Currently VES supports 4 2 authentication methods:

noAuth  --> Works by default. No changes are required.

basicAuth      --> Works with/without https healthcheck endpoint (readiness) defined; DCAE healthcheck pass on either case. VES blueprint needs to be overwritten.
certOnly        --> Works only when https healthcheck endpoint (readiness) is removed from blueprint; DCAE healthcheck also pass (when readiness is not explicitly defined). VES blueprint needs to be overwritten.
certBasicAuth-->Works with/without https healthcheck endpoint (readiness) defined; DCAE healthcheck pass on either case. VES blueprint needs to be overwritten.

For Dublin, there is created separate jira (DCAEGEN2-1593) for documentation updates to include steps for deploying VESCollector with above authentication enabled.

Readiness support on certOnly mode can be dealt vwith healtchecks disabled. Support for healtchecks is planned as future enhancement (DCAEGEN2-1594).

For enabling TLS, as new application port is involved the service should be redeployed (by modifying the parameters in blueprint), esp when changing from noAuth to basicAuth/certOnly/certBasicAuth. The latter 3 types use 8443 while the noAuth uses 8080. Any changes within basicAuth/certOnly/certBasicAuth can be done through consul update as k8s deployment descriptor (which contains the service definition and healthcheck spec) are still validcertBasicAuth→ Default setting.

noAuth  --> Option, can be changed in Consul.

High level test cases for auth.method = "

...

certBasicAuth"  :

...

When application is setup for TLS and auth.method = "basicAuth", healthcheck endpoint must be using 8443 (change submitted to override and support 8080 for healthcheck is not required nor valid) must be send via HTTPS and has basicAuth user/pass in header.

...

TC ID	Test Case Name	Test Case Description	Expected Result	Test Status
T01	Client with correct basic auth and correct certificate	curl -vk --cert rootCA.crt --key rootCA.key --pass collector -u sample1:sample1 -X POST https://192.168.0.22:30417/eventListener/v7 -d @event.json --header "Content-Type: application/json"	PASS. HTTP/1.1 202	Status colour Green title PASSED
T02	Client with

correct basic auth and incorrect certificatecurl -vk -u sample1:sample1 -X --cert

incorrect

_rootCA.crt --key rootCA.key --pass collector POST https://192.168.0.22:30417/eventListener/v7 -d @event.json --header "Content-Type: application/json"PASS. HTTP/1.1 202

Status
colour Green title PASSED

T03Client with correct basic auth and without certificatecurl -vk -u sample1:sample1 -X  POST https://192.168.0.22:30417/eventListener/v7 -d @event.json --header "Content-Type: application/json"PASS. HTTP/1.1 202

Status
colour Green title PASSED

T04Client without basic auth and without certificatecurl -vk -X POST https://192.168.0.22:30417/eventListener/v7 -d @event.json --header "Content-Type: application/json"FAIL, HTTP/1.1 401

Status
colour Green title PASSED

T05Client without

basic

auth and with correct certificatecurl -vk --cert rootCA.crt --key rootCA.key --pass collector -X POST https://192.168.0.22:30417/eventListener/v7 -d @event.json --header "Content-Type: application/json"FAIL, HTTP/1.1 401

Status
colour Green title PASSED

T06Client with incorrect basic

auth and

with correct certificate

curl -vk --cert rootCA.crt --key rootCA.key --pass collector -u sample2:sample1 -X POS https://192.168.0.22:30417/eventListener/v7 -d @event.json --header "Content-Type: application/json"

curl -vk --cert rootCA.crt --key rootCA.key --pass collector -u sample1:sample2 -X POS https://192.168.0.22:30417/eventListener/v7 -d @event.json --header "Content-Type: application/json"

FAIL, HTTP/1.1 401

Status
colour Green title PASSED

T07Client with incorrect basic auth and without certificatecurl -vk  -u sample2:sample1 -X POS https://192.168.0.22:30417/eventListener/v7 -d @event.json --header "Content-Type: application/json"FAIL , HTTP/1.1 401

Status
colour Green title PASSED

High level test cases for auth.method = "certOnly"  :

High level test cases for auth.method = "certBasicAuth"  :

...

High level test cases for auth.method = "noAuth"  :