Configure Codar Console

Complete the following steps to integrate the Codar Console with the Common Access Card:

1. Open the CSA_HOME\jboss-as\standalone\deployments\
csa.war\WEB-INF\classes\csa.properties file in a text editor and uncomment the following line:

   enableCAC=true

2. Extract the user name from the certificate using the username extraction mechanism.

   The username extraction mechanism depends on the format of your certificate. The user name extracted from the certificate should match the user names configured in the LDAP configuration configured in CSA. CSA enables you to extract the user name using the SubjectDN and Subject Alternative Name (SAN) mechanisms. To configure the username extraction mechanism you must make the changes to the following properties in the csa.properties file:

   Property	Description
   csa.cac.x509Attribute	The name of the X.509 certificate attribute from which the user name will be extracted. Set this property to subjectDN/san/subjectDN,san. If this property is set to contain both attributes such as subjectDN,san or san,subjectDN, then username will be extracted from the subjectDN attribute only if the SAN attribute is not present in the certificate. If this property is not set, then the default value for the property is "subjectDN".
   csa.cac.regex	The regular expression used to extract a user name from the subjectDN X.509 attribute. If this property is not set, then the default for regex is CN= (.*?). This property need not be set if the property csa.cac.x509Attribute is set to "san".
   csa.cac.san.type	The type of the subject alternative name. The allowed types are othername and rfc822name. If this property is not set, then the default value for the property is otherName. This property need not be set if csa.cac.x509Attribute is set to "subjectDN".

3. Navigate to the CSA_HOME\jboss-as\standalone\deployments\csa.war\WEB-INF\ directory.

4. Make a backup copy of the applicationContext-security.xml file.

5. Update the Spring Security configuration. Open the
   CSA_HOME\jboss-as\standalone\deployments\csa.war\
WEB-INF\applicationContext-security.xml file in a text editor and make the following changes:

   1. Locate the comment "Pre-authentication for CAC" and uncomment the following line:

      <security:authentication-provider ref="customX509AttrPreAuthAuthProvider"/>

   2. Locate and uncomment both occurrences the following line:

      <custom-filter position="LAST" ref="cacFilter" />

      Note The <custom-filter position="LAST" ref="cacFilter" /> line defines the custom filter to be used and specifies that it will need to be set as the LAST filter in the chain of filters.

   3. Locate and uncomment both occurrences the following line:

      <custom-filter position="X509_FILTER" ref="cacX509AuthenticationFilter" />

      Note The URL must start with http:// and cannot start with just www.

   4. Locate the comment Bean definitions for CAC and uncomment the content that follows it:

      <beans:bean id="cacUserDetailsService"
      class="com.hp.csa.authn.impl.CACUserDetailsServiceImpl">
      <beans:property name="restRole" value="ROLE_REST" />
      </beans:bean>
      <beans:bean id="cacFilter" class="com.hp.csa.security.CACFilter" />
      <beans:bean id="cacX509AuthenticationFilter"
      class="org.springframework.security.web.authentication.preauth.x509.X50
      9AuthenticationFilter">
      <beans:property name="authenticationManager"
      ref="authenticationManager" />
      <beans:property name="principalExtractor"
      ref="customX509Extractor" />
      </beans:bean>
      <beans:bean id="customX509AttrPreAuthAuthProvider"
      class="org.springframework.security.web.authentication.preauth.PreAuthe
      nticatedAuthenticationProvider">
      <beans:property name="preAuthenticatedUserDetailsService"
      ref="customAuthenticationUserDetailsService" />
      </beans:bean>
      <beans:bean id="customAuthenticationUserDetailsService"
      class="org.springframework.security.core.userdetails.UserDetailsByNameS
      erviceWrapper">
      <beans:property name="userDetailsService"
      ref="cacUserDetailsService" />
      </beans:bean>
      <beans:bean id="customX509Extractor"
      class="com.hp.csa.security.CustomX509PrincipalExtractor">
      <beans:property name="x509Attribute"
      value="${csa.cac.x509Attribute:subjectDN}"/>
      <beans:property name="regex" value="${csa.cac.regex:CN=(.*?),}
      "/>
      <beans:property name="sanType"
      value="${csa.cac.san.type:otherName}"/>
      </beans:bean>