Page History

...

Security Configuration File: private.conf

Anchor
js7-auth-users js7-auth-users

js7.auth.users: HTTPS Authentication and Authorization

• An additional authentication mechanism is applied when using HTTPS Server Authentication certificates or public keys for incoming connections, see below: the client of the incoming connection, e.g. JOC Cockpit, is required to provide a Client Authentication certificate and a password. This includes two certificates that are in place for a secure HTTPS connection: the given Controller's Server Authentication certificate and the JOC Cockpit's Client Authentication certificate. 
  • The fact that a given certificate is to be used for Server Authentication and/or Client Authentication is specified with the key usage when the certificate is being created and signed.
  • The distinguished name that is specified with the Controller's configuration has to match the Client Authentication Certificate's or Client public key's subject attribute. This attribute specifies the hostname and additional information that is created when the certificate or public key is generated.
• <controller-id>
  • This element holds the Controller ID that is specified with the same value during installation of both Controller instances in a cluster.
  • Settings in this section are used for connections from a pairing Controller instance, e.g. for a Secondary Controller instance if the given configuration is used for the Primary Controller instance and vice versa. 
  • distinguished-names
    • Specifies the distinguished name as given with the subject of the Client Authentication Certificate for incoming HTTPS connections of a pairing Controller instance.
    • Any number of distinguished names can be specified allowing a number of incoming HTTPS connections from different Controller instances. At a given point in time only one pairing Controller instance can connect to the given Controller.
    • Except for whitespace between attributes the precise sequence and values as available from the certificate's subject has to match this property value.
• History
  • Settings in this section are used for the History Service of JOC Cockpit instances that access the given Controller.
  • distinguished-names:  the same applies as for the above Controller setting. The JOC Cockpit Client Authentication certificate is used.
  • password: a symmetric password that is used for authentication of the History Service to the Controller for both HTTP and HTTPS connections, see below.
• JOC
  • Settings in this section are used for services running in JOC Cockpit instances that access the given Controller.
  • distinguished-names:  the same applies as for the above Controller setting. The JOC Cockpit Client Authentication certificate is used.
  • password: a symmetric password is used for authentication of the History Service to the Controller for both HTTP and HTTPS connections, see below.
  • permissions: JOC Cockpit requires the UpdateRepo permission to enable users to deploy objects such as workflows.
• The password is used for authentication of the History and JOC service accounts with the Controller. Both accounts typically are running in the same JOC Cockpit instance. 
  
  • If HTTP connections are used then the password is the only means for authentication. If HTTPS connections with mutual authentication are used then the password is not relevant as certificate based authentication is in place.
  • The password is specified with the section joc of the the JS7 - Settings page  page of JOC Cockpit and in the private.conf file.
    • User Input to the Settings page of JOC Cockpit can look like this:
      
      
      
      Input to the GUI simply accepts the password and does not require to use the prefixes sha512: or plain:.
    • In the private.conf file a hashed value or a plain text value can be specified like this:
      • password="sha512:B793649879D6..."
      • password="plain:JS7-History"
  • If the password is modified in the private.conf file then it has to be modified in the JOC Cockpit settings too to make the passwords match.
  • The password setting cannot be omitted, however, an empty password can be specified, for example with mutual authentication HTTPS connections, like this:
    • password="plain:"
  • If the password is modified in the private.conf file then it has to be modified in the JOC Cockpit settings too to make the passwords match.
  • The password setting cannot be omitted, however, an empty password can be specified, for example with mutual authentication HTTPS connections, like this:
    • password="plain:"
  • From the private.conf file that ships by default the plain text value and the hashed values are:
    • History: 
      • Plain Text: JS7-History
      • Hash: sha512:B793649879D61613FD3F711B68F7FF3DB19F2FE2D2C136E8523ABC87612219D5AECB4A09035AD88D544E227400A0A56F02BC990CF0D4CB348F8413DE00BCBF08
    • JOC:
      • Plain Text: JS7-JOC
      • Hash: sha512:3662FD6BF84C6B8385FC15F66A137AB75C755147A81CC7AE64092BFE8A18723A7C049D459AB35C059B78FD6028BB61DCFC55801AE3894D2B52401643F17A07FE

Anchor
js7-auth-agents js7-auth-agents

js7.auth.agents: HTTPS Authentication and Authorization

• By default for HTTPS connections both Server Authentication Certificates and Client Authentication Certificates are used. If no Client Authentication Certificates should be used then the Controller has to use a password to authenticate with an Agent.
• For each Agent the <Agent ID> and a plain text password is specified. A plain-text password is required. The same password has to be specified with the Agents private.conf configuration file.

Anchor
js7-web-https js7-web-https

js7.web.https: HTTPS Certificates

• This setting is used to specify the location of a keystore and any truststores used for HTTPS connections.
• Keystore and truststore files are expected in PKCS#12 format.
• keystore
  • The keystore includes the private key for the Controller's incoming HTTPS connections.
  • Private key types RSA and ECDSA are supported. 
  • file:  the full path to the location of the keystore file is expected.
  • key-password: Any keys included with the keystore are protected with a password. The same password has to be used for all private keys in the given keystore.
  • store-password: The keystore file is protected by a password.
• truststores
  
  • A truststore contains the certificates or public keys for the Controller's incoming HTTPS connections.
    • Certificates are signed by a Certificate Authority (CA), alternatively a self-signed certificate can be used.
    • It is recommended that certificates are used instead of public keys.
    • Certificates of type X.509 are supported.
  • file:  the full path to the location of the truststore file is expected.
  • store-password: A truststore file is protected by a password.
  • A number of truststores can be specified by repeating the file and store-password settings.

Anchor
js7-web-server js7-web-server

js7.web.server: HTTPS Authentication

• This setting is used to specify the authentication type for HTTPS connections to a Controller.
• https-client-authentication
  
  • The value on (default) specifies that mutual authentication with certificates for Server Authentication and Client Authentication is used.
  • The value off specifies that HTTP Basic Authentication only is used.
• By default JS7 makes use of mutual authentication including both Server and Client Authentication Certificates. This setting can be switched off to use Server Authentication Certificates only.

Anchor
js7-configuration js7-configuration

js7.configuration: Trusted Signature Keys

• The Controller expects a signature Fof any deployed objects such as workflows. Such signatures are created with a private key and are verified by the Controller based on the available certificates. Agents perform similar signature verification and are configured accordingly.
• When deploying objects with JOC Cockpit
  • for a Low Security Level JOC Cockpit creates the signature from a single private key that is used for any JOC Cockpit user accounts allowed to deploy objects.
  • for a Medium Security Level JOC Cockpit creates the signature from the private key of the JOC Cockpit user account that deploys objects.
  • for a High Security Level the user creates the signature outside of JOC Cockpit and uploads the signed objects.
• The Controller supports PGP public keys and X.509 certificates. This setting expects a directory that holds a number of public key files or certificate files.
• trusted-signature-keys
  • PGP: specifies the directory from which PGP public keys are used to verify the signature of deployed objects.
  • X509: specifies the directory from which X.509 certificates are used to verify the signature of deployed objects.

Anchor
js7-journal js7-journal

js7.journal: Journal Release Permissions

• The Controller writes a journal of events that, for example, results from order state transitions such as an order starting, failing, completing etc.
• The journal file will grow indefinetely indefinitely if events are not released. Typically events are consumed by JOC Cockpit and are added to the order and task history. Events are released from the Controller's journal once they have been stored persistently to the JOC Cockpit database. The Controller accordingly will free the space consumed by its journal files.
• users-allowed-to-release-events:  specifies the list of accounts that are allowed to send a command to the Controller to release events.
  • Typically the "History" account is specified, this account is used by JOC Cockpit.
  • If more than one account is specified then events are released only after all accounts have sent the command to release events to the Controller.

...