#### 6.7.3 Configuring Security services for PolyORB

PolyORB provides support for some elements of the CORBA Security mechanisms. This sections lists the corresponding configuration parameters.

##### 6.7.3.1 Supported mechasnisms

PolyORB provides support for the following security mechanisms:

1. SSL/TLS protected transport;
2. GSSUP (user/password) authentication mechanism;
3. identity assertion and backward trust evaluation.

##### 6.7.3.2 Compile-time configuration

To enable security support, applications must `with' one of the predefined setup packages:

1. `PolyORB.Setup.Secure_Client` - for client side support only;
2. `PolyORB.Setup.Secure_Server` - for both client and server side support.

##### 6.7.3.3 Run-time configuration

1. Capsule configuration

   This section details the configuration parameters for capsule configuration.

                 [security_manager]
                 # List of sections for configure client's credentials
                 #own_credentials=my_credentials
                 #
                 # Client requires integrity proteced messages
                 #integrity_required=true
                 #
                 # Client requires confiodentiality protected messages
                 #confidentiality_required=true
                 #
                 # Client requires security association to detect replay (not supported
                 for now)
                 #detect_replay_required=true
                 #
                 # Client requires security association to detect message sequence
                 errors (not
                 # supported for now)
                 #detect_misordering_required=true
                 #
                 # Client requires target authentication
                 #establish_trust_in_target_required=true
                 #
                 # Client requires client authentication (usually not applicable at
                 all)
                 #establish_trust_in_client_required=true
                 #
                 # (rare useful)
                 #identity_assertion_required=true
                 #
                 # (rare useful)
                 #delegation_by_client_required=true

2. Credentials configuration

   This section details configuration parameters for defining a program's credentials. Depending on the mechanisms used for the transport and authentication layers, the credentials configuration section may define configuration only for one transport mechanism and/or one authentication mechanism.

                 #[my_credentials]
                 #
                 # TLS protected transport mechanism used as transport mechanism
                 #transport_credentials_type=tls
                 #
                 # Connection method. Available methods: tls1, ssl3, ssl2
                 #tls.method=tls1
                 #
                 # Certificate file name
                 #tls.certificate_file=my.crt
                 #
                 # Certificate chain file name
                 #tls.certificate_chain_file=
                 #
                 # Private key file name
                 #tls.private_key_file=my.key
                 #
                 # Name of file, at which CA certificates for verification purposes are
                 #located
                 #tls.certificate_authority_file=root.crt
                 #
                 # Name of directory, at which CA certificates for verification
                 #purposes are
                 # located
                 #tls.certificate_authority_path=
                 #
                 # List of available ciphers
                 #tls.ciphers=ALL
                 #
                 # Verify peer certificate
                 #tls.verify_peer=true
                 #
                 # Fail if client don't provide ceritificate (server only)
                 #tls.verify_fail_if_no_peer_certificate=true
                 #
                 # GSSUP (user/password) mechanism as authentication mechanism
                 #authentication_credentials_type=gssup
                 #
                 # User name
                 #gssup.username=username@domain
                 #
                 # User password
                 #gssup.password=password
                 #
                 # Target name for which user/password pair is applicable
                 #gssup.target_name=@domain

3. POA configuration

   This section details configuration parameters for defining security characteristics of objects managed by POA. The POA's name is used as the section name.

                 #[MySecurePOA]
                 #
                 # Unprotected invocations is allowed
                 #unprotected_invocation_allowed=true
                 #
                 # Section name for configuration of used protected transport mechanism
                 #(if any)
                 #transport_mechanism=tlsiop
                 #
                 # Section name for configuration of used authentication mechanism (if
                 #any)
                 #authentication_mechanism=my_gssup
                 #
                 # Target require client authentication at authentication layer (in
                 #addition
                 # to authentication at transport layer)
                 #authentication_required=true
                 #
                 # Name of file for backward trust evalutation rules
                 #backward_trust_rules_file=file.btr
                 #
                 # Section name for configuration of authorization tokens authority
                 #privilege_authorities=

4. TLS protected transport mechanism configuration

   This section details configuration parameters for the TLS protected transport mechanism. The section name for mechanism configuration is defined in the POA configuration.

                 [tlsiop]
                 # List of access points
                 #addresses=127.0.0.1:3456

5. GSSUP authentication mechanism

   This section details configuration parameters for the GSSUP authentication mechanism. The section name for mechanism configuration is defined in the POA configuration.

                 #[my_gssup]
                 #
                 # Authentication mechanism
                 #mechanism=gssup
                 #
                 # Target name
                 #gssup.target_name=@domain
                 #
                 # User name/password mapping file
                 #gssup.passwd_file=passwd.pwd