In addition to HTTPS/TLS with server certificate, client certificates with client authentication enforces that only the trusted client can send requests to IAM.
- Configure HTTPS/TLS with authentication of IAM.
- Create a client certificate for clients, e.g. using OpenSSL:
- Create a trust store for IAM containing the client certificate:
- Enable client authentication, through the application parameters in
instance.properties:
For multiple clients, separate certificates can be created. Multiple certificates can be included as part of the trust store in the next step.
This example uses "iam build-trust-store" instead of "openssl" due to incompatibilities between trust stores in the PKCS #12 format and Java. "iam build-trust-store" will set a special required "bag attribute", but "openssl" will not. Other tools are available, e.g. KeyStore Explorer
(See also: https://bugs.java.com/bugdatabase/view_bug.do?bug_id=8181737, https://stackoverflow.com/questions/42766935/creating-p12-truststore-with-openssl)
Caution with using client-auth = REQUIRED
iam.web-server.https.client-auth = REQUIRED is good security practice, but it affects all modules configured in this instance.properties and makes the use of X.509 client certifiicates mandatory for all modules including the Adminapp and the Service Container.
To enforce REQUIRED only on the Loginapp, the use of profiles is recommended (see Sandboxing with profiles) allowing a separate configuration of the Loginapp in its own profile.
Using a more flexible configuration of the iam.web-server.https.client-auth parameter is discouraged for the purpose of securing the connection between Airlock Gateway and IAM. See Authentication of REST API calls with client certificates (X.509) for other use case scenarios.