feat: add support for testing connections to other security servers on the diagnostics page #3103
Conversation
…n the diagnostics page Refs: XRDDEV-2923
Job Summary for GradleBuild and test :: BuildAndPackageWithUnitTests
|
Job Summary for GradleBuild and test :: BuildAndPackageWithUnitTests
|
Job Summary for GradleBuild and test :: BuildAndPackageWithUnitTests
|
Eco CI Output - Old Energy EstimationEco CI Output [RUN-ID: 19494541558]: 🌳 CO2 Data: Total cost of whole PR so far:
|
|||||||||||||||||||||||||||||||||||||||||||||
Job Summary for GradleBuild and test :: BuildAndPackageWithUnitTests
|
Job Summary for GradleBuild and test :: BuildAndPackageOnArm
|
Eco CI Output - Old Energy EstimationEco CI Output [RUN-ID: 19494541558]: 🌳 CO2 Data: Total cost of whole PR so far:
|
||||||||||||||||||||||||||||||||||||||||
Eco CI Output - Old Energy EstimationEco CI Output [RUN-ID: 19494541558]: 🌳 CO2 Data: Total cost of whole PR so far:
|
||||||||||||||||||||||||||||||||||||||||
Eco CI Output - Old Energy EstimationEco CI Output [RUN-ID: 19494541558]: 🌳 CO2 Data: Total cost of whole PR so far:
|
||||||||||||||||||||||||||||||||||||||||
Eco CI Output - Old Energy EstimationEco CI Output [RUN-ID: 19502259122]: 🌳 CO2 Data: Total cost of whole PR so far:
|
|||||||||||||||||||||||||||||||||||||||||||||
Job Summary for GradleBuild and test :: BuildAndPackageWithUnitTests
|
Eco CI Output - Old Energy EstimationEco CI Output [RUN-ID: 19502259122]: 🌳 CO2 Data: Total cost of whole PR so far:
|
||||||||||||||||||||||||||||||||||||||||
Job Summary for GradleBuild and test :: BuildAndPackageOnArm
|
Eco CI Output - Old Energy EstimationEco CI Output [RUN-ID: 19502259122]: 🌳 CO2 Data: Total cost of whole PR so far:
|
||||||||||||||||||||||||||||||||||||||||
Eco CI Output - Old Energy EstimationEco CI Output [RUN-ID: 19502259122]: 🌳 CO2 Data: Total cost of whole PR so far:
|
||||||||||||||||||||||||||||||||||||||||
Eco CI Output - Old Energy EstimationEco CI Output [RUN-ID: 19502259122]: 🌳 CO2 Data: Total cost of whole PR so far:
|
||||||||||||||||||||||||||||||||||||||||
Eco CI Output - Old Energy EstimationEco CI Output [RUN-ID: 19573193344]: 🌳 CO2 Data: Total cost of whole PR so far:
|
|||||||||||||||||||||||||||||||||||||||||||||
Job Summary for GradleBuild and test :: BuildAndPackageWithUnitTests
|
Eco CI Output - Old Energy EstimationEco CI Output [RUN-ID: 19573193344]: 🌳 CO2 Data: Total cost of whole PR so far:
|
||||||||||||||||||||||||||||||||||||||||
Job Summary for GradleBuild and test :: BuildAndPackageOnArm
|
Eco CI Output - Old Energy EstimationEco CI Output [RUN-ID: 19573193344]: 🌳 CO2 Data: Total cost of whole PR so far:
|
||||||||||||||||||||||||||||||||||||||||
Eco CI Output - Old Energy EstimationEco CI Output [RUN-ID: 19573193344]: 🌳 CO2 Data: Total cost of whole PR so far:
|
||||||||||||||||||||||||||||||||||||||||
Eco CI Output - Old Energy EstimationEco CI Output [RUN-ID: 19573193344]: 🌳 CO2 Data: Total cost of whole PR so far:
|
||||||||||||||||||||||||||||||||||||||||
petkivim
left a comment
petkivim
left a comment
There was a problem hiding this comment.
Some minor update suggestions to the documentation.
|
|
||
| Examples of error messages: | ||
| - Connection error, unknown host : ... — the Central Server hostname cannot be resolved. Check DNS configuration. | ||
| - IO error : PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException ... — the CA must be trusted by the Security Servers Java installation. For the guidelines on Publish global configuration over HTTPS, please refer to [UG-SEC](ug-sec_x_road_security_hardening.md). |
There was a problem hiding this comment.
Consider changing this to:
IO error : PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException ... — the Security Server doesn't trust the CA that issued Central Server's TLS certificate. The root certificate of the CA that was used to issue Central Server's TLS certificate must be added to the Security Server's Java truststore. For the guidelines on Publish global configuration over HTTPS, please refer to UG-SEC.
|
|
||
| **Authentication Certificate Registration Service** | ||
|
|
||
| Tests connectivity to the Central Server on port `4001` (used by the registration service and must be publicly accessible). |
There was a problem hiding this comment.
Consider changing this:
(used by the registration service and must be publicly accessible)
to:
(used by the registration service and must be accessible by every Security Server registered to the ecosystem)
|
|
||
| Tests connectivity to the Central Server on port `4001` (used by the registration service and must be publicly accessible). | ||
|
|
||
| ✔ Everything ok — indicates that the Authentication Certificate Registration Service is reachable and there are no authentication certificate issues. |
There was a problem hiding this comment.
Consider dropping this since the test only test connectivity to the Authentication Certificate Registration Service and not if the Security Server's authentication certificate is valid, e.g., the connection could be OK even if the OCSP response for the Security Server's auth cert is not valid.
and there are no authentication certificate issues.
|
|
||
| ## 14.3.2 Testing the connection to other Security Servers | ||
|
|
||
| This block enables testing communication with any other Security Server in the same X-Road instance (or federated instances). Functionality is added to the Security Server to allow checking connectivity issues using the `listMethods` service. |
There was a problem hiding this comment.
Consider changing this:
This block enables testing communication with any other Security Server in the same X-Road instance (or federated instances). Functionality is added to the Security Server to allow checking connectivity issues using the
listMethodsservice.
to:
This block enables testing communication with any other Security Server in the same X-Road instance (or federated instances). The functionality uses the
listMethodsmeta service to test communication with other Security Servers. Passing the test requires that the target Security Server allows incoming connections to ports5500and5577from the source Security Server.
| - **Current Client** — a dropdown listing subsystems and members of the current Security Server (from the global configuration). | ||
| - **REST/SOAP** - selects whether the service uses the REST or SOAP protocol. | ||
| - **Target Instance** — the local Security Server instance or federated instances. | ||
| - **Target Client** — a list of clients on other Security Servers, derived from the global configuration. Clients on the same server are included to allow internal tests. If a federation instance exists, then all its clients are included as well. | ||
| - **Target Security Server** — the Security Servers where the target client is registered. If the target client is registered on multiple Security Servers, all of them should be listed for selection. |
There was a problem hiding this comment.
Consider updating the field descriptions:
- Source Client — a list of members and subsystems registered on the client Security Server that can be used as a Source Client.
- REST/SOAP - the protocol (REST or SOAP) that's used to complete the connection test.
- Target Instance - the X-Road instance where the Target Client is registered. This can be the same instance where the Source Client is registered or a federated instance.
- Target Client - a list of clients registered on other Security Servers. Also, clients registered on the same Security Server with the Source Client are included to allow local testing. If federation is enabled and federated instances exist in the configuration, registered clients of federated instances are included as well.
- Target Security Server — a list of Security Servers where the Target Client is registered. If the Target Client is registered on multiple Security Servers, all of them are listed for selection.
| - **Current Client** - the current Security Server owner. | ||
| - **REST/SOAP** - `SOAP`. | ||
| - **Target Instance** - the local Security Server instance. | ||
| - **Target Client** - the Management Security Server Provider. | ||
| - **Target Security server** - if management services are registered on multiple Security Servers, the user is able to select the desired target Security Server. |
There was a problem hiding this comment.
Consider updating these accordingly with the earlier field descriptions:
- Source Client - the owner member of the client Security Server.
- REST/SOAP -
SOAPsince management services only supportSOAP.- Target Instance - the same instance where the Source Client is registered.
- Target Client - the subsystem providing the management services.
- Target Security Server - if management services are registered on multiple Security Servers, the user is able to select the desired target Security Server.
| - **Target Client** - the Management Security Server Provider. | ||
| - **Target Security server** - if management services are registered on multiple Security Servers, the user is able to select the desired target Security Server. | ||
|
|
||
| ✔ Everything ok - indicates that there are no network, configuration, or certificate issues preventing communication with the Management Security Server Provider. |
There was a problem hiding this comment.
Consider changing this to:
✔ Everything ok - indicates that there are no network, configuration, or certificate issues preventing communication with the management Security Server.
|
Eco CI Output [RUN-ID: 19754167993]: 🌳 CO2 Data: Total cost of whole PR so far:
|
|||||||||||||||||||||||||||||||||||||||||||||
Job Summary for GradleBuild and test :: BuildAndPackageWithUnitTests
|
|
Eco CI Output [RUN-ID: 19754167993]: 🌳 CO2 Data: Total cost of whole PR so far:
|
||||||||||||||||||||||||||||||||||||||||
Job Summary for GradleBuild and test :: BuildAndPackageOnArm
|
|
Eco CI Output [RUN-ID: 19754167993]: 🌳 CO2 Data: Total cost of whole PR so far:
|
||||||||||||||||||||||||||||||||||||||||
|
Eco CI Output [RUN-ID: 19754167993]: 🌳 CO2 Data: Total cost of whole PR so far:
|
||||||||||||||||||||||||||||||||||||||||
|
Eco CI Output [RUN-ID: 19754167993]: 🌳 CO2 Data: Total cost of whole PR so far:
|
||||||||||||||||||||||||||||||||||||||||
|
Eco CI Output [RUN-ID: 19811020699]: 🌳 CO2 Data: Total cost of whole PR so far:
|
|||||||||||||||||||||||||||||||||||||||||||||
Job Summary for GradleBuild and test :: BuildAndPackageWithUnitTests
|
|
Eco CI Output [RUN-ID: 19811020699]: 🌳 CO2 Data: Total cost of whole PR so far:
|
||||||||||||||||||||||||||||||||||||||||
Job Summary for GradleBuild and test :: BuildAndPackageOnArm
|
|
Eco CI Output [RUN-ID: 19811020699]: 🌳 CO2 Data: Total cost of whole PR so far:
|
||||||||||||||||||||||||||||||||||||||||
|
Eco CI Output [RUN-ID: 19811020699]: 🌳 CO2 Data: Total cost of whole PR so far:
|
||||||||||||||||||||||||||||||||||||||||
|
Eco CI Output [RUN-ID: 19811020699]: 🌳 CO2 Data: Total cost of whole PR so far:
|
||||||||||||||||||||||||||||||||||||||||
|
|
Eco CI Output [RUN-ID: 19821422463]: 🌳 CO2 Data: Total cost of whole PR so far:
|
|||||||||||||||||||||||||||||||||||||||||||||
Job Summary for GradleBuild and test :: BuildAndPackageWithUnitTests
|
|
Eco CI Output [RUN-ID: 19821422463]: 🌳 CO2 Data: Total cost of whole PR so far:
|
||||||||||||||||||||||||||||||||||||||||
Job Summary for GradleBuild and test :: BuildAndPackageOnArm
|
|
Eco CI Output [RUN-ID: 19821422463]: 🌳 CO2 Data: Total cost of whole PR so far:
|
||||||||||||||||||||||||||||||||||||||||
|
Eco CI Output [RUN-ID: 19821422463]: 🌳 CO2 Data: Total cost of whole PR so far:
|
||||||||||||||||||||||||||||||||||||||||
|
Eco CI Output [RUN-ID: 19821422463]: 🌳 CO2 Data: Total cost of whole PR so far:
|
||||||||||||||||||||||||||||||||||||||||
Refs: XRDDEV-2923