General Configuration

File: controllerjoc.confproperties

Default Location: /var/sos-berlin.com/js7/controllerjoc/varresources/configjoc/controllerjoc.confproperties

Code Block

language	text
title	General configuration file example: controllerjoc.confproperties
linenumbers	true
collapse	true

# Cluster configuration
js7.journal.cluster {
    nodes {
        Primary = "https://controller-2-0-primary:4443"
        Backup = "https://controller-2-0-secondary:4443"
    }
    watches = [ "https://agent-2-0-primary:4443" ]
}

# Allow http connections without authentication
js7.web.server.auth.public = true

js7.journal.cluster: Journal Cluster Settings

...

This setting is used for Controllers in cluster mode only, it is not used for standalone Controller instances.
nodes
- This setting specifies the URLs of the Primary and Backup (Secondary) instance. The URL includes to specify the protocol http/https, the hostname and port.
watches
- Watches are Agents in a JS7 environment that are involved in the decision about a fail-over situation. If Controller instances in a cluster are not connected to each other any longer, e.g. due to network errors, then the majority of Agents decides if a fail-over should take place.
- At least one Agent has to be specified by its URL.

js7.web.server: Authentication Settings

...

This setting specifies public access to a Controller should insecure incoming HTTP connections be used. If used with a value true then no authentication applies.
Default: false

Security Configuration

File: private.conf

Default Location: /var/sos-berlin.com/js7/controller/var/config/private/private.conf

Code Block

language	text
title	Security configuration file example: private.conf
linenumbers	true
collapse	true

# Security configuration
js7 {
    auth {
        # User accounts for https connections
        users {
            # Controller account for connections by primary/secondary controller instance
            Controller {
                distinguished-names=[
                    "DNQ=SOS CA, CN=controller-2-0-secondary, OU=IT, O=SOS, L=Berlin, ST=Berlin, C=DE"
                ]
            }
            # History account (used for release events)
            History {
                distinguished-names=[
                    "DNQ=SOS CA, CN=joc-2-0-primary, OU=IT, O=SOS, L=Berlin, ST=Berlin, C=DE",
                    "DNQ=SOS CA, CN=joc-2-0-secondary, OU=IT, O=SOS, L=Berlin, ST=Berlin, C=DE"
                ]
                password="sha512:B793649879D61613FD3F711B68F7FF3DB19F2FE2D2C136E8523ABC87612219D5AECB4A09035AD88D544E227400A0A56F02BC990CF0D4CB348F8413DE00BCBF08"
            }
            # JOC account (reqires UpdateRepo permission for deployment)
            JOC {
                distinguished-names=[
                    "DNQ=SOS CA, CN=joc-2-0-primary, OU=IT, O=SOS, L=Berlin, ST=Berlin, C=DE",
                    "DNQ=SOS CA, CN=joc-2-0-secondary, OU=IT, O=SOS, L=Berlin, ST=Berlin, C=DE"
                ]
                password="sha512:3662FD6BF84C6B8385FC15F66A137AB75C755147A81CC7AE64092BFE8A18723A7C049D459AB35C059B78FD6028BB61DCFC55801AE3894D2B52401643F17A07FE"
                permissions=[
                    UpdateRepo
                ]
            }
        }
    }
    configuration {
        # Controller truststore location
        trusted-signature-keys {
            PGP=${js7.config-directory}"/private/trusted-pgp-keys"
            X509=${js7.config-directory}"/private/trusted-x509-keys"
        }
    }
    journal {
        # allow History account to release unused journals
        users-allowed-to-release-events=[
            History
        ]
    }
    web {
        # keystore and truststore location for https connections
        https {
            keystore {################################################################################
### If JOC Cockpit is used in a cluster then type a title to identify which node
### is currently used. Further type an ordering (Primary <= 0, Backup > 0) for
### the display order in JOC's dashboard

title = PRIMARY JOC COCKPIT
ordering = 0


###########
daily_plan_timezone = UTC
daily_plan_period_begin = 00:00:00


################################################################################
### Path to log4j configuration file. Path can be absolute or relative
### to this file.

log4j.configuration = log4j2.xml


################################################################################
### Path to hibernate configuration file of JOC's database.
### Path can be absolute or relative to this file.

hibernate_configuration_file = hibernate.cfg.xml


################################################################################
### The time (in seconds) to establish the connection with the
### remote host. Default = 2

jobscheduler_connection_timeout = 2


################################################################################
### The time (in seconds) waiting for data after the connection
### was established; maximum time of inactivity between two data packets.
### Default = 5

jobscheduler_socket_timeout = 5


################################################################################
### Should hostname verification be carried out for https certificate.
### Default false

https_with_hostname_verification = true


################################################################################
### Location, type and password of the Java truststore which contains the
### certificates of eachnJobScheduler Controller for HTTPS connections. Path can be
### absolute or relative to this file.

keystore_path = ../../etc/https-keystore.p12
keystore_type = PKCS12
keystore_password = jobscheduler
key_password = jobscheduler

truststore_path = ../../etc/https-truststore.p12
truststore_type = PKCS12
truststore_password = jobscheduler


################################################################################
### Requests to all web services which modify JobScheduler objects such as
### "start order", "stop job" etc. can contain a comment to describe the reason.
### This flag controls if the comment is required or not. Default false

force_comments_for_audit_log = false


################################################################################
### JOC Cockpit comes with the possibility to configure a security level for the
### signing mechanism, options "high", "medium" and "low".
### high:
###      public PGP keys are stored for verification only
###      all signing will be done externally outside of JOC Cockpit
### medium:
###      a private PGP key will be stored for signing
###      signing will be done automatically with the provided key
### low:
###      no keys will be stored
###      signing will be done internally with default keys
###
### This flag controls the used security level. Default low

security_level = medium


################################################################################
### Settings for a custom logo file on the login page
### The logo file has to be located in ./jetty_base/webapps/root/ext/images
### Possible units for width are according to
### https://www.w3schools.com/cssref/css_units.asp (default px)
### Possible values for the position are "top" or "bottom" (default=bottom).

custom_logo_name =
custom_logo_height =
custom_logo_position =


################################################################################
### A default profile should be available that includes any profile settings
### that are applied by default to new users.

default_profile_account =

################################################################################
### The login dialog provides a 'Remember Me' checkbox. If enable_remember_me
### is false then this checkbox is hidden and unchecked.

enable_remember_me = true


################################################################################
### Pre-defined comments used for example in the 'reasons' describing actions in
### the audit log.

comments =  System maintenance; \
            Repeat execution; \
            Business    # Default: ${js7.config-directory}"/private/https-keystore.p12"requirement; \
            Restart failed   file=${js7.config-directory}"/private/https-keystore.p12"execution; \
            Re-instantiate stopped   key-password=jobschedulerobject; \
            Temporary    store-password=jobschedulerstop; \
            }
Change of JobScheduler          truststores=[object; \
            Rerun with parameter changes; {\
            Change of external dependency; \
    # Default: ${js7.config-directory}"/private/https-truststore.p12"
      Application deployment and upgrade


################################################################################
### Normally, the user permissions control if a view such  file=${js7.config-directory}"/private/https-truststore.p12"
                    store-password=jobscheduler
                }
            ]
        }
    }
}

js7.auth.users: HTTPS Authentication and Authorization

...

as dashboard,
### workflows, etc are shown or hidden. Here you can force to show (=true) or
### hide (=false) a view independent of the permissions. If the value is unequal
### true or false then the permissions win.

show_view_dashboard =
show_view_dailyplan =
show_view_workflows =
show_view_filetransfers =
show_view_resources =
show_view_history =
show_view_auditlog =
show_view_jobstreams =
show_view_configuration =

Dashboard Settings

Setting	Default Value	Explanation
`title`	`PRIMARY JOC COCKPIT` `SECONDARY JOC COCKPIT`	Title of JOC Cockpit widget in Dashboard
`ordering`	`0` `1`	Display sequence of JOC Cockpit widget in Dashboard

title: The title of the respective JOC Cockpit instance as visible from the Cluster Status widget of the JS7 Dashboard view.
ordering: The order of appearance of the respective JOC Cockpit instance with the Cluster Status widget of the JS7 Dashboard view. An ordering 0 indicates the leftmost occurrence.

Daily Plan Settings

Setting	Default Value	Explanation
`daily_plan_timezone`	`UTC`	Specifies the time zone that is used to indicate the period of the Daily Plan
`daily_plan_period_begin`	`00:00`	Specifies the offset that is applied to the time zone indicated with the `daily_plan_timezone` attribute.

Logger Settings

Setting	Default Value	Explanation
`log4j.configuration`	`log4j2.xml`	Specifies the file name of the log4j2 configuration file to be used. This file is expected with the configuration folder ./resources/joc

Database Connection Settings

Setting	Default Value	Explanation
`hibernate_configuration_file`	`hibernate.cfg.xml`	Specifies the connection URL, account and authentication for the connection to the database.

Controller Connection Settings

Setting	Default Value	Explanation
`jobscheduler_connection_timeout`	`2`	Specifies the time (in seconds) to establish a connection to a Controller.
`jobscheduler_socket_timeout`	`5`	The time (in seconds) waiting for data after the connection to a Controller was established; maximum time of inactivity between two data packets.

HTTPS Connection Settings

Setting	Default Value	Explanation
`https_with_hostname_verification`	`false`	Specifies if hostname verification should be performed for HTTPS connections.
`keystore_path`	`../../etc/https-keystore.p12`	The keystore includes the private key and certificate for incoming HTTPS connections.
`keystore_type`	`PKCS12`	The keystore types PKCS12 and JKS are supported.
`keystore_password`		The keystore is protected by a password.
`key_password`		The private keys in the keystore are protected by a password. Consider that for PKCS#12 keystores the same password applies for all keys.
`truststore_path`	`../../etc/https-truststore.p12`	The truststore includes the public key and/or certificates for incoming HTTPS connections.
`truststore_type`	`PKCS12`	The truststore types PKCS12 and JKS are supported.
`truststore_password`		The truststore is protected by a password.

Operational Settings

Setting	Default Value	Explanation

`security_level`	`false`	When being set to true then JOC Cockpit will require an audit log comment (reason) for any operations that modify the state of an object, such as e.g. starting or killing a job..
`jobscheduler_socket_timeout`	`5`	The time (in seconds) waiting for data after the connection to a Controller was established; maximum time of inactivity between two data packets

...

When using HTTPS Certificates or public keys for incoming connections, see below, then an additional authentication mechanism applies: the client of the incoming connection, e.g. JOC Cockpit, is required to provide a Client Authentication certificate or a password. This includes that two certificates are in place for a secure HTTPS connection: the Controller's Server Authentication Certificate and the JOC Cockpit's Client Authentication Certificate.
- The fact that a given certificate is used for Server Authentication and/or Client Authentication is specified with the key usage when creating and signing the certificate.
- The distinguished name that is specified with the Controller's configuration has to match the Client Authentication Certificate's or Client public key's "subject" attribute. This attribute specifies the hostname and additional information that is created when the certificate or public key is generated.
Controller
- Settings in this section are used for connections from a pairing Controller instance, e.g. for a Secondary Controller if this configuration is used for the Primary Controller and vice versa.
- distinguished-names:
  - Specifies the distinguished name as given with the subject of the Client Authentication Certificate for incoming HTTPS connections of a pairing Controller.
  - Any number of distinguished names can be specified, thus allowing a number of incoming HTTPS connections from different Controllers. At a given point in time only one pairing Controller can connect to the given Controller.
History
- Settings in this section are used for the History Service of JOC Cockpit instances that access the given Controller.
- distinguished-names: same as for Controller setting.
- password: a password can be used in addition to use of a certificate or public key. In addition the password is applied in case that insecure incoming HTTP connections are allowed.
JOC
- Settings in this section are used for JOC Cockpit instances that access the given Controller.
- distinguished-names: same as for Controller setting.
- password: a password can be used in addition to use of a certificate or public key. In addition the password is applied in case that insecure incoming HTTP connections are allowed.
- permissions: JOC Cockpit requires the UpdateRepo permission to enable users to deploy objects such as workflows.

js7.configuration: Signature Keys

...

For any deployed objects such as workflows the Controller expects a signature. Such signatures are created with a private key and are verified by the Controller based on the available certificates.
When deploying objects with JOC Cockpit
- for a Low Security Level JOC Cockpit creates the signature from a single private key that is used for any JOC Cockpit user accounts allowed to deploy objects.
- for a Medium Security Level JOC Cockpit creates the signature from the private key of the JOC Cockpit user account that deploy objects.
- for a High Security Level the user creates the signature outside of JOC Cockpit and uploads the signed objects.
The Controller supports PGP public keys and X509 certificates. This setting expects a directory respectively that holds a number of public key files or certificate files.
trusted-signature-keys
- PGP: specifies the directory from which PGP public keys are used to verify the signature of deployed objects.
- X509: specifies the directory from which X509 certificates are used to verify the signature of deployed objects.

js7.journal: Journal Release Permissions

...

The Controller writes a journal of events that e.g. result from order state transitions such as an order starting, failing, completing etc.
The journal file will grow unlimited if events are not released. Typically events are consumed by JOC Cockpit and are added to the order and task history. With events being stored persistently to the JOC Cockpit database they can be released from the Controller's journal. The Controller accordingly will free the space consumed by its journal files.
users-allowed-to-release-events: specifies the list of accounts that are allowed to send a command to the Controller to release events.
- Typically the "History" account is specified, this account is used by the JS7 - Configuration - JOC Cockpit.
- If more than one account is specified then events are released only after all accounts did send the command to release events to the Controller.

js7.web.https: HTTPS Certificates

...

The keystore includes the private key for the Controller's incoming HTTPS connections.
Private key type RSA and ECDSA are supported.
file: the full path to the location of the keystore file is expected.
key-password: Any keys included with the keystore are protected with a password. The same password has to be used for any private keys.
store-password: The keystore file is protected by a password.

...

Certificates are signed by a Certificate Authority (CA), alternatively a self-signed certificate can be used.
It is recommended to use certificates instead of public keys.
Certificates of type X509 are supported.

...

.

Space shortcuts

Page tree

Versions Compared

Old Version 1

New Version 2

Key

General Configuration

js7.journal.cluster: Journal Cluster Settings

js7.web.server: Authentication Settings

Security Configuration

js7.auth.users: HTTPS Authentication and Authorization

Dashboard Settings

Daily Plan Settings

Logger Settings

Database Connection Settings

Controller Connection Settings

HTTPS Connection Settings

Operational Settings

js7.configuration: Signature Keys

js7.journal: Journal Release Permissions

js7.web.https: HTTPS Certificates

Space shortcuts

Page tree

Page History

Versions Compared

Old Version 1

New Version 2

Key

General Configuration

js7.journal.cluster: Journal Cluster Settings

js7.web.server: Authentication Settings

Security Configuration

js7.auth.users: HTTPS Authentication and Authorization

Dashboard Settings

Daily Plan Settings

Logger Settings

Database Connection Settings

Controller Connection Settings

HTTPS Connection Settings

Operational Settings

js7.configuration: Signature Keys

js7.journal: Journal Release Permissions

js7.web.https: HTTPS Certificates