Open topic with navigation

Configure IDOL > Security > Secure Communications

# Secure Communications

Secure communications allow IDOL components to share information with other IDOL components, and with external components. It ensures that:

- third parties cannot read communications.

- the communication occurs between trusted entities.

## IP Access Control

The first option for secure communications is IP address and host name access control lists. You define the IP addresses of systems that IDOL has permission to communicate with. You can define this access separately for administrative actions, index actions, queries, and allowed proxies, by using the `AdminClients`, `IndexClients`, `UserClients`, `QueryClients`, and `ProxyClients` configuration parameters.

You can also bind IDOL Server components to an explicit network interface in systems with multiple interfaces, by using the `ExplicitHost` configuration parameter.

## Transport Layer Security

Main Topic: SSL in IDOL

Transport Layer Security (TLS/SSL) provides both transport encryption (HTTPS), and endpoint authentication.

In the most basic configuration, TLS encrypts the communication channel to and from the IDOL Server component so that third parties cannot decrypt the information. In more advanced configurations, you can use client and server certificates to check that communication happens only between trusted clients and servers (with certificates signed by a trusted authority).

You configure TLS/SSL by using the `SSLConfig` configuration parameter, and the associated `[SSLOptionN]` configuration sections, which you can use to configure one or more sets of SSL options for your components to use.

## Kerberos

IDOL can plug in to an existing Kerberos system, by using the Generic Security Services Application Program Interface (GSSAPI). Kerberos provides both secure channel encryption and end-user identification.

In general, a Kerberos system is more complicated to set up and troubleshoot than a TLS/SSL system. It also requires external access to the IDOL system through one of the ACI API libraries provided by HPE, rather than using a standard HTTP/HTTPS library.

You configure Kerberos by using the `CommsEncryptionType` configuration parameter.

## Performance

Secure communications using TLS or GSSAPI have a minor performance impact, because they need to negotiate encryption protocols and encrypt the responses. You can reduce the overhead by using persistent HTTP/HTTPS connections to reuse an established connection.

© 2016 Hewlett Packard Enterprise Development LP | Send documentation feedback to HPE Close We welcome your comments! To open the configured email client on this computer, open an email window. Otherwise, copy the information below to a web mail client, and send this email to AutonomyTPFeedback@hpe.com. Product: Topic Title: Help Topic: Feedback:

_HP_HTML5_bannerTitle.htm