From 7e75834b04015be0d379c5205201e6f2a5356c10 Mon Sep 17 00:00:00 2001 From: Domenico Sibilio Date: Mon, 14 Feb 2022 14:04:50 +0100 Subject: [PATCH] ACS-2544 - Add Docker image support for Shared Secret Authentication --- search-services/README.md | 18 ++++++++ .../src/docker/search_config_setup.sh | 43 ++++++++++++++----- 2 files changed, 51 insertions(+), 10 deletions(-) diff --git a/search-services/README.md b/search-services/README.md index e5f648013..7e786025b 100644 --- a/search-services/README.md +++ b/search-services/README.md @@ -387,6 +387,7 @@ The following environment variables are supported: | DISABLE_CASCADE_TRACKING | true or false | Whether cascade tracking is enabled or not. Disabling cascade tracking will improve performance, but result in some feature loss (e.g. path queries). | | ALFRESCO_SECURE_COMMS | https or none | Whether communication with the repository is secured. See below. | | SOLR_SSL_... | --- | These variables are also used to configure SSL. See below. | +| ALFRESCO_SECURE_COMMS | https, secret or none | Whether communication with the repository is secured. See below. | **Using Mutual Auth TLS (SSL)** @@ -420,6 +421,23 @@ SOLR Web Console will be available at: *Note* You must install the `browser.p12` certificate in your browser in order to access to this URL. +**Using Shared Secret Authentication** + +An alternative is to use a shared secret in order to secure repo <-> solr communication. You just need to set `ALFRESCO_SECURE_COMMS=secret` **AND** `JAVA_TOOL_OPTIONS="-Dalfresco.secureComms.secret=my_super_secret_secret"`. + +By default, the SOLR Web Console will be available at: + +[http://localhost:8983/solr](http://localhost:8983/solr) + +but you can also start the Jetty server in SSL mode as explained above, in that case the SOLR Web Console will be available at: + +[https://localhost:8983/solr](https://localhost:8983/solr) + +*Note* You must install the `browser.p12` certificate in your browser in order to access to this URL. + +In both cases, when trying to access the SOLR Web Console you will have to provide the `X-Alfresco-Search-Secret` header in the request, specifying as its value the same value that was used for the `-Dalfresco.secureComms.secret` property. +You can do so natively on Safari through the `Dev Tools > Local Overrides` feature, or with a browser extension on Google Chrome/Firefox/Opera/Edge: [ModHeader](https://modheader.com/). + **Using Plain HTTP** By default Docker image is using SSL, so it's required to add an environment variable `ALFRESCO_SECURE_COMMS=none` to use SOLR in plain HTTP mode. diff --git a/search-services/packaging/src/docker/search_config_setup.sh b/search-services/packaging/src/docker/search_config_setup.sh index aabcf63bb..8dd47a252 100644 --- a/search-services/packaging/src/docker/search_config_setup.sh +++ b/search-services/packaging/src/docker/search_config_setup.sh @@ -3,6 +3,10 @@ set -e # By default its going to deploy "Master" setup configuration with "REPLICATION_TYPE=master". # Slave replica service can be enabled using "REPLICATION_TYPE=slave" environment value. +log_warn() { + echo -e " ====WARN==== \n$*\nWARN CODE was $LOG_WARN" >&2 +} + RERANK_TEMPLATE_PATH=$PWD/solrhome/templates/rerank/conf NORERANK_TEMPLATE_PATH=$PWD/solrhome/templates/noRerank/conf SOLR_RERANK_CONFIG_FILE=$RERANK_TEMPLATE_PATH/solrconfig.xml @@ -87,16 +91,35 @@ fi # By default Docker Image is using TLS Mutual Authentication (SSL) for communications with Repository # Plain HTTP can be enabled by setting ALFRESCO_SECURE_COMMS to 'none' -if [[ "none" == "$ALFRESCO_SECURE_COMMS" ]]; then - sed -i 's/alfresco.secureComms=https/alfresco.secureComms=none/' $SOLR_RERANK_CORE_FILE $SOLR_NORERANK_CORE_FILE - # Apply also the setting to existing SOLR cores property files when existing - if [[ -f ${PWD}/solrhome/alfresco/conf/solrcore.properties ]]; then - sed -i 's/alfresco.secureComms=https/alfresco.secureComms=none/' ${PWD}/solrhome/alfresco/conf/solrcore.properties - fi - if [[ -f ${PWD}/solrhome/archive/conf/solrcore.properties ]]; then - sed -i 's/alfresco.secureComms=https/alfresco.secureComms=none/' ${PWD}/solrhome/archive/conf/solrcore.properties - fi -fi +# Plain HTTP with a secret word in the request header can be enabled by setting ALFRESCO_SECURE_COMMS to 'secret', +# the secret word should be defined as a JVM argument like so: JAVA_TOOL_OPTIONS="-Dalfresco.secureComms.secret=my-secret-value" +case "$ALFRESCO_SECURE_COMMS" in + secret) + sed -i "s/alfresco.secureComms=https/alfresco.secureComms=secret\n/" $SOLR_RERANK_CORE_FILE $SOLR_NORERANK_CORE_FILE + if [[ -f ${PWD}/solrhome/alfresco/conf/solrcore.properties ]]; then + sed -i "s/alfresco.secureComms=https/alfresco.secureComms=secret\n/" ${PWD}/solrhome/alfresco/conf/solrcore.properties + fi + if [[ -f ${PWD}/solrhome/archive/conf/solrcore.properties ]]; then + sed -i "s/alfresco.secureComms=https/alfresco.secureComms=secret\n/" ${PWD}/solrhome/archive/conf/solrcore.properties + fi + ;; + none) + sed -i "s/alfresco.secureComms=https/alfresco.secureComms=none\n/" $SOLR_RERANK_CORE_FILE $SOLR_NORERANK_CORE_FILE + if [[ -f ${PWD}/solrhome/alfresco/conf/solrcore.properties ]]; then + sed -i "s/alfresco.secureComms=https/alfresco.secureComms=none\n/" ${PWD}/solrhome/alfresco/conf/solrcore.properties + fi + if [[ -f ${PWD}/solrhome/archive/conf/solrcore.properties ]]; then + sed -i "s/alfresco.secureComms=https/alfresco.secureComms=none\n/" ${PWD}/solrhome/archive/conf/solrcore.properties + fi + ;; + https|'') + ;; + *) + LOG_WARN=1 + ;; +esac + +[ -z $LOG_WARN ] || log_warn "something was wrong with the authentication config, defaulting to https mTLS auth.\nIf mTLS is not properly configured Search service might not work" if [[ true == "$ENABLE_SPELLCHECK" ]]; then sed -i 's/#alfresco.suggestable.property/alfresco.suggestable.property/' ${PWD}/solrhome/conf/shared.properties