Overview

The OSGi Device Client Authorization Verifier bundle with JAR file osgidm.core.auth.verifier.jar (placed in <RM_HOME>/packages/osgidm) provides the server-side support for verifying OSGi devices client certificate or basic authentication. It should be checked if installed on the Remote Manager (RM). All system properties activating the verifiers, are set on the Remote Manager in the default.prs file.

In case of clustered RM, the properties used to activate a predefined authentication mechanism should be set on all of the backend hosts.

Basic Authentication Verifier

The RM can be configured to require username/password based authentication and check the provided client credentials. To activate the Basic Authentication verifier, the following system property should be set to true on the Remote Manager:

osgidm.client.basic.auth.verifier=true


Besides the backend bundle, the Basic User authentication needs a client side implementation, providing username and password to be verified in the RM. For details on how to provide your own client side implementation see Custom Authentication Plugin.

Client Certificate Verifier

The RM can be configured to verify that the client certificate Common Name is equal to the device identifier. To activate the client certificate verifier, the following system property should be set to true on the Remote Manager:

osgidm.client.certificate.verifier=true


The following system properties should be set on the Remote Manager depending on the transport:

  • for HTTP - mprm.auth.verifier.cert.header=cert (default)
  • for WSS - mprm.ws.cert.client-cn=cert (default)

The above-mentioned are required for successful verification as they contain the name of the header where the certificate is read from.
On the gateway side, no implementation is needed. The client certificate is acquired from the connection.

Only one verifier can be used at a time! In case the two verifiers are activated, the Client Certificate Verifier has priority over the Basic Authentication Verifier.