Currently VES supports 4 authentication methods:

noAuth  --> Works by default. No changes are required.

basicAuth      --> Works with/without https healthcheck endpoint (readiness) defined; DCAE healthcheck pass on either case. VES blueprint needs to be overwritten.
certOnly        --> Works only when https healthcheck endpoint (readiness) is removed from blueprint; DCAE healthcheck also pass (when readiness is not explicitly defined). VES blueprint needs to be overwritten.
certBasicAuth-->Works with/without https healthcheck endpoint (readiness) defined; DCAE healthcheck pass on either case. VES blueprint needs to be overwritten.

For Dublin, there is created separate jira (DCAEGEN2-1593) for documentation updates to include steps for deploying VESCollector with above authentication enabled.

Readiness support on certOnly mode can be dealt vwith healtchecks disabled. Support for healtchecks is planned as future enhancement (DCAEGEN2-1594).

For enabling TLS, as new application port is involved the service should be redeployed (by modifying the parameters in blueprint), esp when changing from noAuth to basicAuth/certOnly/certBasicAuth. The latter 3 types use 8443 while the noAuth uses 8080. Any changes within basicAuth/certOnly/certBasicAuth can be done through consul update as k8s deployment descriptor (which contains the service definition and healthcheck spec) are still validauthentication methods certBasicAuth. It is possible to run as a option noAuth method, hovewer HTTP it is not supported by default.

High level test cases for auth.method = "

...

certBasicAuth"  :

...

Tests were done without adopting healthcecks. Healthchecks and rediness probe was tourn off to have VES Collector running.

TC ID	Test Case Name	Test Case

Description

Execution	Expected Result	Test Status
T01	Client with correct basic auth and correct certificate	curl -vk --cert

rootCA

cert.

crt

pem --key

rootCA

key.

key -

pem -

pass collector -

u sample1:sample1 -X POST https://

192.168.0.22

{xdcae-ves-collector_ip}:30417/eventListener/v7 -d @event.json --header "Content-Type: application/json"

PASS. HTTP/1.1 202

 

	Status colour Green title PASSED
T02	Client with

correct

incorrect basic auth and

incorrect

correct certificate

curl -vk -

u sample1:sample1 -X --cert incorrect_rootCA.crt

-cert cert.pem --key

rootCA.

key

--pass collector POST https://192.168.0.22:30417/eventListener/v7 -d @event.json --header "Content-Type: application/json"PASS. HTTP/1.1 202

Status
colour Green title PASSED

T03Client with correct basic auth and without certificatecurl -vk -u sample1:sample1 -X  POST https://192.168.0.22

.pem -u sample1:sample2 -X POST https://{xdcae-ves-collector_ip}:30417/eventListener/v7 -d @event.json --header "Content-Type: application/json"

PASS. HTTP/1.1 202

Status colour Green title PASSED

T04Client without basic auth and without certificatecurl -vk -X POST https://192.168.0.22:30417/eventListener/v7 -d @event.json --header "Content-Type: application/json"FAIL, HTTP/1.1 401

Status
colour Green title PASSED

T05

T03

Client without basic auth and with correct certificate

curl -vk --cert

rootCA

cert.

crt

pem --key key

rootCA

.

key

pem -

-pass collector -

X POST https://

192.168.0.22

{xdcae-ves-collector_ip}:30417/eventListener/v7 -d @event.json --header "Content-Type: application/json"

FAIL,

PASS. HTTP/1.1

401

202	Status colour Green title PASSED

T06

T04	Client with

incorrect basic auth and with correct certificate

correct basic auth and incorrect certificate

curl -vk --cert

rootCA

incorrect.crt --key rootCA.key --pass collector -u

sample2

sample1:sample1 -X

POS curl -vk --cert rootCA.crt --key rootCA.key --pass collector -u sample1:sample2 -X POS https://192.168.0.22:

POST https://

192.168.0.22:30417/eventListener/v7 -d @event.json --header "Content-Type: application/json"

{xdcae-ves-collector_ip}:30417/eventListener/v7 -d @event.json --header "Content-Type: application/json"

FAIL,

HTTP/1.1 401

Status
colour Green title PASSED

T07Client with incorrect basic auth and without certificatecurl -vk  -u sample2:sample1 -X POS https://192.168.0.22:30417/eventListener/v7 -d @event.json --header "Content-Type: application/json"FAIL , HTTP/1.1 401TC ID

Test Case Name

Test Case Description

Expected Result  Test StatusT01Client with correct basic auth and correct

connection closed because of bad certificate

Status colour Green title PASSED

High level test cases for auth.method = "certOnly"  :