certificatedns" certificateKeystoreType="BCFKS" /> </SSLHostConfig> </Connector>

按照以下方式編輯 ism-configuration.properties 檔案：

com.netiq.idm.osp.ssl-keystore.file = /opt/netiq/idm/apps/tomcat/conf/tomcat.bcfks

com.netiq.idm.osp.ssl-keystore.type = BCFKS

com.netiq.idm.osp.oauth-keystore.file =/opt/netiq/idm/apps/tomcat/conf/osp.bcfks

com.netiq.idm.osp.oauth-keystore.type = BCFKS

com.netiq.rpt.ssl-keystore.file = /opt/netiq/idm/apps/tomcat/conf/idm.bcfks

com.netiq.rpt.ssl-keystore.type = BCFKS

DirectoryService/realms/jndi/params/KEYSTORE_PATH = /opt/netiq/idm/apps/tomcat/conf/idm.bcfks

com.sssw.fw.security.sigcert.truststore.type = BCFKS

com.netiq.idm.osp.oauth-truststore.file = /opt/netiq/idm/apps/tomcat/conf/idm.bcfks

com.netiq.idm.ua.ldap.keystore-type = BCFKS

com.netiq.idm.osp.oauth-key-alias = ssl certificatedns

將以下 jar 檔案複製到 configupdate 目錄：

按照以下方式編輯 configupdate.sh.properties 檔案：

master_keystore=/opt/netiq/idm/apps/tomcat/conf/encrypt-keys.bcfks
master_keystore_type=bcfks

按照以下方式編輯 configupdate.sh 檔案：

JAVA_OPTS=" -Dorg.bouncycastle.fips.approved_only=true -Dinternal.osp.framework.fips-password=novell -Dorg.bouncycastle.rsa.allow_multi_use=true -Djavax.net.ssl.keyStoreType=BCFKS -Djavax.net.ssl.trustStoreType=BCFKS -Djavax.net.ssl.trustStore=/opt/netiq/idm/apps/tomcat/conf/idm.bcfks -Djavax.net.ssl.trustStorePassword=novell ${JAVA_OPTS}"

CLASSPATH="/opt/netiq/common/jre/lib/bc-fips-1.0.2.5.jar:/opt/netiq/common/jre/lib/bcpkix-fips-1.0.7.jar:/opt/netiq/common/jre/lib/bctls-fips-1.0.19.jar:$CLASSPATH"

啟動 configupdate.sh 公用程式。

啟動 Tomcat。