Procedure 7.3. Enable SIP Application Security in JBoss Application Server

1. Add Security Policy to Server

   1. Open a terminal and navigate to the conf directory:

      home]$ cd server/default/conf/

   2. Open login-config.xml (using your preferred editor) and append the security policy to the file:

      
      
      
      <application-policy name="sip-servlets">
      
      <authentication>
      
        <login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule" 
      
          flag = "required">
      
        <module-option name="usersProperties">props/sip-servlets-
      
          users.properties</module-option>
      
        <module-option name="rolesProperties">props/sip-servlets-
      
          roles.properties</module-option>
      
        <module-option name="hashAlgorithm">MD5</module-option>
      
        <module-option name="hashEncoding">rfc2617</module-option>
      
        <module-option name="hashUserPassword">false</module-option>
      
        <module-option name="hashStorePassword">true</module-option>
      
        <module-option name="passwordIsA1Hash">true</module-option>
      
        <module-option name="storeDigestCallback">
      
          org.jboss.security.auth.spi.RFC2617Digest</module-option>
      
        </login-module>
      
      </authentication>
      
      </application-policy>
      
        
      
      

2. Update SIP Server User Properties File

   1. Open a terminal and navigate to the /props directory:

      home]$ cd server/default/props/

   2. Open sip-servlets-users.properties and append the user lines to the file:

       
        # A sample users.properties file, this line creates user "admin" with 
        # password "admin" for "sip-servlets-realm"
        admin=<A1_cryptographic_string>
        

   3. To create <A1_cryptographic_string>, execute the following command in a terminal:

      home]$ java -cp ../server/default/lib/jbosssx.jar

   4. Copy the A1 hash, and paste it into the admin parameter in the previous step.

   5. Save and close sip-servlets-users.properties.

3. Update SIP Server Roles File

   1. Open a terminal and navigate to the /props directory:

      home]$ cd server/default/props/

   2. Open sip-servlets-roles.properties (using your preferred editor) and append the following information to the file:

       
      # A sample roles.properties file for use with some roles
      # Each line in this file assigns roles to the users defined in 
      # sip-servlets-users.properties
      admin=caller,role1,role2,..
                  

4. Add the Security Domain to the SIP Application

   1. Open the jboss-web.xml file for the SIP application to which security is required.

   2. Add the <security-domain> element as a child of the <jboss-web> element:

      
      
      
      <jboss-web >
      
      <!--Uncomment the security-domain to enable security. You will need to edit the htmladaptor-->
      
      <!--login configuration to setup the login modules used to authentication users.-->
      
        <security-domain>java:/jaas/sip-servlets</security-domain>
      
      </jboss-web >
      
                  
      
      

5. Add Security Constraints to the SIP Application

   1. Open the sip.xml file for the SIP application.

   2. Add the <security-domain> element as a child of the <jboss-web> element:

      
      
      
      <security-constraint>
      
        <display-name>REGISTER Method Security Constraint</display-name>
      
        <resource-collection>
      
          <resource-name>SimpleSipServlet</resource-name>
      
          <description>Require authenticated REGISTER requests</description>
      
          <servlet-name>SimpleSipServlet</servlet-name>
      
          <sip-method>REGISTER</sip-method>
      
        </resource-collection>
      
        <auth-constraint>
      
          <role-name>caller</role-name>
      
        </auth-constraint>
      
      </security-constraint>
      
      <login-config>
      
        <auth-method>DIGEST</auth-method>
      
        <realm-name>sip-servlets-realm</realm-name>
      
      </login-config>
      
      

Procedure 7.4. Enable SIP Application Security in Tomcat Server

1. Activate the Memory Realm in Catalina:

   1. Open a terminal and navigate to the /conf directory:

      home]$ cd server/default/<tomcat_home>/conf/

   2. Open server.xml and uncomment the following line:

      
      <!--<Realm className="org.apache.catalina.realm.MemoryRealm"/>-->
      
      

2. Update SIP Server User Properties File

   1. In the /conf directory, open tomcat-users.xml (using your preferred editor) and append the following <user> child element:

      
      <user name="user" password="password" roles="caller"/>
      
      

3. Add Security Constraints to the SIP Application

   1. Open the sip.xml file for the SIP application to which security is required.

   2. Add the <security-domain> child element to the <jboss-web> element:

      
      
      
      <security-constraint>
      
        <display-name>REGISTER Method Security Constraint</display-name>
      
        <resource-collection>
      
          <resource-name>SimpleSipServlet</resource-name>
      
          <description>Require authenticated REGISTER requests</description>
      
          <servlet-name>SimpleSipServlet</servlet-name>
      
          <sip-method>REGISTER</sip-method>
      
        </resource-collection>
      
        <auth-constraint>
      
          <role-name>caller</role-name>
      
        </auth-constraint>
      
      </security-constraint>
      
      <login-config>
      
        <auth-method>DIGEST</auth-method>
      
        <realm-name>sip-servlets-realm</realm-name>
      
      </login-config>