Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Can't Logging in Zlux since upgrade to 1.13 #499

Open
deltombf opened this issue Jul 20, 2020 · 19 comments
Open

Can't Logging in Zlux since upgrade to 1.13 #499

deltombf opened this issue Jul 20, 2020 · 19 comments
Assignees
@NakulManchanda @timgerstel @1000TurquoisePogs

Comments

@deltombf
Copy link

Hi,

I upgraded 2 instance from 1.11 to 1.13, in 1.11 all is working fine
Since the upgrade i can't Log to Zlux on the 2 instance with the same message :

L'authentification a échoué pour 3 types. Les types: ["saf","apiml","zss"]

in the AppServer log i find :

2020-07-20 06:40:19.948 ZWED:50331766 ZWESVUSR WARN (org.zowe.zlux.auth.safsso,apimlHandler.js:338) APIML login has failed:
2020-07-20 06:40:19.948 ZWED:50331766 ZWESVUSR WARN (org.zowe.zlux.auth.safsso,apimlHandler.js:339) é Error: self signed certificate in certificate cha
at TLSSocket. (_tls_wrap.js:1116:38)
at emitNone (events.js:106:13)
at TLSSocket.emit (events.js:208:7)
at TLSSocket._finishInit (_tls_wrap.js:643:8)
at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:473:38) code: 'SELF_SIGNED_CERT_IN_CHAIN' è
2020-07-20 06:40:19.984 ZWED:50331766 ZWESVUSR WARN (org.zowe.zlux.auth.safsso,apimlHandler.js:264) APIML query error: self signed certificate in certificate chain
2020-07-20 06:40:20.023 ZWED:50331766 ZWESVUSR WARN (org.zowe.zlux.auth.safsso,apimlHandler.js:338) APIML login has failed:
2020-07-20 06:40:20.023 ZWED:50331766 ZWESVUSR WARN (org.zowe.zlux.auth.safsso,apimlHandler.js:339) é Error: self signed certificate in certificate chain
at TLSSocket. (_tls_wrap.js:1116:38)
at emitNone (events.js:106:13)
at TLSSocket.emit (events.js:208:7)
at TLSSocket._finishInit (_tls_wrap.js:643:8)
at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:473:38) code: 'SELF_SIGNED_CERT_IN_CHAIN' è
2020-07-20 06:40:20.024 ZWED:50331766 ZWESVUSR INFO (zsf.auth,webauth.js:322) ZWED0070I - 9F054kAKmm0VIaTZ3fsZ-v3BiCo5Mby: Session security call refreshStatus succesful for auth handler org.zowe.zlux.auth.trivial. Plugin response: é"success":trueè
2020-07-20 06:40:24.064 ZWED:50331766 ZWESVUSR WARN (org.zowe.zlux.auth.safsso,apimlHandler.js:338) APIML login has failed:
2020-07-20 06:40:24.064 ZWED:50331766 ZWESVUSR WARN (org.zowe.zlux.auth.safssoapimlHandler.js:339) é Error: self signed certificate in certificate chain
at TLSSocket. (_tls_wrap.js:1116:38)
at emitNone (events.js:106:13)
at TLSSocket.emit (events.js:208:7)
at TLSSocket._finishInit (_tls_wrap.js:643:8)
at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:473:38) code: 'SELF_SIGNED_CERT_IN_CHAIN' è
2020-07-20 06:40:24.099 ZWED:50331766 ZWESVUSR WARN (org.zowe.zlux.auth.safsso,apimlHandler.js:264) APIML query error: self signed certificate in certificate in certificate chain
2020-07-20 06:40:24.134 ZWED:50331766 ZWESVUSR WARN (org.zowe.zlux.auth.safsso,apimlHandler.js:338) APIML login has failed:
2020-07-20 06:40:24.134 ZWED:50331766 ZWESVUSR WARN (org.zowe.zlux.auth.safsso,apimlHandler.js:339) é Error: self signed certificate in certificate chain
at TLSSocket. (_tls_wrap.js:1116:38)
at emitNone (events.js:106:13)
at TLSSocket.emit (events.js:208:7)
at TLSSocket._finishInit (_tls_wrap.js:643:8)
at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:473:38) code: 'SELF_SIGNED_CERT_IN_CHAIN' è
2020-07-20 06:40:24.135 ZWED:50331766 ZWESVUSR WARN (zsf.auth,webauth.js:325) ZWED0003W - 9F054kAKmm0VIaTZ3fsZ-v3BiCo5Mby: Session security call authenticate failed for auth handler org.zowe.zlux.auth.safsso. Plugin response: é"success":false,"reason":"Unknown","error":é"message":"APIML self signed certificate in certificate chain"è,"apiml":true,"zss":true,"sso":false,"canChangePassword":trueè
2020-07-20 06:40:24.135 ZWED:50331766 ZWESVUSR INFO (zsf.auth,webauth.js:322) ZWED0070I - 9F054kAKmm0VIaTZ3fsZ-v3BiCo5Mby: Session security call authenticate succesful for auth handler org.zowe.zlux.auth.trivial. Plugin response: é"success":trueè

It seems to be a certificate issue but i don't use self signed certificate so i don't understand.
I have tried to generate the Keystore that doesnt solved the problem.

Any idea how to solve this problem ?
Regards
@deltombf
Copy link
Author

Another point i could use Jes, Mvs and Uss Explorer directly : https://your-server-domain:7554/ui/v1/explorer-jes/

@deltombf
Copy link
Author

But the direct acces failed

https://your-server-domain:8546/ui/v1/explorer-jes/

Unexpected token F in JSON at position 0

@DivergentEuropeans
Copy link
Member

Hello @deltombf
I apologize about your issue! There seems to be a problem with your authentication method. Seeing as you can log into the Explorers directly, could you try to access the desktop with the API port (7554)? So full URL would be:
https://domain:7554/ui/v1/zlux/ZLUX/plugins/org.zowe.zlux.bootstrap/web/

@deltombf
Copy link
Author

Hi,

Thank you for your help I try this URL but :
{"messages":[{"messageType":"ERROR","messageNumber":"ZWEAM104E","messageContent":"The endpoint you are looking for '/ui/v1/zlux/ZLUX/plugins/org.zowe.zlux.bootstrap/web/' could not be located","messageKey":"org.zowe.apiml.common.endPointNotFound"}]}

I also try https://domain:7554/ui/v1/ZLUX/plugins/org.zowe.zlux.bootstrap/web/ and
https://domain:7554/ui/v1/zlux/plugins/org.zowe.zlux.bootstrap/

And that's not working :( I can't finf the Zlux part when i search it in https://domain:7554/ui/v1/apicatalog/

Regards,
françois

@1000TurquoisePogs
Copy link
Member

This has to do with the certificates in Zowe's keystore being self-signed. When the server configuration has node.https.certificateAuthorities defined, then certificate verification is turned on, and those authorities are used for verification. Changing the certificate that the APIML uses, or the list of certificate authorities that the app server uses, can effect if the server allows or rejects the certificates due to self-signing.
https://github.com/zowe/zlux-server-framework/blob/master/plugins/sso-auth/lib/apimlHandler.js#L60

To alter the list to include certificate authorities that may pass validation, you can set ZWED_node_https_certificateAuthorities in instance.env file to a list of files or keyring objects, such as

ZWED_node_https_certificateAuthorities="/path/to/fileA","/path/to/fileB"
ZWED_node_https_certificateAuthorities="/path/to/fileA",
ZWED_node_https_certificateAuthorities="/path/to/fileA","safkeyring://user/name&alias"

A comma is always needed even if there is only one entry, because it signifies the value is an array.
I don't believe 1.13.0 allows you to actually disable certificate verification in this part of the code. We could add this for testing, but it is less secure.

If none of this works, I think it is possible to revert to the older behavior for accessing the desktop.
The behavior is handled by security plugins. The one you saw was "org.zowe.zlux.auth.safsso", which handles sso to apiml, zss, zosmf.
1.13.0 still shipped with an older plugin, "org.zowe.zlux.auth.zss", which handles just zss.
You can remove plugins easily,
delete the json file in $INSTANCE_DIR/workspace/app-server/plugins that corresponds to the ID
You can add them back easily too,
run $INSTANCE_DIR/bin/install-app.sh /path/to/the/plugin
So for the zss plugin, it would be
$INSTANCE_DIR/bin/install-app.sh $ROOT_DIR/components/app-server/share/zss-auth
And to add back safsso if you remove it,
$INSTANCE_DIR/bin/install-app.sh $ROOT_DIR/components/app-server/share/zlux-server-framework/plugins/sso-auth

@1000TurquoisePogs
Copy link
Member

By the way, to access the desktop through the mediation layer, the url is actually /ui/v1/zlux/ZLUX/plugins/org.zowe.zlux.bootstrap/web/ as Lenny said, it has "zlux" twice.
If you go to /ui/v1/zlux/ it will redirect to the longer one.

@deltombf
Copy link
Author

Hi, Thank you for your help !

First I try the two access method but with no success
{"messages":[{"messageType":"ERROR","messageNumber":"ZWEAM104E","messageContent":"The endpoint you are looking for '/ui/v1/zlux/ZLUX/plugins/org.zowe.zlux.bootstrap/web/' could not be located","messageKey":"org.zowe.apiml.common.endPointNotFound"}]}

{"messages":[{"messageType":"ERROR","messageNumber":"ZWEAM104E","messageContent":"The endpoint you are looking for '/ui/v1/zlux/' could not be located","messageKey":"org.zowe.apiml.common.endPointNotFound"}]}

Next i add at the end of the instance.env a line with my external certification authorities and recycle the ZWESVSTC
ZWED_node_https_certificateAuthorities="/etc/zowe/certificats/UINTD41A","/etc/zowe/certificats/URACD41A"

I have the same error message of self signed certificate :'(

Last i delete the json file safsso and create the old plgin by using
/usr/lpp/zowe/instance/bin/install-app.sh /usr/lpp/zowe/1.13.0/components/app-server/share/zss-auth

I recycle the ZWESVSTC and see this error message on the log
ZWED0112E - The server found no plugin implementing the specified default autheauthentication type of saf.

When I try to log in to Zlux, The site is not reachable with ERR_CONNECTION_REFUSED

Regards,
François

@1000TurquoisePogs
Copy link
Member

For self-signed certificate errors, could it be that the APIML certificate is not using the certificate authorities in the "/etc/zowe/certificats/UINTD41A","/etc/zowe/certificats/URACD41A" list. It might be that you are using external files in addition to the default ones, so you need to include all of them. If you look at your old logs, the value of "certificateAuthorities" in the log may have included other files too?

For zss, I failed to mention that ZSS is authentication type "zss".
You can see that the default value was "saf"
https://github.com/zowe/zowe-install-packaging/blob/master/files/zlux/config/zluxserver.json#L49
if you change "defaultAuthentication" to "zss", it may work better.
saf-sso is "zss", "saf", and "apiml", because it handles sso well.
zss-auth is just type "zss".
So that means they can both use type "zss", it will be a good value.
I believe you can change the value quickly through instance.env:

ZWED_dataserviceAuthentication_defaultAuthentication=zss

@deltombf
Copy link
Author

Hi, Thanks again for your help
This is my conf for the certificate :

£ optional - Path to a PKCS12 keystore with a server certificate for API
£ Mediaton Layer (APIML)
EXTERNAL_CERTIFICATE=/etc/zowe/certificats/zosmf.p12
£ optional - Alias of the certificate in the keystore
EXTERNAL_CERTIFICATE_ALIAS=1
£ optional - Public certificates of trusted CAs - multiple certificates
£ delimitad with space has to be enclosed with quotes ("cer1 cer2")
EXTERNAL_CERTIFICATE_AUTHORITIES="/etc/zowe/certificats/UINTD41A /etc/zowe/certificats/URACD41A"
£ optional - Public certificates of z/OSMF - multiple certificates
£ delimited with space has to be enclosed with quotes ("cer1 cer2")
ZOSMF_CERTIFICATE=
£ If APIML SSO token not present
SSO_FALLBACK_TO_NATIVE_AUTH=true
£ optional - PKCS£11 token name for SSO. Must already exist
PKCS11_TOKEN_NAME=
£ optional - PKCS£11 token label for SSO. Must not already exist
PKCS11_TOKEN_LABEL=

By adding ZWED_dataserviceAuthentication_defaultAuthentication=zss on instance.env and recycle the CV
This time i can login !!!! GG
I have another instance with the same problem do you want we do further test with ZWED_node_https_certificateAuthorities and the new auth plugin to make External certification auth working ?

Regards,
François

@1000TurquoisePogs
Copy link
Member

The CA you have, "/etc/zowe/certificats/UINTD41A /etc/zowe/certificats/URACD41A", can you print it?
If you can't print it, then I believe the reason why it wasn't working was the format of the file.
There's more than one file format for certificates, but only one type is being used by the app server at this time, which is a PEM file. They are base64 encoded, so they look like this:

-----BEGIN CERTIFICATE-----
MIID+zCCAuOgAwIB
...
-----END CERTIFICATE-----

If it's possible to convert to that format, then it would be good to know if that allows everything to work properly. If it's in another format, do you know which format? Perhaps we can add support.

@deltombf
Copy link
Author

Hi,
I browse my two external certification authority and They'are starting with :

-----BEGIN CERTIFICATE-----
MIIGuTCCBKGgAwIBAgIBBzANBgkqhkiG9w0BAQsFADBEMSAwHgYDVQQKDBdHUk9V

.....

and finishing with :

MTPLmPr9nX9hsEYSk1rfF8CgWAOcGhWLOJlkOqttFbVHxFMu2pqVG18+a5cg
-----END CERTIFICATE-----

Regards,
François

@deltombf
Copy link
Author

For me it's not a certificate issue since the old zss plugin work like a charm i think the new sso plugin broke the Zss part and only use Token

@bohns
Copy link

bohns commented Aug 18, 2020 •
edited
Loading

@deltombf @1000TurquoisePogs

Thank you for the workaround. This worked great for me as well.

@deltombf
Copy link
Author

deltombf commented Sep 3, 2020 via email

@Wieb-Pilon
Copy link

Hi,
Excactly the same issue while installing zowe 1.14 with 'SELF_SIGNED_CERT_IN_CHAIN' messages and trying to logon via zlux gives measge with ["saf","apiml","zss"] and warning in the ZWESVUSR log:
ZWED:16908586 ZWESVUSR WARN (_zsf.auth,webauth.js:328) ZWED0003W - cRv4-s5k5EGDchmJGJxgi8Up8lSYdLHY: Session security call authenticate failed for auth handller org.zowe.zlux.auth.safsso. Plugin response: {"success":false,"reason":"Unknown","error":{"message":"APIML self signed certificate in certificate chain"},"apiml":true,"zss":true,"sso":false,"canChangePassword":true}

Bypass with
ZWED_dataserviceAuthentication_defaultAuthentication=zss in instance.env,
delete $instance/workspace/app-server/plugins/org.zowe.zlux.auth.safsso.json
and $instance/bin/install-app.sh /usr/lpp/zowe/1.13.0/components/app-server/share/zss-auth
works fine.

Any indication if this solved in 1.15?

Thanks, Wieb Pilon

@1000TurquoisePogs
Copy link
Member

Not in 1.15, but we're continuing to work on automating this solution and I see PRs zowe/zlux-app-server#138 and zowe/zowe-install-packaging#1674 which when merged should resolve some or all issues seen in this ticket. This may be in 1.16 or 1.17 due to timing (1.16 is getting built next week)

@NakulManchanda
Copy link
Member

NakulManchanda commented Oct 6, 2020 •
edited
Loading

hi @1000TurquoisePogs,
@NayerNajafi is helping to test this for v1.16
#499 (comment)

To alter the list to include certificate authorities that may pass validation, you can set ZWED_node_https_certificateAuthorities in instance.env file to a list of files or keyring objects, such as

ZWED_node_https_certificateAuthorities="/path/to/fileA","/path/to/fileB"
ZWED_node_https_certificateAuthorities="/path/to/fileA",
ZWED_node_https_certificateAuthorities="/path/to/fileA","safkeyring://user/name&alias"

@NayerNajafi
Copy link

NayerNajafi commented Oct 6, 2020 •
edited
Loading

I tried Zowe external certificate configured with Zowe 1.16 RC1. I see that External Certificate is added to server.json:

"certificateAuthorities": Ý
"/SYSTEM/var/zowe116/keystore/local_ca/localca.cer-ebcdic",
"/SYSTEM/var/zowe116/keystore/local_ca/extca.1.cer-ebcdic"

But not able to logon into Zowe Desktop,

ZWESVUSR WARN (org.zowe.zlux.auth.safsso,apimlHandler.js:264) APIML query error: self signed certificate in certificate chain
ZWESVUSR WARN (org.zowe.zlux.auth.safsso,apimlHandler.js:338) APIML login has failed:
ZWESVUSR WARN (org.zowe.zlux.auth.safsso,apimlHandler.js:339) Error: self signed certificate in certificate chain
at TLSSocket.onConnectSecure (_tls_wrap.js:1506:34)
at TLSSocket.emit (events.js:315:20)
at TLSSocket._finishInit (_tls_wrap.js:948:8)
at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:706:12) {
code: 'SELF_SIGNED_CERT_IN_CHAIN'
}
FYI @NakulManchanda @1000TurquoisePogs

I added ZWED_node_https_certificateAuthorities into instance.enc, but still getting the same error
ZWED_node_https_certificateAuthorities="/SYSTEM/var/zowe116/keystore/local_ca/localca.cer-ebcdi","/SYSTEM/var/zowe116/keystore/local_ca/extca.1.cer-ebcdic"

@NakulManchanda
Copy link
Member

zowe/docs-site#1448

@ccc13481 ccc13481 mentioned this issue Jul 7, 2021
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@NakulManchanda NakulManchanda

@timgerstel timgerstel

@1000TurquoisePogs 1000TurquoisePogs

Labels
None yet
Projects
WebUI planning board
Status: No status
Milestone
No milestone
Development

No branches or pull requests
8 participants
@NakulManchanda @timgerstel @DivergentEuropeans @bohns @1000TurquoisePogs @NayerNajafi @Wieb-Pilon @deltombf