How to configure secure RIDC port in WebCenter Content?

An SSL Incoming Provider is leveraged and instantiated to create an SSL server socket to which Intradoc clients (WCC UI, WCP etc) can connect, and whereby traffic is encrypted. The provider can be configured with or without requiring client authentication (the WCC UI Managed Server is a client of Content Server). When client authentication is not required, the JAVA RIDC client making the connection to the SSL server socket (Intradoc secure-socket port) does not need to present a valid certificate. This mode is not very different from a normal, non-SSL Intradoc connection. The main difference, however, is that traffic is encrypted and cannot be viewed by packet capture, and so on, in the clear. Client authentication means that the client must supply a valid SSL certificate signed by an authority that is in the server's trust store. 

Pre-requisites

1.       Oracle WebCenter Content (WCC) 12.2.1 is installed

2.       WCC domain is created and all servers are running.

3.       RIDC non-SSL port is configured and IDC is running on 4444.

Steps:

1.       Create the SSL incoming socket provider of sslincoming provider type

Provider Name:	sslkeepaliveincomingprovider
Provider Description:	For RIDC over SSL
Provider Type:	sslincoming
Provider Class:	idc.provider.ssl.SSLSocketIncomingProvider
Provider Connection:	idc.provider.KeepaliveSocketIncomingConnection
Server Thread Class:	idc.server.KeepaliveIdcServerThread
Server Port:	4445
Request Client Authentication:	No
Require Client Authentication:	No
Keystore File Path:	/oracle/app/keystores/wcc_keystore.jks
Alias:	Dev1WCC
Truststore File Path:	/oracle/app/keystore/wcc_trust.jks
Note: a. Please note that RIDC non-secure port and RIDC secure port should be different and must have required firewalls rules. b. If you want client authentication then check the “Require Client Authentication” from the SSL incoming provider. Then you must configure keystore for your client.

2.       Restart the WCC managed server. Make sure that sslincoming provider is in good state.

Once you finished with above steps, IDC server is configured for RIDC secure (SSL) port and you can use idcs protocol for any client.

Verification:

1.       Check SSL is configured

openssl s_client -connect wcchost1:4445

CONNECTED(00000003)
depth=2 C = AU, ST = NSW, L = Sydney, O = myCompany, OU = Digital Certificates Security Services, CN = Imran Mirza

verify error:num=19:self signed certificate in certificate chain

verify return:0

---

Certificate chain
0 s:/C=AU/ST=New South Wales/L=Sydney/O= O = myCompany, OU = Digital Certificates Security Services, CN = Imran Mirza

2.       Check the IDC Service PING_SERVER

http://wcchost1:16200/cs/idcplg?IdcService=PING_SERVER&IsAllowAnonymous=1&IsJava=1

You will see output like:

<?hda version="12.2.1.2.0-2017-07-05 09:25:44Z-r155055" jcharset="UTF8" encoding="utf-8"?>

@Properties LocalData

IdcService=PING_SERVER

IsAllowAnonymous=1

IsJava=1

StatusMessage=You are logged in as ‘weblogic’.

3.       You can configure idcs connection url in any RIDC client for example WCC UI app:

updateRIDCConnection('Oracle WebCenter Content – Web UI',

'WccAdfServerConnection',connUrl='idcs://wcchost1:4445',

credUsername='sysadmin')