Skip to content

Commit 14db10c

Browse files
author
Rathna
committed
fix #18 
1 parent dcc7091 commit 14db10c

File tree

3 files changed

+116
-83
lines changed

3 files changed

+116
-83
lines changed

‎README.md‎

Lines changed: 21 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -71,11 +71,6 @@ $export smtp_manager_url=smtp.axway.com
7171
$export httpbasic_backend=changme
7272
```
7373

74-
- Disable Cassandra SSL
75-
```bash
76-
$export cassandra_disablessl=true
77-
```
78-
7974
- Disable HTTPS Interfaces
8075

8176
```bash
@@ -95,6 +90,20 @@ $export disablehttp_portname=true
9590
- Radius
9691
```bash
9792
```
93+
### Cassandra
94+
95+
- Disable Cassandra SSL
96+
```bash
97+
$export cassandra_disablessl=true
98+
```
99+
100+
- Setup Cassandra read and write Consistency level
101+
102+
```bash
103+
$export cassandraconsistency_readlevel=QUORUM
104+
$export cassandraconsistency_writelevel=QUORUM
105+
```
106+
Possible consistency level **ONE, TWO, THREE, QUORUM, LOCAL_QUORUM, LOCAL_ONE, ALL**
98107

99108
- Cassandra Certificate reference
100109
```bash
@@ -119,7 +128,11 @@ PLHu3INlHcXQs3AY0wNBLhL2jBwZ0uwBYK+entFpCgb+Z+RQ+uxs3joYuKEMj6M6
119128
$export cassandraCert_root = /opt/Axway/apigateway/certs/cassandra.pem
120129
```
121130

122-
- x509 Cert - to trust the backend root and intermediate certificates. In order to use the feature, connect to URL filter should be enabled with "trust all Certificates in the certificate store"
131+
132+
133+
### Connect to URL
134+
135+
- Connect to URL One way SSL - to trust the backend root and intermediate certificates. In order to use the feature, connect to URL filter should be enabled with "trust all Certificates in the certificate store"
123136

124137

125138
![connect to URL](images/connect_to_url.png)
@@ -178,7 +191,7 @@ s2+QnHEKNi5n6eyF81l1X3AGOMp2uUF4CfU=
178191
-----END CERTIFICATE-----"
179192
```
180193
181-
- Connect to URL SSL ( 2-Way SSL / Mutual SSL) Authentication
194+
- Connect to URL 2-Way SSL / Mutual SSL Authentication
182195
183196
To update Connect to URL SSL certificate, there are two environment variables used to set up certificate for SSL Authentication
184197
@@ -197,7 +210,7 @@ $export connecttourlcertandkey_sslauth=changeit
197210
```
198211
**sslauth** is the name of Connect to URL filter **WARNING**: Do not use blank spaces in Connect to URL filter name.
199212

200-
![secureport Interface](images/connect2urlsslauth.PNG)
213+
![connect_to_url client_auth](images/connect2urlsslauth.PNG)
201214

202215
- PKCS12 - To update the https listener certificate. There are two environment variables used to set up certificate on Listener interface
203216

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
<groupId>com.axway</groupId>
88
<artifactId>apim-env-module</artifactId>
9-
<version>1.1.4</version>
9+
<version>1.1.5</version>
1010

1111
<name>apim-env-module</name>
1212
<url>https://axway.com</url>

‎src/main/java/com/axway/ExternalConfigLoader.java‎

Lines changed: 94 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -52,25 +52,10 @@ private void updatePassword(EntityStore entityStore) {
5252
Set<String> keys = envValues.keySet();
5353
Iterator<String> keysIterator = keys.iterator();
5454

55-
Map<String, String> ldap = envValues.entrySet()
56-
.stream()
57-
.filter(map -> map.getKey().startsWith("ldap_"))
58-
.collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue));
59-
60-
Map<String, String> jms = new HashMap<>();
61-
for (Map.Entry<String, String> stringStringEntry : envValues.entrySet()) {
62-
if (stringStringEntry.getKey().startsWith("jms_")) {
63-
if (jms.put(stringStringEntry.getKey(), stringStringEntry.getValue()) != null) {
64-
throw new IllegalStateException("Duplicate key");
65-
}
66-
}
67-
}
68-
69-
Map<String, String> smtp = envValues.entrySet()
70-
.stream()
71-
.filter(map -> map.getKey().startsWith("smtp_"))
72-
.collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue));
73-
55+
Map<String, String> ldap = groupEnvVariables(envValues,"ldap_");
56+
Map<String, String> jms = groupEnvVariables(envValues,"jms_");
57+
Map<String, String> smtp = groupEnvVariables(envValues,"smtp_");
58+
Map<String, String> cassandraConsistency = groupEnvVariables(envValues, "cassandraconsistency_");
7459

7560
while (keysIterator.hasNext()) {
7661
String key = keysIterator.next();
@@ -102,7 +87,7 @@ private void updatePassword(EntityStore entityStore) {
10287
} else if (key.startsWith("cert_")) {
10388
try {
10489
List<X509Certificate> certificates = certHelper.parseX509(passwordValue);
105-
for (X509Certificate certificate:certificates) {
90+
for (X509Certificate certificate : certificates) {
10691
importPublicCertificate(certificate, entityStore);
10792
}
10893
} catch (CertificateException | FileNotFoundException e) {
@@ -124,19 +109,16 @@ private void updatePassword(EntityStore entityStore) {
124109
try {
125110
List<X509Certificate> certificates = certHelper.parseX509(passwordValue);
126111
int index = 0;
127-
for (X509Certificate certificate:certificates) {
112+
for (X509Certificate certificate : certificates) {
128113
String alias = importPublicCertificate(certificate, entityStore);
129-
if(alias != null) {
130-
// String escapedAlias = ShorthandKeyFinder.escapeFieldValue(alias);
131-
//updateCassandraCert(entityStore, escapedAlias);
132-
if(index == 0)
114+
if (alias != null) {
115+
if (index == 0)
133116
updateCassandraCert(entityStore, alias, false);
134117
else
135118
updateCassandraCert(entityStore, alias, true);
136119
index++;
137120
}
138121
}
139-
140122
} catch (CertificateException | FileNotFoundException e) {
141123
Trace.error("Unable to add Cassandra certificate from Environment variable", e);
142124
}
@@ -147,11 +129,11 @@ private void updatePassword(EntityStore entityStore) {
147129
String mTLS = System.getenv("certandkeymtls" + "_" + filterName);
148130
PKCS12 pkcs12 = importP12(entityStore, passwordValue, password);
149131
Trace.info("P12 file alias name :" + pkcs12.getAlias());
150-
configureP12(entityStore, filterName, pkcs12, mTLS);
132+
configureP12(entityStore, filterName, pkcs12, mTLS);
151133
} catch (Exception e) {
152134
Trace.error("Unable to add the p12 from Environment variable", e);
153135
}
154-
}else if (key.startsWith("connecttourlcertandkey_")) {
136+
} else if (key.startsWith("connecttourlcertandkey_")) {
155137
try {
156138
Trace.info("Updating Connect to URL client Auth certificate and key");
157139
char[] password = System.getenv("connecttourlcertandkeypassword" + "_" + filterName).toCharArray();
@@ -161,28 +143,27 @@ private void updatePassword(EntityStore entityStore) {
161143
} catch (Exception e) {
162144
Trace.error("Unable to add the p12 from Environment variable", e);
163145
}
164-
} else if (key.startsWith("gatewaytoplogycertandkey_")) {
165-
try {
166-
Trace.info("Updating Gateway topology certificate");
167-
char[] password = System.getenv("gatewaytoplogycertandkeypassword" + "_" + filterName).toCharArray();
168-
File file = new File(passwordValue);
169-
PKCS12 pkcs12;
170-
if(file.exists()){
171-
pkcs12 = certHelper.parseP12(file, password);
172-
}else {
173-
pkcs12 = certHelper.parseP12(passwordValue, password);
146+
} else if (key.startsWith("gatewaytoplogycertandkey_")) {
147+
try {
148+
Trace.info("Updating Gateway topology certificate");
149+
char[] password = System.getenv("gatewaytoplogycertandkeypassword" + "_" + filterName).toCharArray();
150+
File file = new File(passwordValue);
151+
PKCS12 pkcs12;
152+
if (file.exists()) {
153+
pkcs12 = certHelper.parseP12(file, password);
154+
} else {
155+
pkcs12 = certHelper.parseP12(passwordValue, password);
156+
}
157+
File gatewayConfDir = new File(Config.getVDir("VINSTDIR"), "conf");
158+
File certsXml = new File(gatewayConfDir, "certs.xml");
159+
String caAlias = externalInstanceDomainCert.certsFile(pkcs12, certsXml);
160+
File mgmtXml = new File(gatewayConfDir, "mgmt.xml");
161+
externalInstanceDomainCert.updateMgmtFile(mgmtXml, caAlias);
162+
} catch (Exception e) {
163+
Trace.error("Unable to add the p12 from Environment variable", e);
174164
}
175-
File gatewayConfDir = new File(Config.getVDir("VINSTDIR"), "conf");
176-
File certsXml = new File(gatewayConfDir, "certs.xml");
177-
String caAlias = externalInstanceDomainCert.certsFile(pkcs12, certsXml);
178-
File mgmtXml = new File(gatewayConfDir, "mgmt.xml");
179-
externalInstanceDomainCert.updateMgmtFile(mgmtXml, caAlias);
180-
181-
} catch (Exception e) {
182-
Trace.error("Unable to add the p12 from Environment variable", e);
183165
}
184166
}
185-
}
186167

187168
List<Credential> credentials = parseCred(ldap, "ldap");
188169
if (!credentials.isEmpty()) {
@@ -205,10 +186,27 @@ private void updatePassword(EntityStore entityStore) {
205186
updateAlertSMTP(entityStore, credential);
206187
}
207188
}
189+
190+
if (!cassandraConsistency.isEmpty()) {
191+
String readConsistencyLevel = cassandraConsistency.get("cassandraconsistency_readlevel");
192+
String writeConsistencyLevel = cassandraConsistency.get("cassandraconsistency_writelevel");
193+
if (readConsistencyLevel != null && writeConsistencyLevel != null) {
194+
updateCassandraConsistencyLevel(entityStore, readConsistencyLevel, writeConsistencyLevel);
195+
} else {
196+
Trace.info("cassandraconsistency_readlevel and cassandraconsistency_writelevel environment variables are not found");
197+
}
198+
}
208199
}
209200

210-
private List<Credential> parseCred(Map<String, String> envMap, String connectorName) {
201+
private Map<String, String> groupEnvVariables( Map<String, String> envValues, String namePrefix){
202+
return envValues.entrySet()
203+
.stream()
204+
.filter(map -> map.getKey().startsWith(namePrefix))
205+
.collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue));
206+
}
211207

208+
209+
private List<Credential> parseCred(Map<String, String> envMap, String connectorName) {
212210
List<Credential> credentials = new ArrayList<>();
213211
if (envMap != null && !envMap.isEmpty()) {
214212
Iterator<String> keyIterator = envMap.keySet().iterator();
@@ -373,7 +371,7 @@ private String importPublicCertificate(X509Certificate certificate, EntityStore
373371
final String alias = principal.getName();
374372
String escapedAlias = ShorthandKeyFinder.escapeFieldValue(alias);
375373
Entity certEntity = getCertEntity(entityStore, escapedAlias);
376-
Trace.info("Alias :" + alias + "Escaped alias :"+ escapedAlias);
374+
Trace.info("Alias :" + alias + "Escaped alias :" + escapedAlias);
377375

378376
if (certEntity == null) {
379377
Trace.info("Adding cert");
@@ -396,62 +394,62 @@ private String importPublicCertificate(X509Certificate certificate, EntityStore
396394
return null;
397395
}
398396

399-
private void configureP12(EntityStore entityStore, String name, PKCS12 pkcs12, String mTLS) {
397+
private void configureP12(EntityStore entityStore, String name, PKCS12 pkcs12, String mTLS) {
400398

401399
String shorthandKey = "/[NetService]name=Service/[HTTP]**/[SSLInterface]name=" + name;
402400
List<Entity> entities = getEntities(entityStore, shorthandKey);
403401
if (entities.isEmpty()) {
404402
Trace.error("Listener interface is not available");
405403
return;
406-
}else if(entities.size() > 1){
404+
} else if (entities.size() > 1) {
407405
Trace.error("Found more than one Listener interface");
408406
return;
409407
}
410408
Entity entity = entities.get(0);
411409
String fieldName = "serverCert";
412410
String alias = pkcs12.getAlias();
413411
updateCertEntity(entityStore, entity, alias, fieldName, false);
414-
Trace.info("Mutual auth flag : "+ mTLS);
415-
if(mTLS != null && mTLS.equalsIgnoreCase("true")){
412+
Trace.info("Mutual auth flag : " + mTLS);
413+
if (mTLS != null && mTLS.equalsIgnoreCase("true")) {
416414
String clientAuth = entity.getStringValue("clientAuth");
417-
Trace.info("Mutual auth configured with flag : "+ clientAuth);
418-
if(clientAuth.equals("required") || clientAuth.equals("optional")){
419-
trustRootAndIntermediateCerts(entityStore, entity, pkcs12 );
415+
Trace.info("Mutual auth configured with flag : " + clientAuth);
416+
if (clientAuth.equals("required") || clientAuth.equals("optional")) {
417+
trustRootAndIntermediateCerts(entityStore, entity, pkcs12);
420418
}
421419
}
422420
}
423421

424-
private void trustRootAndIntermediateCerts(EntityStore entityStore, Entity entity, PKCS12 pkcs12){
422+
private void trustRootAndIntermediateCerts(EntityStore entityStore, Entity entity, PKCS12 pkcs12) {
425423
Certificate[] certificates = pkcs12.getCertificates();
426424
Trace.info("Trusting additional certs for mutual auth");
427-
Trace.info("Total certificates : "+ certificates.length);
425+
Trace.info("Total certificates : " + certificates.length);
428426
for (int i = 1; i < certificates.length; i++) {
429427
X509Certificate certificate = (X509Certificate) certificates[i];
430428
Principal principal = certificate.getSubjectDN();
431429
final String alias = principal.getName();
432-
Trace.info("Trusting cert :"+ alias);
430+
Trace.info("Trusting cert :" + alias);
433431
String fieldName = "caCert";
434-
if( i == 1)
432+
if (i == 1) {
435433
updateCertEntity(entityStore, entity, alias, fieldName, false);
436-
else
434+
} else
437435
// Trust more than one certificate for mutual auth
438436
updateCertEntity(entityStore, entity, alias, fieldName, true);
439437
}
440438
}
441439

442-
private List<Entity> getEntities(EntityStore entityStore, String shorthandKey){
440+
private List<Entity> getEntities(EntityStore entityStore, String shorthandKey) {
443441
ShorthandKeyFinder shorthandKeyFinder = new ShorthandKeyFinder(entityStore);
444442
return shorthandKeyFinder.getEntities(shorthandKey);
445443
}
446444

447-
private void updateCertEntity(EntityStore entityStore, Entity entity, String alias, String fieldName, boolean append){
445+
private void updateCertEntity(EntityStore entityStore, Entity entity, String alias, String fieldName, boolean append) {
448446

449447
String escapedAlias = ShorthandKeyFinder.escapeFieldValue(alias);
450448
Entity certEntity = getCertEntity(entityStore, escapedAlias);
451-
// Trace.info("Certificate entity set to listener interface "+ certEntity);
449+
// Trace.info("Certificate entity set to listener interface "+ certEntity);
452450
PortableESPK portableESPK = PortableESPK.toPortableKey(entityStore, certEntity.getPK());
453451
//Trace.info("Portable : " + portableESPK);
454-
if(append) {
452+
if (append) {
455453
Field field = entity.getField(fieldName);
456454
List<Value> values = field.getValueList();
457455
List<Value> cloneVales = new ArrayList<>(values);
@@ -467,7 +465,7 @@ private void updateCertEntity(EntityStore entityStore, Entity entity, String ali
467465
values.add(new Value(portableESPK));
468466
}
469467
field.setValues(values);
470-
}else {
468+
} else {
471469
entity.setReferenceField(fieldName, portableESPK);
472470
}
473471
entityStore.updateEntity(entity);
@@ -481,7 +479,7 @@ private void connectToURLConfigureP12(EntityStore entityStore, String name, Stri
481479
if (entities.isEmpty()) {
482480
Trace.error("Unable to find connect to URL filter");
483481
return;
484-
}else if(entities.size() > 1){
482+
} else if (entities.size() > 1) {
485483
Trace.error("Found more than one connect to URL filter");
486484
return;
487485
}
@@ -495,21 +493,17 @@ private Entity getCertEntity(EntityStore entityStore, String alias) {
495493
ShorthandKeyFinder shorthandKeyFinder = new ShorthandKeyFinder(entityStore);
496494
Entity entity = shorthandKeyFinder.getEntity(shorthandKey);
497495
shorthandKey = "[Certificate]dname=" + alias;
498-
//See if the certificate alias already exists in the entity store,
499-
//if it does then update it thereby preserving any references to any HTTPS interfaces that are using this cert
500496
return shorthandKeyFinder.getEntity(entity.getPK(), shorthandKey);
501-
//Trace.info("PK : " + certEntity.getPK());
502-
//return PortableESPK.toPortableKey(entityStore, certEntity.getPK());
503497
}
504498

505499

506500
private PKCS12 importP12(EntityStore entityStore, String cert, char[] password) throws Exception {
507501

508502
PKCS12 pkcs12;
509503
File file = new File(cert);
510-
if(file.exists()){
504+
if (file.exists()) {
511505
pkcs12 = certHelper.parseP12(file, password);
512-
}else {
506+
} else {
513507
pkcs12 = certHelper.parseP12(cert, password);
514508
}
515509
String alias = pkcs12.getAlias();
@@ -518,7 +512,7 @@ private PKCS12 importP12(EntityStore entityStore, String cert, char[] password)
518512
Certificate[] certificates = pkcs12.getCertificates();
519513
Entity certEntity = getCertEntity(entityStore, escapedAlias);
520514
Trace.info("Escaped Certificate alias name : " + escapedAlias);
521-
// Trace.info("Certificate Entity received from entity store : "+ certEntity);
515+
// Trace.info("Certificate Entity received from entity store : "+ certEntity);
522516
if (certEntity != null) {
523517
//Updates the existing certificate in the certstore
524518
Trace.info("Updating existing certificate");
@@ -559,4 +553,30 @@ private PKCS12 importP12(EntityStore entityStore, String cert, char[] password)
559553
}
560554
return pkcs12;
561555
}
556+
557+
private void updateCassandraConsistencyLevel(EntityStore entityStore, String readConsistencyLevel, String writeConsistencyLevel) {
558+
559+
ShorthandKeyFinder shorthandKeyFinder = new ShorthandKeyFinder(entityStore);
560+
// Update KPS table consistency level
561+
updateCassandraConsistencyLevel(shorthandKeyFinder, "/[KPSRoot]name=Key Property Stores/[KPSPackage]**/[KPSDataSourceGroup]name=Data Sources/[KPSCassandraDataSource]name=Cassandra Storage",
562+
"readConsistencyLevel", readConsistencyLevel, "writeConsistencyLevel", writeConsistencyLevel);
563+
// Update OAUTH table consistency level
564+
updateCassandraConsistencyLevel(shorthandKeyFinder, "/[KPSRoot]name=Key Property Stores/[KPSPackage]name=OAuth/[KPSDataSourceGroup]name=DataSources/[KPSCassandraDataSource]name=Cassandra Storage",
565+
"readConsistencyLevel", readConsistencyLevel, "writeConsistencyLevel", writeConsistencyLevel);
566+
// Update Quota table consistency level
567+
updateCassandraConsistencyLevel(shorthandKeyFinder, "/[KPSRoot]name=Key Property Stores/[KPSPackage]name=OAuth/[KPSDataSourceGroup]name=DataSources/[KPSCassandraDataSource]name=Cassandra Storage",
568+
"quotaReadConsistency", readConsistencyLevel, "quotaWriteConsistency", writeConsistencyLevel);
569+
}
570+
571+
private void updateCassandraConsistencyLevel(ShorthandKeyFinder shorthandKeyFinder, String shorthandKey, String readConsistencyLevelFieldName, String readConsistencyLevel, String writeConsistencyLevelFieldName, String writeConsistencyLevel) {
572+
List<Entity> kpsEntities = shorthandKeyFinder.getEntities(shorthandKey);
573+
if (kpsEntities != null) {
574+
Trace.info("Total number of KPS Store: " + kpsEntities.size());
575+
for (Entity entity : kpsEntities) {
576+
entity.setStringField(readConsistencyLevelFieldName, readConsistencyLevel);
577+
entity.setStringField(writeConsistencyLevelFieldName, writeConsistencyLevel);
578+
}
579+
}
580+
}
581+
562582
}

0 commit comments

Comments
 (0)