You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@unomi.apache.org by jk...@apache.org on 2019/12/04 10:05:26 UTC
[unomi] branch UNOMI-225-ssl-es7-impl created (now d31b448)
This is an automated email from the ASF dual-hosted git repository.
jkevan pushed a change to branch UNOMI-225-ssl-es7-impl
in repository https://gitbox.apache.org/repos/asf/unomi.git.
at d31b448 UNOMI-225: implement ssl communication support with ES7
This branch includes the following new commits:
new d31b448 UNOMI-225: implement ssl communication support with ES7
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
[unomi] 01/01: UNOMI-225: implement ssl communication support with
ES7
Posted by jk...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jkevan pushed a commit to branch UNOMI-225-ssl-es7-impl
in repository https://gitbox.apache.org/repos/asf/unomi.git
commit d31b4488f22ca53c4dd7884276371d671ac26741
Author: Kevan <ke...@jahia.com>
AuthorDate: Wed Dec 4 11:05:14 2019 +0100
UNOMI-225: implement ssl communication support with ES7
---
.../main/resources/etc/custom.system.properties | 11 ++-
.../ElasticSearchPersistenceServiceImpl.java | 83 ++++++++++++++--------
.../resources/OSGI-INF/blueprint/blueprint.xml | 16 ++---
.../org.apache.unomi.persistence.elasticsearch.cfg | 13 ++--
4 files changed, 70 insertions(+), 53 deletions(-)
diff --git a/package/src/main/resources/etc/custom.system.properties b/package/src/main/resources/etc/custom.system.properties
index e70eb8b..1b33486 100644
--- a/package/src/main/resources/etc/custom.system.properties
+++ b/package/src/main/resources/etc/custom.system.properties
@@ -83,13 +83,10 @@ org.apache.unomi.elasticsearch.bulkProcessor.bulkSize=${env:UNOMI_ELASTICSEARCH_
org.apache.unomi.elasticsearch.bulkProcessor.flushInterval=${env:UNOMI_ELASTICSEARCH_BULK_FLUSHINTERVAL:-5s}
org.apache.unomi.elasticsearch.bulkProcessor.backoffPolicy=${env:UNOMI_ELASTICSEARCH_BULK_BACKOFFPOLICY:-exponential}
# Authentication
-# Supported authentication types: NONE, BASIC, SSL
-org.apache.unomi.elasticsearch.authenticationType=${env:UNOMI_ELASTICSEARCH_AUTHENTICATION_TYPE:-NONE}
-# Basic auth configuration:
-org.apache.unomi.elasticsearch.basicAuthUsername=${env:UNOMI_ELASTICSEARCH_BASIC_AUTHENTICATION_USERNAME:-}
-org.apache.unomi.elasticsearch.basicAuthPassword=${env:UNOMI_ELASTICSEARCH_BASIC_AUTHENTICATION_PASSWORD:-}
-# SSL auth configuration
-org.apache.unomi.elasticsearch.sslAuthTrustAllCertificates=${env:UNOMI_ELASTICSEARCH_SSL_AUTHENTICATION_TRUST_ALL:-false}
+org.apache.unomi.elasticsearch.username=${env:UNOMI_ELASTICSEARCH_USERNAME:-}
+org.apache.unomi.elasticsearch.password=${env:UNOMI_ELASTICSEARCH_PASSWORD:-}
+org.apache.unomi.elasticsearch.sslEnable=${env:UNOMI_ELASTICSEARCH_SSL_ENABLE:-false}
+org.apache.unomi.elasticsearch.sslTrustAllCertificates=${env:UNOMI_ELASTICSEARCH_SSL_TRUST_ALL_CERTIFICATES:-false}
#######################################################################################################################
## Service settings ##
diff --git a/persistence-elasticsearch/core/src/main/java/org/apache/unomi/persistence/elasticsearch/ElasticSearchPersistenceServiceImpl.java b/persistence-elasticsearch/core/src/main/java/org/apache/unomi/persistence/elasticsearch/ElasticSearchPersistenceServiceImpl.java
index de47836..3d36784 100644
--- a/persistence-elasticsearch/core/src/main/java/org/apache/unomi/persistence/elasticsearch/ElasticSearchPersistenceServiceImpl.java
+++ b/persistence-elasticsearch/core/src/main/java/org/apache/unomi/persistence/elasticsearch/ElasticSearchPersistenceServiceImpl.java
@@ -23,7 +23,9 @@ import org.apache.http.HttpHost;
import org.apache.http.auth.AuthScope;
import org.apache.http.auth.UsernamePasswordCredentials;
import org.apache.http.client.CredentialsProvider;
+import org.apache.http.conn.ssl.NoopHostnameVerifier;
import org.apache.http.impl.client.BasicCredentialsProvider;
+import org.apache.http.impl.nio.client.HttpAsyncClientBuilder;
import org.apache.unomi.api.Item;
import org.apache.unomi.api.PartialList;
import org.apache.unomi.api.TimestampedItem;
@@ -95,10 +97,17 @@ import org.osgi.framework.*;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.X509TrustManager;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
import java.net.URL;
+import java.security.KeyManagementException;
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
+import java.security.cert.X509Certificate;
import java.text.ParseException;
import java.text.SimpleDateFormat;
import java.util.*;
@@ -150,16 +159,10 @@ public class ElasticSearchPersistenceServiceImpl implements PersistenceService,
private String maximalElasticSearchVersion = "8.0.0";
// authentication props
- private AuthenticationType authenticationType = AuthenticationType.NONE;
- private String basicAuthUsername;
- private String basicAuthPassword;
- private boolean sslAuthTrustAllCertificates = false;
-
- public enum AuthenticationType {
- NONE,
- BASIC,
- SSL
- }
+ private String username;
+ private String password;
+ private boolean sslEnable = false;
+ private boolean sslTrustAllCertificates = false;
private int aggregateQueryBucketSize = 5000;
@@ -285,20 +288,20 @@ public class ElasticSearchPersistenceServiceImpl implements PersistenceService,
this.useBatchingForSave = useBatchingForSave;
}
- public void setAuthenticationType(AuthenticationType authenticationType) {
- this.authenticationType = authenticationType;
+ public void setUsername(String username) {
+ this.username = username;
}
- public void setBasicAuthUsername(String basicAuthUsername) {
- this.basicAuthUsername = basicAuthUsername;
+ public void setPassword(String password) {
+ this.password = password;
}
- public void setBasicAuthPassword(String basicAuthPassword) {
- this.basicAuthPassword = basicAuthPassword;
+ public void setSslEnable(boolean sslEnable) {
+ this.sslEnable = sslEnable;
}
- public void setSslAuthTrustAllCertificates(boolean sslAuthTrustAllCertificates) {
- this.sslAuthTrustAllCertificates = sslAuthTrustAllCertificates;
+ public void setSslTrustAllCertificates(boolean sslTrustAllCertificates) {
+ this.sslTrustAllCertificates = sslTrustAllCertificates;
}
public void start() throws Exception {
@@ -369,8 +372,6 @@ public class ElasticSearchPersistenceServiceImpl implements PersistenceService,
}
private void buildClient() {
- boolean isSslConfigured = authenticationType.equals(AuthenticationType.SSL);
-
List<Node> nodeList = new ArrayList<>();
for (String elasticSearchAddress : elasticSearchAddressList) {
String[] elasticSearchAddressParts = elasticSearchAddress.split(":");
@@ -378,20 +379,44 @@ public class ElasticSearchPersistenceServiceImpl implements PersistenceService,
int elasticSearchPort = Integer.parseInt(elasticSearchAddressParts[1]);
// configure authentication
- nodeList.add(new Node(new HttpHost(elasticSearchHostName, elasticSearchPort, isSslConfigured ? "https" : "http")));
+ nodeList.add(new Node(new HttpHost(elasticSearchHostName, elasticSearchPort, sslEnable ? "https" : "http")));
}
RestClientBuilder clientBuilder = RestClient.builder(nodeList.toArray(new Node[nodeList.size()]));
- if (isSslConfigured) {
- // TODO
- } else if (authenticationType.equals(AuthenticationType.BASIC)) {
- final CredentialsProvider credentialsProvider = new BasicCredentialsProvider();
- credentialsProvider.setCredentials(AuthScope.ANY, new UsernamePasswordCredentials(basicAuthUsername, basicAuthPassword));
+ clientBuilder.setHttpClientConfigCallback(httpClientBuilder -> {
+ if (sslTrustAllCertificates) {
+ try {
+ final SSLContext sslContext = SSLContext.getInstance("SSL");
+ sslContext.init(null, new TrustManager[]{new X509TrustManager() {
+ public X509Certificate[] getAcceptedIssuers() {
+ return null;
+ }
- clientBuilder.setHttpClientConfigCallback(httpClientBuilder -> httpClientBuilder
- .setDefaultCredentialsProvider(credentialsProvider));
- }
+ public void checkClientTrusted(X509Certificate[] certs,
+ String authType) {
+ }
+
+ public void checkServerTrusted(X509Certificate[] certs,
+ String authType) {
+ }
+ }}, new SecureRandom());
+
+ httpClientBuilder.setSSLContext(sslContext).setSSLHostnameVerifier(new NoopHostnameVerifier());
+ } catch (NoSuchAlgorithmException | KeyManagementException e) {
+ logger.error("Error creating SSL Context for trust all certificates", e);
+ }
+ }
+
+ if (StringUtils.isNotBlank(username)) {
+ final CredentialsProvider credentialsProvider = new BasicCredentialsProvider();
+ credentialsProvider.setCredentials(AuthScope.ANY, new UsernamePasswordCredentials(username, password));
+
+ httpClientBuilder.setDefaultCredentialsProvider(credentialsProvider);
+ }
+
+ return httpClientBuilder;
+ });
logger.info("Connecting to ElasticSearch persistence backend using cluster name " + clusterName + " and index prefix " + indexPrefix + "...");
client = new RestHighLevelClient(clientBuilder);
diff --git a/persistence-elasticsearch/core/src/main/resources/OSGI-INF/blueprint/blueprint.xml b/persistence-elasticsearch/core/src/main/resources/OSGI-INF/blueprint/blueprint.xml
index 41ebc8e..8922b3e 100644
--- a/persistence-elasticsearch/core/src/main/resources/OSGI-INF/blueprint/blueprint.xml
+++ b/persistence-elasticsearch/core/src/main/resources/OSGI-INF/blueprint/blueprint.xml
@@ -53,10 +53,10 @@
<cm:property name="itemClassesToCache" value="" />
<cm:property name="useBatchingForSave" value="false" />
- <cm:property name="authenticationType" value="NONE" />
- <cm:property name="basicAuthUsername" value="" />
- <cm:property name="basicAuthPassword" value="" />
- <cm:property name="sslAuthTrustAllCertificates" value="false" />
+ <cm:property name="username" value="" />
+ <cm:property name="password" value="" />
+ <cm:property name="sslEnable" value="false" />
+ <cm:property name="sslTrustAllCertificates" value="false" />
</cm:default-properties>
</cm:property-placeholder>
@@ -120,10 +120,10 @@
<property name="itemClassesToCache" value="${es.itemClassesToCache}" />
<property name="useBatchingForSave" value="${es.useBatchingForSave}" />
- <property name="authenticationType" value="${es.authenticationType}" />
- <property name="basicAuthUsername" value="${es.basicAuthUsername}" />
- <property name="basicAuthPassword" value="${es.basicAuthPassword}" />
- <property name="sslAuthTrustAllCertificates" value="${es.sslAuthTrustAllCertificates}" />
+ <property name="username" value="${es.username}" />
+ <property name="password" value="${es.password}" />
+ <property name="sslEnable" value="${es.sslEnable}" />
+ <property name="sslTrustAllCertificates" value="${es.sslTrustAllCertificates}" />
</bean>
<!-- We use a listener here because using the list directly for listening to proxies coming from the same bundle didn't seem to work -->
diff --git a/persistence-elasticsearch/core/src/main/resources/org.apache.unomi.persistence.elasticsearch.cfg b/persistence-elasticsearch/core/src/main/resources/org.apache.unomi.persistence.elasticsearch.cfg
index aa4122b..9565899 100644
--- a/persistence-elasticsearch/core/src/main/resources/org.apache.unomi.persistence.elasticsearch.cfg
+++ b/persistence-elasticsearch/core/src/main/resources/org.apache.unomi.persistence.elasticsearch.cfg
@@ -50,12 +50,7 @@ aggregateQueryBucketSize=${org.apache.unomi.elasticsearch.aggregateQueryBucketSi
maximumIdsQueryCount=${org.apache.unomi.elasticsearch.maximumIdsQueryCount:-5000}
# Authentication
-# Supported authentication types: NONE, BASIC, SSL
-authenticationType=${org.apache.unomi.elasticsearch.authenticationType:-NONE}
-
-# Basic auth configuration:
-basicAuthUsername=${org.apache.unomi.elasticsearch.basicAuthUsername:-}
-basicAuthPassword=${org.apache.unomi.elasticsearch.basicAuthPassword:-}
-
-# SSL auth configuration
-sslAuthTrustAllCertificates=${org.apache.unomi.elasticsearch.sslAuthTrustAllCertificates:-false}
\ No newline at end of file
+username=${org.apache.unomi.elasticsearch.username:-}
+password=${org.apache.unomi.elasticsearch.password:-}
+sslEnable=${org.apache.unomi.elasticsearch.sslEnable:-false}
+sslTrustAllCertificates=${org.apache.unomi.elasticsearch.sslTrustAllCertificates:-false}
\ No newline at end of file