Mutual Transport Layer Security (mTLS) authentication from AEM

Transcript

Let’s learn how to make HTTPS calls from Adobe Xfinity Manager to APIs that require mutual transport layer security, or MTLS for short. MTLS authentication mandates both client and server to present digital certificates, extending the security of one-way TLS authentication commonly used for web communication. Let’s first understand the challenge. When calling MTLS-protected APIs via HTTPS, you may encounter an SSL handshake exception. However, using the Apache HTTP client library and AEM’s user-specific key store, you can successfully make these calls. Let’s set up the API demo environment. For demonstration purposes, I have set up a Node.js application with an HTTPS server and a self-signed certificate, which requires MTLS authentication for successful responses. As you can see, I’m passing two additional parameters, request-cert and reject-unauthorize, both set to true. We can test this MTLS API by running the curl command with cert and key options and passing the required certificate file and private key file. For demo purposes, I have also created the client certificates. Review the README file of this Node.js project for further details. Next, let’s configure AEM. First, we need to create an AEM certificate. However, to expedite AEM setup and configuration, I’m using the client certificates provided by the sample Node.js project as an AEM certificate. Please note, these are internal certification authorities signed cert and not issued by a trusted certification authority. Next, I’m creating a user. However, you can add it to an existing user as well. After that, create the key store for this user and set the access password. Finally, import the private key and certificate file and give an alias to this certificate. Don’t forget to review the imported certificate details. Additionally, as we are using internal certification authorities signed certificates, both the API server and AEM upload the internal CS certificate to AEM’s global trust store. Finally, let’s update the AEM servlet code. When a regular AEM servlet calls this MTLS API using the HTTPS protocol, you receive a 500 HTTP response code accompanied by SSL Handshake exception. An informing AEM certificate is required. Next, create a new servlet or modify the existing servlet’s code to utilize the SSLContextBuilder object from the Apache HTTP client library. Then, load AEM’s key store and its password into it. For protection quality, the password should come from OSGI config. The key store is obtained from the demo user created earlier using the out-of-the-box key store service provided by AEM. In our case, we have to load the AEM’s global trust store as demo MTLS API is not using trusted CS cert as mentioned earlier. After deploying the modified code, run the new servlet. You should receive a 200 HTTP response code and the correct API response this time. With these changes, AEM sends its certificate when calling the MTLS protected API. The server validates it just as the AEM validates the server’s certificate. In summary, this mutual authentication enhances security by ensuring that both parties are who they claim to be. To summarize, we learned how to call MTLS APIs from AEM by leveraging digital certificates, AEM’s user specific key store and the Apache HTTP client library. We overcame SSL handshake exception, achieving mutual authentication and enhanced security in our API interactions. Thank you. Let’s keep learning.