Keyring support #1177

vit-tomica · 2020-03-03T15:01:16Z

SAF keyring configuration for Zowe

This PR enhances certificate configuration scripts to store certificates in keyrings.
The idea is to provide analogous actions for keyrings to what we currently have for keystores, i.e. generating a local zowe CA and zowe cert, importing external certs, delete certs or generally doing certs cleanup

Motivation:

run Zowe on keyrings
when configuring keyrings, do as much automation as possible
if possible avoid writing a lot of documenation (commands for each ESMs etc...)

How much java keytool can handle SAF keyrings
it can:

generate and connect a certificate with a keyring, creates the keyring if does not exist.
import/export a certificate from/to a keystore, creates the keyring if does not exist.
disconnect a certifice from a keyring.
there is also a java hwkeytool utility that can take advantage of crypto hardware.

it can't:

delete keyring
delete a certificate from RACF database.

The keyring-util program (leverages R_datalib API) provides keyring actions that the Java keytool can't do.
it can:

delete keyring
delete a certificates from RACF database
refresh DIGTCERT class

The keyring-util's functions could be useful in scenarios like:

cleanup keyring configuration
renewing certs
automation
if keyring configuration fails in the middle of the process, we can cleanup partial setup and start from scratch

Tests for the changes have been added (for bug fixes / features)
Necessary documentation (if appropriate) have been added / updated
DCO signoffs have been added to all commits, including this PR

PR type

What type of changes does your PR introduce to Zowe? Put an x in the box that applies to this PR. If you're unsure about any of them, don't hesitate to ask.

Bugfix
Feature
Other... Please describe:

Relevant issues

Fixes

Changes proposed in this PR

Does this PR introduce a breaking change?

Yes
No

Does this PR do something the person installing Zowe should know about?

Affected function: general area of interest *

Description: 1 line description *

Part: name of customizable file involved *

multi-line description

Is there a related doc issue or Pull Request?

Doc issue/PR number:
zowe/docs-site#1214

Other information

Signed-off-by: Vit Tomica <[email protected]>

# Conflicts: # bin/apiml_cm.sh # bin/zowe-setup-certificates.sh

Signed-off-by: Vit Tomica <[email protected]>

OnnoVdT · 2020-03-04T19:58:06Z

assigned myself to have a closer look when I have some time as this is interesting stuff

vit-tomica · 2020-03-05T09:31:18Z

Thanks Onno.
From user perspective, the action should be simple - setting a keyring name for the ZOWE_KEYRING= variable in the zowe-setup-certificates.env, the rest should be handled by the zowe-setup-certificates.sh script

Signed-off-by: Vit Tomica <[email protected]>

…pport

Signed-off-by: Vit Tomica <[email protected]>

OnnoVdT · 2020-03-20T02:12:59Z

Do ACF2 and TSS support the R_datalib API ? I thought this was RACF only (but could be mistaken).
Also, we heard that they current script for keystores is extremely slow on ZD&T (takes about an hour),. This is likely because we drive several invocations of the keytool utility, which in turn drives Java.
We are using keytool here as well, so the keyring support might end up being slow as well. We should try this out and maybe consider to see if something can be doen with direct RACF/ACF2/TSS commands. That would be another issue/pull request, just bringing it to your attention here.

vit-tomica · 2020-03-20T13:08:31Z

Yes, they do. The Java keytool leverages R_datalib API and we recently used this in Zowe to read zosmf keyring to get and trust the zosmf cert. However, I have found a bug in TSS/ACF2 when creating/deleting keyring using R_datalib. Security team is working on the fix and this PR will not work for TSS/ACF2 until it's fixed.

You're right about the ZD&T. It'll be slow because of the keytool commands. In this case, usual security commands make sense.

1000TurquoisePogs · 2020-04-06T16:02:00Z

@timgerstel @vit-tomica Tim's working on using the JWT key info to enable SSO on our other servers. Can you two please collaborate on if these changes will work with ongoing SSO efforts? We don't want the way SAF keyring support is done to hold back SSO work, so just double-check on the files & formats.

timgerstel · 2020-04-06T18:30:49Z

@vit-tomica @1000TurquoisePogs I do not believe this pull request will interfere with the work to enable SSO. All necessary files will still exist and are in the correct format.

# Conflicts: # bin/zowe-setup-certificates.sh

plavjanik · 2020-05-01T04:40:53Z

This looks great. What privileges does a user need to have to be able to run it? Is there a related documentation PR?

vit-tomica · 2020-05-04T08:44:48Z

@plavjanik I don't know exactly what all the privileges are but READ access to all of the IRR.DIGTCERT.* resources is enough + UPDATE access to IRR.DIGTCERT.CONNECT is needed to set up trust with z/OSMF. The READ access to all IRR.DIGTCERT.* resources is a bit excessive but it generally allows to perform actions only on certificates and keyrings owned by the ACID that has the READ access

There is no doc yet.

I'm also working on JCL configuration. I plan to remove the part that compile/link the keyring-util program and I'll replace it with the prebuilt program instead.

Signed-off-by: Vit Tomica <[email protected]>

…pport

Signed-off-by: Vit Tomica <[email protected]>

plavjanik

My latest comments have been addressed. It looks ok to me after a high-level review and no testing.

# Conflicts: # bin/zowe-setup-certificates.sh

Signed-off-by: Vit Tomica <[email protected]>

* add keyring to artifactory build Signed-off-by: MarkAckert <[email protected]> * fix keyring version Signed-off-by: MarkAckert <[email protected]> * fix keyring manifest, add gitignore Signed-off-by: MarkAckert <[email protected]> * setup keyring-util as binary Signed-off-by: MarkAckert <[email protected]> * fix keyring during prepare-workspace, chmod in pre-package Signed-off-by: MarkAckert <[email protected]> * fix dir Signed-off-by: MarkAckert <[email protected]> * set keyring version to 1.0.1 Signed-off-by: MarkAckert <[email protected]>

Signed-off-by: Vit Tomica <[email protected]>

OnnoVdT · 2020-05-12T19:14:49Z

files/jcl/ZWEKRING.jcl

+//*
+//* SPDX-License-Identifier: EPL-2.0
+//*
+//* Copyright Contributors to the Zowe Project. 2018, 2020


this did not exist in 2018, so copyright should say 2020, 2020

OnnoVdT · 2020-05-12T19:15:51Z

files/jcl/ZWEKRING.jcl

+//*    user ID for the ZOWE started task.
+//*
+//* 4) Update the SET ZOWERING= statement to match the desired
+//*    name of the keyring owned by the ZOWEUSER.


... by the &ZOWEUSER user ID.

OnnoVdT · 2020-05-12T19:21:57Z

files/jcl/ZWEKRING.jcl

+//*    name of the keyring owned by the ZOWEUSER.
+//*
+//* 5) Update the SET LABEL= statement with the name of the Zowe
+//*    certificate that will be added to the RACF database or that


keep it product neutral, so use 'security database'

OnnoVdT · 2020-05-12T19:36:47Z

files/jcl/ZWEKRING.jcl

+//* 2) Update the SET PRODUCT= statement to match your security
+//*    product.
+//*
+//* 3) Update the SET ZOWEUSER= statement to match the desired


We cannot use 'desired', at this point the ID must already exist.
... match the (existing)

OnnoVdT · 2020-05-12T19:41:21Z

files/jcl/ZWEKRING.jcl

+//*    product.
+//*
+//* 3) Update the SET ZOWEUSER= statement to match the desired
+//*    user ID for the ZOWE started task.


ZOWE -> Zowe

OnnoVdT · 2020-07-18T00:36:00Z

.pax/prepare-workspace.sh

@@ -23,6 +23,7 @@ set -x

 # expected workspace layout:


had to think again what and where this was. Can you update this line to say the following and remove all doubt
# expected input workspace layout ($ROOT_DIR):

OnnoVdT · 2020-07-18T00:37:20Z

.pax/prepare-workspace.sh

@@ -23,6 +23,7 @@ set -x

 # expected workspace layout:
 # ./.pax/mediation/
+# ./.pax/keyring-util/


keep 'm in alphabetical order so it lines up with output of ls

OnnoVdT · 2020-07-18T00:37:47Z

.pax/prepare-workspace.sh

@@ -199,5 +209,5 @@ echo "[$SCRIPT_NAME] done"
 # ${PAX_WORKSPACE_DIR}/ascii/zowe-${ZOWE_VERSION}/
 # ${PAX_WORKSPACE_DIR}/content/zowe-${ZOWE_VERSION}/
 # ${PAX_WORKSPACE_DIR}/mediation/  # already present
-
+# ${PAX_WORKSPACE_DIR}/keyring-util/  # already present


keep 'm in alphabetical order

Signed-off-by: Vit Tomica <[email protected]>

…pport

vit-tomica · 2020-07-23T15:42:28Z

@OnnoVdT Hi Onno, just a reminder that all your comments have been addressed.

OnnoVdT · 2020-07-24T13:06:15Z

sorry, I saw you did but forgot to approve. That is corrected now

vit-tomica and others added 8 commits February 19, 2020 13:52

keyring support using keytool utility

42f689f

Signed-off-by: Vit Tomica <[email protected]>

do not make keyring as default yet

04624d7

Signed-off-by: Vit Tomica <[email protected]>

added keyring-util function for keyring operations

4e81671

Signed-off-by: Vit Tomica <[email protected]>

Merge remote-tracking branch 'origin/staging' into keyring-support

0e14104

# Conflicts: # bin/apiml_cm.sh # bin/zowe-setup-certificates.sh

add informational message

c0e71a1

Signed-off-by: Vit Tomica <[email protected]>

keyring cleanup; zosmf trust

a111842

Signed-off-by: Vit Tomica <[email protected]>

zosmf trust

67ec8d6

Signed-off-by: Vit Tomica <[email protected]>

Merge branch 'staging' into keyring-support

f8c2086

OnnoVdT self-assigned this Mar 4, 2020

vit-tomica added 2 commits March 5, 2020 13:59

adding umask in zowe-setup-certificates.sh; minor changes

f55ea2a

Signed-off-by: Vit Tomica <[email protected]>

Merge remote-tracking branch 'origin/keyring-support' into keyring-su…

fb54bae

…pport

vit-tomica changed the title ~~WIP: Keyring support~~ Keyring support Mar 5, 2020

vit-tomica requested a review from plavjanik March 5, 2020 13:22

vit-tomica and others added 2 commits March 6, 2020 14:31

typo

990380e

Signed-off-by: Vit Tomica <[email protected]>

Merge branch 'staging' into keyring-support

f1bf272

1000TurquoisePogs assigned timgerstel Apr 6, 2020

Merge remote-tracking branch 'origin/staging' into keyring-support

e39d38a

# Conflicts: # bin/zowe-setup-certificates.sh

jalel01 mentioned this pull request Apr 28, 2020

API ML support for SAF KEYRINGS zowe/api-layer#626

Closed

8 tasks

Merge branch 'staging' into keyring-support

db57265

1000TurquoisePogs mentioned this pull request Apr 30, 2020

Use saf keyrings if they are available zowe/zlux-app-server#116

Merged

vit-tomica added 2 commits May 4, 2020 16:27

use four slashes so java components can directly consume the value

01699ce

Signed-off-by: Vit Tomica <[email protected]>

Merge remote-tracking branch 'origin/keyring-support' into keyring-su…

223d832

…pport

vit-tomica added 2 commits June 19, 2020 15:00

Merge remote-tracking branch 'origin/staging' into keyring-support

7f5268b

increase zlux version

fd72a91

Signed-off-by: Vit Tomica <[email protected]>

jandadav force-pushed the keyring-support branch from fd72a91 to 7f5268b Compare June 19, 2020 14:17

plavjanik requested a review from OnnoVdT June 19, 2020 14:36

plavjanik approved these changes Jun 19, 2020

View reviewed changes

vit-tomica and others added 10 commits June 19, 2020 16:52

Merge remote-tracking branch 'origin/staging' into keyring-support

77097ee

# Conflicts: # bin/zowe-setup-certificates.sh

remove apostrophes from ALTNAME keyword for ACF2

5d3cc8e

Signed-off-by: Vit Tomica <[email protected]>

Detect root CA for a certificate in a key ring

382bf74

Signed-off-by: Vit Tomica <[email protected]>

remove backtick

d35753c

Signed-off-by: Vit Tomica <[email protected]>

update keyring utilities version to 1.0.2

955b65d

Signed-off-by: Vit Tomica <[email protected]>

Merge remote-tracking branch 'origin/staging' into keyring-support

279813e

update keyring utilities version to 1.0.3

249ce27

Signed-off-by: Vit Tomica <[email protected]>

Merge remote-tracking branch 'origin/staging' into keyring-support

10fd8ec

Merge branch 'staging' into keyring-support

f7c4c66

This was referenced Jul 13, 2020

Add keyring support zowe/explorer-uss#88

Merged

Add keyring support zowe/explorer-jes#200

Merged

Add keyring support zowe/explorer-mvs#135

Merged

OnnoVdT requested changes Jul 18, 2020

View reviewed changes

vit-tomica and others added 3 commits July 20, 2020 14:21

resolve PR review comments

4f559f6

Signed-off-by: Vit Tomica <[email protected]>

Merge remote-tracking branch 'origin/keyring-support' into keyring-su…

806c396

…pport

Merge branch 'staging' into keyring-support

3b89914

OnnoVdT approved these changes Jul 24, 2020

View reviewed changes

Merge branch 'staging' into keyring-support

b26f68d

Joe-Winchester mentioned this pull request Jul 27, 2020

Basic RACF automated test for keyring support in Zowe #1535

Closed

Merge branch 'staging' into keyring-support

81c97dd

Joe-Winchester merged commit 9dd2aeb into staging Jul 28, 2020

Joe-Winchester deleted the keyring-support branch July 28, 2020 20:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Keyring support #1177

Keyring support #1177

vit-tomica commented Mar 3, 2020 •

edited by plavjanik

Loading

OnnoVdT commented Mar 4, 2020

vit-tomica commented Mar 5, 2020

OnnoVdT commented Mar 20, 2020

vit-tomica commented Mar 20, 2020

1000TurquoisePogs commented Apr 6, 2020

timgerstel commented Apr 6, 2020

plavjanik commented May 1, 2020

vit-tomica commented May 4, 2020

plavjanik left a comment

OnnoVdT May 12, 2020

vit-tomica Jul 20, 2020

OnnoVdT May 12, 2020

vit-tomica Jul 20, 2020

OnnoVdT May 12, 2020

vit-tomica Jul 20, 2020

OnnoVdT May 12, 2020

vit-tomica Jul 20, 2020

OnnoVdT May 12, 2020

vit-tomica Jul 20, 2020

OnnoVdT Jul 18, 2020

vit-tomica Jul 20, 2020

OnnoVdT Jul 18, 2020

vit-tomica Jul 20, 2020

OnnoVdT Jul 18, 2020

vit-tomica Jul 20, 2020

vit-tomica commented Jul 23, 2020

OnnoVdT commented Jul 24, 2020

Keyring support #1177

Keyring support #1177

Conversation

vit-tomica commented Mar 3, 2020 • edited by plavjanik Loading

SAF keyring configuration for Zowe

Motivation:

PR type

Relevant issues

Changes proposed in this PR

Does this PR introduce a breaking change?

Does this PR do something the person installing Zowe should know about?

Is there a related doc issue or Pull Request?

Other information

OnnoVdT commented Mar 4, 2020

vit-tomica commented Mar 5, 2020

OnnoVdT commented Mar 20, 2020

vit-tomica commented Mar 20, 2020

1000TurquoisePogs commented Apr 6, 2020

timgerstel commented Apr 6, 2020

plavjanik commented May 1, 2020

vit-tomica commented May 4, 2020

plavjanik left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

vit-tomica commented Jul 23, 2020

OnnoVdT commented Jul 24, 2020

vit-tomica commented Mar 3, 2020 •

edited by plavjanik

Loading