CAC y autenticación mutua

Buscar

Introducción

Adobe® LiveCycle® Enterprise Suite 4 (ES4) es compatible con la autenticación mutua para iniciar sesión en los servidores de LiveCycle. Los elementos siguientes son compatibles:

  • Todas las interfaces de usuario de LC, excepto WorkBench
  • Adobe Acrobat y Adobe Reader
  • Microsoft Office

En el caso de autenticación mediante CAC (tarjetas de acceso común), los certificados incrustados pueden utilizarse como certificados en el almacén de certificados de Microsoft® Windows®. Cuando se produce la autenticación mutua y se selecciona el certificado en CAC, el cliente se autentica.

Compatibilidad de LiveCycle con la autenticación mutua

La autenticación mutua en LiveCycle es compatible con:

  • Apertura de documentos protegidos por políticas con Adobe Reader o Adobe Acrobat.
  • Interfaces de usuario web de LiveCycle. Todas las interfaces de usuario de usuario final y las interfaces de usuario de administrador son compatibles.
  • Autenticación a través de SharePoint Connector. La web de LiveCycle SharePoint Connector se puede configurar para que se autentique a través de un certificado de usuario del sistema, en lugar de un nombre de usuario y contraseña previamente configurados.
  • Indexación de la gestión de derechos de documentos protegidos en LiveCycle iFilter.
  • Extensiones de gestión de derechos para Microsoft® Office®.
Nota:

La autenticación mutua no es compatible con:

  • SDK de cliente Java de LiveCycle
  • LiveCycle Workbench

Configuración

Para habilitar la autenticación mutua, realice las siguientes configuraciones:

Configuración del servidor de aplicaciones

La habilitación de la autenticación mutua depende del servidor de aplicaciones utilizado.

Siga las directrices específicas del servidor de aplicaciones para habilitar la autenticación mutua bidireccional.

Configuración del servidor LiveCycle

Para habilitar la autenticación mutua en el servidor de LiveCycle, es necesario implementar y configurar un SPI UM AuthProvider personalizado con un dominio de LiveCycle.

Para obtener más información sobre cómo crear proveedores de autenticación, consulte Creación de proveedores de autenticación.

Lo siguiente es un ejemplo de SPI de proveedor de autenticación para habilitar la autenticación mutua:

package com.adobe.livecycle.usermanager.sslauthprovider;
import com.adobe.idp.um.spi.authentication.*;
import com.adobe.logging.AdobeLogger;
import javax.naming.InvalidNameException;
import javax.naming.ldap.LdapName;
import javax.naming.ldap.Rdn;
import java.security.cert.Certificate;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import javax.security.auth.x500.X500Principal;
import javax.servlet.http.HttpServletRequest;
import java.security.cert.X509Certificate;
import java.util.*;
import org.apache.commons.codec.binary.Base64;
public class SSLMutualAuthProvider implements AuthProvider{
private static AdobeLogger logger = AdobeLogger.getAdobeLogger(SSLMutualAuthProvider.class);
public AuthResponse authenticate(Map credentials, List passedAuthConfigs) {
...
//Extract the client certificate from the request
X509Certificate[] certs = extractCertificate(request);
if(certs == null || certs.length == 0){
return null;
}
AuthResponse ar = new AuthResponseImpl();
ar.setAuthStatus(AuthResponse.AUTH_SUCCESS);
ar.setDomain(authConfigs.get(0).getDomainName()); //Assuming config is single domain and using its domainName
Map<String,String> oidMap = new HashMap<String, String>();
String name = certs[0].getSubjectX500Principal().getName();
logger.info("Got Subject DN as "+name);
LdapName ldapName = null;
try{
ldapName = new LdapName(name);
}catch(InvalidNameException e){
throw new RuntimeException(e);
}
//In this sample the CN of the Subject Name maps to user's loginid, however this can be changed to meet your requirements.
for(Rdn rdn : ldapName.getRdns()){
String type = rdn.getType();
if("CN".equals(type)){
String cn = (String) rdn.getValue();
ar.setUsername(cn);
return ar;
}
}
return null;
}
private X509Certificate[] extractCertificate(HttpServletRequest request) {
X509Certificate[] certs = (X509Certificate[]) request.getAttribute("javax.servlet.request.X509Certificate");
if(certs != null){
logger.debug("No certificate found in the HTTP Header javax.servlet.request.X509Certificate");
return certs;
}
//Check for certificate value passed in HTTP header which is the case with proxy
String certDataInPemFormat = request.getHeader("SSL_CLIENT_CERT");
if(certDataInPemFormat == null){
logger.debug("No certificate found in the HTTP Header SSL_CLIENT_CERT ");
return null;
}
String PREFIX = "-----BEGIN CERTIFICATE----- ";
String SUFFIX = " -----END CERTIFICATE-----";
int dataLength = certDataInPemFormat.length();
String encodedData = certDataInPemFormat.substring(PREFIX.length(), dataLength - SUFFIX.length() - 1);
Certificate c = null;
try {
byte[] certData = Base64.decodeBase64(encodedData.getBytes("utf-8"));
//Certificate factory would take care of removing the prefixes and suffixes
CertificateFactory cf = CertificateFactory.getInstance("X.509");
c = cf.generateCertificate(new ByteArrayInputStream(certData));
} catch (CertificateException e) {
throw new RuntimeException(e);
} catch (UnsupportedEncodingException e) {
throw new RuntimeException(e);
}
return new X509Certificate[]{(X509Certificate) c};
}
}
package com.adobe.livecycle.usermanager.sslauthprovider; import com.adobe.idp.um.spi.authentication.*; import com.adobe.logging.AdobeLogger; import javax.naming.InvalidNameException; import javax.naming.ldap.LdapName; import javax.naming.ldap.Rdn; import java.security.cert.Certificate; import java.security.cert.CertificateException; import java.security.cert.CertificateFactory; import javax.security.auth.x500.X500Principal; import javax.servlet.http.HttpServletRequest; import java.security.cert.X509Certificate; import java.util.*; import org.apache.commons.codec.binary.Base64; public class SSLMutualAuthProvider implements AuthProvider{ private static AdobeLogger logger = AdobeLogger.getAdobeLogger(SSLMutualAuthProvider.class); public AuthResponse authenticate(Map credentials, List passedAuthConfigs) { ... //Extract the client certificate from the request X509Certificate[] certs = extractCertificate(request); if(certs == null || certs.length == 0){ return null; } AuthResponse ar = new AuthResponseImpl(); ar.setAuthStatus(AuthResponse.AUTH_SUCCESS); ar.setDomain(authConfigs.get(0).getDomainName()); //Assuming config is single domain and using its domainName Map<String,String> oidMap = new HashMap<String, String>(); String name = certs[0].getSubjectX500Principal().getName(); logger.info("Got Subject DN as "+name); LdapName ldapName = null; try{ ldapName = new LdapName(name); }catch(InvalidNameException e){ throw new RuntimeException(e); } //In this sample the CN of the Subject Name maps to user's loginid, however this can be changed to meet your requirements. for(Rdn rdn : ldapName.getRdns()){ String type = rdn.getType(); if("CN".equals(type)){ String cn = (String) rdn.getValue(); ar.setUsername(cn); return ar; } } return null; } private X509Certificate[] extractCertificate(HttpServletRequest request) { X509Certificate[] certs = (X509Certificate[]) request.getAttribute("javax.servlet.request.X509Certificate"); if(certs != null){ logger.debug("No certificate found in the HTTP Header javax.servlet.request.X509Certificate"); return certs; } //Check for certificate value passed in HTTP header which is the case with proxy String certDataInPemFormat = request.getHeader("SSL_CLIENT_CERT"); if(certDataInPemFormat == null){ logger.debug("No certificate found in the HTTP Header SSL_CLIENT_CERT "); return null; } String PREFIX = "-----BEGIN CERTIFICATE----- "; String SUFFIX = " -----END CERTIFICATE-----"; int dataLength = certDataInPemFormat.length(); String encodedData = certDataInPemFormat.substring(PREFIX.length(), dataLength - SUFFIX.length() - 1); Certificate c = null; try { byte[] certData = Base64.decodeBase64(encodedData.getBytes("utf-8")); //Certificate factory would take care of removing the prefixes and suffixes CertificateFactory cf = CertificateFactory.getInstance("X.509"); c = cf.generateCertificate(new ByteArrayInputStream(certData)); } catch (CertificateException e) { throw new RuntimeException(e); } catch (UnsupportedEncodingException e) { throw new RuntimeException(e); } return new X509Certificate[]{(X509Certificate) c}; } }
package com.adobe.livecycle.usermanager.sslauthprovider;

import com.adobe.idp.um.spi.authentication.*;
import com.adobe.logging.AdobeLogger;
 
import javax.naming.InvalidNameException;
import javax.naming.ldap.LdapName;
import javax.naming.ldap.Rdn;
import java.security.cert.Certificate;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import javax.security.auth.x500.X500Principal;
import javax.servlet.http.HttpServletRequest;
import java.security.cert.X509Certificate;
import java.util.*;
import org.apache.commons.codec.binary.Base64;
 
public class SSLMutualAuthProvider implements AuthProvider{
    private static AdobeLogger logger = AdobeLogger.getAdobeLogger(SSLMutualAuthProvider.class);
 
    public AuthResponse authenticate(Map credentials, List passedAuthConfigs) {
 
        ...
        //Extract the client certificate from the request
        X509Certificate[] certs = extractCertificate(request);
        if(certs == null || certs.length == 0){
            return null;
        }
 
        AuthResponse ar = new AuthResponseImpl();
    ar.setAuthStatus(AuthResponse.AUTH_SUCCESS);
        ar.setDomain(authConfigs.get(0).getDomainName()); //Assuming config is single domain and using its domainName
 
        Map<String,String> oidMap = new HashMap<String, String>();
        String name = certs[0].getSubjectX500Principal().getName();
        logger.info("Got Subject DN as "+name);
        LdapName ldapName = null;
        try{
            ldapName = new LdapName(name);
        }catch(InvalidNameException e){
            throw new RuntimeException(e);
        }
 
    //In this sample the CN of the Subject Name maps to user's loginid, however this can be changed to meet your requirements.
        for(Rdn rdn : ldapName.getRdns()){
            String type = rdn.getType();
            if("CN".equals(type)){
                String cn = (String) rdn.getValue();
                ar.setUsername(cn);
                return ar;
            }
        }
        return null;
    }
 
   private X509Certificate[] extractCertificate(HttpServletRequest request) {
        X509Certificate[] certs =  (X509Certificate[]) request.getAttribute("javax.servlet.request.X509Certificate");
        if(certs != null){
            logger.debug("No certificate found in the HTTP Header javax.servlet.request.X509Certificate");
            return certs;
        }
 
        //Check for certificate value passed in HTTP header which is the case with proxy
        String certDataInPemFormat = request.getHeader("SSL_CLIENT_CERT");
        if(certDataInPemFormat == null){
            logger.debug("No certificate found in the HTTP Header SSL_CLIENT_CERT ");
            return null;
        }
        String PREFIX = "-----BEGIN CERTIFICATE----- ";
        String SUFFIX = " -----END CERTIFICATE-----";
        int dataLength =  certDataInPemFormat.length();
        String encodedData = certDataInPemFormat.substring(PREFIX.length(), dataLength - SUFFIX.length() - 1);
 
        Certificate c = null;
        try {
            byte[] certData = Base64.decodeBase64(encodedData.getBytes("utf-8"));
            //Certificate factory would take care of removing the prefixes and suffixes
            CertificateFactory cf = CertificateFactory.getInstance("X.509");
            c = cf.generateCertificate(new ByteArrayInputStream(certData));
        } catch (CertificateException e) {
            throw new RuntimeException(e);
        } catch (UnsupportedEncodingException e) {
            throw new RuntimeException(e);
        }
        return new X509Certificate[]{(X509Certificate) c};
    }
 
}

Este proveedor de autenticación se debe incluir en un dominio híbrido de LiveCycle. Los usuarios de ese dominio estarían entonces habilitados para la autenticación mutua.

Después de crear el DSC SPI del proveedor de autenticación, siga los pasos que se describen a continuación para implementar y configurar en el servidor de LiveCycle:

  1. Implemente e inicie el DSC SPI del proveedor de autenticación utilizando Workbench.

  2. Vaya a Inicio > Configuración > Administración de usuarios > Administración de dominios.

  3. Haga clic en Nuevo dominio híbrido.

  4. Añada la autenticación.

    Seleccione Personalizado en la lista de proveedores de autenticación.

  5. En la lista de SPI personalizados que se muestra, seleccione el nombre del SPI que se implementó en el paso 1.

  6. Haga clic en Guardar.

Para configurar la gestión de derechos, siga los pasos que se describen a continuación:

  1. En la interfaz de usuario de administrador, vaya a: Servicios > Gestión de derechos > Configuración.

  2. Compruebe y confirme que la URL base coincide con el certificado del servidor.

  3. Habilite la Autenticación ampliada.

    Nota:

    En el caso de la extensión de gestión de derechos para Microsoft Office, la autenticación ampliada no se aplica.

  4. Haga clic en Guardar.

  5. Reinicie el servidor de LiveCycle.

Nota:

Esta autenticación SPI también se puede ser usar para crear el usuario Just in time.

Cambios en el elemento web de SharePoint Connector

Para que el elemento web pueda acceder a un servidor de LiveCycle configurado con SSL, es necesario realizar los siguientes cambios en el archivo web.config del servidor SharePoint:

Para permitir la autenticación mutua, sustituya lo siguiente:

<system.serviceModel>
<bindings>
...
</bindings>
<client>
...
</client>
</system.serviceModel>
<system.serviceModel> <bindings> ... </bindings> <client> ... </client> </system.serviceModel>
<system.serviceModel>
    <bindings>
      ...
    </bindings>
    <client>
      ...
    </client>
  </system.serviceModel>

Con:

<system.serviceModel>
<behaviors>
<endpointBehaviors>
<behavior name="MutualSslBehavior">
<clientCredentials>
<clientCertificate storeName="My" storeLocation="LocalMachine" x509FindType="FindBySubjectName" findValue="chetanm" />
</clientCredentials>
</behavior>
</endpointBehaviors>
</behaviors>
<bindings>
<basicHttpBinding>
<binding name="ReaderExtensionsServiceSoapBinding" closeTimeout="00:01:00"
openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:05:00"
allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
maxBufferSize="2147483647" maxBufferPoolSize="524288" maxReceivedMessageSize="2147483647"
messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
useDefaultWebProxy="true">
<readerQuotas maxDepth="32" maxStringContentLength="81920000"
maxArrayLength="16384000" maxBytesPerRead="40960000" maxNameTableCharCount="16384" />
<security mode="TransportCredentialOnly">
<transport clientCredentialType="Certificate" proxyCredentialType="None"
realm="" />
</security>
</binding>
<binding name="TaskManagerServiceSoapBinding" closeTimeout="00:01:00"
openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:05:00"
allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
maxBufferSize="2147483647" maxBufferPoolSize="524288" maxReceivedMessageSize="2147483647"
messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
useDefaultWebProxy="true">
<readerQuotas maxDepth="32" maxStringContentLength="81920000" maxArrayLength="16384000"
maxBytesPerRead="40960000" maxNameTableCharCount="16384" />
<security mode="TransportCredentialOnly">
<transport clientCredentialType="Certificate" proxyCredentialType="None"
realm="" />
</security>
</binding>
<binding name="TaskManagerQueryServiceSoapBinding" closeTimeout="00:01:00"
openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:05:00"
allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
maxBufferSize="2147483647" maxBufferPoolSize="524288" maxReceivedMessageSize="2147483647"
messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
useDefaultWebProxy="true">
<readerQuotas maxDepth="32" maxStringContentLength="81920000" maxArrayLength="16384000"
maxBytesPerRead="40960000" maxNameTableCharCount="16384" />
<security mode="TransportCredentialOnly">
<transport clientCredentialType="Certificate" proxyCredentialType="None"
realm="" />
</security>
</binding>
<binding name="FormsServiceSoapBinding" closeTimeout="00:01:00"
openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:05:00"
allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
maxBufferSize="2147483647" maxBufferPoolSize="524288" maxReceivedMessageSize="2147483647"
messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
useDefaultWebProxy="true">
<readerQuotas maxDepth="32" maxStringContentLength="81920000"
maxArrayLength="16384000" maxBytesPerRead="40960000" maxNameTableCharCount="16384" />
<security mode="TransportCredentialOnly">
<transport clientCredentialType="Certificate" proxyCredentialType="None"
realm="" />
</security>
</binding>
<binding name="DirectoryManagerServiceSoapBinding" closeTimeout="00:01:00"
openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:05:00"
allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
maxBufferSize="2147483647" maxBufferPoolSize="524288" maxReceivedMessageSize="2147483647"
messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
useDefaultWebProxy="true">
<readerQuotas maxDepth="32" maxStringContentLength="81920000"
maxArrayLength="16384000" maxBytesPerRead="40960000" maxNameTableCharCount="16384" />
<security mode="TransportCredentialOnly">
<transport clientCredentialType="Certificate" proxyCredentialType="None"
realm="" />
</security>
</binding>
<binding name="MSSharePointConfigServiceSoapBinding" closeTimeout="00:01:00"
openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:05:00"
allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
maxBufferSize="2147483647" maxBufferPoolSize="524288" maxReceivedMessageSize="2147483647"
messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
useDefaultWebProxy="true">
<readerQuotas maxDepth="32" maxStringContentLength="81920000"
maxArrayLength="16384000" maxBytesPerRead="40960000" maxNameTableCharCount="16384" />
<security mode="TransportCredentialOnly">
<transport clientCredentialType="Certificate" proxyCredentialType="None"
realm="" />
</security>
</binding>
</basicHttpBinding>
</bindings>
<client>
<endpoint address="https://<AdobeLiveCycleServer>:<port>/soap/services/ReaderExtensionsService"
binding="basicHttpBinding" bindingConfiguration="ReaderExtensionsServiceSoapBinding" behaviorConfiguration="MutualSslBehavior"
contract="LiveCycleReaderExtensions.ReaderExtensionsService"
name="ReaderExtensionsService" />
<endpoint address="https://<AdobeLiveCycleServer>:<port>/soap/services/FormsService"
binding="basicHttpBinding" bindingConfiguration="FormsServiceSoapBinding" behaviorConfiguration="MutualSslBehavior"
contract="FormsService.FormsService" name="FormsService" />
<endpoint address="https://<AdobeLiveCycleServer>:<port>/soap/services/TaskManagerService"
binding="basicHttpBinding" bindingConfiguration="TaskManagerServiceSoapBinding" behaviorConfiguration="MutualSslBehavior"
contract="TaskManagerService.TaskManagerService" name="TaskManagerService" />
<endpoint address="https://<AdobeLiveCycleServer>:<port>/soap/services/TaskManagerQueryService"
binding="basicHttpBinding" bindingConfiguration="TaskManagerQueryServiceSoapBinding" behaviorConfiguration="MutualSslBehavior"
contract="TaskManagerQueryService.TaskManagerQueryService" name="TaskManagerQueryService" />
<endpoint address="https://<alfresco-server>:<port>/soap/services/DirectoryManagerService"
binding="basicHttpBinding" bindingConfiguration="DirectoryManagerServiceSoapBinding" behaviorConfiguration="MutualSslBehavior"
contract="DirectoryManagerService.DirectoryManagerService" name="DirectoryManagerService" />
<endpoint address="https://<AdobeLiveCycleServer>:<port>/soap/services/MSSharePointConfigService"
binding="basicHttpBinding" bindingConfiguration="MSSharePointConfigServiceSoapBinding"
contract="MSSharePointConfigService.MSSharePointConfigService" behaviorConfiguration="MutualSslBehavior"
name="MSSharePointConfigService" />
</client>
</system.serviceModel>
The certificate specification sections needs to be changed according to the certificate and its location of installation.
<clientCertificate storeName="My" storeLocation="LocalMachine" x509FindType="FindBySubjectName" findValue="<subject-name>" />
<system.serviceModel> <behaviors> <endpointBehaviors> <behavior name="MutualSslBehavior"> <clientCredentials> <clientCertificate storeName="My" storeLocation="LocalMachine" x509FindType="FindBySubjectName" findValue="chetanm" /> </clientCredentials> </behavior> </endpointBehaviors> </behaviors> <bindings> <basicHttpBinding> <binding name="ReaderExtensionsServiceSoapBinding" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:05:00" allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard" maxBufferSize="2147483647" maxBufferPoolSize="524288" maxReceivedMessageSize="2147483647" messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered" useDefaultWebProxy="true"> <readerQuotas maxDepth="32" maxStringContentLength="81920000" maxArrayLength="16384000" maxBytesPerRead="40960000" maxNameTableCharCount="16384" /> <security mode="TransportCredentialOnly"> <transport clientCredentialType="Certificate" proxyCredentialType="None" realm="" /> </security> </binding> <binding name="TaskManagerServiceSoapBinding" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:05:00" allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard" maxBufferSize="2147483647" maxBufferPoolSize="524288" maxReceivedMessageSize="2147483647" messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered" useDefaultWebProxy="true"> <readerQuotas maxDepth="32" maxStringContentLength="81920000" maxArrayLength="16384000" maxBytesPerRead="40960000" maxNameTableCharCount="16384" /> <security mode="TransportCredentialOnly"> <transport clientCredentialType="Certificate" proxyCredentialType="None" realm="" /> </security> </binding> <binding name="TaskManagerQueryServiceSoapBinding" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:05:00" allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard" maxBufferSize="2147483647" maxBufferPoolSize="524288" maxReceivedMessageSize="2147483647" messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered" useDefaultWebProxy="true"> <readerQuotas maxDepth="32" maxStringContentLength="81920000" maxArrayLength="16384000" maxBytesPerRead="40960000" maxNameTableCharCount="16384" /> <security mode="TransportCredentialOnly"> <transport clientCredentialType="Certificate" proxyCredentialType="None" realm="" /> </security> </binding> <binding name="FormsServiceSoapBinding" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:05:00" allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard" maxBufferSize="2147483647" maxBufferPoolSize="524288" maxReceivedMessageSize="2147483647" messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered" useDefaultWebProxy="true"> <readerQuotas maxDepth="32" maxStringContentLength="81920000" maxArrayLength="16384000" maxBytesPerRead="40960000" maxNameTableCharCount="16384" /> <security mode="TransportCredentialOnly"> <transport clientCredentialType="Certificate" proxyCredentialType="None" realm="" /> </security> </binding> <binding name="DirectoryManagerServiceSoapBinding" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:05:00" allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard" maxBufferSize="2147483647" maxBufferPoolSize="524288" maxReceivedMessageSize="2147483647" messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered" useDefaultWebProxy="true"> <readerQuotas maxDepth="32" maxStringContentLength="81920000" maxArrayLength="16384000" maxBytesPerRead="40960000" maxNameTableCharCount="16384" /> <security mode="TransportCredentialOnly"> <transport clientCredentialType="Certificate" proxyCredentialType="None" realm="" /> </security> </binding> <binding name="MSSharePointConfigServiceSoapBinding" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:05:00" allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard" maxBufferSize="2147483647" maxBufferPoolSize="524288" maxReceivedMessageSize="2147483647" messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered" useDefaultWebProxy="true"> <readerQuotas maxDepth="32" maxStringContentLength="81920000" maxArrayLength="16384000" maxBytesPerRead="40960000" maxNameTableCharCount="16384" /> <security mode="TransportCredentialOnly"> <transport clientCredentialType="Certificate" proxyCredentialType="None" realm="" /> </security> </binding> </basicHttpBinding> </bindings> <client> <endpoint address="https://<AdobeLiveCycleServer>:<port>/soap/services/ReaderExtensionsService" binding="basicHttpBinding" bindingConfiguration="ReaderExtensionsServiceSoapBinding" behaviorConfiguration="MutualSslBehavior" contract="LiveCycleReaderExtensions.ReaderExtensionsService" name="ReaderExtensionsService" /> <endpoint address="https://<AdobeLiveCycleServer>:<port>/soap/services/FormsService" binding="basicHttpBinding" bindingConfiguration="FormsServiceSoapBinding" behaviorConfiguration="MutualSslBehavior" contract="FormsService.FormsService" name="FormsService" /> <endpoint address="https://<AdobeLiveCycleServer>:<port>/soap/services/TaskManagerService" binding="basicHttpBinding" bindingConfiguration="TaskManagerServiceSoapBinding" behaviorConfiguration="MutualSslBehavior" contract="TaskManagerService.TaskManagerService" name="TaskManagerService" /> <endpoint address="https://<AdobeLiveCycleServer>:<port>/soap/services/TaskManagerQueryService" binding="basicHttpBinding" bindingConfiguration="TaskManagerQueryServiceSoapBinding" behaviorConfiguration="MutualSslBehavior" contract="TaskManagerQueryService.TaskManagerQueryService" name="TaskManagerQueryService" /> <endpoint address="https://<alfresco-server>:<port>/soap/services/DirectoryManagerService" binding="basicHttpBinding" bindingConfiguration="DirectoryManagerServiceSoapBinding" behaviorConfiguration="MutualSslBehavior" contract="DirectoryManagerService.DirectoryManagerService" name="DirectoryManagerService" /> <endpoint address="https://<AdobeLiveCycleServer>:<port>/soap/services/MSSharePointConfigService" binding="basicHttpBinding" bindingConfiguration="MSSharePointConfigServiceSoapBinding" contract="MSSharePointConfigService.MSSharePointConfigService" behaviorConfiguration="MutualSslBehavior" name="MSSharePointConfigService" /> </client> </system.serviceModel> The certificate specification sections needs to be changed according to the certificate and its location of installation. <clientCertificate storeName="My" storeLocation="LocalMachine" x509FindType="FindBySubjectName" findValue="<subject-name>" />
<system.serviceModel>
    <behaviors>
        <endpointBehaviors>
          <behavior name="MutualSslBehavior">
            <clientCredentials>
              <clientCertificate storeName="My" storeLocation="LocalMachine" x509FindType="FindBySubjectName" findValue="chetanm" />
            </clientCredentials>
          </behavior>
        </endpointBehaviors>
      </behaviors>
    <bindings>
      <basicHttpBinding>
        <binding name="ReaderExtensionsServiceSoapBinding" closeTimeout="00:01:00"
          openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:05:00"
          allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
          maxBufferSize="2147483647" maxBufferPoolSize="524288" maxReceivedMessageSize="2147483647"
          messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
          useDefaultWebProxy="true">
          <readerQuotas maxDepth="32" maxStringContentLength="81920000"
            maxArrayLength="16384000" maxBytesPerRead="40960000" maxNameTableCharCount="16384" />
          <security mode="TransportCredentialOnly">
            <transport clientCredentialType="Certificate" proxyCredentialType="None"
              realm="" />
          </security>
        </binding>
        <binding name="TaskManagerServiceSoapBinding" closeTimeout="00:01:00"
            openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:05:00"
            allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
            maxBufferSize="2147483647" maxBufferPoolSize="524288" maxReceivedMessageSize="2147483647"
            messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
            useDefaultWebProxy="true">
          <readerQuotas maxDepth="32" maxStringContentLength="81920000" maxArrayLength="16384000"
              maxBytesPerRead="40960000" maxNameTableCharCount="16384" />
          <security mode="TransportCredentialOnly">
            <transport clientCredentialType="Certificate" proxyCredentialType="None"
              realm="" />
          </security>
        </binding>
        <binding name="TaskManagerQueryServiceSoapBinding" closeTimeout="00:01:00"
            openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:05:00"
            allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
            maxBufferSize="2147483647" maxBufferPoolSize="524288" maxReceivedMessageSize="2147483647"
            messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
            useDefaultWebProxy="true">
          <readerQuotas maxDepth="32" maxStringContentLength="81920000" maxArrayLength="16384000"
              maxBytesPerRead="40960000" maxNameTableCharCount="16384" />
          <security mode="TransportCredentialOnly">
            <transport clientCredentialType="Certificate" proxyCredentialType="None"
              realm="" />
          </security>
        </binding>
        <binding name="FormsServiceSoapBinding" closeTimeout="00:01:00"
          openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:05:00"
          allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
          maxBufferSize="2147483647" maxBufferPoolSize="524288" maxReceivedMessageSize="2147483647"
          messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
          useDefaultWebProxy="true">
          <readerQuotas maxDepth="32" maxStringContentLength="81920000"
            maxArrayLength="16384000" maxBytesPerRead="40960000" maxNameTableCharCount="16384" />
          <security mode="TransportCredentialOnly">
            <transport clientCredentialType="Certificate" proxyCredentialType="None"
              realm="" />
          </security>
        </binding>
        <binding name="DirectoryManagerServiceSoapBinding" closeTimeout="00:01:00"
          openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:05:00"
          allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
          maxBufferSize="2147483647" maxBufferPoolSize="524288" maxReceivedMessageSize="2147483647"
          messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
          useDefaultWebProxy="true">
          <readerQuotas maxDepth="32" maxStringContentLength="81920000"
            maxArrayLength="16384000" maxBytesPerRead="40960000" maxNameTableCharCount="16384" />
          <security mode="TransportCredentialOnly">
            <transport clientCredentialType="Certificate" proxyCredentialType="None"
              realm="" />
          </security>
        </binding>
        <binding name="MSSharePointConfigServiceSoapBinding" closeTimeout="00:01:00"
        openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:05:00"
         allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
         maxBufferSize="2147483647" maxBufferPoolSize="524288" maxReceivedMessageSize="2147483647"
         messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
         useDefaultWebProxy="true">
          <readerQuotas maxDepth="32" maxStringContentLength="81920000"
            maxArrayLength="16384000" maxBytesPerRead="40960000" maxNameTableCharCount="16384" />
          <security mode="TransportCredentialOnly">
            <transport clientCredentialType="Certificate" proxyCredentialType="None"
              realm="" />
          </security>
        </binding>
      </basicHttpBinding>
    </bindings>
    <client>
      <endpoint address="https://<AdobeLiveCycleServer>:<port>/soap/services/ReaderExtensionsService"
        binding="basicHttpBinding" bindingConfiguration="ReaderExtensionsServiceSoapBinding" behaviorConfiguration="MutualSslBehavior"
        contract="LiveCycleReaderExtensions.ReaderExtensionsService"
        name="ReaderExtensionsService" />
      <endpoint address="https://<AdobeLiveCycleServer>:<port>/soap/services/FormsService"
        binding="basicHttpBinding" bindingConfiguration="FormsServiceSoapBinding" behaviorConfiguration="MutualSslBehavior"
        contract="FormsService.FormsService" name="FormsService" />
      <endpoint address="https://<AdobeLiveCycleServer>:<port>/soap/services/TaskManagerService"
        binding="basicHttpBinding" bindingConfiguration="TaskManagerServiceSoapBinding" behaviorConfiguration="MutualSslBehavior"
        contract="TaskManagerService.TaskManagerService" name="TaskManagerService" />
      <endpoint address="https://<AdobeLiveCycleServer>:<port>/soap/services/TaskManagerQueryService"
        binding="basicHttpBinding" bindingConfiguration="TaskManagerQueryServiceSoapBinding" behaviorConfiguration="MutualSslBehavior"
        contract="TaskManagerQueryService.TaskManagerQueryService" name="TaskManagerQueryService" />
      <endpoint address="https://<alfresco-server>:<port>/soap/services/DirectoryManagerService"
        binding="basicHttpBinding" bindingConfiguration="DirectoryManagerServiceSoapBinding" behaviorConfiguration="MutualSslBehavior"
        contract="DirectoryManagerService.DirectoryManagerService" name="DirectoryManagerService" />
      <endpoint address="https://<AdobeLiveCycleServer>:<port>/soap/services/MSSharePointConfigService"
        binding="basicHttpBinding" bindingConfiguration="MSSharePointConfigServiceSoapBinding"
        contract="MSSharePointConfigService.MSSharePointConfigService" behaviorConfiguration="MutualSslBehavior"
        name="MSSharePointConfigService" />
    </client>
  </system.serviceModel>
The certificate specification sections needs to be changed according to the certificate and its location of installation.
<clientCertificate storeName="My" storeLocation="LocalMachine" x509FindType="FindBySubjectName" findValue="<subject-name>" />

Según sea necesario para su entorno, siga los recursos e instrucciones que aparecen a continuación.

Recurso

Instructions

Instalación de certificados importados en un servidor web

En la sección Configuración del sitio de SharePoint de la página de configuración de LiveCycle, especifique <subject-name> (el nombre del sujeto en el certificado) como Nombre de usuario y active la casilla de verificación Habilitar Https.

Nota: El elemento web asume que solo hay un certificado con un nombre de sujeto específico.

Instrucciones de instalación para el elemento web del conector de SharePoint

Después de instalar el elemento web, haga los cambios en web.config (como se describió anteriormente).

Nota: Si se produce un error de Acceso denegado durante la activación, ejecute el script PowerShell disponible en http://support.microsoft.com/es-es/kb/2564009.

Configuración del conector para Microsoft SharePoint

En caso de que el elemento web esté previamente instalado, primero, desinstálelo usando el script disponible aquí.

Cambios en PDF iFilter

Para obtener más detalles, consulte http://help.adobe.com/en_US/livecycle/11.0/sharepoint_iFilter_RM_docs.pdf.

Nota:

Los certificados autofirmados no son compatibles. Utilice certificados emitidos por CA para la autenticación mutua.

Cambios en el acceso a Workspace HTML mediante la autenticación CAC

Para que sus usuarios puedan iniciar sesión en Workspace HTML con certificados de tarjetas de acceso común (CAC), debe realizar el siguiente cambio en el servidor: 

  1. Vaya a http://[server]:[port]/lc/libs/granite/security/content/useradmin.html e inicie sesión como administrador.

  2. Pulse Administrador. Se abre la página Edición de la configuración de usuario.

  3. Pulse Crear trustStore y establezca una contraseña de acceso para trustStore. Para obtener más información, consulte Añadir el certificado IdP a TrustStore de AEM.

  4. Pulse Crear keyStore y establezca una contraseña para keyStore. Para obtener más información, consulte Añadir la clave del proveedor de servicios y la cadena de certificados al almacén de claves de AEM.

  5. Cierre sesión e intente acceder al espacio de trabajo con el puerto :8443. Podrá acceder al espacio de trabajo con la tarjeta CAC.

Obtén ayuda de forma más rápida y sencilla

¿Nuevo usuario?

Vínculos rápidos

Ver todos los planes Administrar los planes
Ver vínculos rápidos
Ocultar vínculos rápidos

Avisos legales    |    Política de privacidad en línea