The HTTP Instance Digest verification according to RFC 3230. If configured, requests with body must include a digest.

HTTP Instance Digest Verification

Allows to define verifications on the HTTP signature. The headers parameter defines the signed data and is passed with the request to each of the configured verifications. If any of the verifications fail, the request will be rejected.

This allows to enforce certain data to be included/excluded in the signature.

Mandatory HTTP Signature Header Whitelist HTTP Signature Headers

The name of the header containing the request line of the original HTTP request. This must be added on the Airlock Gateway (WAF) mapping's Apache Expert Settings with
RequestHeader set AL_ENV_REQUEST_LINE expr=%{THE_REQUEST}

AL_ENV_REQUEST_LINE

How to load the certificate that is used to verify the signature.

HTTP Signature Static X.509 Certificate Loader HTTP Signature X.509 Certificate Header Loader HTTP Signature X.509 Certificate URL Loader

Keystore file name containing certificates of trusted issuers. Certificates from the loader must be directly issued by one of the issuers in this keystore. The keystore can be of type:

• JKS
• PKCS12

The password used verify the authenticity of the trust store.

Depending on the keystore type, leaving this property empty (or undefined) has a different effect:

• JKS: the keystore can be opened and used but the integrity of the keystore is not checked.
• PKCS12: an error occurs.

A list of certificate status checkers used to check the revocation status of the HTTP signature verification certificate. If more than one checker is configured, all of them are consulted and the certificate is considered revoked if at least one of them tells so.

Security warning: The revocation status is only checked for the leaf certificate. Issuer certificates are not checked for revocation. If revocation checks for issuer certificates are required, these must be performed by the administrative process that manages the IAM truststore, see property 'Trust Store Path'.

Always Revoked Status Checker CRL Certificate Status Checker CRL Distribution Point Extension CRL Checker Caching Certificate Status Checker Dummy Certificate Status Checker OCSP Certificate Status Checker

The client credential extractor.

Basic Auth HTTP Header Extractor Bearer Token HTTP Header Extractor (as Token Credential) Certificate Token Credential Extractor Client Certificate (X.509) Credential Extractor HTTP Header Token Extractor (as SSO Credential) HTTP Header Token Extractor (as Token Credential) HTTP Signature Verification Credential Extractor Kerberos SPNEGO Extractor Static Username Password Extractor

Verifies the signature algorithms being used. If not configured, all algorithms are allowed and therefore all supported algorithms that can be used with the certificate's key material will pass the signature verification.

HTTP Signature Algorithm Whitelist

Client credential verification against the used HTTP signature signing certificate. If not configured, no verification of the credential will be performed.

Certificate Subject Organization Identifier Equality Credential Verifier

Enables logging of signature verification information. Certificate, algorithm, signing string and the signature will be logged in case the verification was successful. This allows to verify signatures at a later point in time.

Security Warning: Signing strings contain request headers which often contain sensitive information and should therefore not be logged. If this feature is enabled, it is highly recommended that these logs are redirected to a special destination using the Logger Name.

HTTP Signature Audit Logger