Authorization with the IBM integration bus V9 using SSL client certificates

Brief introduction

IBM Integration Bus V9 introduces the ability to propagate client-side SSL certificate information to the message flow. This article will tell you how to use the information stored in the SSL certificate to perform authorization checks on the client, allowing access to a specific subset of the message flow through authenticated clients. Topics covered in this article include:

Enable client certificate Propagation

Accessing certificate information in the message flow

Implementing LDAP authorization with certificate information

Enable client certificate Propagation

To ensure that a client provides a certificate when creating an inbound connection, client authentication must be performed. When using the Httpinput node, the full node-scoped listener is used by default. It must enable client authentication, and you can do this by using the following command:

Mqsichangeproperties <node_name>-B httplistener-o httpsconnector-n clientauth-v True

For soapinput nodes, the embedded listener is used by default. To enable client authentication, use the following command:

Mqsichangeproperties <node_name>-E <server_name>-o httpsconnector-n clientauth-v true

To enable this property, you must provide the correct SSL key storage and trust storage configuration for IBM integration bus.

To ensure that the client certificate is propagated to the message flow, the security profile that is set on the Soapinput or Httpinput node must be enabled for propagation. To enable propagation on existing security profiles, use the following command:

Mqsichangeproperties <node_name>-C securityprofiles-o <profile_name>

-N propagation-v TRUE

If the Soapinput or Httpinput node has not yet configured a security profile, you should select the Default propagation security profile provided by IBM. You can complete this configuration from the BAR editor in Integration Toolkit, as shown in Figure 1:

Figure 1. The default propagation security configuration file