stefbehl on master
improved debug logs for autoass… (compare)
bogdan-bondar on master
Extend event for entity events … (compare)
Hi all! I have integrated the keycloak with hawkbit after successful validation it redirect to hawkbit I am not able to assign distrubution to target.But through target filter it is assigning to ds.And I have assigned all client level roles to the user
I have given all client roles to the user like
APPROVE_ROLLOUT
CREATE_ROLLOUT
DELETE_ROLLOUT
UPDATE_ROLLOUT
READ_ROLLOUT
HANDLE_ROLLOUT
ROLLOUT_MANAGEMENT
CREATE_TARGET
DELETE_TARGET
READ_TARGET
UPDATE_TARGET
CREATE_REPOSITORY
DELETE_REPOSITORY
READ_REPOSITORY
UPDATE_REPOSITORY
TENANT_CONFIGURATION
DOWNLOAD_REPOSITORY_ARTIFACT
READ_TARGET_SECURITY_TOKEN
I am getting error like this in terminal
I have decoded Access token it is getting client roles also Whatever I have assigned
Hey @kevlhop
yes this is possible with the new invalidation of distribution sets feature. Extract from the documentation:
Invalidating a distribution set removes all auto-assignments that reference this distribution set. Optionally, all rollouts that reference the distribution set can be stopped and existing update actions are removed, either by a soft-cancel or a forced-cancel.
Invalidated distribution sets cannot be valid again, but remain invalid. They cannot be assigned to targets, neither through a rollout, auto-assignment nor a single assignment.
Hi,
I am facing issue in swupdate after enable SSL/TLS security option in hawkbit server.
To enable SSL, these steps I have done inside hawkbit server source
Generate the self-signed x509 certificate suitable to use on web server.
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
Generate pem file from generated server.key and server.crt
cat server.key > server.pem
cat server.crt >> server.pem
Generate .pkcs12 file
openssl pkcs12 -export -in server.pem -out keystore.pkcs12
Following command imports a .p12 into pkcs12 Java keystore
keytool -importkeystore -srckeystore keystore.pkcs12 -srcstoretype pkcs12 \
-destkeystore hb-pass.jks -deststoretype pkcs12 \
-alias 1 -deststorepass <password_of_p12>
Edit the hawkbit application.properties file
vi application.properties
Change authentication security from false to true.
hawkbit.server.ddi.security.authentication.anonymous.enabled=true
Enter the https details at last
server.hostname=localhost
server.port=8443
hawkbit.artifact.url.protocols.download-http.protocol=https
hawkbit.artifact.url.protocols.download-http.port=8443
security.require-ssl=true
server.use-forward-headers=true
server.ssl.key-store= <hb-pass.jks file location>
server.ssl.key-store-type=JKS
server.ssl.key-password= <password_of_key>
server.ssl.key-store-password= <password_of_key_store>
server.ssl.protocol=TLS
server.ssl.enabled-protocols=TLSv1.2
server.ssl.ciphers=TLS_RSA_WITH_AES_256_CBC_SHA256,
TLS_RSA_WITH_AES_256_CBC_SHA
after that I copied server.pem on target
and add the path in swupdate.cfg
suricatta :
{
tenant = "default";
id = "orion";
confirm = 0;
url = "https://swupdateurl:8443";
polldelay = 360;
nocheckcert = false;
retry = 4;
retrywait = 200;
loglevel = 10;
userid = 0;
groupid = 0;
max_artifacts = 1;
cafile = "/home/root/server.pem";
/
cafile = "/etc/ssl/cafile";
sslkey = "/etc/ssl/sslkey";
sslcert = "/etc/ssl/sslcert";
/
};
and the error logs :
Connected to 192.168.0.10 (192.168.0.10) port 8443 (#1)
I am facing issue in swupdate after enable SSL/TLS security option in hawkbit server.
To enable SSL, these steps I have done inside hawkbit server source
Generate the self-signed x509 certificate suitable to use on web server.
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
Generate pem file from generated server.key and server.crt
cat server.key > server.pem
cat server.crt >> server.pem
Generate .pkcs12 file
openssl pkcs12 -export -in server.pem -out keystore.pkcs12
Following command imports a .p12 into pkcs12 Java keystore
keytool -importkeystore -srckeystore keystore.pkcs12 -srcstoretype pkcs12 \
-destkeystore hb-pass.jks -deststoretype pkcs12 \
-alias 1 -deststorepass <password_of_p12>
Edit the hawkbit application.properties file
vi application.properties
Change authentication security from false to true.
hawkbit.server.ddi.security.authentication.anonymous.enabled=true
Enter the https details at last
server.hostname=localhost
server.port=8443
hawkbit.artifact.url.protocols.download-http.protocol=https
hawkbit.artifact.url.protocols.download-http.port=8443
security.require-ssl=true
server.use-forward-headers=true
server.ssl.key-store= <hb-pass.jks file location>
server.ssl.key-store-type=JKS
server.ssl.key-password= <password_of_key>
server.ssl.key-store-password= <password_of_key_store>
server.ssl.protocol=TLS
server.ssl.enabled-protocols=TLSv1.2
server.ssl.ciphers=TLS_RSA_WITH_AES_256_CBC_SHA256,
TLS_RSA_WITH_AES_256_CBC_SHA
after that I copied server.pem on target
and add the path in swupdate.cfg
suricatta :
{
tenant = "default";
id = "orion";
confirm = 0;
url = "https://swupdateurl:8443";
polldelay = 360;
nocheckcert = false;
retry = 4;
retrywait = 200;
loglevel = 10;
userid = 0;
groupid = 0;
max_artifacts = 1;
cafile = "/home/root/server.pem";
/
cafile = "/etc/ssl/cafile";
sslkey = "/etc/ssl/sslkey";
sslcert = "/etc/ssl/sslcert"; /
};
and the error logs :
Connected to 192.168.0.10 (192.168.0.10) port 8443 (#1)
found 1 certificates in /home/root/server.pem
ALPN, offering http/1.1
SSL connection using TLS1.2 / RSA_AES_256_CBC_SHA1
server certificate verification failed. CAfile: /home/root/server.pem CRLfile: none
Closing connection 1
[ERROR] : SWUPDATE failed [0] ERROR /home/hmecd001520/orion-yocto-bsp/build/tmp/work/orion-poky-linux/swupdate/2021.04-r0/git/corelib/channel_curl.c : channel_get : '
[DEBUG] : SWUPDATE running : [start_suricatta] : No pending action to process.
[DEBUG] : SWUPDATE running : [suricattawait] : Sleeping for 360 seconds.
Hello everyone! I want to expose some hawkBit statistics via a custom InfoContributor (https://docs.spring.io/spring-boot/docs/1.5.2.RELEASE/reference/html/production-ready-endpoints.html#production-ready-application-info-custom). This endpoint is exposed on /info
. So far, I can successfully access the endpoint and even contribute some test data to this endpoint.
I am facing an issue when contributing data from TargetManagement
. When I inject TargetManagement
via my custom InfoContributor endpoint's constructor and invoke a method, e.g., targetManagement.count()
, the source code builds but throws an internal server error when I access the /info
endpoint. The error logs shows org.springframework.web.util.NestedServletException: Request processing failed; nested exception is org.springframework.security.authentication.AuthenticationCredentialsNotFoundException: An Authentication object was not found in the SecurityContext.
I tried removing the @PreAuthorize
annotation for the count()
method, but this does not change things. Any ideas what I might be doing wrong?
SecurityManagedConfiguration
) that is required for @PreAuthorize
to be used. The error that you get means exactly what it mentions: while accessing the /info
endpoint you don’t authenticate yourself, thus there is nothing available to check against in the security context.
Hi All,
I am trying to integrate SWUpdate to Hawkbit with Yocto as build system.
Can someone please let me know how to include some kind of script to set the necessary arguments needed, using the machine ID to uniquely identifiy a client, and passing the "-c" option to indicate the current update state based on the value of the "ustate" boot variable, so that after an update and reboot, a success or failure message would be sent to the hawkBit server.
Any example or reference link to accomplish this would be really helpful.
P.S: This is my first time involving with SWUpdate and hawkBit. And I am using STM32MP based Avenger96 board with u-boot bootloader.
Thanks in advance.
Hello all, I want to add a new column last_update
to sp_target
. This column records the timestamp of the last instance of an attribute update. I managed to change the schema and add this column. I also had to change the migration schema (e.g., V1_11_0__init__MYSQL.sql
) to include this column (otherwise, I get an error when loading the Management UI that this column name is not found). I can get hawkBit to work with an empty database.
When I run this hawkBit instance with an existing MySQL database, I get a org.flywaydb.core.api.FlywayException: Validate failed: Migration checksum mismatch for migration version 1.0.1
. Reading up on Flyway, I understand that this is because the tables in schema_version
database of my MySQL schema have different checksums than what I currently have in the hawkBit instance. Existing solutions on the web, e.g., dropping schema_version
does not seem right. How do I proceed? I also get the sense that there is no way to use an existing database with a modified database schema—is this true? Thanks!
@bogdan-bondar and here it is my property file for reference: org.eclipse.hawkbit.repository.s3.bucketName=hawkbit-dev-storage
org.eclipse.hawkbit.artifact.repository.s3.enabled=true
aws.region=us-east-1
#AWS_REGION
spring.jpa.database=MYSQL
spring.datasource.url=jdbc:mysql://mysql/hawkbit
spring.datasource.username=xxxxxxxxxxxxxxx
spring.datasource.password=XXXXXXXXXXXXXXXX
spring.datasource.driverClassName=com.mysql.jdbc.Driver
spring.security.user.name=admin
spring.security.user.password={noop}abc123!
spring.main.allow-bean-definition-overriding=true
server.servlet.encoding.charset=UTF-8
server.servlet.encoding.enabled=true
server.servlet.encoding.force=true
hawkbit.server.ddi.security.authentication.anonymous.enabled=true
hawkbit.server.ddi.security.authentication.targettoken.enabled=false
hawkbit.server.ddi.security.authentication.gatewaytoken.enabled=false
hawkbit.server.repository.publish-target-poll-event=true
server.hostname=$HOSTNAME
hawkbit.server.ddi.security.authentication.anonymous.enabled=true
server.port=8443
hawkbit.artifact.url.protocols.download-http.protocol=https
hawkbit.artifact.url.protocols.download-http.port=8443
hawkbit.server.security.require-ssl=true
security.require-ssl=true
server.use-forward-headers=true
server.ssl.key-store=/home/hb-pass.jks
server.ssl.key-store-type=JKS
server.ssl.key-password=XXXXXX
server.ssl.key-store-password=XXXXXX
server.ssl.protocol=TLS
server.ssl.enabled-protocols=TLSv1.2
server.ssl.ciphers=TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA
spring.rabbitmq.username=guest
spring.rabbitmq.password=guest
spring.rabbitmq.virtual-host=/
spring.rabbitmq.host=localhost
spring.rabbitmq.port=5672
spring.servlet.multipart.max-file-size=3073741824
spring.servlet.multipart.max-request-size=3073741824
hawkbit.server.security.dos.maxArtifactSize=3073741824
db: hawkbit
Command: Query
Time: 0
State: executing
Info: SELECT DISTINCT t1.id AS a1, t1.tenant AS a2, t1.address AS a3, t1.controller_id AS a4, t1.created_at AS a5, t1.created_by AS a6, t1.description AS a7, t1.install_date AS a8, t1.last_modified_at AS a9, t1.last_modified_by AS a10, t1.last_target_query AS a11, t1.name AS a12, t1.optlock_revision AS a13, t1.request_controller_attributes AS a14, t1.sec_token AS a15, t1.update_status AS a16, t1.assigned_distribution_set AS a17, t1.installed_distribution_set AS a18, t1.target_type AS a19 FROM sp_target t1 LEFT OUTER JOIN sp_action t0 ON ((t0.target = t1.id) AND (t0.distribution_set = 44)) WHERE (((UPPER(t1.controller_id) LIKE 'BN-%' ESCAPE '\' AND (t1.created_at > 1642395600000)) AND (t0.id IS NULL)) AND (t1.tenant = 'DEFAULT')) LIMIT 0, 999