Petals-BC-Gateway 1.0.0-SNAPSHOT

compared with
Key
This line was removed.
This word was removed. This word was added.
This line was added.

Changes (14)

View Page History

{code:lang=xml}
<?xml version="1.0" encoding="UTF-8"?>
<jbi:jbi version="1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:jbi="http://java.sun.com/xml/ns/jbi"
xmlns:cdk="http://petals.ow2.org/components/extensions/version-5" xmlns:g="http://petals.ow2.org/components/petals-bc-gateway/version-1.0">
h1. Using SSL to authenticate and encrypt exchanges between domains

h2. Provider Domain A
In order to secure connections between provider and consumer domain, it is possible to rely on SSL.
SSL itself takes care of the encryption, but it is necessary for the provider domain, and optionally for the consumer domain, to have a certificate shared between parties to authenticate them.
There can't thus be encryption without authentication of at least the provider domain and ideally also of the consumer domain!

h2. Consumer Domain B
h2. Authenticating only the Provider Domain

For a provider domain, using SSL means to define a certificate that consumer domains that connect to it can use to authenticate it.
The certificate is a public information and the provider domain owns also a private key that it can use to answers authentication challenges from the consumer domain.

h3. Provider Domain A

On the provider side, the {{consumer-domain}} element must be updated with the following parameters:
{code:lang=xml}
<?xml version="1.0" encoding="UTF-8"?>
<jbi:jbi ...>

<jbi:services binding-component="true">
...

<g:consumer-domain id="domainB" transport="transport1">
<g:auth-name>UniquelySharedBetweenA&B</g:auth-name>
<g:certificate>path/to/a/certificate+provider.crt</g:certificate>
<g:key>path/to/the/key.pem</g:key>
<g:passphrase>secret-to-unlock-the-key<g:passphrase>
</g:consumer-domain>

</jbi:services>
</jbi:jbi>
{code}

Note that this means that setting up SSL is done per consumer domain that will connect to this SU, but nothing prevent us to configure the same certificate for multiple consumer domains of course!

h3. Consumer Domain B

On the consumer side, the {{consumer-domain}} element must be updated with the following parameters:
{code:lang=xml}
<?xml version="1.0" encoding="UTF-8"?>
<jbi:jbi ...">

<jbi:services binding-component="true">

<g:provider-domain id="domainA">
<g:remote-ip>domainA-hostname</g:remote-ip>
<g:remote-port>7500</g:remote-port>
<g:remote-auth-name>UniquelySharedBetweenA&B</g:remote-auth-name>
<g:remote-certificate>path/to/the/certificate-provider.crt</g:remote-certificate>
</g:provider-domain>

</jbi:services>
</jbi:jbi>
{code}

h2. Authenticating both the Provider and Consumer domains

Optionally, it is also possible to superpose on this basic SSL setup the use of a certificate that the provider domain will use to authenticate the consumer domain.
The later will also own a private key then.

h3. Provider Domain A

On the provider side, the {{consumer-domain}} element must be updated with the following parameters:
{code:lang=xml}
<?xml version="1.0" encoding="UTF-8"?>
<jbi:jbi ...>

<jbi:services binding-component="true">
...

<g:consumer-domain id="domainB" transport="transport1">
<g:auth-name>UniquelySharedBetweenA&B</g:auth-name>
<g:certificate>path/to/a/certificate-provider.crt</g:certificate>
<g:key>path/to/the/key.pem</g:key>
<g:passphrase>secret-to-unlock-the-key<g:passphrase>
<g:remote-certificate>path/to/the/certificate-consumer.crt
</g:consumer-domain>

</jbi:services>
</jbi:jbi>
{code}

This means that even if multiple Provides SUs connects to this provider domain, they all must use the same certificate as it is a mean to authenticate a consumer domain and not an individual node of this domain.

h3. Consumer Domain B

On the consumer side, the {{consumer-domain}} element must be updated with the following parameters:
{code:lang=xml}
<?xml version="1.0" encoding="UTF-8"?>
<jbi:jbi ...">

<jbi:services binding-component="true">

<g:provider-domain id="domainA">
<g:remote-ip>domainA-hostname</g:remote-ip>
<g:remote-port>7500</g:remote-port>
<g:remote-auth-name>UniquelySharedBetweenA&B</g:remote-auth-name>
<g:remote-certificate>path/to/the/certificate-provider.crt</g:remote-certificate>
<g:certificate>path/to/a/certificate-consumer.crt</g:certificate>
<g:key>path/to/the/key.pem</g:key>
<g:passphrase>secret-to-unlock-the-key<g:passphrase>
</g:provider-domain>

</jbi:services>
</jbi:jbi>
{code}

h1. Service Rewriting

h2. Consumes SU

{petalslink}explain coherence/ambiguity consumes{petalslink}

h3. Consumer Domain Element

| +transport+ | The identifier of a transport listener configured in the component | \- | Yes |
| auth-name | A unique name (in the transport listener) to be shared with the consumer domain that will connect to this SU | \- | Yes |
| remote-certificate | The path to a shared SSL certificate used to authenticate the consumer domain that will connect to this SU (relative path means in the SU, absolute path means on the filesystem) | \- | No |
| certificate | The path to a shared SSL certificate used to secure the connections (relative path means in the SU, absolute path means on the filesystem) | \- | Yes if {{remote-certificate}} is specified |
| key | The path to a private SSL key for the SSL certificate specified with {{certificate}} (relative path means in the SU, absolute path means on the filesystem) | \- | Yes if {{certificate}} is specified, else ignored |
| passphrase | The passphrase to unlock the SSL key specified with {{key}} | \- | Only if {{key}} is specified and needs a passphrase, else ignored |
| +propagation-polling-max-delay+ | The maximum delay between polling done by this SU to check new or removed endpoints in the domain (a 0 or negative value means no polling) in milliseconds| {{5000}} | Yes |
h2. Provides SU

{petalslink}explain coherence/ambiguity provides{petalslink}

h3. Provider Domain Element

| remote-port | The port of the remote provider domain gateway | {{7500}} | Yes |
| remote-auth-name | A name to be shared with the provider domain that this SU will connect to | \- | Yes |
| certificate | The path to a shared SSL certificate used to authenticate me (relative path means in the SU, absolute path means on the filesystem) | \- | No |
| key | The path to a private SSL key for the SSL certificate specified with {{certificate}} (relative path means in the SU, absolute path means on the filesystem) | \- | Yes if {{certificate}} is specified, else ignored |
| passphrase | The passphrase to unlock the SSL key specified with {{key}} | \- | Yes if {{key}} is specified and needs a passphrase, else ignored |
| remote-certificate | The path to a shared SSL certificate used to authenticate the provider domain that this SU will connect to (relative path means in the SU, absolute path means on the filesystem) | \- | Yes if {{certificate}} is specified |
| +propagate-all+ | Set to {{false}} to propagate only the services declared as {{provides}} in the SU | {{true}} | Yes |
| +retry-delay+ | Delay between retry in case of disconnection in milliseconds | {{5000}} | Yes |