The following example shows a basic configuration for the Container file.

A user may configure different values for different Repose clusters. This is achieved by including one or more cluster-config elements which map to clusters in the system-model. All configuration within a cluster-config element is optional. When configuration is present, it will override the base configuration (i.e., the deployment-config element) values. This functionality may be referred to as "container configuration patching" or simply as "patching".

When discussing patches, one might notice that there is ambiguity in the rules for how patches are applied. Below is a list of common ambiguities, and how they are handled in this context:

The following assume:

The interaction between the deprecated via attribute and the new via-header element are as follows:

The following further assumes the deprecated via attribute is not defined and the via-header element contains:

There are two steps to supply a logging configuration for Repose:

If a user-supplied logging configuration file is not found, Repose programmatically sets default log4j properties. This default properties add a ConsoleAppender to the ROOT logger. The output will be formatted using a PatternLayout set to the pattern %d %-4r [%t] %-5p %c - %m%n. The default log level is set to DEBUG.

SSL/TLS Client Authentication is being used more and more for communications between different enclaves. This addition to the SSL/TLS handshake involves the Client presenting credentials to the Server in the same manner as the Server does to the Client. If the credentials presented by the Client are not trusted, then the Server will sever the connection just as the Client would have if the situation was reversed. Since a Client initiates contact with the Server, the Server’s credentials are simply to validate it is who the Client was trying to contact. This is accomplished through Certificate Authorities (CA) and the Trust Hierarchies built into the Public Key Infrastructure (PKI). Even though you can optionally add a particular Server’s credentials directly into a Client so that it will implicitly trust a particular Server essentially bypassing the distributed trust mechanism in favor of a more direct one, this is the only way to build a relationship for a Client to a Server.

To require SSL/TLS Client Authentication, set the need-client-auth attribute to True. With this setting enabled, only Clients that have a Public Key imported into the trust store referenced by the truststore-filename element will be allowed to connect. The truststore is a Java Keystore that can be created/updated using the command line tool named aptly enough, keytool. Below is an example of importing a Client certificate (client.crt) into a truststore (truststore.jks):

To use the truststore created/updated in the example above, the following would need to be added/updated in the container.cfg.xml file:

For more details, see:

Repose Valve is based on Jetty and uses its services for SSL/TLS termination. To enable this feature you need to:

Keystore information is located within the <ssl-configuration> element as shown in the following example.

Repose supports whitelisting and blacklisting specific protocols and ciphers by exposing portions of the Jetty configuration via the container.cfg.xml file. You can use this feature if a specific protocol or cipher has been compromised and you want to block its usage and harden your Repose instance. Any of Jetty’s built-in defaults are cleared and then the configured inclusion and exclusion lists are applied if any are defined.

In the following example, the container configuration includes the TLS v1.2 protocol and TLS ciphers and excludes then SSLv3 protocol and SSL ciphers.

Certain attacks (such as Logjam) leverage the weakness of "small" Diffie-Hellman (DH) keys. To mitigate the risk of such attackers, users may either exclude vulnerable ciphers, or lengthen the DH keys used by Repose. Instructions for the former are above. For the latter, note the following:

In other words, the Java option -Djdk.tls.ephemeralDHKeySize=2048 can be passed when starting Repose to force the use of longer DH keys.

For more details, see Customizing DH Keys.

For more information about cipher suites and which ones to dis/allow when setting up Repose, see the following references:

The list of available ciphers and protocols varies depending on the JVM. We have added a command line option to Repose Valve to display the available and default enabled ciphers and protocols:

This will dump a list of the default enabled SSL/TLS parameters for the JVM you’re using. Additionally, it will list all available ciphers and protocols, should you wish to use one of those.

When running in insecure mode, Repose will accept all certificates from external services with which it communicates (e.g., authentication service, origin service).