Using https merely for the login procedure

trude

In Knowledge Base article #49640 it is pointed out that it is a often requested demand that users use https to log into TeamSite (just the login screen, to gather the session cookie) and then use plain http for the rest of their session (to have better performance). I am quoting from that article:

"3. An often requested solution that we do not support is the ability to have the login page use https and the rest of the session use http. This way, the step to get the session cookie is secure and you don't pay the performance hit for the rest of the session. This solution is not appropriate if the customer is updating sensitive information as the content will be sent in plain text."

This is exactly what we want to do. As, in our case, we are not dealing with really sensitive information in the content (after all, it's all going to be worldwide-accessible internet content sooner or later), but rather only want to have the username and password transmitted securely, the situation described in that article would be sufficient for us.

I presume, the implementation would have something to do with writing Rewrite Conditions as described e.g. in KB article #49698.

Interwoven support refuses to give any information about a possible solution, because they "would not spend time on a solution they don't support".

So, does anybody in here have any experience in using https for login and http for all further access? We use TS 5.5.2 on Solaris. Any help is appreciated.

lokesh

I am having solaris 8.0 with ssl teamsite access before you make logging ssl you need to get certificate from a trusted or use the exisiting dummy certificates that are provided by teamsite. and then in the /etc/iw.cfg file you need to eddit like this:

[iwwebd]
default_protocol=https
https_port=443

and in /usr/local/iw-home/iw-webd/conf/httpd.conf.template

modify the lines to specify the private and certificate files names

# Server Certificate:
# Point SSLCertificateFile at a PEM encoded certificate. If
# the certificate is encrypted, then you will be prompted for a
# pass phrase. Note that a kill -HUP will prompt again. A test
# certificate can be generated with `make certificate' under
# built time. Keep in mind that if you've both a RSA and a DSA
# certificate you can configure both in parallel (to also allow
# the use of DSA ciphers, etc.)
SSLCertificateFile "__IWWEBD_HOME__/conf/ssl.crt/public.crt"
#SSLCertificateFile "__IWWEBD_HOME__/conf/ssl.crt/server-dsa.crt"

# Server Private Key:
# If the key is not combined with the certificate, use this
# directive to point at the key file. Keep in mind that if
# you've both a RSA and a DSA private key you can configure
# both in parallel (to also allow the use of DSA ciphers, etc.)
SSLCertificateKeyFile "__IWWEBD_HOME__/conf/ssl.key/private.key"
#SSLCertificateKeyFile "__IWWEBD_HOME__/conf/ssl.key/server-dsa.key"

and then run this command /usr/local/iw-home/iw-webd/bin/iwwebd_conf.ipl
and then run this iwreset -a