Uploaded image for project: 'Help-Desk'
  1. Help-Desk
  2. HELP-5694

FIWARE.Request.Lab.SophiaAntipolis.Sophia Antipolis.Adding Region Support Keys

    Details

    • Type: extRequest
    • Status: Closed
    • Priority: Major
    • Resolution: Done
    • Fix Version/s: 2021
    • Component/s: FIWARE-LAB-HELP
    • Labels:
      None
    • HD-Node:
      SophiaAntipolis

      Description

      The region staff team are responsible of the virtual machines instantiated on their servers. Therefore each region staff should have the control of who access the virtual machines for support purposes and set and enforce the corresponding policy. It is not possible if the public keys are shared among all the regions. Additionally, it is also extremely insecure and a problem when a region leaves the federation.

      A new service, called aiakos and deployed aiakos.lab.fiware.org, has been deployed in FIWARE Lab to manage support region ssh and gpg keys.

      As region administrator, you should create your ssh, and gpg keys and upload it into the aikos service (you can obtain information about how create your keys in https://github.com/telefonicaid/fiware-aiakos/blob/develop/doc/README.rst#generating-a-ssh-key).

      To upload your keys into the aiakos service, you should use just a POST operation
      POST: https://jsapi.apiary.io/apis/fiwareaiakos/reference/aiakos-v1/add-key/post-key.html

      You can find information about why ssh and gpg keys are needed in https://github.com/telefonicaid/fiware-aiakos/blob/develop/doc/README.rst#why-a-ssh-key-and-a-gpg-key-are-needed

        Activity

        Hide
        henar Henar Muñoz added a comment -

        It is ok

        Show
        henar Henar Muñoz added a comment - It is ok
        Hide
        Com4Innov Sophia Antipolis Node Helpdesk added a comment -

        Hi Jésus,
        Thanks. With these :

        It worked: we get back "201 Created". At your side, can you see the key?

        Regards,
        Sophia Antipolis team

        Show
        Com4Innov Sophia Antipolis Node Helpdesk added a comment - Hi Jésus, Thanks. With these : endpoint : http://aiakos.lab.fiware.org:3000/v1/support/ headers : (X-Auth-Token: 79c846445c524c56bc608c35c93ab12c, Accept: text/plain, Content-Type: text/plain) and payload : ssh-rsa "SSH Key" admin.xifi@com4innov.com It worked: we get back "201 Created". At your side, can you see the key? Regards, Sophia Antipolis team
        Hide
        henar Henar Muñoz added a comment -
        Show
        henar Henar Muñoz added a comment - You can have a look at https://github.com/telefonicaid/fiware-aiakos/blob/develop/doc/README.rst#generating-a-ssh-key about how to generate keys.
        Hide
        jesus.perezgonzalez Jesus Perez added a comment -

        Hi,

        a valid ssh key is something like this:

        ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3wWf8ENv1+USgRh0x9EvlczhbOoqfHGXR
        zV1rlkE0I61HM6D6QY3edTGoQLsKyk1QTSo954q/ULBP7KY2/7YucTaDOsJgS0Ff
        Yxnhs5faljmrccApyD1a09rMv9OtCQHdLRpnM3WoyiApIIXBXvpxX4gC6yZVXnCw
        7TcKkFejyeWUsWIsf1PaNKuG8CAKtwQah4L81VrhGGr8vCh8wjreIJCEUV73alcJ
        y5FaxbeasBs5GGlgP4vedzLxsbQpiK3kl/P/gNVPzdGKprjst9urb/k36v82cXy+
        jGQ2HCYGqCSFw6kOXuURrmEjkk0Sk2WSH7hhBGMENHgMf8vY3IFB admin@mydomain.com

        Please use a string like this in your payload.

        Regards
        Jesus.

        Show
        jesus.perezgonzalez Jesus Perez added a comment - Hi, a valid ssh key is something like this: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3wWf8ENv1+USgRh0x9EvlczhbOoqfHGXR zV1rlkE0I61HM6D6QY3edTGoQLsKyk1QTSo954q/ULBP7KY2/7YucTaDOsJgS0Ff Yxnhs5faljmrccApyD1a09rMv9OtCQHdLRpnM3WoyiApIIXBXvpxX4gC6yZVXnCw 7TcKkFejyeWUsWIsf1PaNKuG8CAKtwQah4L81VrhGGr8vCh8wjreIJCEUV73alcJ y5FaxbeasBs5GGlgP4vedzLxsbQpiK3kl/P/gNVPzdGKprjst9urb/k36v82cXy+ jGQ2HCYGqCSFw6kOXuURrmEjkk0Sk2WSH7hhBGMENHgMf8vY3IFB admin@mydomain.com Please use a string like this in your payload. Regards Jesus.
        Hide
        Com4Innov Sophia Antipolis Node Helpdesk added a comment -

        Hello Henar,

        1)
        We did the POST request with
        URL: http://cloud.lab.fi-ware.org:4731/v2.0/tokens
        Headers: Accept: text/plain
        Content-Type: application/json

        and
        Payload:
        {
        "auth":{
        "passwordCredentials":

        { "username":"admin-c4i", "password":"XXX" }

        ,
        "tenantName":"admin"
        }
        }

        and we are able to retrieve the token-id, which in our opinion in the following piece of text is the "id". Is our assumption correct?

        token": {
        "issued_at": "2016-03-18T11:03:43.029503"
        "expires": "2016-03-19T11:03:42Z"
        "id": "79c846445c524c56bc608c35c93ab12c"

        2) Now, we are doing in this url: http://aiakos.lab.fiware.org:3000/v1/support/
        a POST request with

        Headers:
        X-Auth-Token: 79c846445c524c56bc608c35c93ab12c
        Accept: text/plain
        Content-Type: text/plain

        and Payload a key that was generated by puttygen and is this one:
        AAAAB3NzaC1yc2EAAAADAQABAAABAQC3wWf8ENv1+USgRh0x9EvlczhbOoqfHGXR
        zV1rlkE0I61HM6D6QY3edTGoQLsKyk1QTSo954q/ULBP7KY2/7YucTaDOsJgS0Ff
        Yxnhs5faljmrccApyD1a09rMv9OtCQHdLRpnM3WoyiApIIXBXvpxX4gC6yZVXnCw
        7TcKkFejyeWUsWIsf1PaNKuG8CAKtwQah4L81VrhGGr8vCh8wjreIJCEUV73alcJ
        y5FaxbeasBs5GGlgP4vedzLxsbQpiK3kl/P/gNVPzdGKprjst9urb/k36v82cXy+
        jGQ2HCYGqCSFw6kOXuURrmEjkk0Sk2WSH7hhBGMENHgMf8vY3IFB

        and we get as a Response 400 Bad Request with reason : Error: invalid key

        Could you tell us please what is wrong in the whole procedure that we did?

        Best regards,
        Sophia Antipolis Team

        Show
        Com4Innov Sophia Antipolis Node Helpdesk added a comment - Hello Henar, 1) We did the POST request with URL : http://cloud.lab.fi-ware.org:4731/v2.0/tokens Headers: Accept: text/plain Content-Type: application/json and Payload : { "auth":{ "passwordCredentials": { "username":"admin-c4i", "password":"XXX" } , "tenantName":"admin" } } and we are able to retrieve the token-id, which in our opinion in the following piece of text is the "id". Is our assumption correct? token": { "issued_at": "2016-03-18T11:03:43.029503" "expires": "2016-03-19T11:03:42Z" "id": "79c846445c524c56bc608c35c93ab12c" 2) Now, we are doing in this url: http://aiakos.lab.fiware.org:3000/v1/support/ a POST request with Headers: X-Auth-Token: 79c846445c524c56bc608c35c93ab12c Accept: text/plain Content-Type: text/plain and Payload a key that was generated by puttygen and is this one: AAAAB3NzaC1yc2EAAAADAQABAAABAQC3wWf8ENv1+USgRh0x9EvlczhbOoqfHGXR zV1rlkE0I61HM6D6QY3edTGoQLsKyk1QTSo954q/ULBP7KY2/7YucTaDOsJgS0Ff Yxnhs5faljmrccApyD1a09rMv9OtCQHdLRpnM3WoyiApIIXBXvpxX4gC6yZVXnCw 7TcKkFejyeWUsWIsf1PaNKuG8CAKtwQah4L81VrhGGr8vCh8wjreIJCEUV73alcJ y5FaxbeasBs5GGlgP4vedzLxsbQpiK3kl/P/gNVPzdGKprjst9urb/k36v82cXy+ jGQ2HCYGqCSFw6kOXuURrmEjkk0Sk2WSH7hhBGMENHgMf8vY3IFB and we get as a Response 400 Bad Request with reason : Error: invalid key Could you tell us please what is wrong in the whole procedure that we did? Best regards, Sophia Antipolis Team
        Hide
        henar Henar Muñoz added a comment -

        Hi
        To generate the token:
        POST http://cloud.lab.fi-ware.org:4731/v2.0/tokens
        {
        "auth":{
        "passwordCredentials":

        { "username":"admin-c4i", "password":"XXX" }

        ,
        "tenantName":"admin"
        }
        }

        Show
        henar Henar Muñoz added a comment - Hi To generate the token: POST http://cloud.lab.fi-ware.org:4731/v2.0/tokens { "auth":{ "passwordCredentials": { "username":"admin-c4i", "password":"XXX" } , "tenantName":"admin" } }
        Hide
        Com4Innov Sophia Antipolis Node Helpdesk added a comment -

        Hello Henar,

        We would like to know how to request the token with our admin account (admin-c4i). With that account, we cannot access the "cloud.lab.fiware.org" and generate the token but only the "https://account.lab.fiware.org/".
        Could you tell us how we could do it efficiently?

        Best regards,
        Sophia Antipolis team.

        Show
        Com4Innov Sophia Antipolis Node Helpdesk added a comment - Hello Henar, We would like to know how to request the token with our admin account (admin-c4i). With that account, we cannot access the "cloud.lab.fiware.org" and generate the token but only the "https://account.lab.fiware.org/". Could you tell us how we could do it efficiently? Best regards, Sophia Antipolis team.
        Hide
        henar Henar Muñoz added a comment -

        You can see in the documentation. Anyway, they will be Acept, Contenty-Type and X-Auth-Token
        Regards,
        Henar

        Show
        henar Henar Muñoz added a comment - You can see in the documentation. Anyway, they will be Acept, Contenty-Type and X-Auth-Token Regards, Henar
        Hide
        Com4Innov Sophia Antipolis Node Helpdesk added a comment -

        Hi Ariel,
        Thanks for your remark. First of all, for me to build the right request; in the POST query, which headers are compulsory for aiakos?

        Regards,
        Ariel

        Show
        Com4Innov Sophia Antipolis Node Helpdesk added a comment - Hi Ariel, Thanks for your remark. First of all, for me to build the right request; in the POST query, which headers are compulsory for aiakos? Regards, Ariel
        Hide
        jesus.perezgonzalez Jesus Perez added a comment - - edited

        Hi Ariel

        When you are using a token-id value, Are you use this value?. I remember you that a valid token is something like this: 62005db8254c4bbba348edcac5ad597f.
        First of all, you should request a token with your admin user (admin-c4i), and use this token-id in aiakos post.

        Regards,
        Jesus

        Show
        jesus.perezgonzalez Jesus Perez added a comment - - edited Hi Ariel When you are using a token-id value, Are you use this value?. I remember you that a valid token is something like this: 62005db8254c4bbba348edcac5ad597f. First of all, you should request a token with your admin user (admin-c4i), and use this token-id in aiakos post. Regards, Jesus
        Hide
        Com4Innov Sophia Antipolis Node Helpdesk added a comment -

        Hi Jésus,
        With the same parameters (endpoint and headers), we get the same results:

        • "401: Unauthorized", if key in body
        • "415: Unsupported Media Type", if in the payload.

        From what I've told you, have we done the right input?
        Regards,
        Ariel

        Show
        Com4Innov Sophia Antipolis Node Helpdesk added a comment - Hi Jésus, With the same parameters (endpoint and headers), we get the same results: "401: Unauthorized", if key in body "415: Unsupported Media Type", if in the payload. From what I've told you, have we done the right input? Regards, Ariel
        Hide
        jesus.perezgonzalez Jesus Perez added a comment -

        Hi Ariel,

        From today, we have installed a new version, with some bugs fixed!. Please try again.

        Regards.
        Jesus.

        Show
        jesus.perezgonzalez Jesus Perez added a comment - Hi Ariel, From today, we have installed a new version, with some bugs fixed!. Please try again. Regards. Jesus.
        Hide
        Com4Innov Sophia Antipolis Node Helpdesk added a comment -

        Hi,
        I've tried with:

        When the key is, in plain text, put in the body; we get "401: Unauthorized"; attached as payload, "415: Unsupported Media Type
        ".

        Is anything wrong?
        Regards,
        Ariel

        Show
        Com4Innov Sophia Antipolis Node Helpdesk added a comment - Hi, I've tried with: http://aiakos.lab.fiware.org:3000/v1/support as endpoint (Accept: text/plain, Content-Type: text/plain, X-Auth-Token: token-id) as headers. When the key is, in plain text, put in the body; we get "401: Unauthorized"; attached as payload, "415: Unsupported Media Type ". Is anything wrong? Regards, Ariel
        Hide
        henar Henar Muñoz added a comment -
        Show
        henar Henar Muñoz added a comment - Hi the endpoint to upload the keys is http://aiakos.lab.fiware.org:3000/v1/support not http://aiakos.lab.fiware.org:3000/v1/support/SophiaAntipolis/sshkey Regards, Henar
        Hide
        Com4Innov Sophia Antipolis Node Helpdesk added a comment -

        Hi Henar,
        Thanks for your guidance. We did POST this way:

        And we get back "405: Method Not Allowed".
        Have we done it right?

        Regards,
        Ariel

        Show
        Com4Innov Sophia Antipolis Node Helpdesk added a comment - Hi Henar, Thanks for your guidance. We did POST this way: address: http://aiakos.lab.fiware.org:3000/v1/support/SophiaAntipolis/sshkey headers: (Content-Type: text/plain, X-Auth-Token: token-id, Accept: text/plain) payload: the SSH key got from PuTTYgen. And we get back "405: Method Not Allowed". Have we done it right? Regards, Ariel
        Hide
        henar Henar Muñoz added a comment -

        Hi
        1.- You are not invoking the service, you are using the apiary mockup, which is used just for documenting the API. The service endpoint is aiakos.lab.fiware.org:3000. Please, follow the documentation to create the POST request.
        3.- You need to specify the headers, Content-Type and Accept to text/plain
        Regards,
        Henar

        Show
        henar Henar Muñoz added a comment - Hi 1.- You are not invoking the service, you are using the apiary mockup, which is used just for documenting the API. The service endpoint is aiakos.lab.fiware.org:3000. Please, follow the documentation to create the POST request. 3.- You need to specify the headers, Content-Type and Accept to text/plain Regards, Henar
        Hide
        Com4Innov Sophia Antipolis Node Helpdesk added a comment -

        Hi,
        Here is what we did:
        1. From https://jsapi.apiary.io/apis/fiwareaiakos/reference/aiakos-v1/query-key/get-key.html?console=1, we entered the keywords (SophiaAntipolis, with sshkey and gpgkey):
        2. For which we got an answer (both SSH and GPG keys). We posted it:
        3. That done, when queried, from http://aiakos.lab.fiware.org:3000/v1/support/SophiaAntipolis/sshkey, we get "Not Acceptable".

        Have we, from what you've seen, done something wrong?
        Regards,

        Show
        Com4Innov Sophia Antipolis Node Helpdesk added a comment - Hi, Here is what we did: 1. From https://jsapi.apiary.io/apis/fiwareaiakos/reference/aiakos-v1/query-key/get-key.html?console=1 , we entered the keywords (SophiaAntipolis, with sshkey and gpgkey): 2. For which we got an answer (both SSH and GPG keys). We posted it: 3. That done, when queried, from http://aiakos.lab.fiware.org:3000/v1/support/SophiaAntipolis/sshkey , we get "Not Acceptable". Have we, from what you've seen, done something wrong? Regards,
        Hide
        henar Henar Muñoz added a comment -

        To check that your key is uploaded, you can do a GET request:
        http://aiakos.lab.fiware.org:3000/v1/support/

        {yourregion}

        /sshkey
        Tell us if you have any problem.

        Show
        henar Henar Muñoz added a comment - To check that your key is uploaded, you can do a GET request: http://aiakos.lab.fiware.org:3000/v1/support/ {yourregion} /sshkey Tell us if you have any problem.
        Hide
        henar Henar Muñoz added a comment -

        HI
        I think it has not been uploaded. I can see that I cannot obtain the public key with http://aiakos.lab.fiware.org:3000/v1/support/SophiaAntipolis/sshkey
        Please, have you had any problem to upload the keys?
        regards,
        Henar

        Show
        henar Henar Muñoz added a comment - HI I think it has not been uploaded. I can see that I cannot obtain the public key with http://aiakos.lab.fiware.org:3000/v1/support/SophiaAntipolis/sshkey Please, have you had any problem to upload the keys? regards, Henar

          People

          • Assignee:
            Com4Innov Sophia Antipolis Node Helpdesk
            Reporter:
            henar Henar Muñoz
          • Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved: