May 2019 - teiid-issues - Jboss List Archives

[JBoss JIRA] (TEIIDSB-86) Plans for secure socket transports

by Steven Hawkins (Jira)

[ https://issues.jboss.org/browse/TEIIDSB-86?page=com.atlassian.jira.plugin... ] Steven Hawkins commented on TEIIDSB-86: --------------------------------------- an sni passthrough route works as expected, with the caveat that using anonymous ssl seems problematic. Using a static security.setproperty to update the disabled did not work - it does work in the same spring boot app locally. That's something we can look at later. This is where things stand: ||Secure Transport Options||Teiid JDBC||PG|| |End-to-end (internal and external) - Need to allow ssl configuration with either a user-provided cert or a generated one|passthrough route or loadbalancer for external|loadbalancer for external| |Secure External and Clear Internal - Same as above for external - need to allow ssl configuration with either a user-provided cert or a generated one|Would require separate transports|Would require separate transports or an update to the logic requiring a secure connection based upon internal vs. external traffic| |Clear|loadbalancer for external|loadbalancer for external| Based upon all of this we should probably offer the following: * clear transports (current), or 1-way secure transports using the service generated certificate (I'll validate that this works as expected) * optional external exposure with a loadbalancer, which works for both transports with or without ssl. It could be documented how to utilize a router for secure jdbc as well. Two-way authentication and user supplied certs could be considered later. > Plans for secure socket transports > ---------------------------------- > > Key: TEIIDSB-86 > URL: https://issues.jboss.org/browse/TEIIDSB-86 > Project: Teiid Spring Boot > Issue Type: Quality Risk > Reporter: Steven Hawkins > Assignee: Steven Hawkins > Priority: Major > Fix For: 1.1.0 > > > The Teiid Spring Boot configuration allows for only non-secured pg / JDBC socket transports. For external client scenarios and even for varying degrees of compliance with intra-cluster traffic, a secure layer may be required. -- This message was sent by Atlassian Jira (v7.12.1#712002)

6 years, 10 months

1
0
0 / 0

[JBoss JIRA] (TEIIDSB-88) Info log on each health check

by Steven Hawkins (Jira)

Steven Hawkins created TEIIDSB-88: ------------------------------------- Summary: Info log on each health check Key: TEIIDSB-88 URL: https://issues.jboss.org/browse/TEIIDSB-88 Project: Teiid Spring Boot Issue Type: Quality Risk Reporter: Steven Hawkins Assignee: Steven Hawkins Fix For: 1.1.0 Probably due to the recent changes to secure jdbc/pg, I'm now seeing logs like: 2019-05-14 02:13:23.003 INFO 1 --- [nio-8080-exec-8] org.teiid.SECURITY : TEIID40115 Local pass-through connection implicitly closing session 33UbTZhXZKkC so that the connection can be used in a different security context. 2019-05-14 02:13:23.004 INFO 1 --- [nio-8080-exec-8] org.teiid.SECURITY : TEIID40115 Local pass-through connection implicitly closing session 638A9GlJTEtL so that the connection can be used in a different security context. 2019-05-14 02:13:39.086 INFO 1 --- [nio-8080-exec-9] org.teiid.SECURITY : TEIID40115 Local pass-through connection implicitly closing session 4Kc9NS+S/YcE so that the connection can be used in a different security context. 2019-05-14 02:13:39.090 INFO 1 --- [nio-8080-exec-9] org.teiid.SECURITY : TEIID40115 Local pass-through connection implicitly closing session SL9YhfKOtGGw so that the connection can be used in a different security context. 2019-05-14 02:13:42.997 INFO 1 --- [io-8080-exec-10] org.teiid.SECURITY : TEIID40115 Local pass-through connection implicitly closing session Z41j3peTbpHP so that the connection can be used in a different security context. 2019-05-14 02:13:42.998 INFO 1 --- [io-8080-exec-10] org.teiid.SECURITY : TEIID40115 Local pass-through connection implicitly closing session 8XDWPXCiLYwz so that the connection can be used in a different security context. ... -- This message was sent by Atlassian Jira (v7.12.1#712002)

6 years, 10 months

1
0
0 / 0

[JBoss JIRA] (TEIIDSB-86) Plans for secure socket transports

by Steven Hawkins (Jira)

[ https://issues.jboss.org/browse/TEIIDSB-86?page=com.atlassian.jira.plugin... ] Steven Hawkins commented on TEIIDSB-86: --------------------------------------- On sni: Java 6 clients - are not supported. Java 7 clients - some Oracle may be supported according some some comments, but the default handling isn't there in OpenJDK. Java 8 clients - the way Teiid creates a socket using the string host name argument will add that name automatically to the sni header, so we're good there. On the server side it doesn't appear that we need to do anything (no need for custom matchers). > Plans for secure socket transports > ---------------------------------- > > Key: TEIIDSB-86 > URL: https://issues.jboss.org/browse/TEIIDSB-86 > Project: Teiid Spring Boot > Issue Type: Quality Risk > Reporter: Steven Hawkins > Assignee: Steven Hawkins > Priority: Major > Fix For: 1.1.0 > > > The Teiid Spring Boot configuration allows for only non-secured pg / JDBC socket transports. For external client scenarios and even for varying degrees of compliance with intra-cluster traffic, a secure layer may be required. -- This message was sent by Atlassian Jira (v7.12.1#712002)

6 years, 10 months

1
0
0 / 0

[JBoss JIRA] (TEIIDSB-86) Plans for secure socket transports

by Steven Hawkins (Jira)

[ https://issues.jboss.org/browse/TEIIDSB-86?page=com.atlassian.jira.plugin... ] Steven Hawkins commented on TEIIDSB-86: --------------------------------------- The only approach for external pg transport security is the use of a stunnel - http://cpitman.github.io/openshift/tcp/networking/2016/12/28/stunnel-and-... - which can be combined with the service certificate generation linked above, rather than his example that shows a self-signed certificate. The downside being the requirement of running a client stunnel instance. You'd also have a stunnel server instance along side every Teiid instance. And this still exposes an intra-cluster unsecured host/port - so we'd either have to double encrypt (at the stunnel level and at the pg protocol level) or make the requirement for a secure pg transport more flexible. Of course since we have control over the teiid jdbc side we could just do http/https ourselves there and further simplify things. > Plans for secure socket transports > ---------------------------------- > > Key: TEIIDSB-86 > URL: https://issues.jboss.org/browse/TEIIDSB-86 > Project: Teiid Spring Boot > Issue Type: Quality Risk > Reporter: Steven Hawkins > Assignee: Steven Hawkins > Priority: Major > Fix For: 1.1.0 > > > The Teiid Spring Boot configuration allows for only non-secured pg / JDBC socket transports. For external client scenarios and even for varying degrees of compliance with intra-cluster traffic, a secure layer may be required. -- This message was sent by Atlassian Jira (v7.12.1#712002)

6 years, 10 months

1
0
0 / 0

[JBoss JIRA] (TEIIDSB-87) Upgrade Teiid to 12.2.0

by Steven Hawkins (Jira)

[ https://issues.jboss.org/browse/TEIIDSB-87?page=com.atlassian.jira.plugin... ] Steven Hawkins resolved TEIIDSB-87. ----------------------------------- Resolution: Done Updated the teiid and spring boot versions. The hibernate version was actually moved ahead slightly - as it appears that spring boot 2.1.3 still uses 5.3.7, not 5.3.9 (the 2.1.4 version). > Upgrade Teiid to 12.2.0 > ----------------------- > > Key: TEIIDSB-87 > URL: https://issues.jboss.org/browse/TEIIDSB-87 > Project: Teiid Spring Boot > Issue Type: Task > Components: core > Reporter: Ramesh Reddy > Assignee: Steven Hawkins > Priority: Major > Fix For: 1.1.0 > > > Upgrade the Teiid Spring Boot's version of Teiid to 12.2.0 release -- This message was sent by Atlassian Jira (v7.12.1#712002)

6 years, 10 months

1
0
0 / 0

[JBoss JIRA] (TEIIDSB-87) Upgrade Teiid to 12.2.0

by Steven Hawkins (Jira)

[ https://issues.jboss.org/browse/TEIIDSB-87?page=com.atlassian.jira.plugin... ] Steven Hawkins commented on TEIIDSB-87: --------------------------------------- I've updated the pr to 2.1.3 instead. That adds another override version - for httpclient. > Upgrade Teiid to 12.2.0 > ----------------------- > > Key: TEIIDSB-87 > URL: https://issues.jboss.org/browse/TEIIDSB-87 > Project: Teiid Spring Boot > Issue Type: Task > Components: core > Reporter: Ramesh Reddy > Assignee: Steven Hawkins > Priority: Major > Fix For: 1.1.0 > > > Upgrade the Teiid Spring Boot's version of Teiid to 12.2.0 release -- This message was sent by Atlassian Jira (v7.12.1#712002)

6 years, 10 months

1
0
0 / 0

[JBoss JIRA] (TEIIDSB-87) Upgrade Teiid to 12.2.0

by Ramesh Reddy (Jira)

[ https://issues.jboss.org/browse/TEIIDSB-87?page=com.atlassian.jira.plugin... ] Ramesh Reddy reassigned TEIIDSB-87: ----------------------------------- Assignee: Steven Hawkins (was: Ramesh Reddy) > Upgrade Teiid to 12.2.0 > ----------------------- > > Key: TEIIDSB-87 > URL: https://issues.jboss.org/browse/TEIIDSB-87 > Project: Teiid Spring Boot > Issue Type: Task > Components: core > Reporter: Ramesh Reddy > Assignee: Steven Hawkins > Priority: Major > Fix For: 1.1.0 > > > Upgrade the Teiid Spring Boot's version of Teiid to 12.2.0 release -- This message was sent by Atlassian Jira (v7.12.1#712002)

6 years, 11 months

1
0
0 / 0

[JBoss JIRA] (TEIIDSB-45) Develop OpenShift Operator for deploying VDBs

by Ramesh Reddy (Jira)

[ https://issues.jboss.org/browse/TEIIDSB-45?page=com.atlassian.jira.plugin... ] Ramesh Reddy reassigned TEIIDSB-45: ----------------------------------- Assignee: Ramesh Reddy (was: Steven Hawkins) > Develop OpenShift Operator for deploying VDBs > --------------------------------------------- > > Key: TEIIDSB-45 > URL: https://issues.jboss.org/browse/TEIIDSB-45 > Project: Teiid Spring Boot > Issue Type: Feature Request > Components: OpenShift > Reporter: Ramesh Reddy > Assignee: Ramesh Reddy > Priority: Critical > Fix For: 1.1.0 > > > Need to develop a GO lang based Operator for deploying the VDBs and its configuration. -- This message was sent by Atlassian Jira (v7.12.1#712002)

6 years, 11 months

1
0
0 / 0

[JBoss JIRA] (TEIIDSB-45) Develop OpenShift Operator for deploying VDBs

by Ramesh Reddy (Jira)

[ https://issues.jboss.org/browse/TEIIDSB-45?page=com.atlassian.jira.plugin... ] Ramesh Reddy reassigned TEIIDSB-45: ----------------------------------- Assignee: Steven Hawkins (was: Ramesh Reddy) > Develop OpenShift Operator for deploying VDBs > --------------------------------------------- > > Key: TEIIDSB-45 > URL: https://issues.jboss.org/browse/TEIIDSB-45 > Project: Teiid Spring Boot > Issue Type: Feature Request > Components: OpenShift > Reporter: Ramesh Reddy > Assignee: Steven Hawkins > Priority: Critical > Fix For: 1.1.0 > > > Need to develop a GO lang based Operator for deploying the VDBs and its configuration. -- This message was sent by Atlassian Jira (v7.12.1#712002)

6 years, 11 months

1
0
0 / 0

[JBoss JIRA] (TEIIDSB-87) Upgrade Teiid to 12.2.0

by Ramesh Reddy (Jira)

[ https://issues.jboss.org/browse/TEIIDSB-87?page=com.atlassian.jira.plugin... ] Ramesh Reddy commented on TEIIDSB-87: ------------------------------------- camel master is no good, as it is 3.0, I believe Syndesis uses some 2.x version and they are going to 3.0 soon with 8.0 version I believe after 3.0 released. The April release seems to be at 2.1.3 https://developers.redhat.com/products/rhoar/download/?sc_cid=701f2000000... there may be one at end of May that might suit us better. I found this for 2.1.4 https://issues.jboss.org/browse/RHOAR-116 > Upgrade Teiid to 12.2.0 > ----------------------- > > Key: TEIIDSB-87 > URL: https://issues.jboss.org/browse/TEIIDSB-87 > Project: Teiid Spring Boot > Issue Type: Task > Components: core > Reporter: Ramesh Reddy > Assignee: Ramesh Reddy > Priority: Major > Fix For: 1.1.0 > > > Upgrade the Teiid Spring Boot's version of Teiid to 12.2.0 release -- This message was sent by Atlassian Jira (v7.12.1#712002)

6 years, 11 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

teiid-issues May 2019