Knowledge Discovery 25.1
Knowledge Discovery Expert

# Secure Communications

Secure communications allow Knowledge Discovery components to share information with other components, and with external components. It ensures that:

- third parties cannot read communications.

- the communication occurs between trusted entities.

## Access Control

The first option for secure communications is to use authorization roles to allow access by IP address, SSL identity, or GSS principal.

You define the allowed identities of systems or users that Knowledge Discovery has permission to communicate with. You can use the `[AuthorizationRoles]` configuration sections to define access separately for different types of actions (for example, standard roles allow you to define authorization restrictions for administrative actions, index actions, queries, and service actions), or for specific sets of actions. You also define the IP addresses, SSL identities, and GSS principals that each authorization role applies to. A user can send a particular action if they use one of the allowed methods to access the component.

You can also bind Knowledge Discovery components to an explicit network interface in systems with multiple interfaces, by using the `ExplicitHost` configuration parameter.

## Transport Layer Security

Main Topic: SSL in Knowledge Discovery

Transport Layer Security (TLS/SSL) provides both transport encryption (HTTPS), and endpoint authentication.

In the most basic configuration, TLS encrypts the communication channel to and from the Knowledge Discovery component so that third parties cannot decrypt the information. In more advanced configurations, you can use client and server certificates to check that communication happens only between trusted clients and servers (with certificates signed by a trusted authority).

You configure TLS/SSL by using the `SSLConfig` configuration parameter, and the associated `[SSLOptionN]` configuration sections, which you can use to configure one or more sets of SSL options for your components to use.

## Kerberos

Knowledge Discovery can plug in to an existing Kerberos system, by using the Generic Security Services Application Program Interface (GSSAPI). Kerberos provides end-user identification.

In general, a Kerberos system is more complicated to set up and troubleshoot than a TLS/SSL system.

You configure a GSSAPI authentication requirement by setting the `GSSServiceName` configuration parameter for your service, and you set the `RequireGSSAuth` configuration parameter in the `[Server]`, `[Service]`, and `[IndexServer]` sections, as required. This method provides an authentication requirement only, and you can use a standard HTTP/HTTPS library for communication encryption.

## Performance

Secure communications using TLS or GSSAPI have a minor performance impact, because they need to negotiate encryption protocols and encrypt the responses. You can reduce the overhead by using persistent HTTP/HTTPS connections to reuse an established connection.

Copyright 2024 Open Text
Version 25.1 | Last updated January 2025

Send documentation feedback

Close

Send documentation feedback

To send feedback using your default email client, open an email window.

Otherwise, send your feedback and the information below to MFI-swpdl.idoldocsfeedback@opentext.com.

We appreciate your feedback!

Product: Knowledge Discovery 25.1

Topic Title: Secure Communications