Introduction
This article explains configuration items available for Standalone Controllers and Controller instances in a JS7 - Controller Cluster.
- Controllers make Controllers makes use of two configuration files:
- the general configuration file
controller.conf
which that is available from at the following locations:- Windows:
C:\ProgramData\sos-berlin.com\js7\controller\var\config\controller.conf
- Unix
/var/sos-berlin.com/js7/controller/var/config/controller.conf
- the security configuration from
private.conf
which that is available from at the following locations:- Windows:
C:\ProgramData\sos-berlin.com\js7\controller\var\config\private.conf
- Unix:
/var/sos-berlin.com/js7/controller/var/config/private/private.conf
- The configuration format makes use of Typesafe Config, see JS7 - Configuration Format
- Controller instances have to be restarted in order to apply changes to
the - For HTTPS configuration please refer to the JS7 - Configuration Templates article.
Default Configuration
General Configuration File: controller.conf
...
Code Block |
---|
language | text |
---|
title | Default configuration: enable HTTP communication |
---|
linenumbers | true |
---|
|
# Allow HTTP connections without authentication
js7.web.server.auth.public = true |
...
server |
|
|
|
---|
|
|
| auth | public | true | false |
- This setting specifies public access to a Controller if incoming HTTP connections are to be used. If used with a value
true
then authentication is not applied. - Default:
true
Anchor |
---|
| js7-journal-cluster |
---|
| js7-journal-cluster |
---|
|
Controller Cluster ConfigurationIf a JS7 Controller If a JS7 Controller cluster is used then the following configuration has to be applied:
...
- A Secondary Controller instance specifies this setting to indicate that this instance starts as a standby node (Backup). Without When this setting being is not in place, both instances of a Controller Cluster will start as standalone instances.
- This setting is relevant for initial operation only. It is independent of which Controller instance later on will be the active one and which instance will be the standby instanceone.
- This setting has to be added by the user before start of starting a Secondary Controller.
Configuration Settings
...
js7 | journal | cluster |
|
|
|
---|
|
|
| nodes node |
|
|
|
|
|
| Primary | <url> |
|
|
|
| Backup | <url> |
|
|
|
| is-backup | <yes>yes|<no> | watches | <url> [,<url>] | no |
- This setting is used This setting is used for Controller instances in cluster mode only, it is not used for standalone Controller instances.
- The registration of Primary and Secondary Controller instances is performed by the JOC Cockpit during initial operation.
- Therefore the only setting required for cluster operation is is:
js7.journal.cluster.nodesnode.is-backup=yes
: For a Secondary Controller instance this setting specifies that during initial operation the given instance will be the inactive standby node.
- Additional settings can be applied. However, however, we recommend to use that the JOC Cockpit is used instead.
nodes
Primary, Backup
: For a Primary Controller instance this setting specifies the URLs of the Primary
and Backup
(Secondary) instance. The URL includes specification of the protocol http/https protocol, the hostname and port.
Security Configuration File: private.
...
- Watches are Agents in a JS7 environment that are involved in the decision about a fail-over situation. If Controller instances in a cluster are not connected to each other any longer, e.g. due to network errors, then the majority of Agents decides if a fail-over should take place.
- At least one Agent has to be specified by its URL.
conf
Anchor |
---|
| js7-configuration-trusted-signature-keys |
---|
| js7-configuration-trusted-signature-keys |
---|
|
Directory for Trusted Certificates used to verify Signed Workflow SignaturesThe Controller requires X.509 certificates and/or PGP public keys to be in place. These are used to verify the signatures of signed workflows. Unsigned workflows will not be accepted by a Controller and will not be forwarded to Agents. Therefore a minimum of one X.509 certificate file or PGP public key file has to be present in the directories that are specified with the following configuration item:
Code Block |
---|
language | text |
---|
title | Default configuration: assign directories for trusted certificates |
---|
linenumbers | true |
---|
|
# Security configuration
js7 {
configuration {
# Locations of certificates and public keys used for signature verification
trusted-signature-keys {
PGP=${js7.config-directory}"/private/trusted-pgp-keys"
X509=${js7.config-directory}"/private/trusted-x509-keys"
}
}
|
Explanation:
- The Controller verifies signatures of scheduling objects such as workflows during deployment. This can be performed using PGP and X.509 signatures.
- The
trusted-signature-keys
setting specifies the location of PGP public keys and X.509 certificates. - If no PGP public keys are used or if no X.509 certificates are used then this setting should not be used as it is expected that the indicated directory is populated with public keys or certificates respectively.
Secure Configuration
It is essential to secure the connections between Controller, Agents and JOC Cockpit. This includes:
- using HTTPS connections which are secured by private keys and certificates,
- using authentication between JS7 products:
- Option 1 (recommended):
- applying TLS mutual authentication between JOC Cockpit and Controller
- applying TLS mutual authentication between Controller instances and Agents.
- Option 2:
- applying password authentication between JS7 products should mutual authentication not be in place.
Find examples of private.conf
files for Controller configuration for download:
- Standalone Controller
- Controller Cluster
Standalone Controller Configuration
Client Authentication
Anchor |
---|
| js7-auth-users-JOC |
---|
| js7-auth-users-JOC |
---|
|
JOC Cockpit Connections Code Block |
---|
language | yml |
---|
linenumbers | true |
---|
|
js7 {
auth {
# User accounts for https connections
|
HTTP Connections
...
- This setting specifies public access to a Controller if incoming HTTP connections are to be used. If used with a value
true
then no authentication is applied. - Default:
false
Secure Configuration
It is essential to secure the connections between Controller, Agents and JOC Cockpit. This includes:
- using HTTPS connections that are secured by private/public key and certificates,
- applying mutual authentication between Controller and Agent.
- Consider detailed explanations from the subsequent chapters.
Code Block |
---|
language | text |
---|
title | Secure configuration example: private.conf |
---|
linenumbers | true |
---|
collapse | true |
---|
|
# Security configuration
js7 {
auth {
# User accounts for HTTPS connections
users {
# Controller account for connections by primary/secondary controller instance
Controller {
users {
distinguished-names=[
# History account of JOC Cockpit (used to "DNQ=SOS CA, CN=controller-2-0-secondary, OU=IT, O=SOS, L=Berlin, ST=Berlin, C=DE"
release events)
History {
]
# for use with TLS mutual }authentication
# History account (used for release events)
History {
distinguished-names=[
"DNQ=SOS CA, CN=joc-2-0-primary, OU=IT, O=SOS, L=Berlin, ST=Berlin, C=DE",
"DNQ=SOS CA, CN=joc-2-0-secondary, OU=IT, O=SOS, L=Berlin, ST=Berlin, C=DE"
]
password="sha512:B793649879D61613FD3F711B68F7FF3DB19F2FE2D2C136E8523ABC87612219D5AECB4A09035AD88D544E227400A0A56F02BC990CF0D4CB348F8413DE00BCBF08"
}# for use with password authentication (default password stored with JOC Cockpit Settings)
# JOC account (reqires UpdateRepo permission for deployment)
password="sha512:B793649879D61613FD3F711B68F7FF3DB19F2FE2D2C136E8523ABC87612219D5AECB4A09035AD88D544E227400A0A56F02BC990CF0D4CB348F8413DE00BCBF08"
JOC {
# for use of an empty password
# distinguished-names=[password="plain:"
}
"DNQ=SOS CA, CN=joc-2-0-primary, OU=IT, O=SOS, L=Berlin, ST=Berlin, C=DE",
# JOC account of JOC Cockpit (requires UpdateItem permission for deployment)
"DNQ=SOS CA, CN=joc-2-0-secondary, OU=IT, O=SOS, L=Berlin, ST=Berlin, C=DE"
JOC {
# for use with TLS mutual ]authentication
password="sha512:3662FD6BF84C6B8385FC15F66A137AB75C755147A81CC7AE64092BFE8A18723A7C049D459AB35C059B78FD6028BB61DCFC55801AE3894D2B52401643F17A07FE"distinguished-names=[
permissions=[
"DNQ=SOS CA, CN=joc-2-0-primary, OU=IT, O=SOS, L=Berlin, ST=Berlin, C=DE",
UpdateRepo
"DNQ=SOS CA, CN=joc-2-0-secondary, OU=IT, O=SOS, L=Berlin, ]ST=Berlin, C=DE"
}
]
}
}
configuration# {
for use with password authentication (default password stored #with directoryJOC forCockpit trustedSettings)
public keys and certificates used with signatures
trusted-signature-keys {
password="sha512:3662FD6BF84C6B8385FC15F66A137AB75C755147A81CC7AE64092BFE8A18723A7C049D459AB35C059B78FD6028BB61DCFC55801AE3894D2B52401643F17A07FE"
PGP=${js7.config-directory}"/private/trusted-pgp-keys"
# for use of an empty password
X509=${js7.config-directory}"/private/trusted-x509-keys"
}
}# password="plain:"
journal {
# allow History account to release events to free space claimed by journals
permissions=[
users-allowed-to-release-events=[
UpdateItem
History
]
}
web {
}
# keystore and truststore location for HTTPS connections }
https {
keystore {
# Default: ${js7.config-directory}"/private/https-keystore.p12"
file=${js7.config-directory}"/private/https-keystore.p12"
key-password=jobscheduler
store-password=jobscheduler
}
truststores=[
{
# Default: ${js7.config-directory}"/private/https-truststore.p12"
file=${js7.config-directory}"/private/https-truststore.p12"
store-password=jobscheduler
}
]
}
}
}
|
Client Authentication
...
Explanation:
History
- Settings in this section are used for the History Service of JOC Cockpit instances that access the given Controller.
distinguished-names
password
- A default password is specified with the section joc of the JS7 - Settings page of JOC Cockpit and in the
private.conf
file. The password
is used for authentication of the History
service account with the Controller, for details see next chapter about password authentication. - The password setting cannot be omitted, however, an empty password can be specified like this:
- At the same time the password setting in JOC Cockpit has to be assigned an empty value.
JOC
- Settings in this section are used for services running in JOC Cockpit instances that access the given Controller.
distinguished-names
: The same applies as for the History
setting described above.permissions
: JOC Cockpit requires the UpdateItem
permission to enable users to deploy objects such as workflows.password
: The same applies as for the History
setting described above.
Anchor |
---|
| js7-auth-users-Agent |
---|
| js7-auth-users-Agent |
---|
|
Agent ConnectionsNo settings are required when using mutual authentication with Agents.
Consider the below chapter HTTPS Keystore and Truststore Access for explanations:
- The Controller instance's keystore has to hold the Client Authentication private key and certificate.
- The Controller instance's truststore has to hold the Root CA Certificate used when signing the Agent's Server Authentication Certificate.
Password Authentication
Anchor |
---|
| js7-auth-users-password-JOC |
---|
| js7-auth-users-password-JOC |
---|
|
JOC Cockpit Connections Code Block |
---|
language | yml |
---|
linenumbers | true |
---|
|
js7 {
auth {
# User accounts for https connections
|
Code Block |
---|
language | yml |
---|
linenumbers | true |
---|
|
js7 {
auth {
# User accounts for https connections
users {
# Controller account for connections by primary/secondary Controller instance
Controller {
users distinguished-names=[{
# History account of JOC Cockpit (used to "DNQ=SOS CA, CN=controller-2-0-secondary, OU=IT, O=SOS, L=Berlin, ST=Berlin, C=DE"
release events)
History {
]
# for use with }
password authentication (default password stored with JOC Cockpit Settings)
}
password="sha512:B793649879D61613FD3F711B68F7FF3DB19F2FE2D2C136E8523ABC87612219D5AECB4A09035AD88D544E227400A0A56F02BC990CF0D4CB348F8413DE00BCBF08"
}
} |
Explanation:
- This setting applies to use of a Controller Cluster.
- This setting specifies the distinguished name indicated with the pairing Controller's Client Authentication certificate. The certificate acts as a replacement for a password.
- The Controller configuration specifies the distinguished name of a pairing Controller that would access this Controller by use of a Client Authentication certificate.
- Consider that the common name (CN) setting in the distinguished name has to match the fully qualified domain name (FQDN) of a Controller's host.
Server Authentication
...
Code Block |
---|
language | yml |
---|
linenumbers | true |
---|
|
js7 {
web }
# JOC account of JOC Cockpit (requires UpdateItem permission for deployment)
JOC {
# keystore and truststore location for https connections
# for use with password authentication (default httpspassword {
stored with JOC Cockpit Settings)
keystore {
password="sha512:3662FD6BF84C6B8385FC15F66A137AB75C755147A81CC7AE64092BFE8A18723A7C049D459AB35C059B78FD6028BB61DCFC55801AE3894D2B52401643F17A07FE"
# Default: ${js7.config-directory}"/private/https-keystore.p12"
permissions=[
file=${js7.config-directory}"/private/https-keystore.p12"
UpdateItem
key-password=jobscheduler
]
store-password=jobscheduler
}
truststores=[}
{
# Default: ${js7.config-directory}"/private/https-truststore.p12"
file=${js7.config-directory}"/private/https-truststore.p12"
store-password=jobscheduler
}
]
}
}
} |
Explanation:
Explanation:
History
- Settings in this section are used for the History Service of JOC Cockpit instances that access the given Controller.
JOC
- Settings in this section are used for services running in JOC Cockpit instances that access the given Controller.
permissions
: JOC Cockpit requires the UpdateItem
permission to enable users to deploy objects such as workflows.
- The
password
is used for authentication of the History
and JOC
service accounts with the Controller. Both accounts are typically running in the same JOC Cockpit instance.
- If HTTP connections are used then the password is the only means for authentication.
- The password is specified with the section joc of the JS7 - Settings page of JOC Cockpit and in the
private.conf
file.- User Input to the Settings page of JOC Cockpit can look like this:
Image Added
Input to the GUI simply accepts the password and does not require to use the prefixes sha512:
or plain:.
- In the
private.conf
file a hashed value or a plain text value can be specified like this:password="sha512:B793649879D6..."
password="plain:JS7-History"
- If the password is modified in the
private.conf
file then it also has to be modified in the JOC Cockpit settings too in order to make passwords match. - The password setting cannot be omitted, however, an empty password can be specified, for example with mutual authentication HTTPS connections, like this:
- From the
private.conf
file that ships by default the plain text value and the hashed values are:- History:
- Plain Text:
JS7-History
- Hash:
sha512:B793649879D61613FD3F711B68F7FF3DB19F2FE2D2C136E8523ABC87612219D5AECB4A09035AD88D544E227400A0A56F02BC990CF0D4CB348F8413DE00BCBF08
- JOC:
- Plain Text:
JS7-JOC
- Hash:
sha512:3662FD6BF84C6B8385FC15F66A137AB75C755147A81CC7AE64092BFE8A18723A7C049D459AB35C059B78FD6028BB61DCFC55801AE3894D2B52401643F17A07FE
- There are a number of ways to create sha512 hash values from passwords.
- One possible solution includes using:
echo -n "JS7-JOC" | openssl dgst -sha512
Anchor |
---|
| js7-auth-users-password-Agent |
---|
| js7-auth-users-password-Agent |
---|
|
Agent Connections Code Block |
---|
language | yml |
---|
linenumbers | true |
---|
|
js7 {
auth {
# Controller ID for connections by primary/secondary Controller instance
agents {
agent-001="plain:secret-agent-001"
agent-002="plain:secret-agent-002"
agent-003="plain:secret-agent-003"
}
}
} |
Explanation:
- The Agent ID for each Agent is specified from the examples
agent-001
, agent-002
etc. An Agent is assigned a unique Agent ID during initial operation with JOC Cockpit. The Agent ID cannot be changed unless an Agent's journal is dropped. - A plain text password is specified that is preceded with
plain:
. Passwords should be quoted.
Controller Cluster Configuration
Client Authentication
Anchor |
---|
| js7-auth-users-Controller |
---|
| js7-auth-users-Controller |
---|
|
Controller Connections Code Block |
---|
language | yml |
---|
linenumbers | true |
---|
|
js7 {
auth {
# User accounts for https connections
users {
# Controller ID for connections by primary/secondary Controller instance
Controller {
distinguished-names=[
"DNQ=SOS CA, CN=controller-2-0-secondary, OU=IT, O=SOS, L=Berlin, ST=Berlin, C=DE"
]
}
}
}
} |
Explanation:
- Note that the
Controller
element name is an example that has to be replaced by the Controller ID which is specified with identical values during installation of both Controller instances in a cluster. - The
distinguished-names
setting indicates the subject of the pairing Controller's Client Authentication certificate. The certificate and subject authenticate the pairing Controller without use of passwords.
JOC Cockpit Connections
The configuration is the same as for a Standalone Controller, see JOC Cockpit Connections
Password Authentication
Anchor |
---|
| js7-auth-users-password-Controller |
---|
| js7-auth-users-password-Controller |
---|
|
Controller Connections Code Block |
---|
language | yml |
---|
linenumbers | true |
---|
|
js7 {
auth {
# User accounts for https connections
users {
# Controller ID for connections by primary/secondary Controller instance
Controller {
password = "plain:secret"
}
}
}
} |
Explanation:
- Note that the
Controller
element name is an example that has to be replaced by the Controller ID which is specified with identical values during installation of both Controller instances in a cluster. - If the password is modified in the
private.conf
file of a Primary Controller instance then it also has to be modified for the Secondary Controller instance to make passwords match. - A plain-text password has to be specified that is preceded with
plain:
: Passwords should be quoted.
JOC Cockpit Connections
The configuration is the same as for a Standalone Controller, see JOC Cockpit Connections.
Keystore and Truststore
Settings in this section apply to both Standalone Controller and Controller Cluster instances.
Anchor |
---|
| js7-web-https-keystore |
---|
| js7-web-https-keystore |
---|
|
HTTPS Keystore and Truststore Access Code Block |
---|
language | yml |
---|
linenumbers | true |
---|
|
js7 {
web {
# keystore and truststore location for https connections
https {
client-keystore {
# Default: ${js7.config-directory}"/private/https-client-keystore.p12"
file=${js7.config-directory}"/private/https-client-keystore.p12"
key-password="jobscheduler"
store-password="jobscheduler"
}
keystore {
# Default: ${js7.config-directory}"/private/https-keystore.p12"
file=${js7.config-directory}"/private/https-keystore.p12"
key-password="jobscheduler"
store-password="jobscheduler"
# alias=
}
truststores=[
{
# Default: ${js7.config-directory}"/private/https-truststore.p12"
file=${js7.config-directory}"/private/https-truststore.p12"
store-password="jobscheduler"
# alias=
}
]
}
}
} |
Explanation:
- HTTPS keystore and truststores are used to hold private keys and certificates.
- Keystore and truststore settings accept the path to a file in PKCS12 format or in PEM format.
- The keystore holds the Controller instance's private key and certificate. This information is used:
- for Server Authentication with the JOC Cockpit and
- for Client Authentication with Agents.
- The truststore holds the certificate(s) used to verify:
- Client Authentication certificates presented by the JOC Cockpit and
- Server Authentication certificates presented by Agents.
- A number of truststores can be specified
- Optionally a separate HTTPS client keystore can be used:
- The client keystore is used for TLS mutual authentication and holds a private key and certificate created for
Client Auth
extended key usage. - When using TLS mutual authentication then:
- a single certificate can be used that is generated for both
Server Auth
and Client Auth
extended key use. In this case do not use the HTTPS client keystore but use the HTTPS keystore to hold the certificate. - separate certificates can be used with the certificate for
Server Auth
key usage being stored with the HTTPS keystore and the certificate for Client Auth
key use being stored with the HTTPS client keystore.
- For details see
Jira |
---|
server | SOS JIRA |
---|
columns | key,summary,type,created,updated,due,assignee,reporter,priority,status,resolution |
---|
serverId | 6dc67751-9d67-34cd-985b-194a8cdc9602 |
---|
key | JS-1959 |
---|
|
HTTPS keystore and truststore are used to hold private keys and certificates- The keystore holds the Controller instance's private key and certificate. This information is used
- for Server Authentication with JOC Cockpit and
- for Client Authentication with Agents.
- The truststore holds the certificate(s) used to verify
- Client Authentication certificates presented by JOC Cockpit and
Server Authentication certificates presented by Agents.
Keystore and Truststore locations are specified. In addition:- for the keystore a password for the private keys included in the keystore and a password for access to the keystore can be specified
- for the truststore a password for access to the truststore can be specified.
Passwords for keystores and truststores have no tendency to improve keystore and truststore are not intended for security of the configuration: the passwords have to be specified as plain text and have to be in reach of the Controller. This mechanism is not too different from hiding the key under your doormat. In fact limiting ownership and access permissions for keystore and truststore files to the JS7 Controller's run-time account are more important than using a password, they are used to verify the integrity of certificate stores as the password used for creating and reading the certificate store must be the same.- The
key-password
is used for access to a private key in a keystore. - The
store-password
setting is used for access to a keystore or to a truststore. - For PKCS12 (*.p12) keystores both settings have to use the same value. The settings can be omitted if no passwords are used.
The alias
setting can be used for example with a keystore that holds a number of private keys from which the relevant private key is selected by its alias name.Summary of Configuration Items
General Configuration File: controller.conf
js7.web.server: Authentication Settings
js7 | web | server |
|
|
|
---|
|
|
| auth | public | <true>true |<false> false |
- This setting specifies public access to a Controller if insecure HTTP connections are to be used. If used with the value
true
then no HTTP Server Authentication is not applied. - Default:
false
true
Security Configuration File: private.conf
Anchor |
---|
| js7-auth-users |
---|
| js7-auth-users |
---|
|
js7.auth.users: HTTPS Authentication and Authorizationjs7 | auth | users |
|
|
|
---|
|
|
| Controller <controller-id> |
|
|
|
|
|
| distinguished-names | <distinguished<distinguished-name>name>[,<distinguished<distinguished-name>] |
|
|
|
| password | plain:<password> |
|
|
| History |
|
|
|
|
|
| distinguished-names | <distinguished<distinguished-name>name>[,<distinguished<distinguished-name>] |
|
|
|
| password | plain:<text><password>|sha512:<hashed<password-password>hash> |
|
|
| JOC |
|
|
|
|
|
| distinguished-names | <distinguished<distinguished-name>name>[,<distinguished<distinguished-name>] |
|
|
|
| password | plain:<text><password>|sha512:<hashed<password-password>hash> |
|
|
|
| permissions | UpdateRepo UpdateItem |
- An additional authentication mechanism is applied when using HTTPS Server Authentication certificates or public keys for incoming connections, see . See below: the client of the incoming connection, e.g. JOC Cockpit, is is required to provide a Client Authentication certificate and a password. This includes two certificates that which are in place for a secure HTTPS connection: the given Controller's Server Authentication certificate and the JOC Cockpit's Client Authentication certificate. . As an alternative to Client Authentication a password can be used.
- The fact that a given certificate is to be used for Server Authentication and/or Client Authentication is specified with the key usage when the when the certificate is being created and signed.
- The distinguished name that is specified with the Controller's configuration has to match the Client Authentication Certificate's or Client public key's subject attribute. This attribute specifies the hostname and additional information that is created when the certificate or public key is generated..
<controller-id>
- This element holds the Controller ID that has been specified during installation of a Standalone Controller or Controller Cluster.
- Settings in this section are used for connections from a pairing Controller instance.
distinguished-names
- Specifies the distinguished name as given with the subject of the Client Authentication Certificate for incoming HTTPS connections of
Controller
- Settings in this section are used for connections from
- a pairing Controller instance
, e.g. for a Secondary Controller instance if the given configuration is used for the Primary Controller instance and vice versa. - .
- One or two distinguished names can be specified allowing incoming HTTPS connections from a Standalone Controller or Controller Cluster.
History
distinguished-names
: the same applies as for the <controller-id>
setting described above. The JOC Cockpit Client Authentication certificate is used.password
: a symmetric password that is used for authentication of the History Service to the Controller for both HTTP and HTTPS connections, see below.
JOC
distinguished-names
: Specifies the distinguished name as given with the subject of the Client Authentication Certificate for incoming HTTPS connections of a pairing Controller instance.- Any number of distinguished names can be specified allowing a number of incoming HTTPS connections from different Controller instances. At a given point in time only one pairing Controller instance can connect to the given Controller.
History
- Settings in this section are used for the History Service of JOC Cockpit instances that access the given Controller.
distinguished-names
: the same as for the Controller
setting.password
: a password has to be used in addition to use of a certificate or public key. In addition the password is used if incoming HTTP connections are allowed.
JOC
Settings in this section are used for JOC Cockpit instances that access the given Controller.distinguished-names
: the same as for the Controller
setting.password
: a password has to be used in addition to use of a certificate or public key. In addition the password is used if incoming HTTP connections are allowed.permissions
: JOC Cockpit requires the UpdateRepo
permission to enable users to deploy objects such as workflows.- same applies as for the
<controller-id>
setting described above. The JOC Cockpit Client Authentication certificate is used. password
: a symmetric password is used for authentication of the History Service to the Controller for both HTTP and HTTPS connections, see below.permissions
: JOC Cockpit requires the UpdateItem
permission to enable users to deploy objects such as workflows.
The password
is used for authentication of the History
and JOC
service accounts with the Controller. Both accounts are typically running in the same JOC Cockpit instance.
- If the password is modified in the
private.conf
file then it also has to be modified in the JOC Cockpit settings to make the passwords match. - The password setting cannot be omitted, however, an empty password can be specified, for example with mutual authentication HTTPS connections, like this:
- From the
private.conf
file that ships by default the plain text value and the hashed values are:- History:
- Plain Text:
JS7-History
- Hash:
sha512:B793649879D61613FD3F711B68F7FF3DB19F2FE2D2C136E8523ABC87612219D5AECB4A09035AD88D544E227400A0A56F02BC990CF0D4CB348F8413DE00BCBF08
- JOC:
- Plain Text:
JS7-JOC
- Hash:
sha512:3662FD6BF84C6B8385FC15F66A137AB75C755147A81CC7AE64092BFE8A18723A7C049D459AB35C059B78FD6028BB61DCFC55801AE3894D2B52401643F17A07FE
Anchor |
---|
| js7-auth-agents |
---|
| js7-auth-agents |
---|
|
js7.auth.agents: HTTPS Authentication and Authorizationjs7 | auth | agents |
|
|
---|
|
|
| <Agent ID> | plain:<password> |
|
|
| <password> | <Agent ID> | <password> plain:<password> |
- By default for HTTPS connections both Server Authentication Certificates and Client Authentication Certificates are used for HTTPS connections. If no Client Authentication Certificates should are to be used then the Controller has to use a password to authenticate with an Agent.
- For each Agent the
<Agent ID>
and a plain-text password is specified. A plain-text password is required. required that can be specified using the prefix plain:
. Passwords should be quoted The same password has to be specified with the Agents private.conf
configuration file.
Anchor |
---|
| js7-web-https |
---|
| js7-web-https |
---|
|
js7.web.https: HTTPS Certificatesjs7 | web | https |
|
|
|
---|
|
|
| keystore |
|
|
|
|
|
| file | <path> |
|
|
|
| key-password | <password> |
|
|
|
| store-password | <password> |
|
|
|
| alias | <identifier> |
|
|
| client-keystore |
|
|
|
|
|
| file | <path> |
|
|
|
| key-password | <text> <password> |
|
|
|
| store-password | <password> |
|
|
|
| alias | <text> <identifier> |
|
|
| truststores |
|
|
|
|
|
| file | <path> |
|
|
|
| store-password | <password> |
|
|
|
| alias | <identifier> <text> |
- This setting is used to specify the location of a keystore and any truststores used for HTTPS connections.
- Keystore and truststore files are expected in PKCS12 format or in PKCS#12 PEM format.
keystore
- The keystore includes the private key for the Controller's incoming HTTPS connectionsServer Authentication Certificate.
- Private key types RSA and ECDSA are supported.
file
: the full path to the location of the keystore file is expected.key-password
: Any keys included with the keystore are protected with a password. The same password has to be used for all private keys in the given keystore.- are supported.
file
: the path to the location of the keystore file is expected.key-password
: Any keys included with the keystore are protected with a password. The same password has to be used for all private keys in the given keystore.store-password
: The keystore file is protected by a password.alias
: can be used for example with a keystore that holds a number of private keys from which the relevant private key is selected by its alias name.
client-keystore
- Use of this setting is optional. It can be used if separate certificates for Server Authentication and Client Authentication are used.
- The Client Authentication private key and certificate can be added to this keystore.
- Included configuration items correspond to the
keystore
settingstore-password
: The keystore file is protected by a password.
truststores
- A truststore contains the certificates or public keys for to verify the Controller's incoming HTTPS connections.
- Certificates are signed by a Certificate Authority (CA), alternatively a self-signed certificate can be used.
- It is recommended that certificates are used instead of public keys.
- Certificates of type X.509 are supported.
file
: the full path to the location of the truststore file is expected.store-password
: A truststore file is protected by a password.alias
: can be used for example with a truststore that holds a number of certificates from which the relevant certificate is selected by its alias name.- A number of truststores can be specified by repeating the
file
and ,
store-password
and optionally alias
settings.
Anchor |
---|
| js7-web-server |
---|
| js7-web-server |
---|
|
js7.web.server: HTTPS Authenticationjs7 | web | server |
|
|
|
---|
|
|
| auth |
|
|
|
|
|
| https-client-authentication | <onon |off> off |
- This setting is used to specify the authentication type for HTTPS connections to a Controller.
https-client-authentication
- The value
on
(default) specifies that mutual authentication with certificates for Server Authentication and Client Authentication is used. - The value
off
specifies that HTTP Basic Authentication only is used.
- By default JS7 makes use of mutual authentication including both Server and Client Authentication Certificates. This setting can be switched off to use Server Authentication Certificates only.
Anchor |
---|
| js7-configuration |
---|
| js7-configuration |
---|
|
js7.configuration: Trusted Signature Keysjs7 | configuration |
|
|
|
---|
|
| trusted-signature-keys |
|
|
|
|
| PGP | <directory> |
|
|
| X509 | <directory> |
- The Controller expects a signature Fof receives signatures for any deployed objects such as workflows. Such signatures are created with a private key and are verified by the Controller based on the available certificates. Agents perform similar signature verification and are configured accordingly.
- When deploying objects with JOC Cockpit:
- for a Low low Security Level JOC Cockpit creates the signature from a single private key that is used for any JOC Cockpit user accounts allowed to deploy objects.
- for a Medium medium Security Level JOC Cockpit creates the signature from the private key of the JOC Cockpit user account that deploys objects.
- for a High high Security Level the user creates the signature outside of JOC Cockpit and uploads the signed objects.
- The Controller supports PGP public keys and X.509 certificates. This setting expects a directory that holds a number of public key files or certificate files.
trusted-signature-keys
PGP
: specifies the directory from which PGP public keys are used to verify the signature signatures of deployed objects.X509
: specifies specifies the directory from which X.509 certificates are used to verify the signature signatures of deployed objects.
js7.journal: Journal Release Permissionsjs7 | journal |
|
|
---|
|
| users-allowed-to-release-events | <account><account>[,<account><account>] |
- The Controller writes a journal of events that, for example, results result from order state transitions such as an order starting, failing, completing etc.
- The journal file will grow indefinately indefinitely if events are not released. Typically events are consumed by the JOC Cockpit and are added to the order and task history. Events are released from the Controller's journal once they have been stored persistently to in the JOC Cockpit database. The Controller accordingly will then free the space consumed by its journal files.
users-allowed-to-release-events
: specifies the list of accounts that are allowed to send a command to the Controller to release events.- Typically the "History" account is specified, this account is used by JOC Cockpit.
- If more than one account is specified then events are released only after all accounts have sent the command to release events to the Controller.
...