Security Options V3

There are 2 main security options to choose from depending on your infrastructure:

• Mutual Authentication
• Password

Depending on your choice you will need to consume a specific WSDL and call a specific Web Service.

Authentication is performed with the combination of accountId and password fields.  However, mutual SSL authentication can be used if preferred.  To use mutual SSL authentication, please contact us.  When using mutual SSL authentication, the customer must provide a client certificate as part of the handshake process.  The client certificate must be signed by our private Certificate Authority (CA).  If an external CA is used, Edentiti needs to know which one so that the CA certificate can be imported into the greenID truststore.

When mutual authentication is being used, a different endpoint must be used.  Details are in the Web Service Endpoints section.

Mutual Authentication

In a normal HTTPS connection (over which the web services outlined in this document are served) the client is presented with a certificate by the server. The client then decides whether or not to trust the server based on who signed the certificate. With Mutual Authentication the client also provides a signed certificate which the server then validates before a connection can take place.

If you choose to use Mutual Authentication then you provide greenID a Certificate Signing Request (CSR) which greenID will sign with its private CA certificate.

As part of your User Acceptance Testing, it's important you allow time to test that you can connect over Mutual Authentication in the greenID production environment. Your greenID system will be migrated to production approximately 2 weeks after final sign-off of your greenID configuration, so this timeframe plus a testing period should be factored into any project planning.

Note that the WSDL's for the MSSL web services also list a password argument to all the calls, however this is is ignored when the MSSL endpoints are used and is present only maintain a consistent interface for all our web service endpoints.

Setup

We use the following process to configure mutual authentication for test and then for production.
There are two options that you can choose from depending upon your needs and current setup.  Our preferred option is for us to generate and sign a certificate using the greenID private certificate authority.

If you wish to use a client certificate signed by the greenID private certificate authority:

1. Send us a certificate signing request (CSR) for your application infrastructure.
2. We will generate a certificate using the CSR, pass that certificate to you and then add that certificate to our trusted list of certificates for your test or production account.
3. You need to add that certificate to your application server as a client certificate.
4. To test the trust has been setup, retrieve the appropriate MSSL WSDL from the server that has the certificate installed on it.

Password

Even without Mutual Authentication the web service calls are conducted over HTTPS, ensuring that the contents are safe from observers. So a second option is to provide a password with the web service calls.

To use password authentication you will need to provide a password with every web service call you make.  The password will be provided to you with your accountId.

If you choose password authentication then every web service call outlined in this document will also require a password with each request.