Re: SSOClient - using Apache-style key and crt instead of keystore

Nick Howes — Fri, 03 Feb 2012 11:31:01 GMT

A more recent and minor change – since 1.87, the element and its contents can be omitted – defaults for the values are embedded in the library. It automatically chooses the correct login location based on whether you’re using old or new mode.

\\\ <?xml version=”1.0” encoding=”UTF-8”?> true new SSO_USER x-requested-uri https://horses.warwick.ac.uk/shire SSO-SSC-Horses / horses.warwick.ac.uk urn:horses.warwick.ac.uk:stable:service file:/etc/apache2/SSL/horses.warwick.ac.uk.crt file:/etc/apache2/SSL/horses.warwick.ac.uk.key file:/etc/apache2/SSL/terena-ca.crt \\\

SSOClient - using Apache-style key and crt instead of keystore

Nick Howes — Thu, 19 Jan 2012 11:51:01 GMT

This will be of interest to anyone using SSO Client and cursing Java keystores. Since version 1.84, the library can use a pair of Apache-style crt and key files instead of a Java keystore file. If you’re using Apache to serve HTTPS, you will probably already have these files on your server. The config can point to the same files.

Below is an example SSO Client config file using these credentials. The <credentials> element is new, and the old <keystore> element can be removed entirely. The credentials require the path to a chain file, which contains the intermediate certificates. If you are using Apache to serve HTTPS, you probably already have such a file specified in your config as SSLCertificateChainFile.

\\\ <?xml version=”1.0” encoding=”UTF-8”?> true new urn:mace:eduserv.org.uk:athens:provider:warwick.ac.uk https://websignon.warwick.ac.uk/origin/hs https://websignon.warwick.ac.uk/origin/logout https://websignon.warwick.ac.uk/origin/aa SSO_USER x-requested-uri https://horses.warwick.ac.uk/shire SSO-SSC-Horses / horses.warwick.ac.uk urn:horses.warwick.ac.uk:stable:service file:/etc/apache2/SSL/horses.warwick.ac.uk.crt file:/etc/apache2/SSL/horses.warwick.ac.uk.key file:/etc/apache2/SSL/terena-ca.crt \\\

Download SSO Client

IDG » Web Sign On » SSOClient - using Apache-style key and crt instead of keystore

Re: SSOClient - using Apache-style key and crt instead of keystore

SSOClient - using Apache-style key and crt instead of keystore