VID Internal HTTPS
Use HTTPS for internal VID interfaces
Change-Id: I72260cd10c4d83e84f639798f4e4ebb738f6f4aa
Issue-ID: VID-273
Signed-off-by: Piotr Darosz <piotr.darosz@nokia.com>
diff --git a/deliveries/src/main/docker/assembly/assembly-for-plugin.xml b/deliveries/src/main/docker/assembly/assembly-for-plugin.xml
index 35c2033..27bcdb2 100755
--- a/deliveries/src/main/docker/assembly/assembly-for-plugin.xml
+++ b/deliveries/src/main/docker/assembly/assembly-for-plugin.xml
@@ -26,6 +26,20 @@
<directory>src/main/scripts</directory>
<outputDirectory>scripts</outputDirectory>
</fileSet>
+ <fileSet>
+ <includes>
+ <include>server.xml</include>
+ </includes>
+ <directory>../epsdk-app-onap/src/main/resources</directory>
+ <outputDirectory>config</outputDirectory>
+ </fileSet>
+ <fileSet>
+ <includes>
+ <include>org.onap.vid.jks</include>
+ </includes>
+ <directory>../epsdk-app-onap/src/main/webapp/WEB-INF/cert</directory>
+ <outputDirectory>config</outputDirectory>
+ </fileSet>
</fileSets>
</assembly>
diff --git a/deliveries/src/main/docker/docker-files/Dockerfile b/deliveries/src/main/docker/docker-files/Dockerfile
index a347659..0103182 100755
--- a/deliveries/src/main/docker/docker-files/Dockerfile
+++ b/deliveries/src/main/docker/docker-files/Dockerfile
@@ -1,10 +1,12 @@
FROM tomcat:8.0-jre8
# add vim and uncomment alias to speedup troubleshooting purpose
RUN apt-get update && apt-get install -y \
- openjdk-8-jdk vim
+ openjdk-8-jdk vim net-tools
RUN sed -i 's/# alias/alias/g' /root/.bashrc
+RUN mkdir -p ${ROOT_DIR}/etc
+
ENV JAVA_OPTS="-Xmx1536m -Xms1536m"
ENV ROOT_DIR /opt/app/vid
@@ -52,7 +54,7 @@
ENV VID_CONTACT_US_LINK https://todo_contact_us_link.com
ENV VID_DECRYPTION_KEY AGLDdG4D04BKm2IxIWEr8o=
-ENV VID_UEB_URL_LIST ueb.api.simpledemo.onap.org
+ENV VID_UEB_URL_LIST ueb.api.simpledemo.onap.org
ENV VID_UEB_CONSUMER_GROUP VID
ENV VID_ECOMP_PORTAL_INBOX_NAME ECOMP-PORTAL-INBOX
ENV VID_UEB_APP_KEY 2Re7Pvdkgw5aeAUD
@@ -70,6 +72,14 @@
ENV VID_MYSQL_MAXCONNECTIONS 5
ENV VID_MYSQL_PASS Kp8bJ4SXszM0WXlhak3eHlcse2gAw84vaoGGmJvUy2U
+ENV VID_KEYSTORE_FILENAME ${ROOT_DIR}/etc/org.onap.vid.jks
+ENV VID_KEYSTORE_PASSWORD Kp8bJ4SXszM0WXlhak3eHlcse2gAw84vaoGGmJvUy2U
+ENV VID_TOMCAT_PATH /usr/local/tomcat/conf/
+ENV CATALINA_OPTS "-Dvid.keystore.password=${VID_KEYSTORE_PASSWORD} -Dvid.keyalias=vid@vid.onap.org -Dvid.keystore.filename=${VID_KEYSTORE_FILENAME}"
+
+ADD maven/config/org.onap.vid.jks ${VID_KEYSTORE_FILENAME}
+ADD maven/config/server.xml ${VID_TOMCAT_PATH}
+
ADD maven/scripts/*.sh /tmp/vid/
ADD maven/artifacts/vid.war /tmp/vid/stage/
diff --git a/epsdk-app-onap/src/main/resources/server.xml b/epsdk-app-onap/src/main/resources/server.xml
new file mode 100644
index 0000000..2a1bab5
--- /dev/null
+++ b/epsdk-app-onap/src/main/resources/server.xml
@@ -0,0 +1,186 @@
+<?xml version='1.0' encoding='utf-8'?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<!-- Note: A "Server" is not itself a "Container", so you may not
+ define subcomponents such as "Valves" at this level.
+ Documentation at /docs/config/server.html
+ -->
+<Server port="8005" shutdown="SHUTDOWN">
+ <Listener className="org.apache.catalina.startup.VersionLoggerListener" />
+ <!-- Security listener. Documentation at /docs/config/listeners.html
+ <Listener className="org.apache.catalina.security.SecurityListener" />
+ -->
+ <!--APR library loader. Documentation at /docs/apr.html -->
+ <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
+ <!-- Prevent memory leaks due to use of particular java/javax APIs-->
+ <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
+ <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
+ <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
+
+ <!-- Global JNDI resources
+ Documentation at /docs/jndi-resources-howto.html
+ -->
+ <GlobalNamingResources>
+ <!-- Editable user database that can also be used by
+ UserDatabaseRealm to authenticate users
+ -->
+ <Resource name="UserDatabase" auth="Container"
+ type="org.apache.catalina.UserDatabase"
+ description="User database that can be updated and saved"
+ factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
+ pathname="conf/tomcat-users.xml" />
+ </GlobalNamingResources>
+
+ <!-- A "Service" is a collection of one or more "Connectors" that share
+ a single "Container" Note: A "Service" is not itself a "Container",
+ so you may not define subcomponents such as "Valves" at this level.
+ Documentation at /docs/config/service.html
+ -->
+ <Service name="Catalina">
+
+ <!--The connectors can use a shared executor, you can define one or more named thread pools-->
+ <!--
+ <Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
+ maxThreads="150" minSpareThreads="4"/>
+ -->
+
+
+ <!-- A "Connector" represents an endpoint by which requests are received
+ and responses are returned. Documentation at :
+ Java HTTP Connector: /docs/config/http.html (blocking & non-blocking)
+ Java AJP Connector: /docs/config/ajp.html
+ APR (HTTP/AJP) Connector: /docs/apr.html
+ Define a non-SSL/TLS HTTP/1.1 Connector on port 8080
+ -->
+ <Connector port="8080" protocol="HTTP/1.1"
+ connectionTimeout="20000"
+ redirectPort="8443" />
+ <!-- A "Connector" using the shared thread pool-->
+ <!--
+ <Connector executor="tomcatThreadPool"
+ port="8080" protocol="HTTP/1.1"
+ connectionTimeout="20000"
+ redirectPort="8443" />
+ -->
+ <!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443
+ This connector uses the NIO implementation that requires the JSSE
+ style configuration. When using the APR/native implementation, the
+ OpenSSL style configuration is required as described in the APR/native
+ documentation -->
+
+ <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
+ maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
+ clientAuth="false" sslProtocol="TLS" keyAlias="${vid.keyalias}"
+ keystoreFile="${vid.keystore.filename}" keystorePass="${vid.keystore.password}"
+ useServerCipherSuitesOrder="true"
+ ciphers="TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
+ TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
+ TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,
+ TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,
+ TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,
+ TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+ TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+ TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
+ TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,
+ TLS_DHE_DSS_WITH_AES_256_CBC_SHA,
+ TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
+ TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
+ TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,
+ TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,
+ TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,
+ TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
+ TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+ TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
+ TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,
+ TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
+ TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
+ TLS_ECDH_ECDSA_WITH_RC4_128_SHA,
+ TLS_ECDH_RSA_WITH_RC4_128_SHA,
+ TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+ TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+ TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+ TLS_RSA_WITH_AES_256_GCM_SHA384,
+ TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,
+ TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,
+ TLS_DHE_DSS_WITH_AES_256_GCM_SHA384,
+ TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+ TLS_RSA_WITH_AES_128_GCM_SHA256,
+ TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
+ TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,
+ TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,
+ TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,
+ TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
+ TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,
+ TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,
+ TLS_EMPTY_RENEGOTIATION_INFO_SCSVF"
+ />
+
+
+ <!-- Define an AJP 1.3 Connector on port 8009 -->
+ <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
+
+
+ <!-- An Engine represents the entry point (within Catalina) that processes
+ every request. The Engine implementation for Tomcat stand alone
+ analyzes the HTTP headers included with the request, and passes them
+ on to the appropriate Host (virtual host).
+ Documentation at /docs/config/engine.html -->
+
+ <!-- You should set jvmRoute to support load-balancing via AJP ie :
+ <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
+ -->
+ <Engine name="Catalina" defaultHost="localhost">
+
+ <!--For clustering, please take a look at documentation at:
+ /docs/cluster-howto.html (simple how to)
+ /docs/config/cluster.html (reference documentation) -->
+ <!--
+ <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
+ -->
+
+ <!-- Use the LockOutRealm to prevent attempts to guess user passwords
+ via a brute-force attack -->
+ <Realm className="org.apache.catalina.realm.LockOutRealm">
+ <!-- This Realm uses the UserDatabase configured in the global JNDI
+ resources under the key "UserDatabase". Any edits
+ that are performed against this UserDatabase are immediately
+ available for use by the Realm. -->
+ <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
+ resourceName="UserDatabase"/>
+ </Realm>
+
+ <Host name="localhost" appBase="webapps"
+ unpackWARs="true" autoDeploy="true">
+
+ <!-- SingleSignOn valve, share authentication between web applications
+ Documentation at: /docs/config/valve.html -->
+ <!--
+ <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
+ -->
+
+ <!-- Access log processes all example.
+ Documentation at: /docs/config/valve.html
+ Note: The pattern used is equivalent to using pattern="common" -->
+ <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
+ prefix="localhost_access_log" suffix=".txt"
+ pattern="%h %l %u %t "%r" %s %b" />
+
+ </Host>
+ </Engine>
+ </Service>
+</Server>
+
diff --git a/epsdk-app-onap/src/main/webapp/WEB-INF/cert/org.onap.vid.jks b/epsdk-app-onap/src/main/webapp/WEB-INF/cert/org.onap.vid.jks
new file mode 100644
index 0000000..aab34ae
--- /dev/null
+++ b/epsdk-app-onap/src/main/webapp/WEB-INF/cert/org.onap.vid.jks
Binary files differ