Configure CAC Support

This section describes how to configure Common Access Card (CAC) support on the UCMDB Browser.

Search for	Example	Results
A single word	`cat`	Topics that contain the word "cat". You will also find its grammatical variations, such as "cats".
A phrase. You can specify that the search results contain a specific phrase.	`"cat food"` (quotation marks)	Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase.

Search for	Operator	Example
Two or more words in the same topic	`AND` `and` `+` (plus symbol) `&` (ampersand)	`cat AND dog` `"cat food"+milk` `"cat food"&"dog food"`
Either word in a topic	`OR` `or` `\|` (pipe)	`cat OR dog` `cat \| dog`
Topics that do not contain a specific word or phrase	`NOT` `not` `!` (exclamation point)	`NOT cat` `! dog`
Topics that contain one string and do not contain another	`^` (caret)	`cat ^ mouse`
A combination of search types	`( )` parentheses	`cat + (dog \| mouse)` `cat \| dog + (! mouse)`

Make sure that you have access to the keystore, truststore, and crl files. If necessary, you can create them using the following examples:

Import the server certificate into the keystore:

$ keytool -importkeystore -deststorepass changeit ‑destkeypass changeit ‑destkeystore keystore.jks ‑srckeystore ../../certtest/localhost.p12 ‑srcstoretype PKCS12 ‑alias sercer
```
Enter source keystore password:   
```
Import the certificate authority (CA) certificate into the truststore:

$ keytool ‑import ‑keystore cacerts.jks ‑storepass changeit ‑alias my_ca ‑file ../../certtest/ca.crt
```
Owner: EMAILADDRESS=ca@naive.sk, CN=CA Admin, OU=CA, O=Naive, L=Bratislava, ST=Bratislava, C=SK
```
```
...too long... 
```
```
Trust this certificate? [no]:  yes
```
```
Certificate was added to keystore
```

Important After upgrading to UCMDB 10.32 or later,

the deststorepass is the password set at UCMDB server upgrade.
the destkeystore is the password set at UCMDB server upgrade.
the storepass is the password set at UCMDB server upgrade.

Load the client certificate into your Web browser.

Open the server.xml file, located in <UCMDB_Browser_installation_directory>\webapps\release\conf. Add the following lines, if they do not exist:

<Connector protocol="HTTP/1.1" port="8553" maxThreads="200"

This line specifies the port number. You can use any value, as long as it does not conflict with an existing port. The default value is 8443.
SSLEnabled="true" scheme="https" secure="true" sslProtocol="TLS"

This line configures SSL for the Tomcat server.
truststoreFile="C:\Program Files\Apache Software Foundation\Tomcat 8.5.15\certificates\server.truststore" truststorePass="hppass"

This line provides the path to the truststore file and the password of the truststore file.
keystoreFile="C:\Program Files\Apache Software Foundation\Tomcat 8.5.15\certificates\server.keystore" keystorePass="hppass"

This line provides the path to the keystore file and the password of the keystore file.
crlFile="C:\Program Files\Apache Software Foundation\Tomcat 8.5.15\certificates\server.crl"

This line provides the path to the certificate revocation list file.
clientAuth="true" />

This line specifies that login is permitted only when the client has a valid client certificate.
Important After upgrading to UCMDB 10.32 or later,
- the truststorePass is the password set at UCMDB server upgrade.
- the keystorePass is the password set at UCMDB server upgrade.

Disable access to other connectors ( to ensure that no user can connect to the Tomcat server with unsecured HTTP access) by commenting out or deleting other connector tags that are referenced in the file.

Save the server.xml file and restart the Tomcat server.

Note If your Web browser cannot connect to the Tomcat server after following this procedure, delete the following line from the server.xml file:

<Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />

Save the server.xml file and restart the Tomcat server again.