summaryrefslogtreecommitdiffstats
path: root/docs/sections/services/ves-hv/authorization.rst
diff options
context:
space:
mode:
authorkjaniak <kornel.janiak@nokia.com>2018-10-25 14:25:13 +0200
committerkjaniak <kornel.janiak@nokia.com>2018-10-26 08:46:00 +0200
commit53ba1707f0da9d64aae53a43d59a5257dd4e12ce (patch)
tree057744540b68ddba3ca4b782e95eed5b80b16537 /docs/sections/services/ves-hv/authorization.rst
parent86cd893e8dbbbd02a1b3209baa6da60337ae417a (diff)
Publish HV-VES documentation including perf3gpp
Change-Id: I8d3e926ce6bc99f981d52eb72fcbe92e8ce67cde Signed-off-by: kjaniak <kornel.janiak@nokia.com> Issue-ID: DCAEGEN2-859
Diffstat (limited to 'docs/sections/services/ves-hv/authorization.rst')
-rw-r--r--docs/sections/services/ves-hv/authorization.rst26
1 files changed, 26 insertions, 0 deletions
diff --git a/docs/sections/services/ves-hv/authorization.rst b/docs/sections/services/ves-hv/authorization.rst
new file mode 100644
index 00000000..27efdf49
--- /dev/null
+++ b/docs/sections/services/ves-hv/authorization.rst
@@ -0,0 +1,26 @@
+ **WARNING: SSL/TLS authorization is a part of an experimental feature for ONAP Casablanca release and thus should be treated as unstable and subject to change in future releases.**
+
+.. _authorization:
+
+SSL/TLS authorization
+=====================
+
+HV-VES can be configured to require usage of SSL/TLS on every TCP connection. This can be done only during deployment of application container. For reference about exact commands, see :ref:`deployment`.
+
+General steps for configuring TLS for HV-VES collector:
+
+1. Create the collector's key-store in **PKCS #12** format and add HV-VES server certificate to it.
+2. Create the collector's trust-store in **PKCS #12** format with all trusted certificates and certification authorities. Every client with certificate signed by a Certificate Authority (CA) in chain of trust is allowed. The trust-store should not contain ONAP's root CAs.
+3. Start the collector with all required options specified.
+
+ .. code-block:: bash
+
+ docker run -v /path/to/key/and/trust/stores:/etc/hv-ves nexus3.onap.org:10001/onap/org.onap.dcaegen2.collectors.hv-ves.hv-collector-main --listen-port 6061 --config-url http://consul:8500/v1/kv/dcae-hv-ves-collector --key-store /etc/hv-ves/keystore.p12 --key-store-password keystorePass --trust-store /etc/hv-ves/truststore.p12 --trust-store-password truststorePass
+
+
+
+HV-VES uses OpenJDK (version 8u181) implementation of TLS ciphers. For reference, see https://docs.oracle.com/javase/8/docs/technotes/guides/security/overview/jsoverview.html.
+
+If SSL/TLS is enabled for HV-VES container then service turns on also client authentication. HV-VES requires clients to provide their certificates on connection. In addition, HV-VES provides its certificate to every client during SSL/TLS-handshake to enable two-way authorization.
+
+The service rejects any connection attempt that is not secured by SSL/TLS and every connection made by unauthorized client - this is client which certificate is not signed by CA contained within the HV-VES Collector trust store. With TLS tunneling, the communication protocol does not change (see the description in :ref:`hv_ves_behaviors`). In particular there is no change to Wire Frame Protocol.