Enabling mTLS security and delegated authentication using LDAP¶

Overview¶

In this guide, we will setup mTLS to secure the data in motion between the mq-spring-app and the QM1 queue manager. We will also setup an LDAP server to configure the system to delegate authentication of mq users (system and human) to an OpenLDAP server.

The details of the solution are described here mq security.

Prerequisites¶

You have a cluster provisioned with the mq-spring-app deployed and interacting with the QM1 queue manager without any security configured (i.e. no TLS and no LDAP for delegated authentication).

You have cloned the git repositories for: * multi-tenancy-gitops (https://github.com/cloud-native-toolkit/multi-tenancy-gitops) * mq-infra (https://github.com/cloud-native-toolkit/mq-infra) * mq-spring-app (https://github.com/cloud-native-toolkit/mq-spring-app)

Configure mTLS and Delegated Authentication¶

Create openldap project

Go to the multi-tenancy-gitops folder where the local copy of the repo is:
```
cd multi-tenancy-gitops
```
Edit file 0-bootstrap/single-cluster/1-infra/kustomization.yaml and uncomment the line:
```
- argocd/namespace-openldap.yaml
```
Commit the change and push it back to the repo.
```
git add .
git commit -m "create openldap project"
git push origin master
```
This will create the openldap project in the cluster.
Install the OpenLDAP Server

Edit file 0-bootstrap/single-cluster/2-services/kustomization.yaml and uncomment the line:
```
- argocd/instances/openldap.yaml
```
Commit the change and push it back to the repo.
```
git add .
git commit -m "enable OpenLDAP to be installed"
git push origin master
```
This will create the openldap Argo application and install OpenLDAP into the cluster in namespace openldap.
In ArgoCD, when you search for the openldap application, you should see a screen that look like this:

Once, ArgoCD Synchs with the OpenShift cluster, you will see two deployments in the openldap project as follows:

OpenLDAP has a admin UI to manage the users.

Get the route and open the admin UI in a browser:
```
oc get route openldap-admin -n openldap -o jsonpath='{ .spec.host }'
```
The OpenLDAP admin UI will appear as follows:

Login using Login DN credentials:
```
cn=admin,dc=ibm,dc=com
```
and password:
```
admin
```
Once, you login, you will see several users in the directory including the mqapp user which we will use in this guide.
Activate cert-manager Operator

Edit file 0-bootstrap/single-cluster/2-services/kustomization.yaml and uncomment the line:
```
- argocd/operators/cert-manager.yaml
```
Commit the change and push it back to the repo
```
git add .
git commit -m "enable cert-manager operator"
git push origin master
```
The cert-manager ArgoCD application will be created:

The cert-manager operator will show up in the OpenShift cluster.
Activate cert-manager instance

Edit file 0-bootstrap/single-cluster/2-services/kustomization.yaml and uncomment the line:
```
- argocd/instances/cert-manager-instance.yaml
```
Commit the change and push it back to the repo
```
git add .
git commit -m "enable cert-manager instance"
git push origin master
```
The cert-manager instance ArgoCD application will be created:

The cert-manager instance will show up in the OpenShift cluster.
Activate Certificate Issuer and Certificates

NOTE: ??? CHECK WITH HOLLIS. IS THIS GITOPS STRUCTURE STILL CORRECT????

Edit file 0-bootstrap/single-cluster/3-apps/kustomization.yaml and uncomment the line:
```
- argocd/mq/tools.yaml
```
Commit the change and push it back to the repo
```
git add .
git commit -m "enable certificate issuer"
git push origin master
```
Creates the following resources in the cluster:

Resource type Resource name

ClusterIssuer selfsigned-cluster-issuer

Certificate mq-self-signed-ca-cert

ClusterIssuer self-signed-mq-cluster-issuer
Create JKS password secret

NOTE: master branch now has the script and the sealed secret yaml to generate the mq-client-jks-password secret. https://github.com/mqpdg2/multi-tenancy-gitops-apps/tree/master/mq/environments/ci/secrets So I believe this step does not need to be in this guide. I believe that the secret will exist at this point at least in the ci namespace. Not sure of the other namespaces.

Activate Certificates in ci namespace

Edit file `mq/environments/ci/kustomization.yaml and uncomment the line:

- certificates/ci-mq-client-certificate.yaml
- certificates/ci-mq-server-certificate.yaml

Commit the change and push it back to the repo

git add .
git commit -m "create the mq client and server certificate in the ci namespace"
git push origin master

Verify that the certificate was created successfully and the secret was generated by cert-manager.

oc get certificate -n ci

You should see the certificates with a Ready status of True as follows:

NAME                READY   SECRET           AGE
ci-mq-client-cert   True    mq-client-jks    5d16h
ci-mq-server-cert   True    mq-server-cert   5d16h

The cert-manager operator generates the secrets from these certificates. Lets verify the secrets were generated correctly. Run the command:

oc get secret mq-client-jks -n ci

You should see the secret with a Data value of 5 representing 5 key value pairs as follows:

NAME            TYPE                DATA   AGE
mq-client-jks   kubernetes.io/tls   5      5d16h

Run the command:

oc get secret mq-server-cert -n ci

You should see the secret with a Data value of 3 representing 3 key value pairs as follows:

NAME             TYPE                DATA   AGE
mq-server-cert   kubernetes.io/tls   3      5d17h

Activate Certificates in dev namespace

Edit file `mq/environments/dev/kustomization.yaml and uncomment the line:

- certificates/dev-mq-client-certificate.yaml
- certificates/dev-mq-server-certificate.yaml