The steps for Kron PAM Mobile App Server (on the DMZ)

· The certificate files (jks and p12) created in the Section-2 should be transferred to Kron PAM Mobile App Server.

Note that, jks and p12 files should be identical on both environments. To check this, the following commands should be run on both environments:

sha256sum /pam/docker-mgmt/cert/aioc.p12

sha256sum /pam/docker-mgmt/cert/aioc.jks

! If the files are not identical due to the 3rd party SSH/SFTP tool (e.g. MobaXterm) usage, sshpass command can be used for file transfer:

sshpass -p ‘your-password’ rsync -avz /pam/docker-mgmt/cert/aioc.p12 pamuser@10.10.0.2:/pam/docker-mgmt/cert

sshpass -p ‘your-password’ rsync -avz /pam/docker-mgmt/cert/aioc.jks pamuser@10.10.0.2:/pam/docker-mgmt/cert

· After the file transfer from Kron PAM server to Kron PAM Mobile App Server, ownership and mode configurations should be changed for these files:

sudo chown pamuser:pam-group /pam/docker-mgmt/cert/aioc.jks /pam/docker-mgmt/cert/aioc.p12

sudo chmod 750 /pam/docker-mgmt/cert/aioc.jks /pam/docker-mgmt/cert/aioc.p12

· If only the mobile-api service is used on the DMZ (without other docker services) the following docker-compose.yml file should be used under /pam/docker-mgmt/.

x-common-variables: &common-variables
  CONFIG_SERVER_URI: https://10.10.0.1:8001
  # Config variables
  SECURITY_CONFIG_PATH: /app/security/security.properties
  CONFIG_USER: aioc
  CONFIG_PASSWORD: aioc
  # SSL Environment Values
  SSL_ENABLE: true
  SSL_KEY_STORE_TYPE: PKCS12
  KEY_STORE: file:/app/certs/aioc.jks
  TRUST_STORE: file:/app/certs/aioc.p12
  # LOG
  LOG_DIRECTORY_PATH: /app/logs/
  # PAM PROPERTIES
  INSTANCE_NAME: ---Your Instance Name---
  TZ: ---Your Timezone---
  
services:
 mobile-api:
    image: dockerhub.kron.com.tr/pam/mobile-api:24.2.2
    environment: *common-variables
    ports:
      - "9443:9443"
    volumes:
      - /pam/gui/conf/cert:/app/gui-certs
      - /pam/logs:/app/logs
      - /pam/docker-mgmt/cert:/app/certs
      - /pam/kron/security:/app/security
      - /pam/gui/netright/:/app/license
    dns:
      - 8.8.8.8
      - 8.8.4.4
    extra_hosts:
      - "host.docker.internal:10.10.0.2"
      - "---Your PAM Instance Name---:10.10.0.1"

· If the customer uses its own certificate for accessing mobile URL, the certificate should be uploaded to /pam/gui/conf/cert (e.g., mobile.jks). Note that the purpose of using this certificate is different from the self signed certificate to access a specific docker service on the Kron PAM Server. After that, mobile-api-default.properties file located at /pam/docker-mgmt/config-repo/ should be updated:

server.ssl.key-store=file:/app/gui-certs/mobile.jks server.ssl.key-alias=---YOUR ALIAS--- server.ssl.key-password=---YOUR KEY PASSWORD--- server.ssl.key-store-password=---YOUR KEY STORE PASSWORD---

· The following line of the mobile-api-default.properties file located at /pam/docker-mgmt/config-repo/ should be updated:

pam.rest.api.server.url=https://10.10.0.1

· Lastly, mobile-api service on the Kron PAM Mobile App Server should be restarted. (down & up)

docker-compose down mobile-api

docker-compose up mobile-api -d