----
h2. Security
----
{scrollbar}
{cagridtoc:exclude=Security}

{code}<!-- Un-comment this to force the container to SSL
<security-constraint>
<web-resource-collection>
<web-resource-name>HTTPS Only Naming Authority</web-resource-name>
<url-pattern>/NamingAuthorityService/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
-->
{code}
h3. Client Configuration
----
The client toolkit (identifiers-client) uses [Apache HttpClient|http://hc.apache.org/httpclient-3.x/], which fully leverages the [Java Secure Socket Extension (JSSE)|http://java.sun.com/javase/technologies/security/]. Hence, the only requirement to enable SSL is to configure JSSE properly.

The certificate from the naming authority must be added to the key-store used by the JVM running the client. For example, the following command imports the naming authority certificate that was used to secure its web application container:

{code}$ keytool -keystore /home/client/keystore -import -alias tomcat -file identifiers-na.nci.nih.gov-cert.pem{code}The JVM that runs the client program using the resolution toolkit (identifiers-client) must be passed by the _key-store_ being used (e.g. \-Djavax.net.ssl.trustStore=/home/client/keystore)

h3. Creating the Naming Authority Administrator
----
This step is only needed if the identifiers security framework is used. By default, anyone is allowed to create and modify identifiers. The security framework allows control over who can create, modify, and read identifiers in the system.

The _identifiers-namingauthority_ project provides an _ant_ target _addAdmin_ to bootstrap the framework's security by adding an initial administrator identity.

!Identifiers_Admin_Deployment_Guide15.PNG!

The above grid identity can now be used to perform further administration using the grid service API, such as:
* Turning off public creation of identifiers.
* Specifying identities authorized to create identifiers.
* Specifying additional administrators.
{scrollbar}