Forum Discussion

daboochmeister's avatar
daboochmeister
Icon for Cirrus rankCirrus
Jun 08, 2015

APM OAM Simple transport security mode, to v11.1.2 OAM server

Am having trouble configuring an OAM AccessGate in "Simple" transport security mode. It works correctly when "Open" transport mode is used. And, after reconfiguring the accessgate on the OAM server to "Simple" mode, that accessgate works correctly when we configure a webgate on an Oracle HTTP Server (OHS) instance. But that same "Simple" mode accessgate doesn't work on the F5.

 

Our F5 is running 11.5.2 plain; the OAM server is at v11.1.2.

 

Is there anyone with a comparable configuration, operating successfully in "Simple" transport security mode? If so, can you share if there were any difficulties establishing the configuration, and if you need to do anything not described in the F5 integration guide for OAM? I have a support case open, but we haven't succeeded in fixing it yet, and am hoping for feedback from someone successful in this config.

 

One specific question - the OAM 11.1 integration guide for configuring a webgate on an OHS server has you copying the certificate/key, password.xml and ObAccessClient.xml files from the OAM server onto the OHS server. The F5 APM module, on the other hand, seems to always generate its own certificate for the Simple mode. The F5 guide has a similar copying step for Cert mode, but not Simple mode. I'm wondering if possibly Simple mode changed with OAM v11, and now we need to do that copying step on the F5 as well (e.g., maybe both side's certs need to be from the same Oracle built-in CA). So far, however, copying them into place in the /config/aaa/oam/Common tree (overlaying the F5-generated files) and restarting eam hasn't seemed to have any impact. Did anyone find they had to do such a copy-files-from-the-OAM-server for Simple mode, and if so, do you have a procedure for doing so?

 

ty!

 

application delivery
BIG-IP Access Policy Manager (APM)
design
LTM
oam
oracle
security
  • daboochmeister's avatar
    daboochmeister
    Icon for Cirrus rankCirrus
    Jun 09, 2015

    Ahh! We found the answer! Our OAM administrator found a reference to an issue described as follows:

    WEBGATE: SIMPLE MODE HANDSHAKE FAILS WITH JDK 6U28 AND LATER OAM 11g (DocID 1513143.1)

With security fixes in latest JDK updates, 11g and 10g Webgate Simple mode handshake fails with 11g Server.
Webgate simple mode handshake expects continuous stream of data on the socket during simple mode handshake.
With the security fixes in JDK, Server sends the handshake messages split as "1 byte + rest of the message"
Bug: 13387353 ­ WEBGATE: SIMPLE MODE HANDSHAKE FAILS WITH JDK 6U28 AND LATER

    The solution is to use Open or Cert mode, or (setting jsse.enableCBCProtection=false is what worked for us):

    Solution
1. Apply patch for Bug 13387353 ­ WEBGATE: SIMPLE MODE HANDSHAKE FAILS WITH JDK 6U28 AND LATER
2. If one does not exist for specific OS/WG/Webserver combination request OOB
Workaround
1. Set the following extra java property in setDomainEnv.sh under domain_home/bin directory:
EXTRA_JAVA_PROPERTIES="­Djsse.enableCBCProtection=false
${EXTRA_JAVA_PROPERTIES}"
export EXTRA_JAVA_PROPERTIES
    • daboochmeister's avatar
      daboochmeister
      Icon for Cirrus rankCirrus
      Jun 14, 2015
      Does anyone know how I can mark this question as "Answered"? It's not allowing me to mark my own response as the correct answer ...