Administrator's Guide

One can continue using the same token for different SDN Controller APIs within the default 24-hour
period since token creation. If desired, one can change this default 24-hour timeout in the /etc/
keystone/keystone.conf file. (See the OpenStack Keystone Administration Guide for more
information). The CachedTokenTTL value under the configuration properties
com.hp.sdn.adm.auth.impl.AuthenticationManager needs to match the timeout set by
Keystone as well to allow efficient caching of tokens.
5.7.2 Service and admin tokens
The Service token is used for internal communication between controllers and is not exposed to
the user. Likewise, the Admin token is used for the communication between the controller and the
Keystone server and is not exposed to the user.
That said, the values for these tokens can be changed via the UI under the Configurations for
AuthenticationManager. Note that for the Service token, all controllers in a team must have the
same Service token to communicate successfully. Likewise, for the Admin token, both the controller
token value and the Openstack Keystone "admin_token" in /etc/keystone/keystone.conf must
match for authentication to work.
5.8 Controller code verification
All controller code is signed by HP. Validating the certificate via jarsigner should return an HP
X.509 certificate similar to the following:
X.509, CN=Hewlett-Packard, OU=HPGlobal, OU=Digital ID Class 3 - Java
Object Signing, O=Hewlett-Packard, L=Andover, ST=Massachusetts, C=US
[certificate is valid from 11/14/12 4:00 PM to 11/15/14 3:59 PM]
X.509, CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at
https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network,
O="VeriSign, Inc.", C=US
[certificate is valid from 2/7/10 4:00 PM to 2/7/20 3:59 PM]
[CertPath not validated: null]
If a controller jar or war file is tampered with, the jar verification fails, and the container does not
start up.
If an application is not signed by HP, or has its certificate trusted by the controller (see section
below), the application is not allowed to run on the controller.
5.8.1 Adding certificates to the jar-signing truststore
To deploy other signed applications onto the controller, use the Java keytool to import the public
certificate that was used to sign the application jars and/or zips into the controller jar-signing
truststore (/opt/sdn/admin/sdnjar_trust.jks):
keytool -importcert -keystore /opt/sdn/admin/sdnjar_trust.jks -file
signed_app.cer -alias mysignedcert
The controller needs to be restarted for the new truststore to take effect.
5.8.2 Running the SDN Controller Without Jar-Signing Validation
The SDN Controller enforces jar-signing validation by default. For an experimental/development
environment where unsigned applications need to be deployed, jar-signing validation can be
turned off altogether:
1. Use the following command to stop the SDN Controller:
sudo service sdnc stop
68 SDN Controller authentication