Skip to content

Commit ea7d894

Browse files
KbayeroKbayero
committed
fix(backend): update OpenSearch connection to use HTTPS with authentication
1 parent 2145c70 commit ea7d894

6 files changed

Lines changed: 83 additions & 12 deletions

File tree

‎backend/src/main/java/com/park/utmstack/checks/ElasticsearchConnectionCheck.java‎

Lines changed: 37 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,15 @@
11
package com.park.utmstack.checks;
22

33
import com.park.utmstack.config.Constants;
4+
import okhttp3.Credentials;
45
import okhttp3.OkHttpClient;
56
import okhttp3.Request;
67
import okhttp3.Response;
78

9+
import javax.net.ssl.SSLContext;
10+
import javax.net.ssl.TrustManager;
11+
import javax.net.ssl.X509TrustManager;
12+
import java.security.cert.X509Certificate;
813
import java.util.Objects;
914

1015
public class ElasticsearchConnectionCheck {
@@ -53,17 +58,45 @@ public void connectionCheck(int retries) {
5358

5459
private void pingElasticsearch() {
5560
try {
56-
final String ELASTIC_URL = String.format("http://%1$s:%2$s",
61+
final String ELASTIC_URL = String.format("https://%1$s:%2$s",
5762
System.getenv(Constants.ENV_ELASTICSEARCH_HOST), System.getenv(Constants.ENV_ELASTICSEARCH_PORT));
5863

59-
OkHttpClient client = new OkHttpClient().newBuilder().build();
60-
Request rq = new Request.Builder().url(ELASTIC_URL).build();
64+
String user = System.getenv(Constants.ENV_ELASTICSEARCH_USER);
65+
String password = System.getenv(Constants.ENV_ELASTICSEARCH_PASSWORD);
66+
67+
OkHttpClient client = createTrustAllClient();
68+
Request rq = new Request.Builder()
69+
.url(ELASTIC_URL)
70+
.header("Authorization", Credentials.basic(user, password))
71+
.build();
6172
Response rs = client.newCall(rq).execute();
6273
Objects.requireNonNull(rs.body()).close();
6374
if (!rs.isSuccessful())
64-
throw new RuntimeException();
75+
throw new RuntimeException("HTTP " + rs.code());
6576
} catch (Exception e) {
6677
throw new RuntimeException(e.getLocalizedMessage());
6778
}
6879
}
80+
81+
private OkHttpClient createTrustAllClient() {
82+
try {
83+
TrustManager[] trustAllCerts = new TrustManager[]{
84+
new X509TrustManager() {
85+
public X509Certificate[] getAcceptedIssuers() { return new X509Certificate[0]; }
86+
public void checkClientTrusted(X509Certificate[] certs, String authType) {}
87+
public void checkServerTrusted(X509Certificate[] certs, String authType) {}
88+
}
89+
};
90+
91+
SSLContext sslContext = SSLContext.getInstance("TLS");
92+
sslContext.init(null, trustAllCerts, new java.security.SecureRandom());
93+
94+
return new OkHttpClient.Builder()
95+
.sslSocketFactory(sslContext.getSocketFactory(), (X509TrustManager) trustAllCerts[0])
96+
.hostnameVerifier((hostname, session) -> true)
97+
.build();
98+
} catch (Exception e) {
99+
throw new RuntimeException("Failed to create SSL client: " + e.getMessage());
100+
}
101+
}
69102
}

‎backend/src/main/resources/config/application-dev.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,9 @@ spring:
2929
database: POSTGRESQL # For Postgresql database
3030
elasticsearch: # This configuration is for the elasticsearch health indicator, please do not remove
3131
rest:
32-
uris: http://${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}
32+
uris: https://${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}
33+
username: ${ELASTICSEARCH_USER}
34+
password: ${ELASTICSEARCH_PASSWORD}
3335
liquibase:
3436
contexts: dev
3537
mail:

‎backend/src/main/resources/config/application-prod.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,9 @@ spring:
2222
database-platform: tech.jhipster.domain.util.FixedPostgreSQL10Dialect
2323
elasticsearch: # This configuration is for the elasticsearch health indicator, please do not remove
2424
rest:
25-
uris: http://${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}
25+
uris: https://${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}
26+
username: ${ELASTICSEARCH_USER}
27+
password: ${ELASTICSEARCH_PASSWORD}
2628
liquibase:
2729
contexts: prod
2830
mail:

‎installer/docker/compose.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -355,7 +355,6 @@ func (c *Compose) Populate(conf *config.Config, stack *StackConfig) error {
355355
"cluster.initial_master_nodes=node1",
356356
"bootstrap.memory_lock=false",
357357
"OPENSEARCH_INITIAL_ADMIN_PASSWORD=" + conf.OpenSearchPassword,
358-
"DISABLE_INSTALL_DEMO_CONFIG=true",
359358
"JAVA_HOME=/usr/share/opensearch/jdk",
360359
"action.auto_create_index=true",
361360
"compatibility.override_main_response_version=true",

‎user-auditor/src/main/java/com/utmstack/userauditor/checks/ElasticsearchConnectionCheck.java‎

Lines changed: 38 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,16 @@
11
package com.utmstack.userauditor.checks;
22

33
import com.utmstack.userauditor.service.elasticsearch.Constants;
4+
import okhttp3.Credentials;
45
import okhttp3.OkHttpClient;
56
import okhttp3.Request;
67
import okhttp3.Response;
78
import org.springframework.util.Assert;
89

10+
import javax.net.ssl.SSLContext;
11+
import javax.net.ssl.TrustManager;
12+
import javax.net.ssl.X509TrustManager;
13+
import java.security.cert.X509Certificate;
914
import java.util.Objects;
1015

1116
public class ElasticsearchConnectionCheck {
@@ -46,21 +51,49 @@ private void pingElasticsearch() {
4651
try {
4752
String elasticHost = System.getenv(Constants.ENV_ELASTICSEARCH_HOST);
4853
String elasticPort = System.getenv(Constants.ENV_ELASTICSEARCH_PORT);
54+
String user = System.getenv(Constants.ENV_ELASTICSEARCH_USER);
55+
String password = System.getenv(Constants.ENV_ELASTICSEARCH_PASSWORD);
4956

5057
Assert.hasText(elasticHost, "Missing elasticsearch host configuration value");
5158
Assert.hasText(elasticPort, "Missing elasticsearch port configuration value");
59+
Assert.hasText(user, "Missing elasticsearch user configuration value");
60+
Assert.hasText(password, "Missing elasticsearch password configuration value");
5261

53-
final String ELASTIC_URL = String.format("http://%1$s:%2$s",
54-
System.getenv(Constants.ENV_ELASTICSEARCH_HOST), System.getenv(Constants.ENV_ELASTICSEARCH_PORT));
62+
final String ELASTIC_URL = String.format("https://%1$s:%2$s", elasticHost, elasticPort);
5563

56-
OkHttpClient client = new OkHttpClient().newBuilder().build();
57-
Request rq = new Request.Builder().url(ELASTIC_URL).build();
64+
OkHttpClient client = createTrustAllClient();
65+
Request rq = new Request.Builder()
66+
.url(ELASTIC_URL)
67+
.header("Authorization", Credentials.basic(user, password))
68+
.build();
5869
Response rs = client.newCall(rq).execute();
5970
Objects.requireNonNull(rs.body()).close();
6071
if (!rs.isSuccessful())
61-
throw new RuntimeException();
72+
throw new RuntimeException("HTTP " + rs.code());
6273
} catch (Exception e) {
6374
throw new RuntimeException(ctx + ": " + e.getLocalizedMessage());
6475
}
6576
}
77+
78+
private OkHttpClient createTrustAllClient() {
79+
try {
80+
TrustManager[] trustAllCerts = new TrustManager[]{
81+
new X509TrustManager() {
82+
public X509Certificate[] getAcceptedIssuers() { return new X509Certificate[0]; }
83+
public void checkClientTrusted(X509Certificate[] certs, String authType) {}
84+
public void checkServerTrusted(X509Certificate[] certs, String authType) {}
85+
}
86+
};
87+
88+
SSLContext sslContext = SSLContext.getInstance("TLS");
89+
sslContext.init(null, trustAllCerts, new java.security.SecureRandom());
90+
91+
return new OkHttpClient.Builder()
92+
.sslSocketFactory(sslContext.getSocketFactory(), (X509TrustManager) trustAllCerts[0])
93+
.hostnameVerifier((hostname, session) -> true)
94+
.build();
95+
} catch (Exception e) {
96+
throw new RuntimeException("Failed to create SSL client: " + e.getMessage());
97+
}
98+
}
6699
}

‎user-auditor/src/main/java/com/utmstack/userauditor/service/elasticsearch/Constants.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@ public final class Constants {
1818
*/
1919
public static final String ENV_ELASTICSEARCH_HOST = "ELASTICSEARCH_HOST";
2020
public static final String ENV_ELASTICSEARCH_PORT = "ELASTICSEARCH_PORT";
21+
public static final String ENV_ELASTICSEARCH_USER = "ELASTICSEARCH_USER";
22+
public static final String ENV_ELASTICSEARCH_PASSWORD = "ELASTICSEARCH_PASSWORD";
2123
public static final String ENV_DB_HOST = "DB_HOST";
2224
public static final String ENV_DB_PORT = "DB_PORT";
2325
public static final String ENV_DB_NAME = "DB_NAME";

0 commit comments

Comments
 (0)