Page tree

RESTHeart 3.0 is the latest stable version.

Skip to end of metadata
Go to start of metadata

1. Quick-start

Docker

There is a Docker container with a JVM running RESTHeart, linked to another container running MongoDB, which makes use of the official MongoDB image. Docker should be considered the best way to create a development or production environment with RESTHeart.

Recently we added a Github repository which guides to a basic Google Cloud Containers configuration.

Vagrant

Vagrant box available for creating a complete virtual development environment, using a Ubuntu 14.04 image with JDK 8, MongoDB 3 and the latest RESTHeart server. You can then skip section 2 to 6 and jump directly to section 7, in case you want to know how to change the default security settings.

Bare metal

Please follow the next sections for a full local installation.

2. Run it on your host - what you need

If you don’t have them already, please download the following packages:

Most of the work must be done using a command line interface. 

3. Install Java and MongoDB

Install Java 8 and MongoDB following the instructions for your specific operating system and make sure that their binaries are actually executable (so they are in your PATH env variable).

To check Java and MongoDB, you should execute the following commands and you should get something like the below (output might vary depending on Java version and your OS):

$ java -version
java version "1.8.0_66"
Java(TM) SE Runtime Environment (build 1.8.0_66-b17)
Java HotSpot(TM) 64-Bit Server VM (build 25.66-b17, mixed mode)

$ mongod --version
db version v3.0.7
RESTHeart has been tested with MongoDB version 3.2, 3.0, 2.6 and 2.4.

4. Install RESTHeart

To install RESTHeart just extract the content of the dowloaded package in the desired directory.

You are interested in two files:

  • restheart.jar
  • etc/restheart.yml <- an example configuration file

5. Start MongoDB

In pursuit of simplicity we are first going to start MongoDB without enabling authentication. We’ll see later how to enable it.

You can just start MongoDB by running the mongod command from a shell prompt. It is configured by default to use the /data/dbfolder, which must exist already or you have to create it beforehand. If you do not want to use the default data directory (i.e., /data/db), specify the path to the data directory using the --dbpath option: mongod --dbpath <path to data directory>. You might prefer to run the MongoDB process in background, using the --fork parameter: mongod --fork --syslog:

$ mongod --fork --syslog
about to fork child process, waiting until server is ready for connections.
forked process: 11471
child process started successfully, parent exiting

By default MongoDB starts listening for connections on 127.0.0.1:27017. 

6. Start the RESTHeart server

Run the RESTHeart server by typing java -server -jar restheart.jar.

This starts it with the default configuration, which is fine for MongoDB running on localhost, on default port and without authentication.

Convention over configuration

Different configuration options can be specified passing a configuration file as argument. Note that the configuration file path is either absolute or relative to the restheart.jar file location.

The configuration file can specify any option that will overwrite the default value: this way it is not required to specify all the possible options in the configuration file following the convention over configuration approach.

For more information about the configuration file format refer to Advanced Configuration and Default Configuration File sections.

On Linux, OSX and Solaris you can run RESTHeart as a daemon processjava -server -jar restheart.jar --fork. Note that this will force the console logging and the file logging to be turned off and on respectively, regardless the specified log configuration options.

For example:

$ java -jar restheart.jar 
14:01:09.968 [main] INFO  org.restheart.Bootstrapper - Starting RESTHeart
14:01:09.971 [main] INFO  org.restheart.Bootstrapper - version 2.0.0
14:01:09.978 [main] INFO  org.restheart.Bootstrapper - Logging to file /var/folders/yx/mgksqtzn41j41xdnv74snjpc0000gn/T/restheart.log with level INFO
14:01:09.978 [main] INFO  org.restheart.Bootstrapper - Logging to console with level INFO
14:01:10.275 [main] INFO  org.restheart.Bootstrapper - MongoDB connection pool initialized
14:01:10.275 [main] INFO  org.restheart.Bootstrapper - MongoDB version 3.2.0
14:01:10.276 [main] WARN  org.restheart.Bootstrapper - ***** No Identity Manager specified. Authentication disabled.
14:01:10.277 [main] WARN  org.restheart.Bootstrapper - ***** No access manager specified. users can do anything.
14:01:10.277 [main] INFO  org.restheart.Bootstrapper - Token based authentication enabled with token TTL 15 minutes
14:01:10.593 [main] INFO  org.restheart.Bootstrapper - HTTPS listener bound at 0.0.0.0:4443
14:01:10.593 [main] INFO  org.restheart.Bootstrapper - HTTP listener bound at 0.0.0.0:8080
14:01:10.595 [main] INFO  org.restheart.Bootstrapper - Local cache for db and collection properties enabled with TTL 1000 msecs
14:01:10.595 [main] INFO  org.restheart.Bootstrapper - Local cache for schema stores not enabled
14:01:10.766 [main] INFO  org.restheart.Bootstrapper - URL / bound to MongoDB resource *
14:01:10.976 [main] INFO  org.restheart.Bootstrapper - Embedded static resources browser extracted in /var/folders/yx/mgksqtzn41j41xdnv74snjpc0000gn/T/restheart-4469244188076444924
14:01:10.999 [main] INFO  org.restheart.Bootstrapper - URL /browser bound to static resources browser. Access Manager: false
14:01:11.246 [main] INFO  org.restheart.Bootstrapper - Pid file /var/folders/yx/mgksqtzn41j41xdnv74snjpc0000gn/T/restheart-0.pid
14:01:11.246 [main] INFO  org.restheart.Bootstrapper - RESTHeart started

We’ll now use the HAL format and the embedded HAL browser to check that everything is fine. The HAL browser allows you to surf the DATA API with your regular Web browser.

HAL is a simple format that gives a consistent and easy way to hyperlink between resources in your API. Adopting HAL will make your API explorable, and its documentation easily discoverable from within the API itself. In short, it will make your API easier to work with and therefore more attractive to client developers. APIs that adopt HAL can be easily served and consumed using open source libraries available for most major programming languages. It’s also simple enough that you can just deal with it as you would any other JSON.

To see the HAL user interface, now open your browser at: http://127.0.0.1:8080/browser

7. Enable MongoDB authentication

This section assumes using MongoDB 3.2. For other versions, the security configuration is similar but different. Rrefer to the MongoDB documentation for more information.

Start MongoDB with authentication and connect to the MongoDB instance from a client running on the same system. This access is made possible by the localhost exception. Again, you might prefer to run the MongoDB process in background, using the --fork parameter.

$ mongod --fork --syslog --auth
$ mongo

In this section we will use the mongodb superuser role root that provides access to the all operations and all the resources.

However the best practice is to use a MongoDB user with restricted access. For instance, it could be restricted to use only a single DB in read only mode. For more information refer to MongoDB authentication with just enough permissions section.

Create the admin user. The procedure is different depending on MongoDB version.

> use admin
> db.createUser({
	user: "admin",
    pwd: "changeit",
    roles:[ "root" ]
})
We need to provide the MongoDB user authentication credentials in the RESTHeart configuration file: see docs

We’ll use the restheart.yml example configuration file that comes with RESTHeart download package (you find it in the etc directory)

$ vi etc/restheart.yml

Find and modify the following section providing the user-name, password and authentication db (the db where the MongoDB user is defined, in our case ‘admin’).

mongo-uri: mongodb://admin:changeit@127.0.0.1/?authSource=admin

Now start RESTHeart specifying the configuration file:

$ java -server -jar restheart.jar etc/restheart.yml

Test the connection opening the HAL browser at http://127.0.0.1:8080/browser.

Note that the example configuration file etc/restheart.yml also enables the RESTHeart security. Opening the HAL browser page, you’ll be asked to authenticate. You can use of one of the credentials defined in etc/security.yml file (try username = ‘a’ and password = ‘a’).

7.1 Connect RESTHeart to MongoDB over TLS/SSL

MongoDB clients can use TLS/SSL to encrypt connections to mongod and mongos instances.

To configure RESTHeart for TLS/SSL do as follows:

  • create the keystore importing the public certificate used by mongod using keytool (with keytool, the java tool to manage keystores of cryptographic keys)

$ keytool -importcert -file mongo.cer -alias mongoCert -keystore rhTrustStore


# asks for password, use "changeit"


  • specify the ssl option in the mongo-uri in the restheart yml configuration file:


mongo-uri: mongodb://your.mongo-domain.com?ssl=true


  • start restheart with following options:


$ java -server -Djavax.net.ssl.trustStore=rhTrustStore -Djavax.net.ssl.trustStorePassword=changeit -Djavax.security.auth.useSubjectCredsOnly=false -jar restheart.jar restheart.yml

7.2. MongoDB authentication with just enough permissions 

In the previous examples we used a mongodb user with root role (or clusterAdmin and dbAdminAnyDatabase roles for version 2.4) for the sake of simplicity. This allows RESTHeart to execute any command on any mongodb resource.

On production environments a strong security isolation is mandatory.

In order to achieve it, the best practice is:

  1. use the mongo-mounts configuration option to restrict the resources exposed by RESTHeart;
  2. use a mongodb user with just enough roles: read or readWrite on mounted databases 

The following example, creates a mongodb user with appropriate roles to expose the databases db1, db2 and db3 in read only mode.

> use admin
> db.createUser({user: "mongousr",
	pwd: "secret",
	roles: [{role: "readWrite", db: "db1"},
			{role: "readWrite", db: "db2"},
			{role: "read", db: "db3"}
]})

To list the databases (i.e. GET /, the root resource) the listDatabases permission is needed. This permission is granted by the readWriteAnyDatabase role or you can create a custom role.

To allow deleting a database the dropDatabase permission is needed. This permission is granted by the dbAdmin role or you can create a custom role.

8. Clients Authentication and Authorization

Refert to Security section for detailed information about how enable, configure and customize clients authentication and authorization.


 


 
  • No labels

1 Comment

  1. Anonymous