Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
99 changes: 99 additions & 0 deletions dynamic-client-ssl-context/README-source.adoc
Original file line number Diff line number Diff line change
@@ -0,0 +1,99 @@
include::../shared-doc/attributes.adoc[]

= dynamic-client-ssl-context: Dynamic client SSL Context between Server and Client
:author: Richard Záň
:level: Intermidiate

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Typo: :level: Intermidiate:level: Intermediate

:technologies: Dynamic TLS, Security, Undertow

[abstract]
The dynamic-client-ssl-context quickstart shows the option to select different SSL/TLS configurations dynamically based on the host and port of the outbound connection.

:standalone-server-type: default
:archiveType: war

== What is it?

Elytron client supports dynamic client SSL context. It can be configured everywhere in the subsystem where client-ssl-context attribute can be configured.

The `dynamic-client-ssl-context` quickstart demonstrates enabled dynamic SSL context for specified URLs and their ports. The only function they represent is to be called via provided REST client and pass as successful call through the SSL/TLS configuration.

This example consists of the following two URLs, each with enabled dynamic SSL context:

[cols="100%",options="headers"]
|===
|URL paths with their ports

|`https://localhost:9443/dynamic-client-ssl-context/`

|`https://localhost:10443/dynamic-client-ssl-context/`
Comment on lines +20 to +28

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMHO this doesn't belong to an abstract / "what is it" section, and should be removed


|===

The server configuration is done using CLI batch scripts located in the root of the quickstart folder.

// Link to the quickstart source
include::../shared-doc/view-the-source.adoc[leveloffset=+1]
// System Requirements
include::../shared-doc/system-requirements.adoc[leveloffset=+1]
// Use of {jbossHomeName}
include::../shared-doc/use-of-jboss-home-name.adoc[leveloffset=+1]

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we can mention how to run them here to be consistent with the rest of quickstarts

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

something like this? https://github.com/wildfly/quickstart/blob/main/helloworld-mutual-ssl-secured/README.adoc#building-and-running-the-quickstart-application-with-provisioned-wildfly-server

I have already added parts that cover it:
../shared-doc/start-the-standalone-server.adoc
../shared-doc/build-and-deploy-the-quickstart.adoc
../shared-doc/run-integration-tests-with-server-distribution.adoc
...

I took a massive inspiration from https://github.com/wildfly/quickstart/blob/main/ejb-multi-server/README-source.adoc

[[start_with_a_clean_server_install]]

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. Wrap the standard dist instructions in a header like this:
    https://github.com/wildfly/quickstart/blob/main/helloworld/README-source.adoc?plain=1#L27
  2. Change all sections to be wrapped to use header ===, and includes of sections to wrap should offset+2

== Start with a Clean Server Install

It is important to start with a clean version of {productName} before testing this quickstart. Make sure you unzip or install a fresh {productName} instance.

// Back Up the {productName} Managed Domain Configuration

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess this should be Standalone instead of Managed Domain?

include::../shared-doc/back-up-server-standalone-configuration.adoc[leveloffset=+1]
// Start the {productName} Managed Domain

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as above?

include::../shared-doc/start-the-standalone-server.adoc[leveloffset=+1]

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is missing the step to configure the server, ie run the script. You can copy and adapt from https://github.com/wildfly/quickstart/blob/main/ejb-security-context-propagation/README-source.adoc?plain=1#L83

// Build and Deploy the Quickstart

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be after the section wrt config changes

include::../shared-doc/build-and-deploy-the-quickstart.adoc[leveloffset=+1]

[[review_the_modified_server_configuration]]
== Review the Modified Server Configuration

There are too many additions to the configuration file to list here. Feel free to compare the `standalone.xml` to the backup copy to see the changes made to configure the server to run this quickstart.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am lazy to check, but is this sentence consistent with some other quickstarts?

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, I have took the liberty to reuse this one:

There are too many additions to the configuration files to list here. Feel free to compare the domain.xml and host.xml to the backup copies to see the changes made to configure the server to run this quickstart.

https://github.com/wildfly/quickstart/blob/main/ejb-multi-server/README.adoc?plain=1#L349

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should describe the configuration changes, the ejb-multi-server lazy choice is not acceptable for a new quickstart :)


[[access_the_application]]
== Access the Application

The application will be running at the following URL: https://localhost:8080/dynamic-client-ssl-context

A main page displays list of links:

[source,options="nowrap"]
----
Click below to send request to different ports:

Send request to port 9443
Send request to port 10443
----

Each of links executes https GET request on server under specified ports. Each port uses a different TLS certificate. Both GET requests use the same dynamic client SSL context. For http://localhost:8080/dynamic-client-ssl-context/rest/port9443request, it will display:

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The URL uses http:// but the application only exposes HTTPS listeners (ports 9443 and 10443) — there is no plain HTTP listener on 8080 for this endpoint. Should be https://. Same issue on line 81.


[source,options="nowrap"]
----
HTTP status of result is 200
----

Similar result is for http://localhost:8080/dynamic-client-ssl-context/rest/port10443request:

[source,options="nowrap"]
----
HTTP status of result is 200
----

// Server Distribution Testing
:integrationTestsDirectory: app-web/src/test/

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please remove this attribute set, that is specific to ejb-multi-server multi-module design

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:integrationTestsDirectory: app-web/src/test/ is incorrect — the integration tests are under src/test/, not app-web/src/test/. This will render a wrong path in the generated documentation. Should be removed (let the shared-doc default apply) or set to src/test/.

include::../shared-doc/run-integration-tests-with-server-distribution.adoc[leveloffset=+1]

// Undeploy the Quickstart
include::../shared-doc/undeploy-the-quickstart.adoc[leveloffset=+1]

// Restore the {productName} Managed Domain Configuration Manually

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Standalone?

include::../shared-doc/restore-standalone-server-configuration-manual.adoc[leveloffset=+1]

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This quickstart includes provisioned-server maven profile, but no instructions related with that, please add the following include to fix this:

include::../shared-doc/build-and-run-the-quickstart-with-provisioned-server.adoc[leveloffset=+1]

// Quickstart not compatible with OpenShift
include::../shared-doc/openshift-incompatibility.adoc[leveloffset=+1]
Loading