Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

DPS Auth requires Mutual TLS #2910

Merged
merged 4 commits into from Nov 4, 2019
Merged

DPS Auth requires Mutual TLS #2910

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
13ca98d
DPS Auth requires Mutual TLS
Nov 1, 2019
2d623ae
Merge branch 'master' into cg_dps_mutual_tls
Nov 4, 2019
a719ca1
Deploy to experimental
Nov 4, 2019
901ca7c
Revert "Deploy to experimental"
Nov 4, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
22 changes: 18 additions & 4 deletions config/app-client-tls.container-definition.json
View file
Open in desktop
Expand Up @@ -17,8 +17,6 @@
"production",
"--debug-logging",
"--log-task-metadata",
"--db-env",
"container",
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was duplicated for some reason. We don't need it twice.

"--mutual-tls-enabled",
"--tls-enabled"
],
Expand Down Expand Up @@ -89,8 +87,20 @@
"value": "{{ .move_mil_dod_ca_cert }}"
},
{
"name": "HTTP_MY_SERVER_NAME",
"value": "my.{{ .domain }}"
"name": "DPS_REDIRECT_URL",
"value": "{{ .DPS_REDIRECT_URL }}"
},
{
"name": "DPS_COOKIE_NAME",
"value": "{{ .DPS_COOKIE_NAME }}"
},
{
"name": "DPS_COOKIE_DOMAIN",
"value": ".sddc.army.mil"
},
{
"name": "HTTP_DPS_SERVER_NAME",
"value": "dps.{{ .domain }}"
},
{
"name": "HTTP_ORDERS_SERVER_NAME",
Expand Down Expand Up @@ -148,6 +158,10 @@
"name": "SERVE_SWAGGER_UI",
"value": "{{ .SERVE_SWAGGER_UI }}"
},
{
"name": "SERVE_DPS",
"value": "{{ .SERVE_DPS }}"
},
{
"name": "SERVE_ORDERS",
"value": "{{ .SERVE_ORDERS }}"
Expand Down
24 changes: 0 additions & 24 deletions config/app.container-definition.json
View file
Open in desktop
Expand Up @@ -93,14 +93,6 @@
"name": "HTTP_ADMIN_SERVER_NAME",
"value": "admin.{{ .domain }}"
},
{
"name": "HTTP_ORDERS_SERVER_NAME",
"value": "orders.{{ .domain }}"
},
{
"name": "HTTP_DPS_SERVER_NAME",
"value": "dps.{{ .domain }}"
},
{
"name": "AWS_S3_BUCKET_NAME",
"value": "transcom-ppp-app-{{ .environment }}-us-west-2"
Expand Down Expand Up @@ -161,18 +153,6 @@
"name": "HTTP_SDDC_PORT",
"value": ""
},
{
"name": "DPS_REDIRECT_URL",
"value": "{{ .DPS_REDIRECT_URL }}"
},
{
"name": "DPS_COOKIE_NAME",
"value": "{{ .DPS_COOKIE_NAME }}"
},
{
"name": "DPS_COOKIE_DOMAIN",
"value": ".sddc.army.mil"
},
{
"name": "GEX_URL",
"value": "https://gexweba.daas.dla.mil/msg_data/submit/"
Expand Down Expand Up @@ -201,10 +181,6 @@
"name": "SERVE_SDDC",
"value": "{{ .SERVE_SDDC }}"
},
{
"name": "SERVE_DPS",
"value": "{{ .SERVE_DPS }}"
},
{
"name": "SERVE_API_INTERNAL",
"value": "{{ .SERVE_API_INTERNAL }}"
Expand Down
9 changes: 7 additions & 2 deletions pkg/cli/services.go
View file
Open in desktop
Expand Up @@ -57,17 +57,22 @@ func CheckServices(v *viper.Viper) error {
return errors.New("no service was enabled")
}

// if DPS is enabled then the mutualTLSListener is needed too
// if Orders is enabled then the mutualTLSListener is needed too
// if PRIME is enabled then the mutualTLSListener is needed too
mutualTLSEnabled := v.GetBool(MutualTLSListenerFlag)
if v.GetString(EnvironmentFlag) != EnvironmentDevelopment {
if dpsEnabled && !mutualTLSEnabled {
return errors.New(fmt.Sprintf("for dps service to be enabled both %s and the %s flags must be in use", ServeDPSFlag, MutualTLSListenerFlag))
}
if ordersEnabled && !mutualTLSEnabled {
return errors.New(fmt.Sprintf("for orders service to be enabled both %s and the %s flags must be in use", ServeOrdersFlag, MutualTLSListenerFlag))
}
if primeAPIEnabled && !mutualTLSEnabled {
return errors.New(fmt.Sprintf("for prime service to be enabled both %s and the %s flags must be in use", ServePrimeFlag, MutualTLSListenerFlag))
}
if mutualTLSEnabled && !ordersEnabled && !primeAPIEnabled {
return errors.New("either orders service or prime service must be enabled for mutualTSL to be enabled")
if mutualTLSEnabled && !(dpsEnabled || ordersEnabled || primeAPIEnabled) {
return errors.New("either dps, orders or prime service must be enabled for mutualTSL to be enabled")
}
}

Expand Down