Page History
Table of Contents |
---|
Summary
- The Controller makes use of two configuration files:
- the general configuration from
controller.conf
- the security configuration from
private.conf
- the general configuration from
- Restart the Controller instance to apply changes to any configuration file file .
General Configuration
File: controller.conf
Default Location: /var/sos-berlin.com/js7/controller/var/config/controller.conf
Code Block | ||||||||
---|---|---|---|---|---|---|---|---|
| ||||||||
# Cluster configuration js7.journal.cluster { nodes { Primary = "https://controller-2-0-primary:4443" Backup = "https://controller-2-0-secondary:4443" } watches = [ "https://agent-2-0-primary:4443" ] } # Allow http connections without authentication js7.web.server.auth.public = true |
Journal Cluster Settings
...
x
js7 | journal | cluster | |||
---|---|---|---|---|---|
nodes | |||||
Primary | <url> | ||||
Backup | <url> | ||||
watches | |||||
<url> [,<url>] |
- This setting is used for Controller Cluster mode only, it is not used for Controller Standalone instances.
- Nodes
- The nodes setting specifies the URLs of the Primary and Secondary (Backup) instance. The URL includes to specify the protocol http/https, the hostname and port
- Watches
- Watches are Agents in a JS7 environment that are involved in the decision about a fail-over situation. If Controller instances are not connected to each other any longer, e.g. due to a network error, then the majority of Agents decides if a fail-over should take place.
- At least one Agent has to be specified by its URL.
Authentication Settings
js7 | web | server | |||
---|---|---|---|---|---|
auth | public | <bool> |
- This setting specifies public access to a controller. If used with a value
true
then no authentication applies. - Default:
false
Security Configuration
File: private.conf
Default Location: /var/sos-berlin.com/js7/controller/var/config/private/private.conf
...
Code Block | ||||||||
---|---|---|---|---|---|---|---|---|
| ||||||||
# ClusterSecurity configuration js7.journal.cluster { auth { # User accounts for https connections users { nodes # Controller account for connections by primary/secondary controller instance Controller { Primary distinguished-names=[ "https://controller "DNQ=SOS CA, CN=controller-2-0-secondary, OU=IT, O=SOS, L=Berlin, ST=Berlin, C=DE" ] } # History account (used for release events) History { distinguished-names=[ "DNQ=SOS CA, CN=joc-2-0-primary:4443" , OU=IT, O=SOS, L=Berlin, ST=Berlin, C=DE", Backup = "https://controller "DNQ=SOS CA, CN=joc-2-0-secondary:4443, OU=IT, O=SOS, L=Berlin, ST=Berlin, C=DE" ] password="sha512:B793649879D61613FD3F711B68F7FF3DB19F2FE2D2C136E8523ABC87612219D5AECB4A09035AD88D544E227400A0A56F02BC990CF0D4CB348F8413DE00BCBF08" } # watches = [ "https://agent-2-0-primary:4443" ] } # allow http connections without authentication js7.web.server.auth.public = true JOC account (reqires UpdateRepo permission for deployment) JOC { distinguished-names=[ "DNQ=SOS CA, CN=joc-2-0-primary, OU=IT, O=SOS, L=Berlin, ST=Berlin, C=DE", "DNQ=SOS CA, CN=joc-2-0-secondary, OU=IT, O=SOS, L=Berlin, ST=Berlin, C=DE" ] password="sha512:3662FD6BF84C6B8385FC15F66A137AB75C755147A81CC7AE64092BFE8A18723A7C049D459AB35C059B78FD6028BB61DCFC55801AE3894D2B52401643F17A07FE" permissions=[ UpdateRepo ] } } } configuration { # Controller truststore location trusted-signature-keys { PGP=${js7.config-directory}"/private/trusted-pgp-keys" X509=${js7.config-directory}"/private/trusted-x509-keys" } } journal { # allow History account to release unused journals users-allowed-to-release-events=[ History ] } web { # keystore and truststore location for https connections https { keystore { # Default: ${js7.config-directory}"/private/https-keystore.p12" file=${js7.config-directory}"/private/https-keystore.p12" key-password=jobscheduler store-password=jobscheduler } truststores=[ { # Default: ${js7.config-directory}"/private/https-truststore.p12" file=${js7.config-directory}"/private/https-truststore.p12" store-password=jobscheduler } ] } } } |
js7.auth.users: HTTPS Authentication and Authorization
js7 | auth | users | |||
---|---|---|---|---|---|
Controller | |||||
distinguished-names | <distinguished-name>[,<distinguished-name] | ||||
History | |||||
distinguished-names | <distinguished-name>[,<distinguished-name] | ||||
password | plain:<text>|sha512:<hashed-password> | ||||
JOC | |||||
distinguished-names | <distinguished-name>[,<distinguished-name] | ||||
password | plain:<text>|sha512:<hashed-password> | ||||
permissions | UpdateRepo |
- When using HTTPS Certificates or public keys for incoming connections, see below, then an additional authentication mechanism applies: the client of the incoming connection, e.g. JOC Cockpit, is required to provide a Client Authentication certificate or a password. This includes that two certificates are in place for a secure HTTPS connection: the Controller's Server Authentication Certificate and the JOC Cockpit's Client Authentication Certificate.
- The fact that a given certificate is used for Server Authentication and/or Client Authentication is specified with the key usage when creating and signing the certificate.
- The distinguished name that is specified with the Controller's configuration has to match the Client Authentication Certificate's or Client public key's "subject" attribute. This attribute specifies the hostname and additional information that is created when the certificate or public key is generated.
Controller
- Settings in this section are used for the History Service of JOC Cockpit instances that access the given Controller.
distinguished-names
:- Specifies the distinguished name as given with the subject of the Client Authentication Certificate for incoming HTTPS connections.
- Any number of distinguished names can be specified, thus allowing a number of incoming HTTPS connections from different clients.
History
- Settings in this section are used for the History Service of JOC Cockpit instances that access the given Controller.
distinguished-names
: same as forController
setting.password
: a password can be used in addition to use of a certificate or public key. In addition the password is applied in case that insecure incoming HTTP connections are allowed.
JOC
- Settings in this section are used for JOC Cockpit instances that access the given Controller.
distinguished-names
: same as forController
setting.password
: a password can be used in addition to use of a certificate or public key. In addition the password is applied in case that insecure incoming HTTP connections are allowed.permissions
: JOC Cockpit requires theUpdateRepo
permission to enable users to deploy objects such as workflows.
js7.configuration: Signature Keys
js7 | configuration | |||
---|---|---|---|---|
trusted-signature-keys | ||||
PGP | <directory> | |||
X509 | <directory> |
- For any deployed objects such as workflows the Controller expects a signature. Such signatures are created with a private key and are verified by the Controller based on the available certificates.
- When deploying objects with JOC Cockpit
- for a Low Security Level JOC Cockpit creates the signature from a single private key that is used for any JOC Cockpit user accounts allowed to deploy objects.
- for a Medium Security Level JOC Cockpit creates the signature from the private key of the JOC Cockpit user account that deploy objects.
- for a High Security Level the user creates the signature outside of JOC Cockpit and uploads the signed objects.
- The Controller supports PGP public keys and X509 certificates. This setting expects a directory respectively that holds a number of public key files or certificate files.
trusted-signature-keys
PGP
: specifies the directory from which PGP public keys are used to verify the signature of deployed objects.X509
: specifies the directory from which X509 certificates are used to verify the signature of deployed objects.
js7.journal: Journal Release Permissions
js7 | journal | ||
---|---|---|---|
users-allowed-to-release-events | <account>[,<account>] |
- The Controller writes a journal of events that e.g. result from order state transitions such as an order starting, failing, completing etc.
- The journal file will grow unlimited if events are not released. Typically events are consumed by JOC Cockpit and are added to the order and task history. With events being stored persistently to the JOC Cockpit database they can be released from the Controller's journal. The Controller accordingly will free the space consumed by its journal files.
users-allowed-to-release-events
: specifies the list of accounts that are allowed to send a command to the Controller to release events.- Typically the "History" account is specified, this account is used by the JS7 - Configuration - JOC Cockpit.
- If more than one account is specified then events are released only after all accounts did send the command to release events to the Controller.
js7.web.https: HTTPS Certificates
js7 | web | https | |||
---|---|---|---|---|---|
keystore | |||||
file | <path> | ||||
key-password | <text> | ||||
store-password | <text> | ||||
truststores | |||||
file | <path> | ||||
store-password | <text> |
- This setting is used to specify the location of a keystore and any truststores used for HTTPS connections.
- Keystore and truststore files are expected in PKCS#12 format.
keystore
- The keystore includes the private key for the Controller's incoming HTTPS connections.
- Private key type RSA and ECDSA are supported.
file
: the full path to the location of the keystore file is expected.key-password
: Any keys included with the keystore are protected with a password. The same password has to be used for any private keys.store-password
: The keystore file is protected by a password.
truststores
- A truststore contains the certificates or public keys for the Controller's incoming HTTPS connections.
- Certificates are signed by a Certificate Authority (CA), alternatively a self-signed certificate can be used.
- It is recommended to use certificates instead of public keys.
- Certificates of type X509 are supported.
file
: the full path to the location of the truststore file is expected.store-password
: A truststore file is protected by a password.- A number of truststores can be specified by repeating the
file
andstore-password
settings.
- A truststore contains the certificates or public keys for the Controller's incoming HTTPS connections.
Overview
Content Tools