Page History

...

• The Agent expects a signature for any deployed objects such as workflows. Such signatures are created with a private key and are verified by the Agent according to the available certificates. 
• When deploying objects with JOC Cockpit:
  • for a low Security Level JOC Cockpit creates the signature from a single private key that is used for any JOC Cockpit user accounts allowed to deploy objects.
  • for a medium Security Level JOC Cockpit creates the signature from the private key of the JOC Cockpit user account that deploys objects.
  • for a high Security Level the user creates the signature outside of JOC Cockpit and uploads the files holding scheduling objects and signatures.
• The Agent supports PGP public keys and X.509 certificates. This setting expects a directory that holds a number of public key files or certificate files.
• trusted-signature-keys
  • PGP: specifies the directory from which PGP public keys are used to verify the signature of deployed objects.
  • X509: specifies the directory from which X.509 certificates are used to verify the signature of deployed objects.

js7.auth

...

: HTTPS Authentication and Authorization

• An additional authentication mechanism is applied when using HTTPS certificates or public keys for incoming connections, see below: the client of the incoming connection, i.e. a Controller, is required to provide a Client Authentication Certificate. This includes two certificates that are in place for a secure HTTPS connection: the Agent's a Server Authentication Certificate and the Controller's a Client Authentication Certificate. 
  • The fact that a given certificate is to be used for Server Authentication and/or Client Authentication is specified with the key usage when the certificate is being created and signed.
  • The distinguished name that is specified with the Agent's configuration has to match the Client Authentication Certificate's subject attribute of the Controller. This attribute specifies the hostname and additional information that is created when the certificate or public key is generated.
• js7.auth.users.Controller
  • Settings in this section are used for incoming HTTPS connections from Controller instances.
  • distinguished-names: 
    • Specifies the distinguished name as given with the subject of the Client Authentication Certificate for incoming HTTPS connections from a Controller.
    • Any number of One or two distinguished names can be specified allowing a number of incoming HTTPS connections from different Controllersincoming HTTPS connections from a Standalone Controller or Controller Cluster.
  • password
    • As an alternative to TLS mutual authentication a password can be specified.
• js7.auth.subagents
  • Settings in this section are used for outgoing HTTPS connections from Director Agent instances to Subagents.

js7.web.https: HTTPS Certificates

...