[Enhancement] Allow OrientDB Studio to be accessible via HTTPS

[ngalan818]

OrientDB Version: 2.2.37

Java Version: OpenJDK 8

OS: Windows

Expected behavior

There should be an option in orientdb-server-config.xml to configure SSL for OrientDB Studio

Actual behavior

OrientDB Studio can only be accessed through HTTP

[tglman]

Hi,

you should be able to configure the ssl like described here : https://orientdb.com/docs/last/security/Using-SSL-with-OrientDB.html and then also studio should work through https.

Regards

[ngalan818]

Hi, I have followed the documentation to configure SSL, but it only applies to the server. The studio is only accessible at http://localhost:2480 but not https://localhost:2480

[tglman]

Hi,

did you also change the:

<listener protocol="http" ip-address="0.0.0.0" port-range="2480-2490" socket="default">

to

<listener protocol="http" ip-address="0.0.0.0" port-range="2480-2490" socket="https">

could you share your updated configuration (without password please) ?

[ngalan818]

<?xml version="1.0" encoding="UTF-8" standalone="no"?><!--
   ~ /*
   ~  *  Copyright 2014 Orient Technologies LTD (info(at)orientechnologies.com)
   ~  *
   ~  *  Licensed under the Apache License, Version 2.0 (the "License");
   ~  *  you may not use this file except in compliance with the License.
   ~  *  You may obtain a copy of the License at
   ~  *
   ~  *       http://www.apache.org/licenses/LICENSE-2.0
   ~  *
   ~  *  Unless required by applicable law or agreed to in writing, software
   ~  *  distributed under the License is distributed on an "AS IS" BASIS,
   ~  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   ~  *  See the License for the specific language governing permissions and
   ~  *  limitations under the License.
   ~  *
   ~  * For more information: http://www.orientechnologies.com
   ~  */
   --><orient-server>
    <handlers>
        <handler class="com.orientechnologies.orient.graph.handler.OGraphServerHandler">
            <parameters>
                <parameter name="enabled" value="true"/>
                <parameter name="graph.pool.max" value="50"/>
            </parameters>
        </handler>
        <!-- CLUSTER PLUGIN, TO TURN ON SET THE 'ENABLED' PARAMETER TO 'true' -->
        <handler class="com.orientechnologies.orient.server.hazelcast.OHazelcastPlugin">
            <parameters>
                <!-- <parameter name="nodeName" value="europe1" /> -->
                <parameter name="enabled" value="${distributed}"/>
                <parameter name="configuration.db.default" value="${ORIENTDB_HOME}/config/default-distributed-db-config.json"/>
                <parameter name="configuration.hazelcast" value="${ORIENTDB_HOME}/config/hazelcast.xml"/>
            </parameters>
        </handler>
        <!-- JMX SERVER, TO TURN ON SET THE 'ENABLED' PARAMETER TO 'true' -->
        <handler class="com.orientechnologies.orient.server.handler.OJMXPlugin">
            <parameters>
                <parameter name="enabled" value="false"/>
                <parameter name="profilerManaged" value="true"/>
            </parameters>
        </handler>
        <!-- AUTOMATIC BACKUP, TO TURN ON SET THE 'ENABLED' PARAMETER TO 'true' -->
        <handler class="com.orientechnologies.orient.server.handler.OAutomaticBackup">
            <parameters>
                <parameter name="enabled" value="false"/>
                <!-- LOCATION OF JSON CONFIGURATION FILE -->
                <parameter name="config" value="${ORIENTDB_HOME}/config/automatic-backup.json"/>
            </parameters>
        </handler>
        <!-- SERVER SIDE SCRIPT INTERPRETER. WARNING, THIS CAN BE A SECURITY HOLE BECAUSE MALICIOUS CODE COULD BE INJECTED.
            ENABLE IT ONLY IF CLIENTS ARE TRUSTED, TO TURN ON SET THE 'ENABLED' PARAMETER TO 'true' -->
        <handler class="com.orientechnologies.orient.server.handler.OServerSideScriptInterpreter">
            <parameters>
                <parameter name="enabled" value="true"/>
                <parameter name="allowedLanguages" value="SQL"/>
            </parameters>
        </handler>

    </handlers>
    <network>
        <sockets>
            <socket implementation="com.orientechnologies.orient.server.network.OServerTLSSocketFactory" name="ssl">
                <parameters>
                    <parameter name="network.ssl.clientAuth" value="true"/>
                    <parameter name="network.ssl.keyStore" value="keystore"/>
                    <parameter name="network.ssl.keyStorePassword" value="password"/>
                    <parameter name="network.ssl.trustStore" value="keystore"/>
                    <parameter name="network.ssl.trustStorePassword" value="password"/>
                </parameters>
            </socket>
            <socket implementation="com.orientechnologies.orient.server.network.OServerTLSSocketFactory" name="https">
                <parameters>
                    <parameter name="network.ssl.clientAuth" value="true"/>
                    <parameter name="network.ssl.keyStore" value="C:\Users\Administrator\Desktop\demo\server_keystore.p12"/>
                    <parameter name="network.ssl.keyStorePassword" value="password"/>
                    <parameter name="network.ssl.trustStore" value="C:\Users\Administrator\Desktop\demo\server_keystore.p12"/>
                    <parameter name="network.ssl.trustStorePassword" value="password"/>
                </parameters>
            </socket>
        </sockets>
        <protocols>
            <!-- Default registered protocol. It reads commands using the HTTP protocol
                and write data locally -->
            <protocol implementation="com.orientechnologies.orient.server.network.protocol.binary.ONetworkProtocolBinary" name="binary"/>
            <protocol implementation="com.orientechnologies.orient.server.network.protocol.http.ONetworkProtocolHttpDb" name="http"/>
        </protocols>
        <listeners>
            <listener ip-address="0.0.0.0" port-range="2424" protocol="binary" socket="ssl"/>
            <listener ip-address="127.0.0.1" port-range="2480-2490" protocol="http" socket="https">
                <parameters>
                    <!-- Connection's custom parameters. If not specified the global configuration
                        will be taken -->
                    <parameter name="network.http.charset" value="utf-8"/>
                    <parameter name="network.http.jsonResponseError" value="true"/>
                    <!-- Define additional HTTP headers to always send as response -->
                    <!-- Allow cross-site scripting -->
                    <!-- parameter name="network.http.additionalResponseHeaders" value="Access-Control-Allow-Origin:
                        *;Access-Control-Allow-Credentials: true" / -->
                </parameters>
                <commands>
                    <command implementation="com.orientechnologies.orient.server.network.protocol.http.command.get.OServerCommandGetStaticContent" pattern="GET|www GET|studio/ GET| GET|*.htm GET|*.html GET|*.xml GET|*.jpeg GET|*.jpg GET|*.png GET|*.gif GET|*.js GET|*.css GET|*.swf GET|*.ico GET|*.txt GET|*.otf GET|*.pjs GET|*.svg GET|*.json GET|*.woff GET|*.woff2 GET|*.ttf GET|*.svgz">
                        <parameters>
                            <!-- Don't cache html resources in development mode -->
                            <entry name="http.cache:*.htm *.html" value="Cache-Control: no-cache, no-store, max-age=0, must-revalidate\r\nPragma: no-cache"/>
                            <!-- Default caching -->
                            <entry name="http.cache:default" value="Cache-Control: max-age=120"/>
                        </parameters>
                    </command>
                    <command implementation="com.orientechnologies.orient.graph.server.command.OServerCommandGetGephi" pattern="GET|gephi/*"/>
                </commands>
            </listener>
        </listeners>
        <cluster>
        </cluster>
    </network>
    <storages>
    </storages>
    <users>
    <user name="name" password="password" resources="*"/></users>
    <properties>
        <!-- DATABASE POOL: size min/max -->
        <entry name="db.pool.min" value="1"/>
        <entry name="db.pool.max" value="50"/>

        <!-- PROFILER: configures the profiler as <seconds-for-snapshot>,<archive-snapshot-size>,<summary-size> -->
        <entry name="profiler.enabled" value="false"/>
        <!-- <entry name="profiler.config" value="30,10,10" /> -->
    </properties>
<schemaVersion value="2"/></orient-server>

[ngalan818]

I am still seeing http being used after switching socket to https from default
INFO Listening http connections on 127.0.0.1:2480 (protocol v.10, socket=https) [OServerNetworkListener]
INFO OrientDB Studio available at http://127.0.0.1:2480/studio/index.html [OServer]

[tglman]

Hi,

Since 3.2.17, now it also print the https:// with the url when the server is configured to use ssl.

Regards