search

nordic-institute / X-Road

Source code of the X-Road® data exchange layer software
https://x-road.global
Other
606 stars 186 forks source link

certificate self signing issue #1899

Open mithunhegde-egov opened 9 months ago

mithunhegde-egov commented 9 months ago

Hi, I am unable to self sign the ca.cert.pem certificate generated. get this error on trying to sign from the form or manually Error: Unable to load X509 request 804B4FDE057F0000:error:068000A8:asn1 encoding routines:asn1_check_tlen:wrong tag:../crypto/asn1/tasn_dec.c:1188: 804B4FDE057F0000:error:0688010A:asn1 encoding routines:asn1_item_embed_d2i:nested asn1 error:../crypto/asn1/tasn_dec.c:349:Type=X509_REQ

cert is generated using steos mentioned in docker cs setup steps. please let me know what can be done to resolve this as it is causing issue while importing the signing certificate from the security server.

Regards, Mithun

petkivim commented 9 months ago

Hi @mithunhegde-egov! There's no need to sign the test CA's root certificate ( ca.cert.pem). It's enough to add it to the Central Server as described here. No additional steps are required for the root certificate.

mithunhegde-egov commented 9 months ago

thank you very much for the response. does the same apply for tsa and ocsp certificate also while configuring the central server? (tsa.cert.pem and ocs.cert.pem)

petkivim commented 9 months ago

Yes, the same applies to ocs.cert.pem and tsa.cert.pem too. It's enough to upload them to the Central Server following the configuration guide.

mithunhegde-egov commented 9 months ago

thank you. unable to add wsdl copied from the central server management services. throws this error-WSDL download failed ID: 2dca780e1b8742bd.

petkivim commented 9 months ago

Have you checked the /var/log/xroad/proxy_ui_api.log log file for more details?

mithunhegde-egov commented 9 months ago

yes. issue is with the connection. not able to connect at this address http:///managementservices.wsdl. wanted to understand if any port needs to be mapped from the container for wsdl. my security server and central server is on the same machine for testing purpose. different ports.

petkivim commented 9 months ago

The management Security Server needs to be able to access the Central Server port 80 in order to fetch the WSDL file. Currently, you're using 3.111.118.35 as the Central Server address. Please make sure that the Security Server is able to access the Central Server using the public IP address. More information about the Security Server network configuration is available here and the Central Server network configuration is available here. The port 80 is missing from the diagram between the management Security Server and the Central Server, but it's required too.

mithunhegde-egov commented 9 months ago

sure thank you. In the last step of the configuration I am getting error_code.core.Server.ClientProxy.SslAuthenticationFailed Security server has no valid authentication certificate when I try to register TEST subsystem as a client. can we add a provider and consumer both to the same security server? even the authentication certificates and signing certificates(the one with .der downloaded) does not need any signing? used the csr html form to sign. the docker readme has mentioned self signing is required. If I am not wrong instructions need to be updated in the same.

petkivim commented 9 months ago

The error message means that the Security Server where you try to register the subsystem doesn't have a valid authentication certificate. More information about the cause of the error can be found here. Please search with Server.ClientProxy.SslAuthenticationFailed.

A service provider and service consumer can share the same Security Server. Both auth and sign certificates need to be signed by the test CA. The required steps for generating the CSRs and importing the certificates can be found here. Instead, the Test CA documentation is available here.

mithunhegde-egov commented 9 months ago

the authentication cert status is GOOD. I have added signed certs only. the error changed to 400 bad request now- when trying to register.cannot find about this error anywhere in the doc. please share any link for reference

2023-12-12T12:20:19.539Z [https-jsse-nio-4000-exec-4] correlation-id:[116fb988fad675a3] INFO ee.ria.xroad.common.AuditLogger - {"event":"Register client failed","user":"xrd","ipaddress":"106.51.69.20","reason":"Server.ServerProxy.ServiceFailed.HttpError: Server responded with error 400: Bad Request","warning":false,"auth":"Session","url":"/api/v1/clients/EGOV%3AEGOV%3A1234%3ATESTCLIENT/register","data":{"clientIdentifier":{"memberClass":"EGOV","memberCode":"1234","subsystemCode":"TESTCLIENT","fieldsForStringFormat":["EGOV","1234","TESTCLIENT"],"objectType":"SUBSYSTEM","xroadInstance":"EGOV"}}} 2023-12-12T12:20:19.540Z [https-jsse-nio-4000-exec-4] correlation-id:[116fb988fad675a3] ERROR o.n.x.r.e.ApplicationExceptionHandler - exception caught ee.ria.xroad.common.CodedException$Fault: Server.ServerProxy.ServiceFailed.HttpError: Server responded with error 400: Bad Request

petkivim commented 9 months ago

There's something wrong with the management services configuration on the management Security Server, e.g., incorrect service URL. The service URL should be https://<CENTRAL_SERVER_ADDRESS>:4002/managementservice/manage/. Please check that you have completed all the steps described here.

mithunhegde-egov commented 9 months ago

thank you the setup is complete. I have security server docker container port 80 mapped to port 6000 of my host. I am trying to make rest api call from the client service using https://:6000/ but not able to connect to port 6000 in the server. I see that it is listening but throws connection refused error- at org.springframework.boot.SpringApplication.run(SpringApplication.java:1226) at org.springframework.boot.SpringApplication.run(SpringApplication.java:1215) at org.egov.enc.Main.main(Main.java:12) Caused by: org.springframework.web.client.ResourceAccessException: I/O error on POST request for "https://:/r1/EGOV/EGOV/1234/MDMS/MDMSService/egov-mdms-service/v1/_search": Connection refused (Connection refused); nested exception is java.net.ConnectException: Connection refused (Connection refused) at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:746) at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:672) at org.springframework.web.client.RestTemplate.postForEntity(RestTemplate.java:447) at org.egov.enc.services.KeyManagementService.getTenantIds(KeyManagementService.java:191) at org.egov.enc.services.KeyManagementService.makeComprehensiveListOfTenantIds(KeyManagementService.java:120) at org.egov.enc.services.KeyManagementService.generateKeyForNewTenants(KeyManagementService.java:106) at org.egov.enc.services.KeyManagementService.init(KeyManagementService.java:67) at org.egov.enc.services.KeyManagementService.run(KeyManagementService.java:208) at org.springframework.boot.SpringApplication.callRunner(SpringApplication.java:775) ... 5 common frames omitted Caused by: java.net.ConnectException: Connection refused (Connection refused) at java.net.PlainSocketImpl.socketConnect(Native Method) at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350) at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206) at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188) at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392) at java.net.Socket.connect(Socket.java:607)

can you please share something for reference or what I am doing wrong here.

petkivim commented 9 months ago

Hi @mithunhegde-egov! Since you have mapped the container port 80 to port 6000, you should use http and not https. Instead, if you want to use https, you should map the container port 443 to port 6000. In that case, you should change the client subsystem connection type from HTTPS to HTTP NOAUTH. More information about the client subsystem connection type is available here.

mithunhegde-egov commented 9 months ago

I did those changes. I am unable to curl also to the port mapped with the 80 port in the security server. central server I am able to ping with the port mapped with docker container's port 80. I started a new docker container and facing the same issue with that also. unable to access the port mapped with docker's port 80 for the security server

petkivim commented 9 months ago

What's the error message when you try to submit a request to the Security Server port 80 that's mapped to the container port 443?

mithunhegde-egov commented 9 months ago

I have changed to using http and using port 80 of the container only still. I am getting this connection refused error in(Main.java:12) Caused by: org.springframework.web.client.ResourceAccessException: I/O error on POST request for "http://:/r1/EGOV/EGOV/1234/MDMS/MDMSService/egov-mdms-service/v1/_search": Connection refused (Connection refused); nested exception is java.net.ConnectException: Connection refused (Connection refused) at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:746) at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:672)

petkivim commented 9 months ago

What Security Server Docker image are you using? In the niis/xroad-security-server-sidecar image the http port is 8080 and https port 8443.

mithunhegde-egov commented 9 months ago

no using this one for testing- https://hub.docker.com/r/niis/xroad-security-server

petkivim commented 9 months ago

Also that image uses ports 8080 and 8443 now. Unfortunately, the documentation on Docker Hub wasn't up-to-date. These are the correct mappings: 

docker run -p 8080:8080 -p 8443:8443 -p 4000:4000 -p 5500:5500 -p 5577:5577 --name my-ss niis/xroad-security-server
mithunhegde-egov commented 9 months ago

I am getting this error trying to connect to the provider- have two security servers running in the same machine mapped to different ports and central server is also running in the same machine. Caused by: org.springframework.web.client.HttpServerErrorException$InternalServerError: 500 Server Error: [{"type":"Server.ServerProxy.NetworkError","message":"Connect to :8094 [/] failed: Connection timed out (Connection timed out)","detail":"8741ddd9-30b2-4a01-86b7-fcc18373517d"}] is it because of the provider service or issue with the security server setup? I looked for Server.ServerProxy.NetworkError. similar errors are in the doc but not this exact one.

petkivim commented 9 months ago

It looks like the provider Security Server is not able to connect to the service. You should check that the provider Security Server is able to establish connection to <provider_system_ip>:8094.

mithunhegde-egov commented 9 months ago

Hi, I am trying to find helm chart for security server deployment. Can you provide reference to helm chart or is there any other recommended way to deploy security server.

petkivim commented 9 months ago

Hi @mithunhegde-egov! Unfortunately, we don't have helm charts for X-Road. Instead, you can use this Ansible playbook to deploy a single Security Server or an entire X-Road ecosystem. Alternatively, here you can find instructions for Kubernetes.

mithunhegde-egov commented 9 months ago

Hi @petkivim I have a doubt. how do we secure the client and provider IDs generated? so the only change a consumer needs to make is append the header with client id and add the appropriate provider id in the request url right? basically anyone with the id can connect to the consumer security server? or do we have option to implement any authentication between the information system and security server.

petkivim commented 9 months ago

Hi @mithunhegde-egov! It's strongly recommended to use mTLS in the communication between a client information system and the Security Server. In that way, it's possible to secure the communication and be sure that only authorised clients are able to access the subsystems. More information about the required configuration is available here.

mithunhegde-egov commented 9 months ago

Hi @petkivim I see there is readme steps for setting external database for sidecar security server in github. is the same available for security server docker image? want to setup external postgres db with docker image for security server. can you share if any steps are available for the same?

petkivim commented 9 months ago

Hi @mithunhegde-egov! The Security Server Sidecar Docker image (niis/xroad-security-server-sidecar) is the official Docker image for the Security Server. Instead, the niis/xroad-security-server image is for test and development purposes only and it doesn't support an external database. To setup an external database with the Security Server Sidecar, please follow these instructions.

mithunhegde-egov commented 9 months ago

okay thank you and regarding authentication between the information system and security server. "An X-Road organisation’s client information system Security Server acts as the entry point to all the X-Road services. The client information system is responsible for implementing an end user authentication and access control mechanism that complies with the requirements of the particular X-Road instance. The identity of the end user may be made available to the service provider by including it in the service request" does this mean we have to implement our own authentication between information system and ss? or does tls take care of the same? the concern is, what happens if someone gets access to the registered client id and server id? any information system can access the provider information system if these two are compromised correct?

petkivim commented 9 months ago

An X-Road organisation’s client information system Security Server acts as the entry point to all the X-Road services. The client information system is responsible for implementing an end user authentication and access control mechanism that complies with the requirements of the particular X-Road instance. The identity of the end user may be made available to the service provider by including it in the service request

The above refers to a data exchange use case that includes an enduser / a citizen that plays an active role in the data exchange. Here's more information about the topic:

End-user authentication

X-Road is a data exchange layer between information systems. Among other things, X-Road provides organization level and machine level authentication that is based on Public Key Infrastructure (PKI). The identity of each organization and Security Server is verified using certificates that are issued by a trusted Certification Authority (CA) when an organization joins an X-Road ecosystem.

In case X-Road is used as a data exchange layer in a process that involves end-users and require their authentication, service consumer and service provider are responsible for the authentication of the end-user. Usually, the service consumer must authenticate the user before sending a request via X-Road and then it’s up to the service provider to decide whether it requires some evidence regarding the authentication to be sent as a part of the service request, e.g. authentication token, session context etc. From X-Road’s point of view end-user authentication is completely transparent and in case some data regarding the authentication is sent within the messages X-Road does not verify or validate it in any way.

TLS authentication between the Security Server and the information system takes care of authentication on the system level. More information is available here. Instead, you need to implement enduser authentication by yourself if/when needed.

mithunhegde-egov commented 9 months ago

Hi @petkivim trying this single pod deployment in our environemtn is failing. using this for testing and development apiVersion: v1 kind: Pod metadata: name: xroad-ss namespace: xroad spec: containers:

petkivim commented 9 months ago

Hi @mithunhegde-egov! Have you tried to access the Security Server UI running in port 4000? Errors about the instance identifier and configuration anchor are normal until the Security Server has been initialised. They'll go away after the initial configuration has been completed.

mithunhegde-egov commented 9 months ago

I am not able to access. by port forwarding I can access the UI but frmo the aws host where the cluster is running it tthrows this error. Refused to apply style from 'https:///assets/style-28d01c5c.css' because its MIME type ('text/html') is not a supported stylesheet MIME type, and strict MIME checking is enabled. index-49c7dbc5.js:1 Failed to load module script: Expected a JavaScript module script but the server responded with a MIME type of "text/html". Strict MIME type checking is enforced for module scripts per HTML spec. xroad:1 Refused to apply style from 'https:///assets/style-28d01c5c.css' because its MIME type ('text/html') is not a supported stylesheet MIME type, and strict MIME checking is enabled. unable to make out if the issue is with the host environment or the application??

petkivim commented 9 months ago

I haven't come up with that kind of error message before. I'd say that it's related to your environment's configuration.

mithunhegde-egov commented 9 months ago

okay. thank you very much. that helps.

mithunhegde-egov commented 9 months ago

Hi @petkivim we are using postgres v10.x as remote rds. when I login to the ss there is this http 500 error. I cannot find much in the proxy_ui_api.log about the error except for the 500 status in the post request. this might have to do anything with the version or the environment?

petkivim commented 9 months ago

Hi @mithunhegde-egov! The supported PostgreSQL version depends on the X-Road software version and the operating system that you're using. For example, by default X-Road 7.3.x uses the following PostgreSQL versions on different operating systems:

You can find the default PostgreSQL versions from the X-Road Technologies document:

https://github.com/nordic-institute/X-Road/blob/7.3.2/doc/Architecture/arc-tec_x-road_technologies.md#5-security-server-technologies

Please note that you should change the tag according to the X-Road version that you're using.

mithunhegde-egov commented 9 months ago

[5] PostgreSQL version varies depending on operating system. By default, RHEL7 uses version 9, RHEL8 - 10, Ubuntu 20.04 - 12, Ubuntu 22.04 - 14. User may also use external PostgreSQL server.

latest security server version is being used(7.4.0) and Ubuntu 20.04. If we are using external remote db in this case PostgreSQL 12 needs to be used? currently using postgres v10 remote db. can that be causing this error? AxiosError: Request failed with status code 500. basically I am trying to understand if any feature other than backup and restore does not work with postgreSQL version 10 external db.

petkivim commented 9 months ago

Yes, the Security Server version 7.4.0 on Ubuntu 20.04 requires PostgreSQL 12.

The error message (AxiosError) doesn't say a lot, it just means that a request to the management API failed for some reason. A more detailed reason for the error should be available in the /var/log/xroad/proxy_ui_api.log file.

mithunhegde-egov commented 9 months ago

yes I did check the logs. there is not detailed descritpion of the failure in the logs too. Screenshot from 2024-01-03 12-45-12

petkivim commented 9 months ago

The screenshot is from the the /var/log/xroad/proxy_ui_api_access.log log file. Instead, you should look at the /var/log/xroad/proxy_ui_api.log log file.

mithunhegde-egov commented 9 months ago

this the only file present. proxy_ui_api.log file is missing the directory /var/log/xroad. checked for the hidden files too. but cannot find any other file other than the /var/log/xroad/proxy_ui_api_access.log. can it be present in any other location other than the one mentioned above? I am able to get this from kubectl logs though

2024-01-03T07:36:54.064Z ERROR [xroad-proxy-ui-api] [scheduling-1] com.zaxxer.hikari.pool.HikariPool - HikariPool-1 - Exception during pool initialization. org.postgresql.util.PSQLException: The server requested password-based authentication, but no password was provided by plugin null at org.postgresql.core.v3.AuthenticationPluginManager.lambda$withEncodedPassword$0(AuthenticationPluginManager.java:110) at org.postgresql.core.v3.AuthenticationPluginManager.withPassword(AuthenticationPluginManager.java:81) at org.postgresql.core.v3.AuthenticationPluginManager.withEncodedPassword(AuthenticationPluginManager.java:107) 2024-01-03T07:36:54.065Z WARN [xroad-proxy-ui-api] [scheduling-1] o.h.e.jdbc.spi.SqlExceptionHelper - SQL Error: 0, SQLState: 08004 2024-01-03T07:36:54.065Z ERROR [xroad-proxy-ui-api] [scheduling-1] o.h.e.jdbc.spi.SqlExceptionHelper - The server requested password-based authentication, but no password was provided by plugin null 2024-01-03T07:36:54.065Z ERROR [xroad-proxy-ui-api] [scheduling-1] o.s.s.s.TaskUtils$LoggingErrorHandler - Unexpected error occurred in scheduled task org.postgresql.util.PSQLException: The server requested password-based authentication, but no password was provided by plugin null at org.postgresql.core.v3.AuthenticationPluginManager.lambda$withEncodedPassword$0(AuthenticationPluginManager.java:110) at org.postgresql.core.v3.AuthenticationPluginManager.withPassword(AuthenticationPluginManager.java:81) at org.postgresql.core.v3.AuthenticationPluginManager.withEncodedPassword(AuthenticationPluginManager.java:107) Wrapped by: org.hibernate.exception.JDBCConnectionException: Unable to acquire JDBC Connection [The server requested password-based authentication, but no password was provided by plugin null] [n/a] at org.hibernate.exception.internal.SQLStateConversionDelegate.convert(SQLStateConversionDelegate.java:98) at org.hibernate.exception.internal.StandardSQLExceptionConverter.convert(StandardSQLExceptionConverter.java:56) at org.hibernate.engine.jdbc.spi.SqlExceptionHelper.convert(SqlExceptionHelper.java:108) Wrapped by: org.springframework.transaction.CannotCreateTransactionException: Could not open JPA EntityManager for transaction at org.springframework.orm.jpa.JpaTransactionManager.doBegin(JpaTransactionManager.java:466) at org.niis.xroad.securityserver.restapi.config.UsernameSettingTransactionManager.doBegin(UsernameSettingTransactionManager.java:58) at org.springframework.transaction.support.AbstractPlatformTransactionManager.startTransaction(AbstractPlatformTransactionManager.java:400)

petkivim commented 9 months ago

When running the Security Server in Docker on Kubernetes the proxy_ui_api.log must be accessed using kubectl logs.

It seems that the problem is related to database authentication. When setting up the Security Server, have you followed these instructions:

https://github.com/nordic-institute/X-Road/blob/develop/doc/Sidecar/kubernetes_security_server_sidecar_user_guide.md

mithunhegde-egov commented 9 months ago

yes followed the same steps but with the external db which is postgresql v10. I am getting the above error for this setup when I try to login with the given username and pwd. unable to make out if it is the deployment or the environment that is causing the above issue.

petkivim commented 9 months ago

I'd recommend you to try with PostgreSQL 12 since it's the officially supported version. Also, you could try to further debug the issue by trying to establish a connection from inside the Security Server container to the database manually.

mithunhegde-egov commented 9 months ago

yes manually I am able to connect. I did try that. we will try with the PostgreSQL 12.

mithunhegde-egov commented 9 months ago

Hi @petkivim we are getting ImagePullBackOff error. Is there a rate limiting? this is happening for security server sidecar kubernetes single pod deployment.

petkivim commented 9 months ago

The Docker Hub rate limits are available here. There shouldn't be other restrictions besides them.

mithunhegde-egov commented 9 months ago

okay. there is this error when I am trying to register a new sub system in the last configuration step. the 5500 port is listening on the server. what might the issue be about. central server is on an ec2 instance and security server sidecar has been deployed in our cluster. 2024-01-04T09:04:17.190Z ERROR [xroad-proxy-ui-api] [https-jsse-nio-4000-exec-5] o.n.x.r.e.ApplicationExceptionHandler - exception caught ee.ria.xroad.common.CodedException$Fault: Server.ClientProxy.NetworkError: Could not connect to any target host ([https://xroad-dev.digit.org:5500/]) at ee.ria.xroad.common.CodedException.fromFault(CodedException.java:141) at ee.ria.xroad.common.message.SoapFault.toCodedException(SoapFault.java:130) at org.niis.xroad.common.managementrequest.ManagementRequestSender.getResponse(ManagementRequestSender.java:272)

petkivim commented 9 months ago

The error means that the Security Server where you're trying to register a subsystem is not able to establish a connection to the management Security Server port 5500. This is the management Security Server URL that the client Security Server is using: https://xroad-dev.digit.org:5500. Either the URL is incorrect or there's something wrong with the firewall configurations.

mithunhegde-egov commented 9 months ago

I have a central server deployed with the docker image and two security servers deployed on two different clusters. those are the client and provider security servers. is management security server the one deployed along with the central server docker image?? in which step of the configuration do we add/change the management security url. I am not able to find it in the documentation.