jdk/src/share/lib/security/java.security-windows
author weijun
Thu, 19 Aug 2010 11:26:32 +0800
changeset 6311 1448d18935b5
parent 3492 e549cea58864
child 7040 659824c2a550
permissions -rw-r--r--
6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default. Reviewed-by: valeriep
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
     1
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
     2
# This is the "master security properties file".
90ce3da70b43 Initial load
duke
parents:
diff changeset
     3
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
     4
# In this file, various security properties are set for use by
90ce3da70b43 Initial load
duke
parents:
diff changeset
     5
# java.security classes. This is where users can statically register
90ce3da70b43 Initial load
duke
parents:
diff changeset
     6
# Cryptography Package Providers ("providers" for short). The term
90ce3da70b43 Initial load
duke
parents:
diff changeset
     7
# "provider" refers to a package or set of packages that supply a
90ce3da70b43 Initial load
duke
parents:
diff changeset
     8
# concrete implementation of a subset of the cryptography aspects of
90ce3da70b43 Initial load
duke
parents:
diff changeset
     9
# the Java Security API. A provider may, for example, implement one or
90ce3da70b43 Initial load
duke
parents:
diff changeset
    10
# more digital signature algorithms or message digest algorithms.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    11
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    12
# Each provider must implement a subclass of the Provider class.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    13
# To register a provider in this master security properties file,
90ce3da70b43 Initial load
duke
parents:
diff changeset
    14
# specify the Provider subclass name and priority in the format
90ce3da70b43 Initial load
duke
parents:
diff changeset
    15
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    16
#    security.provider.<n>=<className>
90ce3da70b43 Initial load
duke
parents:
diff changeset
    17
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    18
# This declares a provider, and specifies its preference
90ce3da70b43 Initial load
duke
parents:
diff changeset
    19
# order n. The preference order is the order in which providers are
90ce3da70b43 Initial load
duke
parents:
diff changeset
    20
# searched for requested algorithms (when no specific provider is
90ce3da70b43 Initial load
duke
parents:
diff changeset
    21
# requested). The order is 1-based; 1 is the most preferred, followed
90ce3da70b43 Initial load
duke
parents:
diff changeset
    22
# by 2, and so on.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    23
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    24
# <className> must specify the subclass of the Provider class whose
90ce3da70b43 Initial load
duke
parents:
diff changeset
    25
# constructor sets the values of various properties that are required
90ce3da70b43 Initial load
duke
parents:
diff changeset
    26
# for the Java Security API to look up the algorithms or other
90ce3da70b43 Initial load
duke
parents:
diff changeset
    27
# facilities implemented by the provider.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    28
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    29
# There must be at least one provider specification in java.security.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    30
# There is a default provider that comes standard with the JDK. It
90ce3da70b43 Initial load
duke
parents:
diff changeset
    31
# is called the "SUN" provider, and its Provider subclass
90ce3da70b43 Initial load
duke
parents:
diff changeset
    32
# named Sun appears in the sun.security.provider package. Thus, the
90ce3da70b43 Initial load
duke
parents:
diff changeset
    33
# "SUN" provider is registered via the following:
90ce3da70b43 Initial load
duke
parents:
diff changeset
    34
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    35
#    security.provider.1=sun.security.provider.Sun
90ce3da70b43 Initial load
duke
parents:
diff changeset
    36
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    37
# (The number 1 is used for the default provider.)
90ce3da70b43 Initial load
duke
parents:
diff changeset
    38
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    39
# Note: Providers can be dynamically registered instead by calls to
90ce3da70b43 Initial load
duke
parents:
diff changeset
    40
# either the addProvider or insertProviderAt method in the Security
90ce3da70b43 Initial load
duke
parents:
diff changeset
    41
# class.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    42
90ce3da70b43 Initial load
duke
parents:
diff changeset
    43
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    44
# List of providers and their preference orders (see above):
90ce3da70b43 Initial load
duke
parents:
diff changeset
    45
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    46
security.provider.1=sun.security.provider.Sun
90ce3da70b43 Initial load
duke
parents:
diff changeset
    47
security.provider.2=sun.security.rsa.SunRsaSign
3492
e549cea58864 6840752: Provide out-of-the-box support for ECC algorithms
vinnie
parents: 3448
diff changeset
    48
security.provider.3=sun.security.ec.SunEC
e549cea58864 6840752: Provide out-of-the-box support for ECC algorithms
vinnie
parents: 3448
diff changeset
    49
security.provider.4=com.sun.net.ssl.internal.ssl.Provider
e549cea58864 6840752: Provide out-of-the-box support for ECC algorithms
vinnie
parents: 3448
diff changeset
    50
security.provider.5=com.sun.crypto.provider.SunJCE
e549cea58864 6840752: Provide out-of-the-box support for ECC algorithms
vinnie
parents: 3448
diff changeset
    51
security.provider.6=sun.security.jgss.SunProvider
e549cea58864 6840752: Provide out-of-the-box support for ECC algorithms
vinnie
parents: 3448
diff changeset
    52
security.provider.7=com.sun.security.sasl.Provider
e549cea58864 6840752: Provide out-of-the-box support for ECC algorithms
vinnie
parents: 3448
diff changeset
    53
security.provider.8=org.jcp.xml.dsig.internal.dom.XMLDSigRI
e549cea58864 6840752: Provide out-of-the-box support for ECC algorithms
vinnie
parents: 3448
diff changeset
    54
security.provider.9=sun.security.smartcardio.SunPCSC
e549cea58864 6840752: Provide out-of-the-box support for ECC algorithms
vinnie
parents: 3448
diff changeset
    55
security.provider.10=sun.security.mscapi.SunMSCAPI
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    56
90ce3da70b43 Initial load
duke
parents:
diff changeset
    57
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    58
# Select the source of seed data for SecureRandom. By default an
90ce3da70b43 Initial load
duke
parents:
diff changeset
    59
# attempt is made to use the entropy gathering device specified by 
90ce3da70b43 Initial load
duke
parents:
diff changeset
    60
# the securerandom.source property. If an exception occurs when
90ce3da70b43 Initial load
duke
parents:
diff changeset
    61
# accessing the URL then the traditional system/thread activity 
90ce3da70b43 Initial load
duke
parents:
diff changeset
    62
# algorithm is used. 
90ce3da70b43 Initial load
duke
parents:
diff changeset
    63
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    64
# On Solaris and Linux systems, if file:/dev/urandom is specified and it
90ce3da70b43 Initial load
duke
parents:
diff changeset
    65
# exists, a special SecureRandom implementation is activated by default.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    66
# This "NativePRNG" reads random bytes directly from /dev/urandom.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    67
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    68
# On Windows systems, the URLs file:/dev/random and file:/dev/urandom
90ce3da70b43 Initial load
duke
parents:
diff changeset
    69
# enables use of the Microsoft CryptoAPI seed functionality.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    70
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    71
securerandom.source=file:/dev/urandom
90ce3da70b43 Initial load
duke
parents:
diff changeset
    72
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    73
# The entropy gathering device is described as a URL and can also
90ce3da70b43 Initial load
duke
parents:
diff changeset
    74
# be specified with the system property "java.security.egd". For example,
90ce3da70b43 Initial load
duke
parents:
diff changeset
    75
#   -Djava.security.egd=file:/dev/urandom
90ce3da70b43 Initial load
duke
parents:
diff changeset
    76
# Specifying this system property will override the securerandom.source 
90ce3da70b43 Initial load
duke
parents:
diff changeset
    77
# setting.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    78
90ce3da70b43 Initial load
duke
parents:
diff changeset
    79
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    80
# Class to instantiate as the javax.security.auth.login.Configuration
90ce3da70b43 Initial load
duke
parents:
diff changeset
    81
# provider.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    82
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    83
login.configuration.provider=com.sun.security.auth.login.ConfigFile
90ce3da70b43 Initial load
duke
parents:
diff changeset
    84
90ce3da70b43 Initial load
duke
parents:
diff changeset
    85
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    86
# Default login configuration file
90ce3da70b43 Initial load
duke
parents:
diff changeset
    87
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    88
#login.config.url.1=file:${user.home}/.java.login.config
90ce3da70b43 Initial load
duke
parents:
diff changeset
    89
90ce3da70b43 Initial load
duke
parents:
diff changeset
    90
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    91
# Class to instantiate as the system Policy. This is the name of the class
90ce3da70b43 Initial load
duke
parents:
diff changeset
    92
# that will be used as the Policy object.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    93
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    94
policy.provider=sun.security.provider.PolicyFile
90ce3da70b43 Initial load
duke
parents:
diff changeset
    95
90ce3da70b43 Initial load
duke
parents:
diff changeset
    96
# The default is to have a single system-wide policy file,
90ce3da70b43 Initial load
duke
parents:
diff changeset
    97
# and a policy file in the user's home directory.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    98
policy.url.1=file:${java.home}/lib/security/java.policy
90ce3da70b43 Initial load
duke
parents:
diff changeset
    99
policy.url.2=file:${user.home}/.java.policy
90ce3da70b43 Initial load
duke
parents:
diff changeset
   100
90ce3da70b43 Initial load
duke
parents:
diff changeset
   101
# whether or not we expand properties in the policy file
90ce3da70b43 Initial load
duke
parents:
diff changeset
   102
# if this is set to false, properties (${...}) will not be expanded in policy
90ce3da70b43 Initial load
duke
parents:
diff changeset
   103
# files.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   104
policy.expandProperties=true
90ce3da70b43 Initial load
duke
parents:
diff changeset
   105
90ce3da70b43 Initial load
duke
parents:
diff changeset
   106
# whether or not we allow an extra policy to be passed on the command line
90ce3da70b43 Initial load
duke
parents:
diff changeset
   107
# with -Djava.security.policy=somefile. Comment out this line to disable
90ce3da70b43 Initial load
duke
parents:
diff changeset
   108
# this feature.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   109
policy.allowSystemProperty=true
90ce3da70b43 Initial load
duke
parents:
diff changeset
   110
90ce3da70b43 Initial load
duke
parents:
diff changeset
   111
# whether or not we look into the IdentityScope for trusted Identities
90ce3da70b43 Initial load
duke
parents:
diff changeset
   112
# when encountering a 1.1 signed JAR file. If the identity is found
90ce3da70b43 Initial load
duke
parents:
diff changeset
   113
# and is trusted, we grant it AllPermission.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   114
policy.ignoreIdentityScope=false
90ce3da70b43 Initial load
duke
parents:
diff changeset
   115
90ce3da70b43 Initial load
duke
parents:
diff changeset
   116
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   117
# Default keystore type.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   118
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   119
keystore.type=jks
90ce3da70b43 Initial load
duke
parents:
diff changeset
   120
90ce3da70b43 Initial load
duke
parents:
diff changeset
   121
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   122
# Class to instantiate as the system scope:
90ce3da70b43 Initial load
duke
parents:
diff changeset
   123
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   124
system.scope=sun.security.provider.IdentityDatabase
90ce3da70b43 Initial load
duke
parents:
diff changeset
   125
90ce3da70b43 Initial load
duke
parents:
diff changeset
   126
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   127
# List of comma-separated packages that start with or equal this string
90ce3da70b43 Initial load
duke
parents:
diff changeset
   128
# will cause a security exception to be thrown when
90ce3da70b43 Initial load
duke
parents:
diff changeset
   129
# passed to checkPackageAccess unless the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   130
# corresponding RuntimePermission ("accessClassInPackage."+package) has
90ce3da70b43 Initial load
duke
parents:
diff changeset
   131
# been granted.
3448
1ccef37a150f 6657133: Mutable statics in imageio plugins (findbugs)
bae
parents: 2
diff changeset
   132
package.access=sun.,com.sun.imageio.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   133
90ce3da70b43 Initial load
duke
parents:
diff changeset
   134
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   135
# List of comma-separated packages that start with or equal this string
90ce3da70b43 Initial load
duke
parents:
diff changeset
   136
# will cause a security exception to be thrown when
90ce3da70b43 Initial load
duke
parents:
diff changeset
   137
# passed to checkPackageDefinition unless the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   138
# corresponding RuntimePermission ("defineClassInPackage."+package) has
90ce3da70b43 Initial load
duke
parents:
diff changeset
   139
# been granted.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   140
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   141
# by default, no packages are restricted for definition, and none of
90ce3da70b43 Initial load
duke
parents:
diff changeset
   142
# the class loaders supplied with the JDK call checkPackageDefinition.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   143
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   144
#package.definition=
90ce3da70b43 Initial load
duke
parents:
diff changeset
   145
90ce3da70b43 Initial load
duke
parents:
diff changeset
   146
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   147
# Determines whether this properties file can be appended to
90ce3da70b43 Initial load
duke
parents:
diff changeset
   148
# or overridden on the command line via -Djava.security.properties
90ce3da70b43 Initial load
duke
parents:
diff changeset
   149
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   150
security.overridePropertiesFile=true
90ce3da70b43 Initial load
duke
parents:
diff changeset
   151
90ce3da70b43 Initial load
duke
parents:
diff changeset
   152
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   153
# Determines the default key and trust manager factory algorithms for 
90ce3da70b43 Initial load
duke
parents:
diff changeset
   154
# the javax.net.ssl package.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   155
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   156
ssl.KeyManagerFactory.algorithm=SunX509
90ce3da70b43 Initial load
duke
parents:
diff changeset
   157
ssl.TrustManagerFactory.algorithm=PKIX
90ce3da70b43 Initial load
duke
parents:
diff changeset
   158
90ce3da70b43 Initial load
duke
parents:
diff changeset
   159
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   160
# The Java-level namelookup cache policy for successful lookups:
90ce3da70b43 Initial load
duke
parents:
diff changeset
   161
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   162
# any negative value: caching forever
90ce3da70b43 Initial load
duke
parents:
diff changeset
   163
# any positive value: the number of seconds to cache an address for
90ce3da70b43 Initial load
duke
parents:
diff changeset
   164
# zero: do not cache
90ce3da70b43 Initial load
duke
parents:
diff changeset
   165
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   166
# default value is forever (FOREVER). For security reasons, this
90ce3da70b43 Initial load
duke
parents:
diff changeset
   167
# caching is made forever when a security manager is set. When a security
90ce3da70b43 Initial load
duke
parents:
diff changeset
   168
# manager is not set, the default behavior is to cache for 30 seconds.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   169
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   170
# NOTE: setting this to anything other than the default value can have
90ce3da70b43 Initial load
duke
parents:
diff changeset
   171
#       serious security implications. Do not set it unless 
90ce3da70b43 Initial load
duke
parents:
diff changeset
   172
#       you are sure you are not exposed to DNS spoofing attack.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   173
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   174
#networkaddress.cache.ttl=-1 
90ce3da70b43 Initial load
duke
parents:
diff changeset
   175
90ce3da70b43 Initial load
duke
parents:
diff changeset
   176
# The Java-level namelookup cache policy for failed lookups:
90ce3da70b43 Initial load
duke
parents:
diff changeset
   177
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   178
# any negative value: cache forever
90ce3da70b43 Initial load
duke
parents:
diff changeset
   179
# any positive value: the number of seconds to cache negative lookup results
90ce3da70b43 Initial load
duke
parents:
diff changeset
   180
# zero: do not cache
90ce3da70b43 Initial load
duke
parents:
diff changeset
   181
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   182
# In some Microsoft Windows networking environments that employ
90ce3da70b43 Initial load
duke
parents:
diff changeset
   183
# the WINS name service in addition to DNS, name service lookups
90ce3da70b43 Initial load
duke
parents:
diff changeset
   184
# that fail may take a noticeably long time to return (approx. 5 seconds).
90ce3da70b43 Initial load
duke
parents:
diff changeset
   185
# For this reason the default caching policy is to maintain these
90ce3da70b43 Initial load
duke
parents:
diff changeset
   186
# results for 10 seconds. 
90ce3da70b43 Initial load
duke
parents:
diff changeset
   187
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   188
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   189
networkaddress.cache.negative.ttl=10
90ce3da70b43 Initial load
duke
parents:
diff changeset
   190
90ce3da70b43 Initial load
duke
parents:
diff changeset
   191
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   192
# Properties to configure OCSP for certificate revocation checking
90ce3da70b43 Initial load
duke
parents:
diff changeset
   193
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   194
90ce3da70b43 Initial load
duke
parents:
diff changeset
   195
# Enable OCSP 
90ce3da70b43 Initial load
duke
parents:
diff changeset
   196
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   197
# By default, OCSP is not used for certificate revocation checking.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   198
# This property enables the use of OCSP when set to the value "true".
90ce3da70b43 Initial load
duke
parents:
diff changeset
   199
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   200
# NOTE: SocketPermission is required to connect to an OCSP responder.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   201
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   202
# Example,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   203
#   ocsp.enable=true
90ce3da70b43 Initial load
duke
parents:
diff changeset
   204
 
90ce3da70b43 Initial load
duke
parents:
diff changeset
   205
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   206
# Location of the OCSP responder
90ce3da70b43 Initial load
duke
parents:
diff changeset
   207
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   208
# By default, the location of the OCSP responder is determined implicitly
90ce3da70b43 Initial load
duke
parents:
diff changeset
   209
# from the certificate being validated. This property explicitly specifies
90ce3da70b43 Initial load
duke
parents:
diff changeset
   210
# the location of the OCSP responder. The property is used when the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   211
# Authority Information Access extension (defined in RFC 3280) is absent
90ce3da70b43 Initial load
duke
parents:
diff changeset
   212
# from the certificate or when it requires overriding.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   213
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   214
# Example,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   215
#   ocsp.responderURL=http://ocsp.example.net:80
90ce3da70b43 Initial load
duke
parents:
diff changeset
   216
 
90ce3da70b43 Initial load
duke
parents:
diff changeset
   217
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   218
# Subject name of the OCSP responder's certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
   219
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   220
# By default, the certificate of the OCSP responder is that of the issuer
90ce3da70b43 Initial load
duke
parents:
diff changeset
   221
# of the certificate being validated. This property identifies the certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
   222
# of the OCSP responder when the default does not apply. Its value is a string 
90ce3da70b43 Initial load
duke
parents:
diff changeset
   223
# distinguished name (defined in RFC 2253) which identifies a certificate in 
90ce3da70b43 Initial load
duke
parents:
diff changeset
   224
# the set of certificates supplied during cert path validation. In cases where 
90ce3da70b43 Initial load
duke
parents:
diff changeset
   225
# the subject name alone is not sufficient to uniquely identify the certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
   226
# then both the "ocsp.responderCertIssuerName" and
90ce3da70b43 Initial load
duke
parents:
diff changeset
   227
# "ocsp.responderCertSerialNumber" properties must be used instead. When this
90ce3da70b43 Initial load
duke
parents:
diff changeset
   228
# property is set then those two properties are ignored.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   229
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   230
# Example,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   231
#   ocsp.responderCertSubjectName="CN=OCSP Responder, O=XYZ Corp"
90ce3da70b43 Initial load
duke
parents:
diff changeset
   232
90ce3da70b43 Initial load
duke
parents:
diff changeset
   233
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   234
# Issuer name of the OCSP responder's certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
   235
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   236
# By default, the certificate of the OCSP responder is that of the issuer
90ce3da70b43 Initial load
duke
parents:
diff changeset
   237
# of the certificate being validated. This property identifies the certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
   238
# of the OCSP responder when the default does not apply. Its value is a string
90ce3da70b43 Initial load
duke
parents:
diff changeset
   239
# distinguished name (defined in RFC 2253) which identifies a certificate in
90ce3da70b43 Initial load
duke
parents:
diff changeset
   240
# the set of certificates supplied during cert path validation. When this 
90ce3da70b43 Initial load
duke
parents:
diff changeset
   241
# property is set then the "ocsp.responderCertSerialNumber" property must also 
90ce3da70b43 Initial load
duke
parents:
diff changeset
   242
# be set. When the "ocsp.responderCertSubjectName" property is set then this 
90ce3da70b43 Initial load
duke
parents:
diff changeset
   243
# property is ignored.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   244
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   245
# Example,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   246
#   ocsp.responderCertIssuerName="CN=Enterprise CA, O=XYZ Corp"
90ce3da70b43 Initial load
duke
parents:
diff changeset
   247
 
90ce3da70b43 Initial load
duke
parents:
diff changeset
   248
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   249
# Serial number of the OCSP responder's certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
   250
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   251
# By default, the certificate of the OCSP responder is that of the issuer
90ce3da70b43 Initial load
duke
parents:
diff changeset
   252
# of the certificate being validated. This property identifies the certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
   253
# of the OCSP responder when the default does not apply. Its value is a string
90ce3da70b43 Initial load
duke
parents:
diff changeset
   254
# of hexadecimal digits (colon or space separators may be present) which
90ce3da70b43 Initial load
duke
parents:
diff changeset
   255
# identifies a certificate in the set of certificates supplied during cert path
90ce3da70b43 Initial load
duke
parents:
diff changeset
   256
# validation. When this property is set then the "ocsp.responderCertIssuerName"
90ce3da70b43 Initial load
duke
parents:
diff changeset
   257
# property must also be set. When the "ocsp.responderCertSubjectName" property
90ce3da70b43 Initial load
duke
parents:
diff changeset
   258
# is set then this property is ignored.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   259
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   260
# Example,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   261
#   ocsp.responderCertSerialNumber=2A:FF:00
90ce3da70b43 Initial load
duke
parents:
diff changeset
   262
 
6311
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   263
#
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   264
# Policy for failed Kerberos KDC lookups:
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   265
#
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   266
# When a KDC is unavailable (network error, service failure, etc), it is
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   267
# put inside a blacklist and accessed less often for future requests. The
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   268
# value (case-insensitive) for this policy can be:
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   269
#
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   270
# tryLast
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   271
#    KDCs in the blacklist are always tried after those not on the list.
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   272
#
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   273
# tryLess[:max_retries,timeout]
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   274
#    KDCs in the blacklist are still tried by their order in the configuration,
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   275
#    but with smaller max_retries and timeout values. max_retries and timeout
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   276
#    are optional numerical parameters (default 1 and 5000, which means once
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   277
#    and 5 seconds). Please notes that if any of the values defined here is
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   278
#    more than what is defined in krb5.conf, it will be ignored.
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   279
#
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   280
# Whenever a KDC is detected as available, it is removed from the blacklist.
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   281
# The blacklist is reset when krb5.conf is reloaded. You can add
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   282
# refreshKrb5Config=true to a JAAS configuration file so that krb5.conf is
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   283
# reloaded whenever a JAAS authentication is attempted.
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   284
#
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   285
# Example,
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   286
#   krb5.kdc.bad.policy = tryLast
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   287
#   krb5.kdc.bad.policy = tryLess:2,2000
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   288
krb5.kdc.bad.policy = tryLast
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   289