#### 6.7.3 Configuring Security services for PolyORB

PolyORB provides support for some elements of the CORBA Security mechanisms. This sections lists the corresponding configuration parameters.

#### 6.7.3.1 Supported mechasnisms

PolyORB provides support for the following security mechanisms:

1. SSL/TLS protected transport;
2. GSSUP (user/password) authentication mechanism;
3. identity assertion and backward trust evaluation.

#### 6.7.3.2 Compile-time configuration

To enable security support, applications must ‘with’ one of the predefined setup packages:

1. `PolyORB.Setup.Secure_Client` - for client side support only;
2. `PolyORB.Setup.Secure_Server` - for both client and server side support.

#### 6.7.3.3 Run-time configuration

1. Capsule configuration

   This section details the configuration parameters for capsule configuration.

       [security_manager]
       # List of sections for configure client's credentials
       #own_credentials=my_credentials
       #
       # Client requires integrity proteced messages
       #integrity_required=true
       #
       # Client requires confiodentiality protected messages
       #confidentiality_required=true
       #
       # Client requires security association to detect replay (not supported
       for now)
       #detect_replay_required=true
       #
       # Client requires security association to detect message sequence
       errors (not
       # supported for now)
       #detect_misordering_required=true
       #
       # Client requires target authentication
       #establish_trust_in_target_required=true
       #
       # Client requires client authentication (usually not applicable at
       all)
       #establish_trust_in_client_required=true
       #
       # (rare useful)
       #identity_assertion_required=true
       #
       # (rare useful)
       #delegation_by_client_required=true

2. Credentials configuration

   This section details configuration parameters for defining a program’s credentials. Depending on the mechanisms used for the transport and authentication layers, the credentials configuration section may define configuration only for one transport mechanism and/or one authentication mechanism.

       #[my_credentials]
       #
       # TLS protected transport mechanism used as transport mechanism
       #transport_credentials_type=tls
       #
       # Connection method. Available methods: tls1, ssl3, ssl2
       #tls.method=tls1
       #
       # Certificate file name
       #tls.certificate_file=my.crt
       #
       # Certificate chain file name
       #tls.certificate_chain_file=
       #
       # Private key file name
       #tls.private_key_file=my.key
       #
       # Name of file, at which CA certificates for verification purposes are
       #located
       #tls.certificate_authority_file=root.crt
       #
       # Name of directory, at which CA certificates for verification
       #purposes are
       # located
       #tls.certificate_authority_path=
       #
       # List of available ciphers
       #tls.ciphers=ALL
       #
       # Verify peer certificate
       #tls.verify_peer=true
       #
       # Fail if client don't provide ceritificate (server only)
       #tls.verify_fail_if_no_peer_certificate=true
       #
       # GSSUP (user/password) mechanism as authentication mechanism
       #authentication_credentials_type=gssup
       #
       # User name
       #gssup.username=username@domain
       #
       # User password
       #gssup.password=password
       #
       # Target name for which user/password pair is applicable
       #gssup.target_name=@domain

3. POA configuration

   This section details configuration parameters for defining security characteristics of objects managed by POA. The POA’s name is used as the section name.

       #[MySecurePOA]
       #
       # Unprotected invocations is allowed
       #unprotected_invocation_allowed=true
       #
       # Section name for configuration of used protected transport mechanism
       #(if any)
       #transport_mechanism=tlsiop
       #
       # Section name for configuration of used authentication mechanism (if
       #any)
       #authentication_mechanism=my_gssup
       #
       # Target require client authentication at authentication layer (in
       #addition
       # to authentication at transport layer)
       #authentication_required=true
       #
       # Name of file for backward trust evalutation rules
       #backward_trust_rules_file=file.btr
       #
       # Section name for configuration of authorization tokens authority
       #privilege_authorities=

4. TLS protected transport mechanism configuration

   This section details configuration parameters for the TLS protected transport mechanism. The section name for mechanism configuration is defined in the POA configuration.

       [tlsiop]
       # List of access points
       #addresses=127.0.0.1:3456

5. GSSUP authentication mechanism

   This section details configuration parameters for the GSSUP authentication mechanism. The section name for mechanism configuration is defined in the POA configuration.

       #[my_gssup]
       #
       # Authentication mechanism
       #mechanism=gssup
       #
       # Target name
       #gssup.target_name=@domain
       #
       # User name/password mapping file
       #gssup.passwd_file=passwd.pwd