Hi, I am currently trying to correct our communication setup between two components who use A12 UAA.
Service One receives requests from Frontend and is as far as I can tell configured correctly to receive, handle and answer said requests.
Service Two receives requests from service One, uses A12 Camunda and answers accordingly.
Configuration of service Two:
mgmtp:
a12:
uaa:
authentication:
types: LOCAL
context-path: /engine-rest
cors:
allowedOrigins: "*"
user:
access-rights-resource: classpath:accessRights.yaml
additional-properties:
- someIdentifier
local-config:
user-resources: [ ]
jwt:
secret: .... ;)
store-user-in-token:
enabled: true
compress-user:
enabled: true
user-lifetime-seconds: 86400
client:
rest:
uaa-base:
url: http://serviceOne/path/mgm
authentication-type: CERTIFICATE
certificate-resource: classpath:certificate/client.crt
delegated-mode-configuration:
excluded-contexts: /camunda/**
dataservices:
client:
configuration:
base-url: http://serviceOne/path/mgm
As fas I understand: we secure incoming Requests by using the LOCAL Authentication and outgoing requests by using CERTIFICATE.
Now, we want to omit the incoming login behaviour entirely, because there is only service One who talks to service Two. I currently don’t know why we need the outgoing certificate authenticated communication, but I’ll check.
I am not able to configure “nothing” for incoming requests, I have to set an AuthenticationType, otherwise LOCAL will be used. ANONYMOUS doesn’t work when the incoming request uses the old Authentication method (which I think comes from service One DELEGATED client behaviour - see below)
Configuration of service One:
mgmtp:
a12:
uaa:
authentication:
types: LOCAL,CERTIFICATE
context-path: /serviceOne/mgm
certificate-authority-resources: classpath:certificate/rootCA.crt
cors:
allowed-origins: "*"
user:
access-rights-resource: classpath:accessRights.yaml
additional-properties:
- someIdentifier
local-config:
user-resources: [ ]
backend:
enabled: true
grant-super-user-privileges:
enabled: true
jwt:
secret: ...
store-user-in-token:
enabled: true
compress-user:
enabled: true
user-lifetime-seconds: 86400
client:
rest:
authentication-type: DELEGATED
delegated-mode-configuration:
excluded-contexts: ${mgmtp.a12.uaa.authentication.context-path}/uaa-authentication/**,/serviceOne/,/serviceOne/custom/**,/internal/**,/ops/**
authorization:
authorizationDefinition: classpath:/uaa/authorizationDefinition.json
child-authorization-definitions: classpath:/uaa/workflowsAuthorizationDefinition.json,classpath:uaa/authorizationDefinitionServiceOne.json
workflows:
camunda:
client:
base-url: http://teilnehmer-camunda/engine-rest
Is it possible to remove the LOCAL configuration in some way with keeping the CERTIFICATE communication in service Two?