Special Considerations

Configuration Considerations

Consider the following when configuring Sterling External Authentication Server:

• The System Settings dialog box allows you to configure the listeners, SSL keystore, and trusted certificates and uses a separate object for each tab. When you click OK, the objects are updated in the following order: Listeners, SSL Keystore, and Trusted Certificates.
• The product uses strong, but limited, cryptography. To use stronger encryption, replace the default jurisdiction policy files with the Unlimited Strength Jurisdiction Policy Files 6.0, available from the JCE provider. See Jurisdiction Policy File Use for more information.

Jurisdiction Policy File Use

TLS and SSL protocols are implemented, both server and GUI components, using the standard Java 6.0 API, Java Secure Socket Extension (JSSE) and default provider package. JSSE, in turn, utilizes the standard Java 6.0 API, Java Cryptography Extension (JCE) to implement the underlying crypto algorithms.

The cipher suites available for use in SSL and TLS connections are determined by the following JCE jurisdiction policy files:

• install_dir/jre/lib/security/local_policy.jar
• install_dir/jre/lib/security/US_export_policy.jar

where install_dir is the location of the installation.

The jurisdiction policy files shipped with Sterling External Authentication Server enable strong, but limited, cryptography. If you need to use stronger encryption, US customers and those in other eligible countries can replace the default jurisdiction policy files with the Unlimited Strength Jurisdiction Policy Files 6.0, available from the JCE provider.

To replace the default jurisdiction policy files:

1. Go to the main Security page for IBM®'s Java 6 at http://www.ibm.com/developerworks/java/jdk/security/60.
2. Scroll down the page and click the IBM SDK Policy files link.
3. Provide your IBM ID.
4. Copy the unlimited strength jurisdiction policy files to the following locations:
   • install_dir/jre/lib/security/local_policy.jar
   • install_dir/jre/lib/security/US_export_policy.jar

     where install_dir is the location of the product

Following are the cipher suites available for use by default and by the unlimited jurisdiction policy files: