It's all about the answers!

Ask a question
QuestionsTagsUsersBadges
Guidelines | FAQ
Follow this question
Question details

×1,192

question asked: Mar 04 '10, 5:01 a.m.
question was seen: 13,966 times
last updated: Mar 04 '10, 5:01 a.m.

Related questions

Buildforge JAVA API with SSL

0
hagai izenberg (26●1●1) | asked Mar 04 '10, 5:01 a.m.
Hi,
I'm using the Java API to run a project in buildforge and having problems connection with SSL.
when working without SSL, this connection code works great: 

APIClientConnection conn = new APIClientConnection ("server");


it also works great when i use the default port: 
APIClientConnection conn = new APIClientConnection ("server",3966);

when trying to work with the SSL port, and initializing SSL like this: 

System.setProperty("javax.net.ssl.keyStore", "c:\\buildForgeKeyStore.p12");

System.setProperty("javax.net.ssl.keyStorePassword", "111111");

System.setProperty("javax.net.ssl.keyStoreType", "PKCS12");

System.setProperty("javax.net.ssl.trustStore", "c:\\buildForgeTrustStore.p12");

System.setProperty("javax.net.ssl.trustStorePassword", "111111");

System.setProperty("javax.net.ssl.trustStoreType", "PKCS12");

              

APIClientConnection conn = new APIClientConnection ("server",49150);


i'm getting this exception: 

Exception in thread "main" java.io.IOException: Unexpected EOF

        at com.buildforge.services.client.api.APIClientBuffer.fill(APIClientBuffer.java:121)

        at com.buildforge.services.client.api.APIClientConnection.call(APIClientConnection.java:584)

        at com.buildforge.services.client.api.APIClientConnection.setVersion(APIClientConnection.java:929)

        at com.buildforge.services.client.api.APIClientConnection.<init>(APIClientConnection.java:262)

        at com.buildforge.services.client.api.APIClientConnection.<init>(APIClientConnection.java:248)

        at com.buildforge.services.client.api.APIClientConnection.<init>(APIClientConnection.java:240)

        at com.buildforge.services.client.api.APIClientConnection.<init>(APIClientConnection.java:332)

        at com.buildforge.services.client.api.APIClientConnection.<init>(APIClientConnection.java:310)

        at il.co.bll.techinfra.bf.buildForge.main(buildForge.java:36)


i've also tried obtaining SSL certificate from the browser (working with the admin-console), i've also tried using invalid password or files but i'm always getting the same error,
is there a way to set the connection more to SSL?

Thanks.

11 answers

Most liked answers ↑|Newest answers|Oldest answers

0
permanent link
Peter Birk (501●1●4●5) | answered Mar 05 '10, 4:54 p.m.
JAZZ DEVELOPER
Here are some instructions for setting up SSL for Java API clients with Build Forge 7.1.x. Let me know if you have any questions about these instructions. The intent is to get the Java API quickly using SSL. Obviously, it's always good to use unique SSL certificates on the client, rather than copying them over from the server. But this is a quick way to get it working.

Using bflclient.conf to configure SSL connections for an API client (Perl or Java)

To make an SSL connection with an API client program, you will need to setup bfclient.conf which contains the SSL configuration properties needed to make an SSL connection. To simplify this process, follow the steps below and run your client in the client directory mentioned below. 


1. Create a client directory where you are going to run the script from. 

 Windows example: c:\client 

 Unix example: /temp/client 



2. Copy bfclient.conf to the client directory. 

 Windows: copy c:\BuildForge\bfclient.conf c:\client 

 Unix: cp /opt/BuildForge/Platform/bfclient.conf /temp/client 



3. Create a keystore subdirectory in the client directory. 

 Windows: mkdir c:\client\keystore 

 Unix: mkdir /temp/client/keystore 



4. Copy the keystores from the BuildForge install into the client keystore directory.

 Windows: copy \BuildForge\keystore\*.pem \client\keystore. 

 Unix: cp /opt/BuildForge/Platform/*.pem /temp/client/keystore 



5. For Perl, set the following OS environment variable so that bfclient.conf location is found. 

 Windows: set com.buildforge.client.config=c:\client\bfclient.conf 

 Unix: export com.buildforge.client.config=/temp/client/bfclient.conf 



6. For Java, set the following System property on the Java command line when running your script.  Also, you must use SecureAPIClientConnection instead of APIClientConnection in your code to make an SSL connection using bfclient.conf. 

 Windows: -Dcom.buildforge.client.config=c:\client\bfclient.conf 

 Unix: -Dcom.buildforge.client.config=/temp/client/bfclient.conf 



7. Edit bfclient.conf and check the following properties: 

 bf_services_preferred_protocol=ssl (make sure it's ssl instead of tcp) 

 bf_services_ssl_port=49150 (make sure 49150 is your Services Layer SSL port) 

 bf_keystore_location=./keystore/buildForgeKey.pem (several of these, change to fully qualified path if not running script in client directory) 



8. If you want to be sure that your script is using the bfclient.conf correctly, set the following debug property in your environment. When you run your script, you should see a lot more output about the SSL connection properties. 

 Windows: set BFDEBUG_SECURITY=1 

 Unix: export BFDEBUG_SECURITY=1 



Note: If you choose to run your script in another directory, you have to update bfclient.conf and change the keystore locations to have absolute paths to the PEM files.
0
permanent link
hagai izenberg (26●1●1) | answered Mar 09 '10, 5:22 a.m.
Thanks,
It seems to be working with two exceptionals:
1) I had to copy the both .pem and .p12 files to make it work
2) using the BFDEBUG_SECURITY debug option didn't bring any special messages why is that?

i have 2 more questions regarding this issue:
1) is there a way to shut-down the non-ssl port in buildforge, so that no one will be able to work against buildforge without ssl.
2) is there a way to use the LDAP user that is running the script as the build-forge user, without having to pass the password of-course?

Best regards,
Hagai.
0
permanent link
Peter Birk (501●1●4●5) | answered Mar 09 '10, 8:53 a.m.
JAZZ DEVELOPER
Thanks,
It seems to be working with two exceptionals:
1) I had to copy the both .pem and .p12 files to make it work
2) using the BFDEBUG_SECURITY debug option didn't bring any special messages why is that?


1), it depends on the type of client you have. If you have a Java API client, you should have only needed the .p12 files. For a Perl API client, you should only need the .pem files. If you need both, I'm not sure why, other than satisfying a reference.
2) BFDEBUG_SECURITY is only effective for the Perl API client. If you want to see debug for the API client, you need to referencing logging.properties via -Djava.util.logging.config.file=logging.properties (whereever it exists).. This should produce logging output. You can also trace JSSE by adding -Djavax.net.debug=true to your launching script.



i have 2 more questions regarding this issue:
1) is there a way to shut-down the non-ssl port in buildforge, so that no one will be able to work against buildforge without ssl.
2) is there a way to use the LDAP user that is running the script as the build-forge user, without having to pass the password of-course?


1) You can disable the Services Layer TCP port during installation. It has a checkbox next to the port which lets you deselect it. There's probably a way to disable the port after installation, but I would have to check around.
2) There is currently no way to authenticate to the Build Forge Services Layer API without userid/password. We do support password encryption in bfclient.conf which allows you to encrypt the password stored there. You can also specify the password in your code via the authUser API. If we were to support some mechanism to pass a token instead of user/pass it would likely be Kerberos or Certificates. Let me know if you need some other mechanism, but userid w/o password is not secure.

Regards,
Pete
0
permanent link
hagai izenberg (26●1●1) | answered Mar 09 '10, 9:11 a.m.
Thanks,
Can we use an LDAP user&password when making a client connection?
0
permanent link
Peter Birk (501●1●4●5) | answered Mar 09 '10, 9:18 a.m.
JAZZ DEVELOPER
Thanks,
Can we use an LDAP user&password when making a client connection?


Yes. You can use the same user/pass (DB or LDAP) that you are able to login to the BF console with. It goes though basically the same flow. If you have multiple LDAP servers, you must specify the domain or it will try using the "default" LDAP domain.

Regards,
Pete
0
permanent link
hagai izenberg (26●1●1) | answered Mar 14 '10, 5:15 a.m.
Thanks, it works perfectly, got a few more questions from our security team:

1) regarding the buildforge users - how are the users & password saved in the buildforge database? are they encrypted, and if so using what algorithm? and where is the encryption key saved?
2) about the connection between buildforge and it's agents - can we make it use SSL?
3) did you have a chance to find out if there's a way to disable the Services Layer TCP after installation?

Thanks again, your support if much appreciated.
0
permanent link
Peter Birk (501●1●4●5) | answered Mar 14 '10, 11:53 a.m.
JAZZ DEVELOPER
Thanks, it works perfectly, got a few more questions from our security team:

1) regarding the buildforge users - how are the users & password saved in the buildforge database? are they encrypted, and if so using what algorithm? and where is the encryption key saved?
2) about the connection between buildforge and it's agents - can we make it use SSL?
3) did you have a chance to find out if there's a way to disable the Services Layer TCP after installation?

Thanks again, your support if much appreciated.



1) If you enable password encryption at the console (Administration -> Security), then passwords will get encrypted with 128-bit AES encryption. See the Build Forge installation documentation for more details. If you do not enable password encryption, then all passwords get stored with an encoding algorithm for obfuscation purposes.

2) Yes, you must use a 7.1.x or later console and agent. With this combination, you can use SSL between engine and agent. You can still use 7.0.2 agents with a 7.1 engine, but just cannot use SSL to those agents. You can have some agents using SSL while others are configured for TCP.

3) If you comment out the #services_tcp_port=3966 property in buildforge.conf, it will cause the port to stay closed. You should do this in two laces:
Directory of C:\BuildForge7113.053\Apache\tomcat\webapps\rbf-services\WEB-INF\classes\buildforge.conf
and
C:\BuildForge7113.053\buildforge.conf
After remarking them out with a # and starting the server up, a netstat -a will show 3966 is not started while 49150 is started.

Hope that helps.

Regards,
Pete
0
permanent link
hagai izenberg (26●1●1) | answered May 16 '10, 7:24 a.m.
Hi,
I changed the following line to a comment

#services_tcp_port 3966

on both:
D:\Program Files\ibm\Build Forge\Apache\tomcat\webapps\rbf-services\WEB-INF\classes\buildforge.conf
D:\Program Files\ibm\Build Forge\buildforge.conf

But after restarting the server, it still listens on port 3966.
Any suggestions?

Thanks.
0
permanent link
Peter Birk (501●1●4●5) | answered May 17 '10, 12:17 p.m.
JAZZ DEVELOPER
Hi,
I changed the following line to a comment

#services_tcp_port 3966

on both:
D:\Program Files\ibm\Build Forge\Apache\tomcat\webapps\rbf-services\WEB-INF\classes\buildforge.conf
D:\Program Files\ibm\Build Forge\buildforge.conf

But after restarting the server, it still listens on port 3966.
Any suggestions?

Thanks.


You do need to change buildforge.conf files as you did, but what really assigns the port is the web.xml for rbf-services. Open the file tomcat/webapps/rbf-services/WEB-INF/web.xml and look for the following stanza:

<servlet>
<servlet-name>ServicesBootstrap</servlet-name>
<servlet-class>com.buildforge.services.server.web.BootstrapServlet</servlet-class>
<init-param>
<param-name>port</param-name>
<param-value>3966</param-value>
</init-param>
<init-param>
<param-name>sslPort</param-name>
<param-value>49150</param-value>
</init-param>
<load-on-startup>0</load-on-startup>
</servlet>

You can change the port and sslPort to whatever you want it to be. However, make sure buildforge.conf matches the values you choose.

Regards,
Pete
0
permanent link
hagai izenberg (26●1●1) | answered May 20 '10, 6:33 a.m.
What you're saying is that I can only change the port number or is there a way to disable it?

Your answer

Register or to post your answer.


Dashboards and work items are no longer publicly available, so some links may be invalid. We now provide similar information through other means. Learn more here.