Configure LW-SSO in the Chat Server for FIPS mode

Service Manager Collaboration uses LW-SSO to access and authenticate users. Service Manager Collaboration requires that you configure LW-SSO for the Service Manager web tier and the Openfire Chat Server. When FIPS mode is enabled on the SM Server side, you need to configure LW-SSO in the Chat Server for FIPS mode.

Prerequisites

Before you proceed, make sure of the following:

1. You have already configured the Openfire Chat Server's JRE for FIPS mode. For details, see the Openfire Chat Server section in Configure Java for FIPS mode.

2. You have already successfully enabled FIPS mode on the SM Server side. For details, see Configure FIPS mode in the Server.
3. You have already configured LW-SSO in the SM Server for FIPS mode. For details, see Configure LW-SSO in the Server for FIPS mode.
4. You have already configured LW-SSO in the SM Web Tier for FIPS mode. For details, see Configure LW-SSO in the Web tier for FIPS mode.

To configure LW-SSO in the Chat Server for FIPS mode, follow these steps:

1. Go to the <Openfire_home>\plugins\lwssoplugin folder, and open the lwssofmconf.xml file in a text editor.

2. Locate the following section.

   <lwssoValidation>
               <domain>example.com</domain>
               <crypto cipherType="symmetricBlockCipher"
                 engineName="AES" paddingModeName="CBC" keySize="256"
                 encodingMode="Base64Url"
                 initString="This is a shared secret passphrase"/>
               <!-- When Service Manager is running in FIPS mode, the crypto configuration above needs to be replaced with the configuration below. The initString value must be 32 characters long and contain no spaces.  -->
               <!--
               <crypto cryptoSource="jce" cipherType="symmetricBlockCipher"
                 engineName="AES" paddingModeName="CBC" keySize="256"
                 pbeDigestAlgorithm="SHA1" encodingMode="Base64Url"
                 jcePbeAlgorithmName="AES" jcePbeMacAlgorithmName="AES"
                 macType="hmac"
                 macAlgorithmName="SHA1" directKeyEncoded="true" directKeyEncoding="Base64Url"
                 algorithmPaddingName="PKCS5Padding"
                 pbeCount="20" macKeySize="256" macPbeCount="20"
                 initString="rqa9mkdmfkvdvienfj4usldo9205mvid">
               </crypto>
               --> 
   </lwssoValidation>

3. Update this section by doing the following:

   • Comment out the ordinary crypoto configuration part.
   • Uncomment the FIPS mode crypto configuration part.
   • Configure the domain of the host.

   • Update the default initString value to your own value, if needed.

     Caution The initString value is shared among all parties that participate in LW-SSO. In FIPs mode, this value must be 32 characters long and contain no spaces; otherwise LW-SSO will not work in FIPS mode.

   The following is an example:

   <lwssoValidation>
       <domain>myhostdomain.com</domain>
        <!--
              <crypto cipherType="symmetricBlockCipher"
                 engineName="AES" paddingModeName="CBC" keySize="256"
                 encodingMode="Base64Url"
                 initString="This is a shared secret passphrase"/>
         -->
         <!-- When Service Manager is running in FIPS mode, the crypto configuration above needs to be replaced with the configuration below.
         The initString value must be 32 characters long and contain no spaces. --> 
     
               <crypto cryptoSource="jce" cipherType="symmetricBlockCipher"
                 engineName="AES" paddingModeName="CBC" keySize="256"
                 pbeDigestAlgorithm="SHA1" encodingMode="Base64Url"
                 jcePbeAlgorithmName="AES" jcePbeMacAlgorithmName="AES"
                 macType="hmac"
                 macAlgorithmName="SHA1" directKeyEncoded="true" directKeyEncoding="Base64Url"
                 algorithmPaddingName="PKCS5Padding"
                 pbeCount="20" macKeySize="256" macPbeCount="20"
                 initString="1qaz2wsxfkvdvienfj4usldo9205mvid">
               </crypto>
   </lwssoValidation>

   Note Here, myhostdomain.com refers to the domain of the Openfire Chat Server host.

4. Stop openfire.exe and quit, and then restart openfire.exe again.

5. Make sure the SM Server is started.
6. Make sure the SM Web Tier's web application server is started.
7. Verify that SM Collaboration can work correctly. For more information, see Install Service Manager Collaboration.