Page Comparison

...

http://aaf-onap-beijing-test.osaaf.org/-

Credentials

AAF does support User/Password, and allows additional plugins as it did in Amsterdam, however, User/Password credentials are inferior to PKI technology, and does not match the ONAP Design goal of TLS and PKI Identity across the board.  Therefore, while an individual organization might avail themselves of the User/Password facilities within AAF, for ONAP, we are avoiding.

THEREFORE: GO WITH CERTIFICATE IDENTITY

Certificates

Root Certificate

Anchor
RootCertificate RootCertificate

...

# 0 - unique ID - Let's go with this naming convention:  a[0-9]{4}[a-z,0-9], meaning the letter "a", followed by 4 digits and a final letter or digit. 
# 1 - full name of the App
# 2 - App Acronym
# 3 - App Description, or just "Application"
# 5 - official email - a Distribution list for the Application, or the Email of the Owner
# 6 - type - application
# 7 - reports to: give the Application Owner's Unique ID.  Note, this should also be the Owner in AAF Namespace

Obtaining a Certificate

There are 3 types of Certificates available for AAF and ONAP community through AAF.  People, App Client-only, and App Service (can be used for both Client and Service)

Process (This process may fluctuate, or move to iTrack, so revisit this page for each certificate you request)

1. 1. 1. 1. Email the AAF Team (jonathan.gathman@att.com, for now)
         2. Put "REQUEST ONAP CERTIFICATE" in the Subject Line
         3. If you have NOT established an Identity, see above, put the Identity information in first
         4. Then declare which of the three kinds of Certificates you want.
            1. People and App Client-only certificates will be Manual
               1. You will receive a reply email with instructions on creating and signing a CSR, with a specific Subject.
               2. Reply back with the CSR attached. DO NOT CHANGE the Subject.  
                  1. Subject is NOT NEGOTIABLE. If it does not match the original Email, you will be rejected, and will waste everyone's time.
               3. You will receive back the certificate itself, and some openssl instructions to build a .p12 file (or maybe a ready-to-run Shell Script)
            2. App Service Certificate is supported by AAF's Certman
               1. However, this requires the establishment of Deployer Identities, as no Certificate is deployed without Authorization.
               2. Therefore, for now, follow the "Manual" method, described in 4.a, but include the Machine to be the "cn="

People

People Certificates can be used for browsers, curl, etc.

Automation and tracking of People Certificates will be proposed for Casablanca.

In the meantime, for testing purposes, you may request a certificate from AAF team, see process.

Application Client-only

Application Client-only certificates are not tied to a specific machine.  They function just like people, only it is expected that they are used within "keystores" as identity when talking to AAF enabled components.

Automation and tracking of Application Certificates will be proposed for Casablanca. 

In the meantime, for testing purposes, you may request a certificate from AAF team, see process.

GUI

https://aaf-onap-beijing-test.osaaf.org

...