Zowe - APIML - HTTPS south-bound edge - Discovery Service access is protected by HTTPS client certificates (in APIML)

[plavjanik]

Issue by plavjanik
Thursday Oct 25, 2018 at 13:23 GMT
Originally opened as https://github.com/gizafoundation/api-layer/issues/196

---

As the security administrator, I want only authorized services to be able to register into the APIML.

Acceptance criteria:

1. Only services that have a certificate trusted by APIML can communicate with discovery service
2. Internal APIML services (API Catalog, Gateway, Discoverable Client) provide correct client certificate to the discovery service
3. The certificate generated by the CM script is usable for DS
4. HTTPS for DS is on by default, can be switched off by using a different Spring profile
5. Provides good error handling in the following situations:
   • Wrong configuration of services (missing certificate, an invalid path to the certificate, invalid protocol, password...)
     • Wrong key alias - expected behavior: Server stops and there is an exception that that clearly describes @taban03
     • Other were tested by @plavjanik and they result in failure (DS stops) and informative exceptions
     • Untrusted certificate of a service (reported once in the DS, reported nicely in the service) - moved to error handling story because of infrastructure dependency
6. Keyrings on z/OS are read
7. Zowe installation templates are updated

Notes:

• Branch: https://github.com/zowe/api-layer/tree/https-discovery-service-%2374
• Doc branch: https://github.com/zowe/docs-site/blob/apiml-https/docs/guides/api-mediation-security.md
• It does not cover all enablers
• Depends on Zowe - APIML - HTTPS south-bound edge - API Gateway, Discovery Service, and Discoverable Client Configuration Cleanup #76
• Depends on Zowe - APIML - HTTPS south-bound edge - Certification management for Zowe developer - localhost #72
• https://docs.oracle.com/javase/6/docs/technotes/guides/security/jsse/JSSERefGuide.html
• http://www.robinhowlett.com/blog/2016/01/05/everything-you-ever-wanted-to-know-about-ssl-but-were-afraid-to-ask/

[zowe-robot]

The changes to the error code documentation are available in this PR: zowe/docs-site#2525