| andrzejszukuc | 96e029e | 2018-11-28 18:09:37 +0100 | [diff] [blame] | 1 | .. This work is licensed under a Creative Commons Attribution 4.0 International License. |
| 2 | .. http://creativecommons.org/licenses/by/4.0 |
| 3 | |
| 4 | Certificates as authentication method for PNFs/VNFs |
| 5 | =================================================== |
| 6 | |
| 7 | VES supports mutual TLS authentication via X.509 certificates. If VES is deployed via docker image then VES configuration can be modified by editing */opt/app/VESCollector/etc/collector.properties* which is present on the docker container. VES detects changes made to the mentioned file automatically and restarts the application. |
| 8 | |
| 9 | The authentication can be enabled by *collector.service.secure.clientauth* property. When *collector.service.secure.clientauth=1* VES uses additional properties: |
| 10 | |
| 11 | * *collector.truststore.file.location* - a path to jks trust store containing certificates of clients or certificate authorities |
| 12 | * *collector.truststore.passwordfile* - a path to file containing password for the trust store |
| 13 | |
| 14 | Of course, mutual TLS authentication requires also server certificates, so following properties have to be set to valid values: |
| 15 | |
| 16 | * *collector.keystore.file.location* - a path to jks key store containing certificates which can be used for TLS handshake |
| 17 | * *collector.keystore.passwordfile* - a path to file containing a password for the key store |
| andrzejszukuc | 96e029e | 2018-11-28 18:09:37 +0100 | [diff] [blame] | 18 | |
| Zlatko Murgoski | 580eae2 | 2019-03-15 15:05:15 +0100 | [diff] [blame] | 19 | Property *auth.method* is used to manage security mode, possible configuration: noAuth, basicAuth, certOnly, certBasicAuth |
| 20 | |
| 21 | * *auth.method=noAuth* default option - no security (http) |
| 22 | * *auth.method=certOnly* is used to enable mutual TLS authentication (https) |
| 23 | * *auth.method=certBasicAuth* is used to enable mutual TLS authentication or/and basic HTTPs authentication |
| 24 | * *auth.method=basicAuth* is used to enable basic HTTPs authentication |