Project: Athenz (Provisioning / Key Management)
File: zms-setup.md

<a id="markdown-setup-zms-in-production-env" name="setup-zms-in-production-env"></a> <!-- TOC --> - - - - - - - <!-- /TOC --> <a id="markdown-prerequisites" name="prerequisites"></a> Env. setup done. () Bootstrap setup done. () All the setup commands below are expected to run inside container. ```bash BASE_DIR="$(git rev-parse --show-toplevel)" docker run --rm -it \ -v "${BASE_DIR}:/athenz" \ --user "$(id -u):$(id -g)" \ athenz-setup-env \ sh BASE_DIR="$(git rev-parse --show-toplevel)" . "${BASE_DIR}/docker/env.sh" ``` <a id="markdown-target" name="target"></a> <a id="markdown-steps" name="steps"></a> <a id="markdown-1-update-your-passwords" name="1-update-your-passwords"></a> ```bash export ZMSDBROOTPASS=<yourpassword> export ZMSDBADMINPASS=<yourpassword> export ZMSKEYSTOREPASS=<your_password> export ZMSTRUSTSTOREPASS=<your_password> ``` <a id="markdown-2-get-a-server-certificate-for-zms" name="2-get-a-server-certificate-for-zms"></a> Create your CSR and private key for ZMS Ask your Athenz CA to sign the CSR and get the server certificate for ZMS ```bash echo "${ZMSCERTKEY_PATH}" echo "${ZMSCERTPATH}" ``` <a id="markdown-3-create-zms-key-pairs-for-signing-athenz-token" name="3-create-zms-key-pairs-for-signing-athenz-token"></a> ```bash openssl genrsa -out "${ZMSPRIVATEKEY_PATH}" 4096 openssl rsa -pubout -in "${ZMSPRIVATEKEYPATH}" -out "${ZMSPUBLICKEYPATH}" ``` <a id="markdown-4-create-zms-trust-store-for-https-connections" name="4-create-zms-trust-store-for-https-connections"></a> Verify CA file paths ```bash ls -l "${ATHENZCAPATH}" ls -l "${USERCAPATH}" ls -l "${SERVICECAPATH}" ``` Create the ZMS trust store ```bash rm -f "${ZMSTRUSTSTOREPATH}" CERTALIAS='athenzca' openssl x509 -outform pem -in "${ATHENZCAPATH}" | keytool -importcert -noprompt \ -keystore "${ZMSTRUSTSTOREPATH}" -storepass "${ZMSTRUSTSTOREPASS}" \ -storetype JKS -alias "${CERT_ALIAS}" CERTALIAS='userca' openssl x509 -outform pem -in "${USERCAPATH}" | keytool -importcert -noprompt \ -keystore "${ZMSTRUSTSTOREPATH}" -storepass "${ZMSTRUSTSTOREPASS}" \ -storetype JKS -alias "${CERT_ALIAS}" CERTALIAS='serviceca' openssl x509 -outform pem -in "${SERVICECAPATH}" | keytool -importcert -noprompt \ -keystore "${ZMSTRUSTSTOREPATH}" -storepass "${ZMSTRUSTSTOREPASS}" \ -storetype JKS -alias "${CERT_ALIAS}" ``` <a id="markdown-5-create-zms-key-store-with-zms-server-certificate" name="5-create-zms-key-store-with-zms-server-certificate"></a> ```bash openssl pkcs12 -export -noiter -nomaciter \ -out "${ZMSKEYSTOREPATH}" -passout "pass:${ZMSKEYSTOREPASS}" \ -in "${ZMSCERTPATH}" -inkey "${ZMSCERTKEY_PATH}" ``` <a id="markdown-6-config-the-athenz-domain-admin" name="6-config-the-athenz-domain-admin"></a> As a demo, we will use the github identity. You can use any identity provider at your will. Get your github ID by the following API. ```bash curl --silent --fail --show-error https://api.github.com/users/<your github username> | grep '"id":' export DOMAIN_ADMIN='user.github-<your github ID>' ``` To simplify the set up, we will just configure a single admin. ```bash sed -i "s/user\.github-.*$/${DOMAINADMIN}/g" "${ZMSCONF_DIR}/zms.properties" ``` <a id="markdown-7-summary" name="7-summary"></a> ```bash $ tree "${CA_DIR}" prod/CAs athenz_ca.pem service_ca.pem user_ca.pem $ tree "${PRODZMSDIR}" prod/zms zms_cert.pem zms_csr.pem zms_key.pem $ tree "${ZMS_DIR}" zms Dockerfile conf athenz.properties authorized_services.json logback.xml solution_templates.json zms.properties var certs zms_keystore.pkcs12 zms_truststore.jks keys zms_private.pem zms_public.pem ``` <a id="markdown-get-athenz-domain-admin-user-certificate-for-accessing-zms" name="get-athenz-domain-admin-user-certificate-for-accessing-zms"></a> Request your identity provider to get a user certificate with `CN=user.<your github ID>` ```bash echo "${DOMAINADMINCERTKEYPATH}" echo "${DOMAINADMINCERT_PATH}" ``` If your certificate provider cannot issue user certificate with customized common name, you need to change the `zms.properties` configuration accordingly. ```properties athenz.user_domain=user athenz.zms.domain_admin=user.github-<your github ID> ``` <a id="markdown-deploy-zms" name="deploy-zms"></a> ```bash sh "${DOCKER_DIR}/deploy-scripts/zms-deploy.sh" ``` <a id="markdown-debug-zms" name="debug-zms"></a> ```bash BASE_DIR="$(git rev-parse --show-toplevel)" . "${BASE_DIR}/docker/env.sh" docker run --rm -t \ --network="${DOCKER_NETWORK}" \ -v "${BASE_DIR}:/athenz" \ --user "$(id -u):$(id -g)" \ athenz-setup-env \ sh /athenz/docker/deploy-scripts/zms-debug.sh ```