JS7 JobScheduler

Space shortcuts

Page tree

Versions Compared

Old Version 3

changes.mady.by.user Andreas Püschel

Saved on

compared with

New Version Current

changes.mady.by.user Andreas Püschel

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Table of Contents

Introduction

LDAP authentication for the JOC Cockpit is

...

provided by the JS7 - LDAP Identity Service and relies on a connection between the JS7 - REST Web Service API and the LDAP Server.

  • This connection should be secured, otherwise it is vulnerable for example server. It is desirable that this connection is secured as it would otherwise be vulnerable e.g. to man-in-the-middle attacks.
  • The LDAP server Server connection can be secured using two commonly available protocols "LDAP over TLS" (STARTTLS) and "LDAP over SSL" (LDAPS).
  • General information how to configure LDAP connections is available from the JS7 - LDAP Identity Service Configuration article.

This article describes the configuration of STARTTLS for use with the JS7 REST Web Service API and and a certificate truststore, as well as providing an example for use with

...

LDAPS

...

.

Secure Connection Schemes

Connection Content Encryption with STARTTLS

STARTTLS in is an extension to the LDAP protocol that uses the TLS protocol to encrypt communication. It works by establishing a normal - i.e. unsecured - connection with the LDAP server before a handshake negotiation between the server and the web service is carried out. Here, the server sends its certificate to prove its identity before the secure connection is established. If negotiation for a secure connection is unsuccessful then a standard LDAP connection may be opened as a fallback. Whether or not this occurs depends on the LDAP server Server and its configuration.

Connection Encryption with LDAPS

LDAPS is the non-standardized "LDAP over SSL" protocol that in contrast with STARTTLS only allows communication over a secure port such as 636. It establishes the secure connection before there is any communication with the LDAP serverServer. However, as LDAPS is not part of the LDAP standard, there is no guarantee that LDAPS client libraries actually verify the host name against the name Common Name provided with the LDAP server Server certificate. See here for more information https://shibboleth.net/community/advisories/secadv_20120227.txt for details.

Configuration

Anchor
configuration_ldap_tls
configuration_ldap_tls
Configuration for LDAP over TLS

When The following settings are available when managing the LDAP Identity Service the following settings are offered:


Explanation:

  • LDAP Server URL: The LDAP Server URL specifies the protocol ldap:// for the TLS connection. The protocol is added the hostname (FQDN) and port of are added to the LDAP Server protocol. No An IP address can cannot be used as it would not match the LDAP server Server certificate.
  • LDAP Start TLS: This switch makes TLS the protocol for the connection to the LDAP Server.
  • LDAP Host Name Verification: This switch has to be active to check if hostnames in the LDAP Server URL and in the LDAP Server certificate match.
  • LDAP Truststore Path: The TLS protocol requires a truststore to be used that used which holds an X.509 certificate specified for the Extended Key Usage of Server Authentication.
    • The truststore can include a selfSelf-signed certificate issued Certificate or a CA-signed certificateCertificate. Typically the Root CA certificate Certificate is used as otherwise the complete certificate chain involved in signing the Server Authentication certificate Certificate has to be available with the truststore.
    • If this setting is not specified then JOC Cockpit will use the truststore that is configured with the JETTY_BASE/resources/joc/joc.properties configuration file. This includes use of settings for the truststore password and truststore type.
    • The path to the truststore is specified relative to the JETTY_BASE/resources/joc directory. If the truststore is located in this directory then specify only the file name onlyis specified, typically with a .p12 extension. Other relative locations can be specified using e.g. ../../joc-truststore.p12 if the truststore is located in the JETTY_BASE directory. No absolute path can Absolute paths cannot be specified and no a path can cannot be specified that lies before the JETTY_BASE directory in the file system hierarchy.
  • LDAP Truststore Password: If the LDAP truststore is protected by a password, then the password has to be specified.
  • LDAP Truststore Type: The type of the indicated truststore has to be specified being either PKCS12 or JKS (deprecated).

Anchor
configuration_ldap_ssl
configuration_ldap_ssl
Configuration for LDAP over SSL

When managing the LDAP Identity Service the following settings are offeredavailable:


Explanation:

  • LDAP Server URL: The LDAP Server URL specifies the protocol ldaps:// for the SSL connection. The protocol is added the hostname (FQDN) and port of the LDAP Server.  No An IP address can cannot be used as it would not match the LDAP server Server certificate.
  • LDAP Start TLS: This switch is not used as it would make TLS the protocol for the connection to the LDAP Server.
  • For the remaining settings see explanations from chapter the Configuration for LDAP over TLS section above.

Certificate Management

For The certificates for use with both TLS and SSL protocols the certificates are distributed in a similar way.

Users can use certficates issued by a Private CA or by a Public CA.

Use with CA-signed Certificates


Flowchart
JOC [label="   JOC Cockpit   ",fillcolor="lightskyblue",fontname="Arial",fontsize="10pt"]
LDAP [label="   LDAP Server   ",fillcolor="lightskyblue",fontname="Arial",fontsize="10pt"]
 
JOC_Truststore [label="JOC Cockpit Truststore\n./jetty_base/resource/joc/joc.p12\nCA certificates",fillcolor="orange",fontname="Arial",fontsize="10pt"]
LDAP_Keystore [label="LDAP Server Keystore\nLDAP Server Private Key\nLDAP Server Certificate",fillcolor="orange",fontname="Arial",fontsize="10pt"]

CA_RootCertificate [shape="ellipse",shape="ellipse",label="Root CA Certificate",fillcolor="white",fontname="Arial",fontsize="10pt"]
CA_IntermediateCertificate [shape="ellipse",label="Intermediate CA Certificate",fillcolor="white",fontname="Arial",fontsize="10pt"]

LDAP_PrivateKey [shape="ellipse",label="LDAP Server Private Key",fillcolor="white",fontname="Arial",fontsize="10pt"]
LDAP_Keystore_Certificate [shape="ellipse",label="LDAP Server Certificate",fillcolor="white",fontname="Arial",fontsize="10pt"]

LDAP -> LDAP_Keystore 
LDAP_Keystore -> LDAP_PrivateKey -> LDAP_Keystore_Certificate [label=" in keystore ",fontname="Arial",fontsize="10pt"]

JOC -> JOC_Truststore
JOC_Truststore -> CA_RootCertificate -> CA_IntermediateCertificate [label=" add to truststore ",fontname="Arial",fontsize="10pt"]
CA_IntermediateCertificate -> LDAP_Keystore_Certificate [label=" verify in handshake ",fontname="Arial",fontsize="10pt"]

Use with

...

Self-

...

issued Certificates


Flowchart
JOC [label="   JOC Cockpit   ",fillcolor="lightskyblue",fontname="Arial",fontsize="10pt"]
LDAP [label="   LDAP Server   ",fillcolor="lightskyblue",fontname="Arial",fontsize="10pt"]
 
JOC_Truststore [label="JOC Cockpit Truststore\n./jetty_base/resource/joc/joc.p12\nLDAP Server Certificate",fillcolor="orange",fontname="Arial",fontsize="10pt"]
LDAP_Keystore [label="LDAP Server Keystore\nLDAP Server Private Key\nLDAP Server Certificate",fillcolor="orange",fontname="Arial",fontsize="10pt"]

LDAP_PrivateKey [shape="ellipse",label="LDAP Server Private Key",fillcolor="white",fontname="Arial",fontsize="10pt"]
LDAP_Keystore_Certificate [shape="ellipse",label="LDAP Server Certificate",fillcolor="white",fontname="Arial",fontsize="10pt"]
LDAP_Truststore_Certificate [shape="ellipse",label="LDAP Server Certificate",fillcolor="white",fontname="Arial",fontsize="10pt"]

LDAP -> LDAP_Keystore 
LDAP -> LDAP_Truststore_Certificate [label=" transfer to\nJOC Cockpit\ntruststore ",fontname="Arial",fontsize="10pt"]
LDAP_Keystore -> LDAP_PrivateKey -> LDAP_Keystore_Certificate [label=" in keystore ",fontname="Arial",fontsize="10pt"]

JOC -> JOC_Truststore
JOC_Truststore -> LDAP_Truststore_Certificate [label=" add to truststore ",fontname="Arial",fontsize="10pt"]
LDAP_Truststore_Certificate -> LDAP_Keystore_Certificate [label=" verify in handshake ",fontname="Arial",fontsize="10pt"]

Set up JOC Cockpit Truststore and import Certificates

The following steps are performed on the server that hosts the JOC Cockpit.

In the following the placeholder JETTY_BASE is  placeholder is used:

  • JETTY_BASE is Jetty's base directory that is specified during the JOC Cockpit installation:
    • C:\ProgramData\sos-berlin.com\joc (default on Windows)
    • /home/<setup-user>/sos-berlin.com/joc (default on Linux)

Consider information from the See the JS7 - JOC Cockpit HTTPS Connections articles about truststores for more information.

Example how to import Certificates

The following examples suggest imply use of the Java keytool utility, however, other tools might be applicable such as the OpenSSL CLI, Keystore Explorer etc.

  • Example for import of importing a certificate to a JOC Cockpit truststore in PKCS12 format:

    Code Block
    languagebash
    titleExample for import of LDAP Server Certificate to PKCS12 Keystore
    # import LDAP serverServer certificate to a truststore (joc.p12) by specifying the certificate file (ldap-certificate.crt) and alias name (ldap)
keytool -importcert -noprompt -file "ldap-certificate.crt" -alias "ldap" -keystore "JETTY_BASE/resources/joc/joc.p12" -storetype pkcs12 -storepass secret_store -trustcacerts

  • Example for import of importing a certificate to a JOC Cockpit truststore in JKS format:

    Code Block
    languagebash
    titleExmple for import of LDAP Server certificate to JKS Keystore
    # import LDAP serverServer certificate to a truststore (joc.jks) by specifying the certificate file (ldap-certificate.crt) and alias name (ldap)
keytool -importcert -noprompt -file "ldap-certificate.crt" -alias "ldap" -keystore "JETTY_BASE/resources/joc/joc.jks" -storetype jks -storepass secret_store -trustcacerts
  • Explanation
    • The -keystore option specifies the location of the truststore file.
    • The -storepass option specifies the password for access to the truststore.
    • The certificate file ldap-ertificate.crt should be available from the LDAP serverServer. Transfer this file to the JOC Cockpit server. Alternatively the server server certificate can be requested on-the-fly.

      • Example for request of server certificate:
         

        Code Block
        languagebash
        titleExample for request of server certificate from LDAP serverServer
        # connect to the LDAP serverServer (ldap_server) with the available port (636), in the server response you should find the certificate that you can copy & paste to a certificate file
openssl s_client -showcerts -connect ldap_server:636

      • If the certificate is signed by a CA then the certificate should can include the certificate chain of Root CA Root CA Certificate and Intermediate CA Certificate. Otherwise it might be required to concatenate the certificates into one file, for example:

        Code Block
        languagebash
        titleExample for use of a certificate chain
        # concatenate Root CA certificate and Intermediate CA certificate as provided from the LDAP serverServer to a single CA Bundle certificate file (ca-bundle.crt)
cat RootCACertificate.crt > ca-bundle.crt
cat IntermediateCACertificate.crt >> ca-bundle.crt

# import LDAP serverServer certificate and certificate chain to a truststore (joc.p12) by specifying the certificate file (ldap-certificate.crt) and alias name (ldap)
keytool -importcert -noprompt -file "ca-bundle.crt" -alias "ldap" -keystore "JETTY_BASE/resources/joc/joc.p12" storetype pkcs12 -storepass secret_store -trustcacerts

Example how to configure the JOC Cockpit Truststore

  • Find examples for entries in the JETTY_BASE/resources/joc/joc.properties configuration file to specify a truststore:

    • Example

      Code Block
      languagetext
      titleExample for joc.properties setting for a truststore in PKCS12 format
      truststore_path = joc.p12
truststore_type = PKCS12
truststore_password = secret_store

    • Example

      Code Block
      languagetext
      titleExample for joc.properties setting for a truststore in JKS format with relative location
      truststore_path = ../../joc.jks
truststore_type = JKS
truststore_password = secret_store

    • Explanation

      • Specify Specifies the location of the truststore with the truststore_path setting. A location relative to the JETTY_BASE/resources/joc directory can be specified. If only a file name only is specified such as with joc.p12 then this directory is assumed. Use of a relative path as with such as ../../joc.p12 would locate  locates the truststore file in the JETTY_BASE directory.

...