JS7 JobScheduler

Space shortcuts

Page tree

Versions Compared

Old Version 35

changes.mady.by.user Andreas Püschel

Saved on

compared with

New Version 36

changes.mady.by.user Andreas Püschel

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  • using HTTPS connections that are secured by private/public key and certificates,
  • applying mutual authentication between JOC Cockpit and Controller as well as between Controller and Agent.
  • Consider detailed explanations from the subsequent chapters.

...

  • An additional authentication mechanism is applied when using HTTPS Server Authentication certificates or public keys for incoming connections, see below: the client of the incoming connection, e.g. JOC Cockpit, is required to provide a Client Authentication certificate and a password. This includes two certificates that are in place for a secure HTTPS connection: the given Controller's Server Authentication certificate and the JOC Cockpit's Client Authentication certificate. 
    • The fact that a given certificate is to be used for Server Authentication and/or Client Authentication is specified with the key usage when the certificate is being created and signed.
    • The distinguished name that is specified with the Controller's configuration has to match the Client Authentication Certificate's or Client public key's subject attribute. This attribute specifies the hostname and additional information that is created when the certificate or public key is generated.
  • <controller-id>
    • This element holds the Controller ID that is specified with the same value during installation of both Controller instances in a cluster.
    • Settings in this section are used for connections from a pairing Controller instance, e.g. for a Secondary Controller instance if the given configuration is used for the Primary Controller instance and vice versa. 
    • distinguished-names
      • Specifies the distinguished name as given with the subject of the Client Authentication Certificate for incoming HTTPS connections of a pairing Controller instance.
      • Any number of distinguished names can be specified allowing a number of incoming HTTPS connections from different Controller instances. At a given point in time only one pairing Controller instance can connect to the given Controller.
      • Except for whitespace between attributes the precise sequence and values as available from the certificate's subject has to match this property value.
  • History
    • Settings in this section are used for the History Service of JOC Cockpit instances that access the given Controller.
    • distinguished-names:  the same applies as for the above Controller setting. The JOC Cockpit Client Authentication certificate is used.
    • password: a symmetric password that is used for authentication of the History Service to the Controller for both HTTP and HTTPS connections, see below.
  • JOC
    • Settings in this section are used for services running in JOC Cockpit instances that access the given Controller.
    • distinguished-names:  the same applies as for the above Controller setting. The JOC Cockpit Client Authentication certificate is used.
    • password: a symmetric password that is used for authentication of the History Service to the Controller for both HTTP and HTTPS connections, see below.
    • permissions: JOC Cockpit requires the UpdateRepo permission to enable users to deploy objects such as workflows.
  • The password is used for authentication of the History and JOC service accounts with the Controller. Both accounts typically are running in the same JOC Cockpit instance. 
    • If HTTP connections are used then the password is the only means for authentication. If HTTPS connections with mutual authentication are used then the password is not relevant as certificate based authentication is in place.
    • The password is specified with the section joc of the Settings page of JOC Cockpit and in the private.conf file.
      • A hashed value or a plain text value can be specified like this:
        • password="sha512:B793649879D6..."
        • password="plain:JS7-History"
    • If the password is modified in the private.conf file then it has to be modified in the JOC Cockpit settings too to make the passwords match.
    • The password setting cannot be omitted, however, an empty password can be specified, for example with mutual authentication HTTPS connections, like this:
      • password="plain:"
    • If the password is modified in the private.conf file then it has to be modified in the JOC Cockpit settings too to make the passwords match.
    • The password setting cannot be omitted, however, an empty password can be specified, for example with mutual authentication HTTPS connections, like this:
      • password="plain:"
    • From the private.conf file that ships by default the plain text value and the hashed values areBy default the clear text for the hashed value is:
      • History: 
        • Plain Text: JS7-History
        • Hash: sha512:B793649879D61613FD3F711B68F7FF3DB19F2FE2D2C136E8523ABC87612219D5AECB4A09035AD88D544E227400A0A56F02BC990CF0D4CB348F8413DE00BCBF08
      • JOC:
        • Plain Text: JS7-JOC
        • Hash: sha512:3662FD6BF84C6B8385FC15F66A137AB75C755147A81CC7AE64092BFE8A18723A7C049D459AB35C059B78FD6028BB61DCFC55801AE3894D2B52401643F17A07FE

js7.auth.agents: HTTPS Authentication and Authorization

...