ExternalVendorCode/corda
1
0
Fork 0
mirror of https://github.com/corda/corda.git synced 2024-12-28 16:58:55 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Improve run instructions for the HSM doorman (#190)

Browse Source 
* Add more detail to HSM doorman outputs
* Remove duplicate display of defaults, add default value where it was only set in text, and show the actual names of the authentication modes.
* Add instructions for getting command line help
* Change error display to use System.err
This commit is contained in:
Ross Nicoll 2017-12-19 12:47:54 +00:00 committed by GitHub
parent fbcdc23434
commit 3ab1a06db6
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 22 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
network-management/Readme.md
View File

@ -28,9 +28,13 @@ To run the HSM signing server:
```
cd network-management
java -jar capsule-hsm/build/libs/hsm-3.0-NETWORKMAP-20171204.134345-6-capsule.jar --configFile hsm.conf
java -jar capsule-hsm/build/libs/hsm-3.0-NETWORKMAP-20171204.134345-6.jar --configFile hsm.conf
```
For a list of options the HSM signing server takes, run with the `--help` option:
java -jar capsule-hsm/build/libs/hsm-3.0-NETWORKMAP-20171204.134345-6.jar --help
#Configuring network management service
### Local signing

2
network-management/src/main/kotlin/com/r3/corda/networkmanage/hsm/Main.kt
View File

@ -110,7 +110,7 @@ fun run(parameters: Parameters) {
private fun processError(exception: Exception) {
val processed = mapCryptoServerException(exception)
println("An error occured: ${processed.message}")
System.err.println("An error occurred: ${processed.message}")
}
private fun confirmedSign(selectedItems: List<ApprovedCertificateRequestData>): Boolean {

10
network-management/src/main/kotlin/com/r3/corda/networkmanage/hsm/authentication/Authenticator.kt
View File

@ -43,12 +43,15 @@ class Authenticator(private val provider: CryptoServerProvider,
autoUsername
}
when (mode) {
AuthMode.CARD_READER -> provider.loginSign(user, ":cs2:cyb:USB0", null)
AuthMode.CARD_READER -> {
println("Authenticating using card reader")
provider.loginSign(user, ":cs2:cyb:USB0", null)
}
AuthMode.KEY_FILE -> {
println("Authenticating using preconfigured key file")
println("Authenticating using preconfigured key file $authKeyFilePath")
val password = if (authKeyFilePass == null) {
val input = readPassword("Enter key file password (or Q to quit): ")
if ("q" == input.toLowerCase()) {
if ("q" == input.toLowerCase().trim()) {
authenticated.clear()
break@loop
} else {
@ -60,6 +63,7 @@ class Authenticator(private val provider: CryptoServerProvider,
provider.loginSign(user, authKeyFilePath.toString(), password)
}
AuthMode.PASSWORD -> {
println("Authenticating using password")
val password = readPassword("Enter password (or Q to quit): ")
if ("q" == password.toLowerCase()) {
authenticated.clear()

18
network-management/src/main/kotlin/com/r3/corda/networkmanage/hsm/configuration/Configuration.kt
View File

@ -68,22 +68,22 @@ data class Parameters(val dataSourceProperties: Properties,
fun parseParameters(vararg args: String): Parameters {
val argConfig = args.toConfigWithOptions {
accepts("basedir", "Overriding configuration filepath, default to current directory.").withRequiredArg().defaultsTo(".").describedAs("filepath")
accepts("configFile", "Overriding configuration file. (default: <<current directory>>/node.conf)").withRequiredArg().describedAs("filepath")
accepts("device", "CryptoServer device address (default: $DEFAULT_DEVICE)").withRequiredArg()
accepts("configFile", "Overriding configuration file.").withRequiredArg().defaultsTo("node.conf").describedAs("filepath")
accepts("device", "CryptoServer device address").withRequiredArg().defaultsTo(DEFAULT_DEVICE)
accepts("keyGroup", "CryptoServer key group").withRequiredArg()
accepts("keySpecifier", "CryptoServer key specifier (default: $DEFAULT_KEY_SPECIFIER)").withRequiredArg().ofType(Int::class.java).defaultsTo(DEFAULT_KEY_SPECIFIER)
accepts("keySpecifier", "CryptoServer key specifier").withRequiredArg().ofType(Int::class.java).defaultsTo(DEFAULT_KEY_SPECIFIER)
accepts("rootPrivateKeyPassword", "Password for the root certificate private key").withRequiredArg().describedAs("password")
accepts("csrPrivateKeyPassword", "Password for the CSR signing certificate private key").withRequiredArg().describedAs("password")
accepts("keyGenAuthThreshold", "Authentication strength threshold for the HSM key generation (default: $DEFAULT_KEY_GEN_AUTH_THRESHOLD)").withRequiredArg().ofType(Int::class.java).defaultsTo(DEFAULT_KEY_GEN_AUTH_THRESHOLD)
accepts("signAuthThreshold", "Authentication strength threshold for the HSM CSR signing (default: $DEFAULT_SIGN_AUTH_THRESHOLD)").withRequiredArg().ofType(Int::class.java).defaultsTo(DEFAULT_SIGN_AUTH_THRESHOLD)
accepts("authMode", "Authentication mode. Allowed values: ${AuthMode.values()} (default: $DEFAULT_AUTH_MODE)").withRequiredArg().defaultsTo(DEFAULT_AUTH_MODE.name)
accepts("keyGenAuthThreshold", "Authentication strength threshold for the HSM key generation").withRequiredArg().ofType(Int::class.java).defaultsTo(DEFAULT_KEY_GEN_AUTH_THRESHOLD)
accepts("signAuthThreshold", "Authentication strength threshold for the HSM CSR signing").withRequiredArg().ofType(Int::class.java).defaultsTo(DEFAULT_SIGN_AUTH_THRESHOLD)
accepts("authMode", "Authentication mode. Allowed values: ${AuthMode.values().map(AuthMode::name)})").withRequiredArg().defaultsTo(DEFAULT_AUTH_MODE.name)
accepts("authKeyFilePath", "Key file path when authentication is based on a key file (i.e. authMode=${AuthMode.KEY_FILE.name})").withRequiredArg().describedAs("filepath")
accepts("authKeyFilePassword", "Key file password when authentication is based on a key file (i.e. authMode=${AuthMode.KEY_FILE.name})").withRequiredArg()
accepts("autoUsername", "Username to be used for certificate signing (if not specified it will be prompted for input)").withRequiredArg()
accepts("csrCertificateName", "Name of the certificate to be used by this CA to sign CSR (default: $DEFAULT_CSR_CERTIFICATE_NAME)").withRequiredArg().defaultsTo(DEFAULT_CSR_CERTIFICATE_NAME)
accepts("rootCertificateName", "Name of the root certificate to be used by this CA (default: $DEFAULT_ROOT_CERTIFICATE_NAME)").withRequiredArg().defaultsTo(DEFAULT_ROOT_CERTIFICATE_NAME)
accepts("csrCertificateName", "Name of the certificate to be used by this CA to sign CSR").withRequiredArg().defaultsTo(DEFAULT_CSR_CERTIFICATE_NAME)
accepts("rootCertificateName", "Name of the root certificate to be used by this CA").withRequiredArg().defaultsTo(DEFAULT_ROOT_CERTIFICATE_NAME)
accepts("validDays", "Validity duration in days").withRequiredArg().ofType(Int::class.java)
accepts("signInterval", "Time interval (in seconds) in which network map is signed (default: $DEFAULT_SIGN_INTERVAL)").withRequiredArg().ofType(Long::class.java).defaultsTo(DEFAULT_SIGN_INTERVAL)
accepts("signInterval", "Time interval (in seconds) in which network map is signed").withRequiredArg().ofType(Long::class.java).defaultsTo(DEFAULT_SIGN_INTERVAL)
}
val configFile = if (argConfig.hasPath("configFile")) {