HTTPS/Authentication Mechanism

In NMX-M, security and user authentication are critical components achieved through the use of HTTPS and a Kong Basic Authentication mechanism. HTTPS (Hypertext Transfer Protocol Secure) is employed to protect data transmitted between clients (such as web browsers) and the server by encrypting this data using SSL/TLS protocols. HTTPS ensures that sensitive information, such as login credentials and personal details is safeguarded from interception or tampering by unauthorized parties. When a client connects to a server over HTTPS, the server presents a digital certificate verified by a trusted Certificate Authority (CA). This certificate authenticates the server's identity and establishes a secure connection, ensuring data integrity, confidentiality, and authentication.

In addition to HTTPS, our system utilizes a basic authentication approach with pre-defined users that are set upon installation. This provides a flexible and secure way to authenticate and authorize users interacting with our REST API. To implement this, we use the Kong API gateway as a reverse proxy, configured with Basic Authentication and ACL plugins. This setup allows Kong to authenticate users attempting to access specific resources using the existing user accounts on the system.

By combining HTTPS and a robust authentication mechanism, our system provides a secure and reliable environment for users, protecting their data and ensuring proper access controls.

In NMX-M, there are two users configured for interacting with the API:

• ro-user

• rw-user

The password for each user is set during the NMX-M cluster installation process. Those users are configured in Kong’s basic authentication settings and applied to all routes. The login information is encrypted and kept in a dedicated PostgreSQL DB.

Each user has its own ACL group configuration.

Ready Only ACL Group

This group includes the "ro-user" and grants access to read-only API endpoints. Any NMX API endpoint that uses the GET HTTP method can be accessed here.

Relevant API Endpoints

Ready Write ACL Group

Includes the "rw-user" and allows access to all API endpoints. Any NMX API endpoint, regardless of its HTTP method, can be accessed here.

Relevant API Endpoints

In addition to the above GET endpoints.

Read Only Endpoint

Postman

Authorization settings tab:

1. Select type: Basic Auth

2. Username: rw-user ; Password: <password defined during cluster installation>

Terminal

1. In a terminal window, use "bash plus curl" to execute requests.

2. Run the following curl command, enter values for the various parameters.

   Copy

   Copied!

               
   
               
   curl -X 'GET' \ 
     'https://<ip_address>/nmx/v1/compute-nodes' \ 
     -u ro-user:ro-password  
           

Read Write Endpoint

Postman

Authorization settings tab:

1. Select type: Basic Auth

2. Username: rw-user ; Password: <password defined during cluster installation>

Example Request Body

1. Select Method: PUT

2. Select type: JSON

3. Fill in the request body details as seen below.

Terminal

1. In a terminal window, use "bash plus curl" to execute requests.

2. Run the following curl command, and enter values for the various parameters.

   Copy

   Copied!

               
   
               
   curl -X 'PUT' \ 
     'https://<ip_address>/nmx/v1/compute-nodes/<id>' \ 
     -H 'accept: application/json' \ 
     -H 'Content-Type: application/json' \ 
     -u rw-user:rw-password \ 
     -d '{ 
     "Description": "Some New Description", 
     "Name": "Some New Name" 
   }