`docker run -d --name workflow-backend -e SDC_PROTOCOL=http
-e SDC_ENDPOINT=$(docker inspect sdc-BE --format={{.NetworkSettings.IPAddress}}):8080
-e CS_HOSTS=$(docker inspect workflow-cassandra --format={{.NetworkSettings.IPAddress}})
--e SDC_USER=workflow -e SDC_PASSWORD=<secret> -e JAVA_OPTIONS="-Xmx128m -Xms128m -Xss1m"
+-e SDC_USER=workflow -e SDC_PASSWORD=<secret> -e JAVA_OPTIONS="-Xmx128m -Xms128m -Xss1m" -p 8184:8443
nexus3.onap.org:10001/onap/workflow-backend:latest`
### Troubleshooting
- IS_HTTPS — flag to set if frontend accepts https connection from client. Default is false.
- KEYSTORE_PATH
-- KEYSTORE_PASSWORD
-- KEYSTORE_TYPE
+- KEYSTORE_PASS
- TRUSTSTORE_PATH
-- TRUSTSTORE_PASSWORD
-- TRUSTSTORE_TYPE
+- TRUSTSTORE_PASS
If not set then Using jetty default SSL keys.
### Example
`docker run -d --name workflow-frontend
--e BACKEND=http://$(docker inspect workflow-backend --format={{.NetworkSettings.IPAddress}}):8080
--e JAVA_OPTIONS="-Xmx64m -Xms64m -Xss1m" -p 9088:8080 -p 8186:8443 -e IS_HTTPS=true nexus3.onap.org:10001/onap/workflow-frontend:latest`
+-e BACKEND=http://$(docker inspect workflow-backend --format={{.NetworkSettings.IPAddress}}):8443 -e IS_HTTPS=true
+-e KEYSTORE_PATH="etc/org.onap.sdc.p12" -e KEYSTORE_PASS='!ppJ.JvWn0hGh)oVF]([Kv)^'
+-e TRUSTSTORE_PATH="etc/org.onap.sdc.trust.jks" -e TRUSTSTORE_PASS="].][xgtze]hBhz*wy]}m#lf*"
+-e JAVA_OPTIONS="-Xmx64m -Xms64m -Xss1m" -p 9088:8080 -p 8186:8443
+-e IS_HTTPS=true nexus3.onap.org:10001/onap/workflow-frontend:latest`
Notice that port 8080 of the frontend container has been
[mapped]( https://docs.docker.com/config/containers/container-networking/#published-ports) to port 9088 of the host
```
- pluginId: WORKFLOW
- pluginDiscoveryUrl: "http://workflow.example.com:9088/ping"
- pluginSourceUrl: "http://workflow.example.com:9088"
- pluginStateUrl: "workflowDesigner"
- pluginDisplayOptions:
- tab:
- displayName: "WORKFLOW"
- displayRoles: ["DESIGNER", "TESTER"]
+ pluginDiscoveryUrl: "http://workflow.example.com:9088/ping"
+ pluginSourceUrl: "http://workflow.example.com:9088"
+ pluginStateUrl: "workflowDesigner"
+ pluginDisplayOptions:
+ tab:
+ displayName: "WORKFLOW"
+ displayRoles: ["DESIGNER", "TESTER"]
```
#!/bin/sh
+
# adding support for https
HTTPS_ENABLED=${IS_HTTPS:-"false"}
-
-if [ "$HTTPS_ENABLED" = "true" ]; then
+CLIENT_AUTH=${IS_CLIENT_AUTH:-"false"}
+if [ "$HTTPS_ENABLED" = "true" ]
+then
echo "enable ssl"
- if [ -n "$KEYSTORE_PATH" ]; then
- keystore_pass="!ppJ.JvWn0hGh)oVF]([Kv)^"
- truststore_pass="].][xgtze]hBhz*wy]}m#lf*"
+ java -jar "${JETTY_HOME}/start.jar" --add-to-start=https,ssl \
+ jetty.sslContext.keyStorePath=$KEYSTORE_PATH \
+ jetty.sslContext.keyStorePassword=$KEYSTORE_PASS \
+ jetty.sslContext.keyManagerPassword=$KEYSTORE_PASS \
+ jetty.sslContext.trustStorePath=$TRUSTSTORE_PATH \
+ jetty.sslContext.trustStorePassword=$TRUSTSTORE_PASS
+
+ echo "setting SSL environment variable"
+
+ SSL_JAVA_OPTS=" -DkeystorePath=$JETTY_BASE/$KEYSTORE_PATH -DkeystorePassword=$KEYSTORE_PASS -DkeyManagerPassword=$KEYSTORE_PASS -DtruststorePath=$JETTY_BASE/$KEYSTORE_PATH -DtruststorePassword=$TRUSTSTORE_PASS -DsslTrustAll=$TRUST_ALL"
+
+ echo $SSL_JAVA_OPTS
- java -jar "${JETTY_HOME}/start.jar" --add-to-start=https,ssl \
- jetty.sslContext.keyStorePath=$KEYSTORE_PATH \
- jetty.sslContext.keyStorePassword=${KEYSTORE_PASS:-$keystore_pass} \
- jetty.sslContext.trustStorePath=$TRUSTSTORE_PATH \
- jetty.sslContext.trustStorePassword=${TRUSTSTORE_PASS:-$truststore_pass}
- else
- echo "Using jetty default SSL"
- java -jar "${JETTY_HOME}/start.jar" --add-to-start=https,ssl
- fi
else
echo "no ssl required"
fi
-
-java -DproxyTo=$BACKEND $JAVA_OPTIONS -jar $JETTY_HOME/start.jar
+java $JAVA_OPTIONS -DproxyTo=$BACKEND $SSL_JAVA_OPTS -jar $JETTY_HOME/start.jar
--- /dev/null
+/*-
+ * ============LICENSE_START=======================================================
+ * SDC
+ * ================================================================================
+ * Copyright (C) 2017 AT&T Intellectual Property. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+
+package org.onap.workflow.web;
+
+
+import org.eclipse.jetty.client.HttpClient;
+import org.eclipse.jetty.client.api.Request;
+import org.eclipse.jetty.http.HttpHeader;
+import org.eclipse.jetty.http.HttpScheme;
+import org.eclipse.jetty.proxy.ProxyServlet;
+import org.eclipse.jetty.util.URIUtil;
+import org.eclipse.jetty.util.ssl.SslContextFactory;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.util.Enumeration;
+
+
+/***
+ * Class that provides the proxy implementation for both secured and unsecured backend connections.
+ *
+ * The following nevironment value is mandatory:
+ * proxyTo - the full URL to the backend server (including protocol and context path if relevant)
+ *
+ * In case of a secured connection (proxyTo starting with https) the following may be set:
+ * sslTrustAll - set to true if all secure connection are accepted
+ * maxPoolConnections - number of connection in the pool, only when overriding the jetty default
+ *
+ * In case of SSL and nto trusting all certificates:
+ * keystorePath - path to the keystore
+ * keystoreType - type of the keystore
+ * keystorePassword - keystore password
+ *
+ * truststorePath - path to the truststore
+ * truststoreType - type of the truststore
+ * truststorePassword - truststore password
+
+ */
+
+public class SSLProxyServlet extends ProxyServlet {
+
+
+ public static final int TIMEOUT = 600000;
+ protected static final String PROXY_TO = "proxyTo";
+ protected static final String TRUST_ALL = "sslTrustAll";
+ protected static final String MAX_POOL_CONNECTIONS = "maxPoolConnections";
+ protected static final String KEYSTORE_PATH = "keystorePath";
+ protected static final String KEYSTORE_TYPE = "keystoreType";
+ protected static final String KEYSTORE_P = "keystorePassword";
+ protected static final String KEYMANAGER_P = "keyManagerPassword";
+ protected static final String KEYSTORE_CYPHER = "keystoreCypher";
+ protected static final String TRUSTSTORE_PATH = "truststorePath";
+ protected static final String TRUSTSTORE_TYPE = "truststoreType";
+ protected static final String TRUSTSTORE_P = "truststorePassword";
+ protected static final String ENDPOINT_IDENTIFICATION_ALGORITHM = "endpointIdentificationAlgorithm";
+ private static final long serialVersionUID = 1L;
+ private static URL proxyUrl = null;
+
+
+ private static void setProxyUrl(URL proxy) {
+ SSLProxyServlet.proxyUrl = proxy;
+ }
+
+ private void initProxyUrl() throws ServletException, MalformedURLException {
+
+ if (SSLProxyServlet.proxyUrl != null)
+ return;
+ String proxyUrlStr = System.getProperty(PROXY_TO);
+ if (proxyUrlStr == null) {
+ throw new ServletException("-D" + PROXY_TO + " must be specified");
+ }
+ setProxyUrl(new URL(proxyUrlStr));
+ }
+
+
+ @Override
+ public void init() throws ServletException {
+ super.init();
+ try {
+ initProxyUrl();
+ } catch (MalformedURLException e) {
+ throw new ServletException(e);
+ }
+ }
+
+
+ @Override
+ public void sendProxyRequest(HttpServletRequest request, HttpServletResponse response, Request proxyRequest) {
+
+ @SuppressWarnings("unchecked")
+ Enumeration<String> headerNames = request.getHeaderNames();
+ while (headerNames.hasMoreElements()) {
+ String headerName = headerNames.nextElement();
+ if (!proxyRequest.getHeaders().containsKey(headerName)) {
+ String headerVal = request.getHeader(headerName);
+ proxyRequest.header(headerName, headerVal);
+ }
+ }
+ proxyRequest.getHeaders().remove(HttpHeader.HOST);
+ super.sendProxyRequest(request, response, proxyRequest);
+
+ }
+
+ @Override
+ protected HttpClient newHttpClient() {
+ // ioverride parent method to be able to create a secured client as well.
+ boolean isSecureClient = (
+ proxyUrl.getProtocol() != null &&
+ proxyUrl.getProtocol().equalsIgnoreCase(HttpScheme.HTTPS.toString()));
+ if ((isSecureClient)) {
+ String trustAll = System.getProperty(TRUST_ALL);
+ SslContextFactory sslContextFactory = null;
+ if (trustAll != null && Boolean.parseBoolean(trustAll) == Boolean.TRUE) {
+ sslContextFactory = new SslContextFactory.Client(true);
+ } else {
+ sslContextFactory = new SslContextFactory.Client(false);
+ // setting up truststore
+ sslContextFactory.setTrustStorePath(System.getProperty(TRUSTSTORE_PATH));
+ sslContextFactory.setTrustStorePassword(System.getProperty(TRUSTSTORE_P));
+ sslContextFactory.setTrustStoreType(System.getProperty(TRUSTSTORE_TYPE));
+ // setting up keystore
+ sslContextFactory.setKeyStorePath(System.getProperty(KEYSTORE_PATH));
+ sslContextFactory.setKeyStorePassword(System.getProperty(KEYSTORE_P));
+ sslContextFactory.setKeyStoreType(System.getProperty(KEYSTORE_TYPE));
+ sslContextFactory.setKeyManagerPassword(System.getProperty(KEYMANAGER_P));
+
+ if (System.getProperty(ENDPOINT_IDENTIFICATION_ALGORITHM) != null &&
+ !System.getProperty(ENDPOINT_IDENTIFICATION_ALGORITHM).equals("")) {
+ sslContextFactory
+ .setEndpointIdentificationAlgorithm(System.getProperty(ENDPOINT_IDENTIFICATION_ALGORITHM));
+ }
+
+ if (System.getProperty(KEYSTORE_CYPHER) != null &&
+ !System.getProperty(KEYSTORE_CYPHER).equals("")) {
+ sslContextFactory.setIncludeCipherSuites(System.getProperty(KEYSTORE_CYPHER));
+ }
+ }
+
+ return new HttpClient(sslContextFactory);
+
+ } else {
+ return super.newHttpClient();
+ }
+
+ }
+
+ @Override
+ protected HttpClient createHttpClient() throws ServletException {
+
+ try {
+ initProxyUrl();
+ } catch (MalformedURLException e) {
+ throw new ServletException(e);
+ }
+ // calling the parent and setting the configuration for our implementation
+ HttpClient client = super.createHttpClient();
+ setTimeout(TIMEOUT);
+ client.setIdleTimeout(TIMEOUT);
+ client.setStopTimeout(TIMEOUT);
+ if (System.getProperty(MAX_POOL_CONNECTIONS) != null) {
+ client.setMaxConnectionsPerDestination(
+ Integer.valueOf(System.getProperty(MAX_POOL_CONNECTIONS)));
+ }
+ return client;
+
+ }
+
+
+
+ @Override
+ protected String rewriteTarget(HttpServletRequest request) {
+
+ String path = proxyUrl.getPath();
+ if (request.getServletPath() != null) {
+ path += request.getServletPath();
+ }
+ if (request.getPathInfo() != null) {
+ path += request.getPathInfo();
+ }
+
+ return URIUtil.newURI(
+ proxyUrl.getProtocol(),
+ proxyUrl.getHost(),
+ proxyUrl.getPort(),
+ path,
+ request.getQueryString());
+ }
+
+}
+++ /dev/null
-/*
- * Copyright © 2016-2018 European Support Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.onap.workflow.web;
-
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.Enumeration;
-import javax.servlet.ServletConfig;
-import javax.servlet.ServletContext;
-import javax.servlet.ServletException;
-import org.eclipse.jetty.proxy.ProxyServlet;
-
-/**
- * <p>A naive implementation of transparent proxy based on
- * <a href="https://www.eclipse.org/jetty/documentation/9.4.x/proxy-servlet.html">Jetty proxy servlet</a>.
- * The only difference is that the <code>proxyTo</code> configuration parameter is taken from a JVM argument (and can
- * be therefore injected via an environment variable), instead of an <code>init-param</code> in <i>web.xml</i>.</p>
- * <p>Example: <code>java -DproxyTo=http://172.17.0.9:8080 -jar $JETTY_HOME/start.jar</code></p>
- * <p>If you get a <i>502 Bad Gateway</i> error:</p>
- * <ul>
- * <ol>
- * Make sure that Jetty 'proxy' module
- * <a href="https://www.eclipse.org/jetty/documentation/9.4.x/startup-modules.html">is not enabled</a>.
- * </ol>
- * <ol>
- * Check the value of <code>proxyTo</code>. Make sure it does not redirect to the proxy server itself.
- * </ol>
- * <ol>
- * Make sure there is no proxy (e.g. in a corporate environment) between the servlet and <code>proxyTo</code>.
- * </ol>
- * </ul>
- *
- * @author evitaliy
- * @since 16 Jul 2018
- */
-public class TransparentProxy extends ProxyServlet.Transparent {
-
- @Override
- public void init(ServletConfig config) throws ServletException {
- super.init(new ServletConfigWrapper(config));
- }
-
- private class ServletConfigWrapper implements ServletConfig {
-
- private static final String PROXY_TO = "proxyTo";
-
- private final String proxyTo;
- private final ServletConfig config;
-
- ServletConfigWrapper(ServletConfig config) throws ServletException {
-
- this.proxyTo = System.getProperty(PROXY_TO);
- if (this.proxyTo == null) {
- throw new ServletException("-D" + PROXY_TO + " must be specified");
- }
-
- this.config = config;
- }
-
- @Override
- public String getServletName() {
- return config.getServletName();
- }
-
- @Override
- public ServletContext getServletContext() {
- return config.getServletContext();
- }
-
- @Override
- public String getInitParameter(String s) {
- return PROXY_TO.equals(s) ? this.proxyTo : config.getInitParameter(s);
- }
-
- @Override
- public Enumeration<String> getInitParameterNames() {
- ArrayList<String> params = Collections.list(config.getInitParameterNames());
- params.add(PROXY_TO);
- return Collections.enumeration(params);
- }
- }
-}
Code Review / sdc / sdc-workflow-designer.git / commitdiff