zowe / zowe/api-layer

Improve client AT-TLS handling

Open
#3,940 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement Priority: High size/M
Dominant language
Java
Stars
92
Forks
81
Avg merge
1d 9h
Merged PRs (30d)
46

Description

Is your feature request related to a problem? Please describe.
In AT-TLS scenarios:

  • If using ICSF hardware-stored key:
    All routes starting from GW will need AT-TLS outbound enabled (controlled via client.attls setting)

Currently, these requests depend on whether https is enabled in the service data in eureka.

In container scenarios, we want to avoid sending plain text to a service even if AT-TLS inbound is enabled on it (i.e. ZSS)

Another thing the API ML services don't handle properly currently is that we only verify the global setting, while the setting can also be set on a component level in zowe.yaml.

Describe the solution you'd like

  • Gateway could rely on the client.attls setting to determine if the internal communication should go through HTTP (client.attls enabled) or https (client.attls disabled)
  • In container scenarios this parameter should be disabled by default.
  • There could be logic to determine when to override the expected protocol in the service (registration data vs client.attls enabled or disabled)

Describe alternatives you've considered
Services simply switching the secure or normal port in the eureka registration may be insecure.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the Gateway handling of the client.attls setting and the component-level settings in zowe.yaml. Trace how Eureka service registration currently determines HTTP versus HTTPS, including container scenarios and API ML services. Done means internal requests consistently use the intended protocol without relying solely on service registration data.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.