Web Services, SSL, Windows Authentication, ColdFusion MX+

So you're working toward creating a SOA (Service-Oriented Architecture) in your organization and you've picked ColdFusion to create various web services at in support of it at a given tier (i.e. internal/external). It's a beautiful thing as ColdFusion makes it easy to create them.

is entry is not going to start with the basics on creating a web service but will address the possible challenges associated with implementing one with CF in regard to SSL and Windows Authentication. Now that you have created a web service and tested it you may wish to encrypt its contents with SSL and, if running on IIS, integrate Windows Authentication to force the user/calling application to pass login credentials to a given domain.

Where to start? Assuming you are doing all this on a development machine with no registered certificates 8-), we need to start with the creation of a Certificate for the implementation of SSL and then registering it within CFs keystore. J2EE requires that certificates be registered within their service as there are standards that they address in validating certificates. One note here is that one should use an open/universal, non-Microsoft based certificate generation tool as there is an issue with Java's implementation of digesting/validating Microsoft generated certificates for storage. The tool of choice is IBM's Keyman. This tool, with a bit of practice, will have you generating keys and certificates that you can register in IIS.

To work with the tool you must first generate a request in IIS to pass to Keyman. To generate a request go to the properties of you web site in IIS and select the directory security tab. From there click on the server certificate button. You will then be prompted several times, be sure to select "create a new certificate" and change attributes such as name when necessary. Don't forget to make a note as to where the request text file was generated. Next open Keyman select new Token. On development machines I use default settings. Once the token has been created you must create a key. Go to Actions in the menu and select generate key, accept the default selections. Now that the key has been generated, go to actions once more and select create certificate. Select sign a PKCS#10 request and browse to where you saved you cert. request from IIS or select load from clipboard if you happened to copy the request files text. Next save the generated certificate. Lastly, open IIS and click on server certificate again. Select Process the pending request and install the certificate. Browse to the certificate and install. You will now be able to access the site over https.

Now to turn on domain authentication go to Directory Security tab again in IIS and select edit button. Select Basic and just the default domain and realm if necessary. I usually leave them blank and specify login parameters with ColdFusion. So we are secure on the server now and we must register the generated certificate in a keystore for ColdFusion to be able to access the files within the site.

You can use the keytools command line application that installs with CF to support this or if you would like, download the GUI app. (see link below). It can save you a bit of time. A good reference for keytool command and registering certificates within a keystore can be found here and here. This should get you up to speed and when I get more time I will provide screenshots.

I have a copy of KeyTool GUI 1.7 which is under GNU Public License and free to distribute and DOWNLOAD. Point this at your ColdFusion keystore and you can import (Look here if not running as J2EE D:\CFusionMX7\runtime\jre\lib\security).