JS7 JobScheduler

Space shortcuts

Page tree

Versions Compared

Old Version 2

changes.mady.by.user Andreas Püschel

Saved on

compared with

New Version Current

changes.mady.by.user Andreas Püschel

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Table of Contents

Introduction

The article is focused on configuration items used for HTTPS Server Authentication with passwords. For a complete overview of settings see JS7 - Controller Configuration Items and JS7 - Agent Configuration Items,

  • HTTPS Server Authentication is preferably used in combination with Client Authentication (mutual authentication) as this allows a secure configuration without the use of passwords.
    • The purpose of Server Authentication is to secure the identity of an http HTTP server and to encrypt the communication between client and server.
    • The purpose of Client Authentication is to prove the identity of a client. Without proof of identity any http HTTP client could perform a man-in-the-middle attack e.g. by by, for example, pretending to be a Controller that connects to an Agent.
  • Consider Please refer to the communication scheme between JS7 components products as explained from described in the JS7 - System Architecture article:
    • User browsers acting as http HTTPS clients establish connections to JOC Cockpit as an http HTTPS server.
    • JOC Cockpit acting as an http HTTPS client establishes connections to Controllers Controller instances acting as http HTTPS servers.
    • Controllers Controller instances acting as http HTTPS clients establish connections to Agents acting as http HTTPS servers.
  • We recommend It is recommended to apply TLS mutual authentication, however. However, there might be reasons why use of Client Authentication is not an immediate option, e.g.for example:
    • Use of a wildcard certificate for Server Authentication leverages the effort for certificate management. At the same time such certificates cannot be used for Client Authentication.
  • Should If mutual authentication is not be an immediate option then passwords can be used by following the recommendations from made in this article for the handling of passwords apply.

...

Location of Configuration

...

Download: private.conf

Files

In the following the JS7_CONTROLLER_CONFIG_DIR placeholder specifies the configuration directory of the Controller. The JS7_AGENT_HOME, JS7_AGENT_CONFIG_DIR placeholders specify the directories where the Agent is installed and configured.

Controller Configuration

Configuration File: JS7_CONTROLLER_CONFIG_DIR/private/private.conf

Find examples for Controller configuration for download:


Code Block
languageyml
titleController configuration file: private.conf
linenumberstrue
collapsetrue
js7 {
    auth {
        # User accounts for HTTPS connections
        users {
            # Controller ID for connections by primary/secondary Controller instance
            Controller
Code Block
languageyml
titleController configuration file: private.conf
linenumberstrue
collapsetrue
js7 {
    auth {
        # User accounts for HTTPS connections
        users {
            # Controller account for connections by primary/secondary Controller instance
            Controller {
            }
            # History account (used to release events)
            History {
                password="sha512:B793649879D61613FD3F711B68F7FF3DB19F2FE2D2C136E8523ABC87612219D5AECB4A09035AD88D544E227400A0A56F02BC990CF0D4CB348F8413DE00BCBF08"
            }
            # JOC account (requires UpdateRepo permission for deployment)
            JOC {
                password="sha512:3662FD6BF84C6B8385FC15F66A137AB75C755147A81CC7AE64092BFE8A18723A7C049D459AB35C059B78FD6028BB61DCFC55801AE3894D2B52401643F17A07FE"
                permissions=[
                    UpdateItem
                ]
            }
        }

        # for each Agent specify Agent ID and plain text password for authentication
        agents {
           agent-dev-001="secret"
           agent-dev-002="secret"
        }
    }

    configuration {
        # directory for trusted public keys and certificates used with signatures password="plain:secret"
        trusted-signature-keys {
   }

         PGP=${js7.config-directory}"/private/trusted-pgp-keys"
   # History account of JOC Cockpit (used to  X509=${js7.config-directory}"/private/trusted-x509-keys"
release events)
            }History {
    }

    journal {
        # allow History account to release unused journalspassword="sha512:B793649879D61613FD3F711B68F7FF3DB19F2FE2D2C136E8523ABC87612219D5AECB4A09035AD88D544E227400A0A56F02BC990CF0D4CB348F8413DE00BCBF08"
            }

        users-allowed-to-release-events=[
    # JOC account of JOC Cockpit (requires UpdateItem permission for Historydeployment)
        ]
    }

   JOC web {
         # keystore and truststore location for https connections password="sha512:3662FD6BF84C6B8385FC15F66A137AB75C755147A81CC7AE64092BFE8A18723A7C049D459AB35C059B78FD6028BB61DCFC55801AE3894D2B52401643F17A07FE"
        https {
       permissions=[
     keystore {
              UpdateItem
  # Default: ${js7.config-directory}"/private/https-keystore.p12"
            ]
    file=${js7.config-directory}"/private/https-keystore.p12"
        }
        key-password=jobscheduler}

        # for each Agent specify Agent ID  store-password=jobscheduler
  and plain text password for authentication
        agents  }{
            truststores=[agent-001="plain:secret-agent-001"
           agent-002="plain:secret-agent-002"
     {
      agent-003="plain:secret-agent-003"
        }
    }

   # Default:configuration ${js7.config-directory}"/private/https-truststore.p12"
        # directory for trusted public keys and certificates used with signatures
    file=    trusted-signature-keys {
            PGP=${js7.config-directory}"/private/https-truststore.p12trusted-pgp-keys"
            X509=${js7.config-directory}"/private/trusted-x509-keys"
        store-password=jobscheduler}
    }

    journal {
        # allow History }
account to release unused journals
        ]users-allowed-to-release-events=[
        }

    History
    # disable use of client authentication certificates]
    }

    serverweb {
        # keystore and truststore location for  authhttps connections
        https {
            keystore {
      https-client-authentication=off
          # Default: ${js7.config-directory}"/private/https-keystore.p12"
        }
     }
}

Explanation:

  • Consider that the above configuration has to be deployed to both Controller instances should a Controller Cluster be used.
  • Find below explanations about configuration items relevant to both Client and Server.

Specify Agent ID and Password

Code Block
languageyml
titlexx
linenumberstrue
js7 {
    auth {
   file=${js7.config-directory}"/private/https-keystore.p12"
                key-password=jobscheduler
   # for each Agent specify Agent ID and plain text password for authentication
   store-password=jobscheduler
        agents    {}
           agent-dev-001="secret"
 truststores=[
                agent-dev-002="secret"
{
         }
           # }
}

Explanation:

  • For each Agent the Agent ID is specified. An Agent is assigned a unique Agent ID during initial operation that cannot be changed.

Disable Client Authentication

Code Block
languageyml
titlexx
linenumberstrue
js7 {
Default: ${js7.config-directory}"/private/https-truststore.p12"
            web {
        # disable use of client authentication certificates
file=${js7.config-directory}"/private/https-truststore.p12"
               server {
    store-password=jobscheduler
        auth {
       }
         https-client-authentication=off   ]
        }

        # disable use of client authentication certificates
        server {
   }
         auth }
}

Explanation:

  • By default Client Authentication is required if Server Authentication is in place.
  • The above setting disables Client Authentication.

Agent Configuration

Download: private.conf

{
                https-client-authentication=off
            }
        }
    }
}

Explanation:

  • The configuration file is located in the JS7_CONTROLLER_CONFIG_DIR/private folder.
  • Note that the above configuration has to be deployed to both Controller instances if a Controller Cluster is to be used.
  • The configuration items relevant to Server Authentication from the example above are described in the following sections.

Specify Controller ID and Password

Code Block
collapse
languageyml
titleAgent configuration file: private.conf
linenumberstruetrue
# Security configuration
js7 {
    auth {
        # User accounts for httpsHTTPS connections
        users {
            # Controller accountID for connections by primary/secondary Controller instance
            js7_devController {
                 password="plain:secret"
            }
        }
     }
    
    configuration {
        # Locations of certificates and public keys used for signature verification
        trusted-signature-keys {
            PGP=${js7.config-directory}"/private/trusted-pgp-keys"
            X509=${js7.config-directory}"/private/trusted-x509-keys"
        }
    }
    
    job {
        # Enable script execution from signed workflows }
}

Explanation:

  • This setting is not required when using a Standalone Controller. It is used for password authentication between Controller instances in a cluster.
  • Note that the Controller element name is an example that has to be replaced by the Controller ID which is specified with identical values during installation of both Controller instances in a cluster.
  • If the password is modified in the private.conf file of a Primary Controller instance then it also has to be modified for the Secondary Controller instance to make passwords match.
  • A plain-text password has to be specified that is preceded with plain:: Passwords should be quoted.

Specify Agent ID and Password

Code Block
languageyml
linenumberstrue
js7 {
    auth {
        # for each Agent specify Agent ID and plain text password for authentication
        executionagents {
            signed-script-injection-allowed = yesagent-001="plain:secret-agent-001"
        }
    }agent-002="plain:secret-agent-002"
    
    web {
  agent-003="plain:secret-agent-003"
      # Locations of}
 keystore and  }
}

Explanation:

  • The Agent ID for each Agent is specified from the examples agent-001, agent-002 etc. An Agent is assigned a unique Agent ID during initial operation with JOC Cockpit. The Agent ID cannot be changed unless an Agent's journal is dropped.
  • A plain text password is specified that is preceded with plain:. Passwords should be quoted.

Disable Client Authentication

Code Block
languageyml
linenumberstrue
js7 {
    web {
truststore files for HTTPS connections
        https {
            keystore {
                # Default: ${js7.config-directory}"/private/https-keystore.p12"
                file=${js7.config-directory}"/private/https-keystore.p12"
        # disable use of client    key-password=jobschedulerauthentication certificates
        server {
       store-password=jobscheduler
     auth {
      }
            truststores=[https-client-authentication=off
            }
        }
}

Explanation:

  • By default Client Authentication is used if Server Authentication is in place.
  • The above setting disables Client Authentication.

Agent Configuration

Configuration File: JS7_AGENT_CONFIG_DIR/private/private.conf

Download: private.conf

Code Block
languageyml
titleAgent configuration file: private.conf
linenumberstrue
collapsetrue
js7 {
{
                 auth {
   # Default: ${js7.config-directory}"/private/https-truststore.p12"
                    file=${js7.config-directory}"/private/https-truststore.p12"
                    store-password=jobscheduler
                }
            ]
        }

     # User accounts for https connections
        users {
            # Controller ID for connections by primary/secondary Controller instance
            Controller {
                 password="plain:secret"
                 # password="sha512:bd2b1aaf7ef4f09be9f52ce2d8d599674d81aa9d6a4421696dc4d93dd0619d682ce56b4d64a9ef097761ced99e0f67265b5f76085e5b0ee7ca4696b2ad6fe2b2"
            }
        }
    }
    
    configuration {
        # Locations of certificates and public keys used for signature verification
        trusted-signature-keys {
            PGP=${js7.config-directory}"/private/trusted-pgp-keys"
            X509=${js7.config-directory}"/private/trusted-x509-keys"
        }
    }
    
    job {
        # Enable script execution from signed workflows
        execution {
            signed-script-injection-allowed = yes
        }
    }
    
    web {
        # Locations of keystore and truststore files for HTTPS connections
        https {
            keystore {
                # Default: ${js7.config-directory}"/private/https-keystore.p12"
                file=${js7.config-directory}"/private/https-keystore.p12"
                key-password="jobscheduler"
                store-password="jobscheduler"
                # alias=
            }
            truststores=[
                {
                    # Default: ${js7.config-directory}"/private/https-truststore.p12"
                    file=${js7.config-directory}"/private/https-truststore.p12"
                    store-password="jobscheduler"
                    # alias=
                }
            ]
        }

        # Disable use of client authentication
        server {
            auth {
                https-client-authentication=off
            }
        }
    }
}

Explanation:

  • The configuration file is located with the JS7_AGENT_CONFIG_DIR/private folder.
  • Consider that the above configuration has to be deployed to any Agent instances.
  • The configuration items relevant to Server Authentication with passwords from the example above are described in the following sections.

Specify Controller ID and Password

Code Block
languageyml
linenumberstrue
js7 {
    auth {
        # User accounts for https connections
        users {
            # Controller ID for connections by primary/secondary Controller instance
            Controller {
                 password="plain:secret-agent-001"
                 # password="sha512:fcef10f554e086d2f572fed70e494a6e03eac3034d1c928a9553bc9435b2b94081183958b5d1f53088b6ed2c1a968b1c4322854163a01a671cf07a1cd59ea006"
            }
        }
    }

Explanation:

  • In this example Controller is the Controller ID used by a Standalone Controller or by a Controller Cluster. A Controller is assigned a unique Controller ID during installation. The Controller ID cannot be changed unless the Controller's journal is reset.
  • The password for the Controller ID in the Agent configuration is the same as stated in the Controller configuration with the js7.auth.agents setting.
    • The password has to be preceded with plain: if a plain text password is used.
    • The password has to be preceded with sha512: if a password hashed with this algorithm is used
      • There are a number of ways to create sha512 hash values from passwords.
      • One possible solution includes using:  echo -n "secret-agent-001" | openssl dgst -sha512

Disable Client Authentication

Code Block
languageyml
linenumberstrue
js7 {
    web {
        # disable use of client authentication certificates
        server {
            auth {
                https-client-authentication=off
            }
        }
    }
}

...

Explanation:
  • By default Client Authentication is used if Server Authentication is in place.
  • The above setting disables Client Authentication.