Using a secure Validate Server connection

You can set up Validate tools to use a secure HTTP connection (https). This means all Validate client tools that connect to the Validate Server will connect using SSL.

Perform the following steps to set up SSL:

  • Set up the Validate Server.
  • Set up all Validate client tools that connect to the Validate Server.

  • When setting up a secure connection for SAML or OIDC authentication, you need to add the certificate to either your Validate JVM or your machine's trusted keystore. See Enabling SSL for SAML or OIDC authentication for more information.

You can use kwauthconfig to generate an unsigned certificate, or you can generate your own signed certificate. Both scenarios are explained below.

Configure the Validate Server to use SSL - Unsigned certificate

This section shows you how to generate an unsigned SSL certificate by using kwauthconfig. See the next section if you want to generate your own signed certificate.

You can configure SSL as part of setting up access control. You can also configure SSL later.

If you haven't already set up access control:

  • Go to Setting up access control and be sure to select the Use secure Validate Server connection check box when you select the access control method. The text fields are explained below.

If you've already set up access control:

  1. The way to launch the Validate security utility, kwauthconfig, is different depending on your platform:
    • Windows: Click Start > All Programs > Validate 24.3 > Klocwork Security Configuration.
    • Other: From <server_install>/bin, run kwauthconfig.
  2. Click Configure.
  3. Select the Use secure Klocwork Server connection check box.
  4. Fill in the text fields as described below.
  5. Click Finish.
  6. Restart the Validate Server by using the command validate service restart, or by using Windows Services Administration.

Text fields for setting up SSL with kwauthconfig

  • Host name is the fully qualified host name of the Validate Server, for example, testserver.mydomain.com.
  • Organizational unit is the organizational unit this certificate will apply to, for example, development.
  • Organization is the name of your organization, for example, Validate.

Configure the Validate Server to use SSL - Signed certificate

When you set up the Validate Server to use a secure connection by using kwauthconfig as shown above, the generated certificate is unsigned. If you want to use your own signed certificate, create a self-signed keystore file, then run the kwauthconfig utility to detect the settings.

The following procedure provides basic instructions for creating a self-signed keystore using the Java Development Kit tool "keytool", which you can find at <Server_install>/_jvm/bin. However, we strongly recommend that you read the following for more information:

Please refer to the documentation specific to your version.

For example, you may want to use the -validity flag to change the default certificate validity period.

Create a self-signed keystore file

From <Server_install>, run the following command:

_jvm/bin/keytool -genkeypair -alias tomcat -keyalg RSA -keystore <projects_root>/tomcat/conf/.keystore 
-dname "cn=<ValidateServer_hostname>, ou=<your_organizational_unit>,o=<your_organization>" 
-keypass changeit -storepass changeit

where

  • cn is the fully qualified Validate Server hostname.
  • ou and o should be substituted with an appropriate organizational unit and organization name.
  • The values for keypass and storepass are the Tomcat default values.

The keystore is saved into the Tomcat config directory at <projects_root>/tomcat/conf.

Example command line:

_jvm/bin/keytool -genkeypair -alias tomcat -keyalg RSA -keystore <projects_root>/tomcat/conf/.keystore 
-dname "cn=testserver.klocwork.com, ou=Development, o=Validate" -keypass changeit -storepass changeit

This command generates a keystore file named .keystore.

Configure the Validate Server to use SSL (using kwauthconfig)

  1. Launch the Validate security utility, kwauthconfig.
  2. Specify the location of your projects_root directory.
  3. Click Configure....
  4. Select the Use secure Klocwork Server connection check box. Verify that the settings are correct and click Finish. (These settings are entered during keystore creation above.)
  5. Restart the Validate Server by using the command validate service --projects-root <projects_root> restart klocwork or by using Windows Services Administration.

After completing these steps, continue to the section Configure Validate client tools to use SSL.

Configure the Validate Server to use SSL (manually)

If you need to manually configure/enable SSL on the Validate Server (for example, if you are running Validate on servers and only have shell access), the steps are as follows:

Prerequisite: Your .keystore file must have been previously created and saved at <projects_root>/tomcat/conf

  1. Open the following file in a text editor:
    <projects_root>/config/admin.conf
  2. Find the setting klocwork.protocol=http and change the value to https.
  3. Open the following file in a text editor:
    <projects_root>/tomcat/conf/server.template
  4. Find the XML element <Connector>. Below is an example of what it may look like:
         <Connector port="$PORT"
     maxthreads="4-" minSpareThreads="20" maxSpareThreads="40"
     enableLooksups="false" redirectPort="8443" acceptCount="50"
     debug="0" connectionTimeout="20000"
     compression="on"
     compressionMinSize="2048"
     noCompressionUserAgents=".*MSIE.*,gozilla,traviata"
     compressableMimeType="text.htm,text/xml"
     maxPostSize="0"
     />
  5. Add SSL attributes to the Connector element:
    SSLEnabled="true" scheme="https" secure="true"

  6. Also add the following SSLHostConfig element to the Connector:

    <SSLHostConfig sslProtocol="TLS">
<Certificate certificateKeystoreFile="conf/.keystore" type="RSA" />
</SSLHostConfig>
  7. Restart the Validate Server with the command validate service --projects-root <projects_root> restart klocwork (or with Windows Services Administration).

After completing these steps, continue to the section Configure Validate client tools to use SSL.

Configure Validate client tools to use SSL

This section provides information on setting up a secure Validate Server connection after installation. You can set up SSL during installation as well, with

  • the Use secure server connection (HTTPS) check box in the Windows User installer
  • the "USE_SSL" property for unattended Windows installation
  • the --use-ssl option for the UnixServer installer and User installer

Client certificates support

You can configure the Validate tools to work with client certificates to support Public-key infrastructure (PKI) and smart cards. Client certificates are also supported for use with the Validate Web API.

Prerequisites:

  • You must be running your client installation on Windows.

To enable this:

  1. In Windows, click Start > All Programs > Validate 2024.3 > Klocwork Security Configuration, or from the command line on any platform, run the following command:
    kwauthconfig [<projects_root>]
  2. Click Configure...
  3. Select the Use secure Klocwork Server connection check box and fill in the fields if you have not already done so.
  4. Select the Enable smart card client authentication check box.
  5. Click Browse... and point to the location of your trusted client certificates keystore.
  6. Enter your keystore password.
  7. Click Finish and then OK to finalize your changes.

Your trusted client certificates keystore should be created by your administrator and contain the certificates for all users with access to the Validate tools.

When accessing the Validate portal login page in your browser, Chrome and Internet Explorer will ask you to select your client certificate the first time the page is accessed. After the initial time, your browser will remember your choice automatically.

Firefox uses a separate keystore, so it requires some manual configuration:

  1. Go to Options > Advanced > Encryption.
  2. Click View Certificates.
  3. Click the Your Certificates tab and click Import....
  4. Locate your client certificate and click Open.

When you open Firefox for the first time after completing these steps, it may ask you to verify the certificate. After this, you will be able to access the Validate portal login page without any prompts.

Command-line tools that connect to Validate Server

Specify the --url option, which also allows you to specify the host and port of the Validate Server plus the name of the integration project for some commands. Specify https in the URL instead of http.

kwadmin --url https://myserver:8080/
If you still use the older --host and --port options, you can use the --ssl option instead of the --url option.
kwadmin --ssl --host myserver --port 8080

GUI-based client tools

For the IDE plug-ins and Klocwork Desktop enable the "Use secure connection" option when connecting to the Validate Server.

Browser-based client tools

For Validate, Klocwork Code Review and Validate Documentation, specify https instead of http in the URL. Note that users may be prompted to download a file if they use http.

Example for Validate:

https://myserver.mydomain.com:8080/

Certificate warning issued by browser-based client tools

When connecting to the Klocwork browser-based tools after SSL has been configured on the Validate Server, users will see a warning, such as:

  • "Secure Connection Failed" in Firefox
  • "Certificate Error: Navigation Blocked" in Internet Explorer

Users can add an exception for the Validate Server, so that they do not see this message in future. Consult your browser help for more information.

Configure redirection from HTTP to HTTPS

Once you have migrated your servers from HTTP to HTTPS, you can use Tomcat to configure all your bookmarks and links in various portals, emails, and document systems to be redirected to the new HTTPS scheme and a new secure port.

The original bookmarked URLs will have the form of http://<hostname>:<port>, for instance, http://localhost:8080. Since we have configured HTTPS to port 8080, the redirects will not work. The steps to fix the redirects are:

  • change the Validate server port for HTTPS to something other than 8080, for instance, 8443

  • add an insecure connector to redirect from

  • add a redirect from HTTP/8080 to HTTPS/8443

Change the HTTPS server port

  1. Stop the project and set a different HTTPS port:

    validate service -r projects_root stop
validate service -r projects_root set-service-property klocwork port 8443
  2. Edit <projects_root>/tomcat/conf/server.template and remove the redirectPort attribute from the Connector definition.

  3. Restart the project:

    validate service -r projects_root start

  4. Open https://localhost:8443 and log into the portal to verify that the secure site is working. Optionally, check that http://localhost:8080 is no longer accessible.

Add an insecure connector to redirect from

Configure Tomcat to respond to requests on HTTP/8080 by adding a connector for it. We'll use the new HTTPS connector as a template and modify it to be non-SSL.

  1. Stop the project:

    validate service -r projects_root stop

  2. Edit <projects_root>/tomcat/conf/server.template:

    • Copy the secure Connector definition and paste it above the secure Connector definition. Do not modify the original secure definition.

    • In the copy of the Connector definition:

      • Change the port setting to the old port number you wrote down above (8080)

      • Add or set the following attributes:
        SSLEnabled="false", scheme="http" and secure="false"

      • Delete these attributes:
        clientAuth="false", sslProtocol="TLS", keystoreFile="conf/mycertificate.cert", keystorePass="password"

      • Add the redirectPort attribute configured as your new HTTPS port:

        redirectPort="8443"

At this point no redirect will happen. You will be able to access both HTTP (on http://localhost:8080) and HTTPS (on https://localhost:8443) and each will function properly.

Add the redirect

The final step is to tell Tomcat to redirect insecure connections using the above connectors.

  1. Stop the project:

    validate service -r projects_root stop

  2. Edit <Validate install>/3rdparty/tomcat/conf/web.xml:

    Do not edit projects_root/tomcat/conf/web.xml as it will be overwritten when the Validate server is started. No redirects will happen and you will still be able to access HTTP and HTTPS sites independently.

    Add the following XML just before the closing web-app tag:

    Copy 
    <!-- Enable redirect from HTTP to HTTPS -->
    <security-constraint>
        <web-resource-collection>
            <web-resource-name>Entire Application</web-resource-name>
            <url-pattern>/*</url-pattern>
        </web-resource-collection>
        <user-data-constraint>
            <transport-guarantee>CONFIDENTIAL</transport-guarantee>
        </user-data-constraint>
    </security-constraint>

When you open your old HTTP URLs in your browser, they will redirect to the new HTTPS ones. For example, entering http://localhost:8080/review/insight-review.html will redirect to https://localhost:8443/review/insight-review.html.

The following is a sample server.template file configured for redirect:

Copy 
<?xml version="1.0" encoding="UTF-8"?>
<Server port="$SHUTDOWNPORT" shutdown="SHUTDOWN">
  <Listener className="org.apache.catalina.startup.VersionLoggerListener" />
  <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
  <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
  <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
  <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
  <!-- Global JNDI resources Documentation at /docs/jndi-resources-howto.html -->
  <GlobalNamingResources />
  <Service name="Catalina">
      <!-- Insecure connector for redirect -->
      <!-- use your old HTTP port number -->
      <Connector port="8080" redirectPort="8443"
        protocol="org.apache.coyote.http11.Http11NioProtocol" 
        maxThreads="64" minSpareThreads="20" 
        acceptCount="200" connectionTimeout="20000" 
        URIEncoding="UTF-8" compression="on" compressionMinSize="2048" 
        noCompressionUserAgents="gozilla,traviata" 
        compressableMimeType="text/html,text/xml,text/javascript" 
        maxPostSize="-1" 
        SSLEnabled="false" 
        scheme="http" 
        secure="false" 
        clientAuth="false" 
        />
    
    <!-- Secure connector -->
    <!-- $PORT will be configured by Validate using the configured Validate port (see validate service set-service-property) -->
    <Connector port="$PORT"
        protocol="org.apache.coyote.http11.Http11NioProtocol" 
        maxThreads="64" minSpareThreads="20" 
        acceptCount="200" connectionTimeout="20000" 
        URIEncoding="UTF-8" compression="on" compressionMinSize="2048" 
        noCompressionUserAgents="gozilla,traviata" 
        compressableMimeType="text/html,text/xml,text/javascript" 
        maxPostSize="-1" 
        SSLEnabled="true" 
        scheme="https" 
        secure="true" 
        clientAuth="false" 
        sslProtocol="TLS" 
        keystoreFile="conf/mycertificate.cert"
        keystorePass="password"/>
    <Engine name="Catalina" defaultHost="localhost">
      <Host name="localhost" unpackWARs="false" autoDeploy="false" errorReportValveClass="com.klocwork.valves.ValidateErrorReportValve" appBase="webapps">
        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" prefix="localhost_access_log" suffix=".txt" pattern="common" />
      </Host>
    </Engine>
  </Service>
</Server>

Disabling the SSL connection

  1. Launch kwauthconfig from <server_install>/bin.
  2. Click Configure.
  3. Clear the Use secure Klocwork Server connection check box.
  4. Click Finish.
  5. Restart the Validate Server by using the command validate service restart, or by using Windows Services Administration.
  6. Inform all users that they now need to run Validate tools without the special SSL options.