SEARCH-2885 mTLS Configuration for ACS Community 6 & 7

e2e-test/generator-alfresco-docker-compose/generators/app/index.js

@@ -3,7 +3,7 @@ const Generator = require('yeoman-generator');
 var banner = require('./banner')
 
 /**
- * This module buids a Docker Compose template to test
+ * This module builds a Docker Compose template to test
  * Repository and Search Services/Insight Engine with
  * different configurations.
 */
@@ -316,8 +316,7 @@ module.exports = class extends Generator {
 
     // Add resources for SSL configuration
     if (this.props.httpMode == 'https') {
-      // Currently Community 'latest' only supports OLD keystores and trustores format
-      var subfolder = (this.props.acsVersion == 'latest' && this.props.alfrescoVersion == 'enterprise') ? '7.x' : '6.x'
+      var subfolder = (this.props.acsVersion.startsWith('7')) ? '7.x' : '6.x'
       this.fs.copy(
         this.templatePath('keystores/' + subfolder + '/alfresco'),
         this.destinationPath('keystores/alfresco')

e2e-test/generator-alfresco-docker-compose/generators/app/templates/6.2/.env

@@ -7,9 +7,9 @@ TRANSFORM_CORE_AIO_TAG=2.2.1
 TRANSFORMER_TAG=2.1.0
 SHARED_FILE_STORE_TAG=0.7.0
 ACTIVE_MQ_TAG=5.15.8
-DIGITAL_WORKSPACE_TAG=1.5.0
+DIGITAL_WORKSPACE_TAG=2.1.0-adw
 ACS_NGINX_TAG=3.0.1
 ACS_COMMUNITY_NGINX_TAG=1.0.0
 SEARCH_TAG=latest
 ZEPPELIN_TAG=latest
-ACA_TAG=master-latest
+ACA_TAG=2.3.0

e2e-test/generator-alfresco-docker-compose/generators/app/templates/7.0/docker-compose-ce.yml

@@ -27,8 +27,16 @@ services:
                 -Dmetadata-keystore.password=mp6yc0UD9e
                 -Dmetadata-keystore.aliases=metadata
                 -Dmetadata-keystore.metadata.password=oKIWzVdEdA
-                -Dmetadata-keystore.metadata.algorithm=DESede
-                "
+                -Dmetadata-keystore.metadata.algorithm=DESede <% if (httpMode == 'https') { %>
+                -Dssl-keystore.password=kT9X6oe68t
+                -Dssl-keystore.aliases=ssl-alfresco-ca,ssl-repo
+                -Dssl-keystore.ssl-alfresco-ca.password=kT9X6oe68t
+                -Dssl-keystore.ssl-repo.password=kT9X6oe68t
+                -Dssl-truststore.password=kT9X6oe68t
+                -Dssl-truststore.aliases=alfresco-ca,ssl-repo-client
+                -Dssl-truststore.alfresco-ca.password=kT9X6oe68t
+                -Dssl-truststore.ssl-repo-client.password=kT9X6oe68t<% } %>
+            "
             JAVA_OPTS : "
                 -Ddb.driver=org.postgresql.Driver
                 -Ddb.username=alfresco
@@ -69,7 +77,8 @@ services:
             ALFRESCO_HOSTNAME: alfresco
             ALFRESCO_COMMS: <%=secureComms%> <% if (httpMode == 'https') { %>
             TRUSTSTORE_TYPE: JCEKS
-            KEYSTORE_TYPE: JCEKS <% } %> <% if (replication) { %>
+            KEYSTORE_TYPE: JCEKS
+            PASSWORDS_AS_ENV_VARS: "true" <% } %> <% if (replication) { %>
             ENABLE_MASTER: "true"
             ENABLE_SLAVE: "false" <% } %>
             COMPRESS_CONTENT: "<%=gzip%>"
@@ -89,13 +98,26 @@ services:
             #Create the default alfresco and archive cores
             SOLR_CREATE_ALFRESCO_DEFAULTS: "alfresco,archive"
             SOLR_JAVA_MEM: "-Xms1g -Xmx1g" <% if (httpMode == 'https') { %>
-            SOLR_SSL_TRUST_STORE: "/opt/<%=searchPath%>/keystore/ssl.repo.client.truststore"
+            SOLR_SSL_TRUST_STORE: "/opt/<%=searchPath%>/keystore/ssl-repo-client.truststore"
             SOLR_SSL_TRUST_STORE_PASSWORD: "kT9X6oe68t"
             SOLR_SSL_TRUST_STORE_TYPE: "JCEKS"
-            SOLR_SSL_KEY_STORE: "/opt/<%=searchPath%>/keystore/ssl.repo.client.keystore"
+            SOLR_SSL_KEY_STORE: "/opt/<%=searchPath%>/keystore/ssl-repo-client.keystore"
             SOLR_SSL_KEY_STORE_PASSWORD: "kT9X6oe68t"
             SOLR_SSL_KEY_STORE_TYPE: "JCEKS"
             SOLR_SSL_NEED_CLIENT_AUTH: "true"
+            JAVA_TOOL_OPTIONS: "
+                -Dsolr.jetty.truststore.password=kT9X6oe68t
+                -Dsolr.jetty.keystore.password=kT9X6oe68t
+                -Dssl-keystore.password=kT9X6oe68t
+                -Dssl-keystore.aliases=ssl-alfresco-ca,ssl-repo-client
+                -Dssl-keystore.ssl-alfresco-ca.password=kT9X6oe68t
+                -Dssl-keystore.ssl-repo-client.password=kT9X6oe68t
+                -Dssl-truststore.password=kT9X6oe68t
+                -Dssl-truststore.aliases=ssl-alfresco-ca,ssl-repo,ssl-repo-client
+                -Dssl-truststore.ssl-alfresco-ca.password=kT9X6oe68t
+                -Dssl-truststore.ssl-repo.password=kT9X6oe68t
+                -Dssl-truststore.ssl-repo-client.password=kT9X6oe68t
+            "
             SOLR_OPTS: "
                 -Dsolr.ssl.checkPeerName=false
                 -Dsolr.allow.unsafe.resourceloading=true
@@ -118,7 +140,8 @@ services:
             ALFRESCO_HOSTNAME: alfresco
             ALFRESCO_COMMS: <%=secureComms%> <% if (httpMode == 'https') { %>
             TRUSTSTORE_TYPE: JCEKS
-            KEYSTORE_TYPE: JCEKS <% } %> <% if (replication) { %>
+            KEYSTORE_TYPE: JCEKS
+            PASSWORDS_AS_ENV_VARS: "true" <% } %> <% if (replication) { %>
             ENABLE_MASTER: <% if (replication == 'master-master') { %>"true"<% } else { %>"false"<% } %>
             ENABLE_SLAVE: <% if (replication == 'master-master') { %>"false"<% } else { %>"true"<% } %>
             MASTER_HOST: solr6 <% } %>
@@ -138,13 +161,26 @@ services:
             #Create the default alfresco and archive cores
             SOLR_CREATE_ALFRESCO_DEFAULTS: "alfresco,archive"
             SOLR_JAVA_MEM: "-Xms1g -Xmx1g" <% if (httpMode == 'https') { %>
-            SOLR_SSL_TRUST_STORE: "/opt/<%=searchPath%>/keystore/ssl.repo.client.truststore"
+            SOLR_SSL_TRUST_STORE: "/opt/<%=searchPath%>/keystore/ssl-repo-client.truststore"
             SOLR_SSL_TRUST_STORE_PASSWORD: "kT9X6oe68t"
             SOLR_SSL_TRUST_STORE_TYPE: "JCEKS"
-            SOLR_SSL_KEY_STORE: "/opt/<%=searchPath%>/keystore/ssl.repo.client.keystore"
+            SOLR_SSL_KEY_STORE: "/opt/<%=searchPath%>/keystore/ssl-repo-client.keystore"
             SOLR_SSL_KEY_STORE_PASSWORD: "kT9X6oe68t"
             SOLR_SSL_KEY_STORE_TYPE: "JCEKS"
             SOLR_SSL_NEED_CLIENT_AUTH: "true"
+            JAVA_TOOL_OPTIONS: "
+                -Dsolr.jetty.truststore.password=kT9X6oe68t
+                -Dsolr.jetty.keystore.password=kT9X6oe68t
+                -Dssl-keystore.password=kT9X6oe68t
+                -Dssl-keystore.aliases=ssl-alfresco-ca,ssl-repo-client
+                -Dssl-keystore.ssl-alfresco-ca.password=kT9X6oe68t
+                -Dssl-keystore.ssl-repo-client.password=kT9X6oe68t
+                -Dssl-truststore.password=kT9X6oe68t
+                -Dssl-truststore.aliases=ssl-alfresco-ca,ssl-repo,ssl-repo-client
+                -Dssl-truststore.ssl-alfresco-ca.password=kT9X6oe68t
+                -Dssl-truststore.ssl-repo.password=kT9X6oe68t
+                -Dssl-truststore.ssl-repo-client.password=kT9X6oe68t
+            "
             SOLR_OPTS: "
                 -Dsolr.ssl.checkPeerName=false
                 -Dsolr.allow.unsafe.resourceloading=true
@@ -226,7 +262,7 @@ services:
             - ./config/cert/localhost.cer:/etc/nginx/localhost.cer
             - ./config/cert/localhost.key:/etc/nginx/localhost.key <% } %>
         ports:
-            - <%=port%>:<%=port%>  
+            - <%=port%>:<%=port%>
         links:
             - alfresco
             - share

e2e-test/generator-alfresco-docker-compose/generators/app/templates/images/alfresco/Dockerfile

@@ -59,8 +59,8 @@ RUN if [ "$SOLR_COMMS" == "https" ] ; then \
       sed -i "s/\
 [[:space:]]\+<\/Engine>/\n\
         <\/Engine>\n\
-        <Connector port=\"8443\" protocol=\"org.apache.coyote.http11.Http11Protocol\"\n\
-            connectionTimeout=\"20000\"\n\        
+        <Connector port=\"8443\" protocol=\"HTTP\/1.1\"\n\
+            connectionTimeout=\"20000\"\n\
             SSLEnabled=\"true\" maxThreads=\"150\" scheme=\"https\"\n\
             keystoreFile=\"\/usr\/local\/tomcat\/alf_data\/keystore\/ssl.keystore\"\n\
             keystorePass=\"${KEYSTORE_PASS}\" keystoreType=\"${KEYSTORE_TYPE}\" secure=\"true\"\n\