Skip to content
This repository has been archived by the owner on May 26, 2023. It is now read-only.

Enable CLI to work with both secured/none secured EdgeXFoundry instances #207

Open
difince opened this issue May 28, 2020 · 2 comments
Open
Labels
dependent issue Issue/functionality that could be handled only when another issue is fixed/implemented enhancement New feature or request hanoi Hanoi release

Comments

@difince
Copy link
Contributor

difince commented May 28, 2020

🚀 Feature Request

Description

EdgeX Foundry could work in two modes - secure and none secure.
When security is off all micro services are accessible and could be called from outside.
When security is On, there is a single entry point - gateway that accepts https requests and requires Authorization Header.

Here it is how you could create a user with name tony that belongs to pre-existent group - admin.

docker-compose -f docker-compose-geneva-redis.yml run --rm

--entrypoint /edgex/security-proxy-setup edgex-proxy --init=false --useradd=tony --group=admin

Once the user is created a token is provided.
This token could be used for accessing edgex services by sending it in the Authorization Header.
More about Gateway security : here

Describe the solution you'd like

The token could be created only by executing the above command locally on the EdgeX Server. So lets assume that the token is already created and ENV variable is created with the token value on the machine where edgex-cli is running.
Propose Name for env variable could be : EDGEX_ACCESS_TOKEN
configuration.tolm file content will be different depending on the EdgeX Foundry security mode.
If the security is Off: the content should be :

[Service]
security= false
[Clients]
[Clients.Metadata]
Host = 'localhost'
Protocol = 'http'
Port = 48081
[Clients.CoreData]
Host = 'localhost'
Protocol = 'http'
Port = 48080
[Clients.Scheduler]
Host = 'localhost'
Protocol = 'http'
Port = 48085
[Clients.Notification]
Host = 'localhost'
Protocol = 'http'
Port = 48060
[Clients.Logging]
Host = 'localhost'
Protocol = 'http'
Port = 48061

If the security is On

[Service]
security= true
[Clients]
[Clients.Proxy]
Host = 'gatewayIp'
Protocol = 'https'
Port = 8443

Configuration file, will be filled with the appropriate content during the installation process:
make install - the default will be working in security enabled mode.
make install insecure - work in security disabled mode.

On start up, edgex-cli should check what is the value of security property
If it is true, all requests towards all edgex microservices goes through the gateway. Part of the url will be used to identify which EdgeX micro service the request should be routed to.

curl https://:8443/<service_identifier>/api/v1/ping

coredata 48080 -> coredata
metadata 48081 -> metadata
command 48082 -> command
notifications 48060 -> notifications
supportlogging 48061 -> supportlogging

examples:
curl https://:8443/coredata/api/v1/ping
curl https://:8443/metadata/api/v1/ping
curl https://:8443/command/api/v1/ping
and etc.

Each request should contain the special two Headers:

  • Authorization: EDGEX_ACCESS_TOKEN

  • host: edgex

Current Edgex-CLI implementation use go-mod-core-contracts models and Interface clients - that are not prepared to work in security mode. First Go-mod-core -contract should be updated appropriately and used in the Edgex-CLI.
(I am still not sure if the security mode need to be implemnted for edgex api v1, or to come when working with edgex API v2 )

@difince difince added the enhancement New feature or request label May 28, 2020
@difince difince added the dependent issue Issue/functionality that could be handled only when another issue is fixed/implemented label Jun 18, 2020
@difince difince added the hanoi Hanoi release label Oct 22, 2020
@tonyespy
Copy link
Member

tonyespy commented Nov 3, 2020

I thought we'd ruled out support for secure mode as the client for the initial release?

@tonyespy
Copy link
Member

tonyespy commented Nov 3, 2020

Isn't this a duplicate of issue #101?

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
dependent issue Issue/functionality that could be handled only when another issue is fixed/implemented enhancement New feature or request hanoi Hanoi release
Projects
None yet
Development

No branches or pull requests

2 participants