I have installed apollo 1.7.1 and using a broker with default setting. When I try to connect to this broker, got this error message.
Authentication failed. Credentials=[]
By default it comes with file based authentication setup. How can I disable this authentication?
Related
We have NiFi and Registry with LDAP authorization.
While updating Flow version via regestry-api this error appears:
Failed to register flow with Flow Registry due to Error creating snapshot: Untrusted proxy [CN=192.168.199.87, OU=NIFI] for write operation.
How can I create this user [CN=192.168.199.87, OU=NIFI] with "Can proxy user requests" option in Registry?
Thanks.
The error below comes up when we stage our Bluemix Liberty app, about 1 in every 10 times. If you try and authenticate, after redirection from the OpenID provider you get a popup asking you for a username and password, which seems to have no effect. Restarting the app fixes it.
CWWKS1707E: The OpenID Connect client [NTBhZGQ4MWMtN2Y5Ni00] was
unable to create an SSL context due to [CWWKS1707E: The OpenID Connect
client [NTBhZGQ4MWMtN2Y5Ni00] was unable to create an SSL context due
to [Null ssl conext]. Ensure that your SSL feature is properly
configured.]. Ensure that your SSL feature is properly configured.
This may be related to injecting the OpenID Client configuration from a user-provided service in our server.xml:
<openidConnectClient
httpsRequired="true" id="blueid" includeIdTokenInSubject="true"
authorizationEndpointUrl="https://${cloud.services.${env.openidservice}.connection.domain}/idaas/oidc/endpoint/default/authorize"
tokenEndpointUrl="https://${cloud.services.${env.openidservice}.connection.domain}/idaas/oidc/endpoint/default/token"
issuerIdentifier="https://${cloud.services.${env.openidservice}.connection.domain}"
clientId="${cloud.services.${env.openidservice}.connection.clientid}"
clientSecret="${cloud.services.${env.openidservice}.connection.clientsecret}"
mapIdentityToRegistryUser="false" scope="openid" signatureAlgorithm="RS256"
trustAliasName="${cloud.services.${env.openidservice}.connection.certificate}"
trustStoreRef="validationKeyStore"
userIdentityToCreateSubject="uniqueSecurityName">
</openidConnectClient>
The injection must be working because the clientId mentioned in the error message is correct. Not sure why the SSL context would be null. I have tried with and without an SSL element in the server.xml, but the problem still occurs.
Does anyone know what the cause might be?
From your openid connect client configuration, you do not have SSL configuration defined for openid connect client, so openid connect client is using the server's default SSL configuration. To have a definitive behavior, I would recommend that you explicitly configure SSL for openid connect client by adding "sslRef=" into openidConnectClient, and your ssl configuration must contain a trust store that has openid provider'scertificate.
I have setup IBM MobileFirst 7.0 with IBM HTTPServer. HTTPServer only listens for SSL traffic on 443 (no requests over http on port 80 are being processed). The plugin-cfg.xml is directing the /appcenterconsole URLs to the WebSphere Liberty server running the MobileFirst app.
At first, the App Center console loaded and I could login, but any calls to /appcenterconsole/services/* were getting a certificate chain error. I fixed this by adding the http server's certificate to the Liberty keystore. After executing this change, the behavior changed such that on login to App Center, the user immediately receives a 'Your session has expired' message and is sent back to the login page.
Why is my session getting lost? The HTTP server has a JSESIONID for requests to /appcenterconsole/*.
Can the HTTP plugin send the traffic over http to the Liberty server to avoid the SSL chain issue?
This looks like an SSO (Single Sign On) problem. There are two web application, AppCenterConsole and AppCenterServices, and both require authentication, hence they should be set up with SSO. It seems you reach the AppCenterConsole but not the AppCenterService.
Liberty has SSO by default, but if you are using multiple servers, ensure that you have followed the instructions Configuring LTPA on the Liberty profile in the Websphere Liberty Profile documentation.
Alternatively, you can set the JNDI property ibm.appcenter.ui.cors to false for the AppCenterConsole. This will avoid the redirection of requests from the AppCenterConsole to the AppCenterService. If it doesn't already fix the problem, then at least it will produce a better error message with a stack trace that points to the real problem.
Required Authorization for executing application, which I am not sure what I need to put
Popped up message: The server localhost is asking for username and password.The server reports that it is from spring.
Warning: Your username and password will be sent using basic authentication on a connection that is not secure
You should add security.basic.enabled=false in application.properties file and put it under src/main/resources path.
Is it possible to use mutual authentication (client SSL certificates) with WSO2 ESB? (I'm not talking about WS-Security.)
I see that it is possible to add custom keystores to the ESB but I could not find any information on how to specify what client key to use when connecting to a specific backend.
Yes. You can enable mutual authentication for ESB proxy service. Here you want to do small configuration to enable mutual authentication for all proxy service . You can edit axis2.xml file and change following property to "require"
<parameter name="SSLVerifyClient">require</parameter>
More details you can find here. However, if you are enabling mutual authentication for given set of proxy services, There is some more to do.. More details you can find here. There was an issue with older release in ESB. therefore you need some patches to install. but with 4.7.0 and 4.8.0 (next release). there have been fixed.
It is actually quite simple to set up mutual SSL authentication between the ESB and a back-end server. This requires configuration of the back-end server as well. Because the ESB serves as a 'client' when initiating a connection with the back-end, the back-end server is responsible for requesting the 'mutual' SSL instead of one-way SSL. See this nice mutual SSL article for reference [1].
In order to successfully use mutual SSL with a back-end server,
Load the back-end server's public certificate into the default
truststore, which is located in: repository/resources/security/client-truststore.jks (That's it!
That's the only change necessary on the WSO2 ESB side.)
Load the public certificate from the WSO2 keystore into the back-end server's
keystore.
Configure the back-end server to request mutual SSL.
If you're using a CA certificate instead of the default self-signed certificate, skip step 2.
Cheers,
Colin
[1] http://www.codeproject.com/Articles/326574/An-Introduction-to-Mutual-SSL-Authentication