Proxy Configuration

[phaupt]

Please add a quick description about how to use a simple http proxy configuration.
It seems that system settings http.proxyHost and http.proxyPort like in the example below are of no use to httpClient?

-Dhttp.proxyHost=http://aproxy.corproot.net
-Dhttp.proxyPort=8080
-Dhttp.proxyUser=<user>
-Dhttp.proxyPassword=<password>
-Dhttp.nonProxyHosts="localhost|127.0.0.1|::1"
-Dhttps.proxyHost=http://aproxy.corproot.net
-Dhttps.proxyPort=8080

Also, please add documentation (and code, if needed) how to enable more verbose log output.

My setup steps:

1. git clone https://github.com/MobileID-Strong-Authentication/mobileid-client-java.git
2. mvn clean install
3. cd mid-java-client-usage/target/release/mid-client-1.3.0
4. ./bin/mid-client.sh -init
5. Updated the conf.properties
6. ./bin/mid-client.sh -profile-query -msisdn 41700092501 -vvv

[phaupt]

Here's a current log example related to connectivity/proxy issues:

--------------------------------------------------------------------------------
Swisscom Mobile ID Java client version 1.3.0, built on May/02/2022, git #8fc555b
--------------------------------------------------------------------------------
Starting with following parameters:
Operation             : profile-query
MSISDN                : 4179****608
Config                : config.properties
Interface             : rest
Verbose level         : 3
--------------------------------------------------------------------------------
2022-05-02 11:44:03,244 DEBUG [main] ch.swisscom.mid.client.impl.MIDClientImpl: Creating new instance of MIDClient
2022-05-02 11:44:03,248 DEBUG [main] ch.swisscom.mid.client.impl.MIDClientImpl: MIDClient configuration: ClientConfiguration{tls=ch.swisscom.mid.client.config.TlsConfiguration@72cde7cc, http=ch.swisscom.mid.client.config.HttpConfiguration@5fd4f8f5, protocol=REST, apId='mid://***.swisscom.com', msspId='http://mid.swisscom.ch/', urls='UrlsConfiguration{signatureServiceUrl='https://mobileid.swisscom.com/rest/service', statusQueryServiceUrl='https://mobileid.swisscom.com/rest/service', profileQueryServiceUrl='https://mobileid.swisscom.com/rest/service'}'}
2022-05-02 11:44:03,253 DEBUG [main] ch.swisscom.mid.client.impl.MIDClientImpl: Found MID client protocol implementation for: SOAP
2022-05-02 11:44:03,258 DEBUG [main] ch.swisscom.mid.client.impl.MIDClientImpl: Found MID client protocol implementation for: REST
2022-05-02 11:44:03,259 DEBUG [main] ch.swisscom.mid.client.impl.MIDClientImpl: MID Client configuration successfully validated.
2022-05-02 11:44:03,260 DEBUG [main] ch.swisscom.mid.client.impl.MIDClientImpl: MID Client selected the following protocol implementation: REST
2022-05-02 11:44:03,260 INFO  [main] ch.swisscom.mid.client.rest.ComProtocolHandlerRestImpl: Configuring TLS connection factory for MID client: key store source: [file: [/Users/taad****/Work/MRI/OSSJump/oss-mobileid-client/config/gitignore/mid-oss_scnam-keystore.jks]], key store type: [JKS], key store alias: [mobileid.oss.nm], trust store source: [file: [/Users/taad****/Work/MRI/OSSJump/oss-mobileid-client/config/gitignore/mid-truststore.jks]], trust store type: [JKS]
2022-05-02 11:44:03,455 INFO  [main] ch.swisscom.mid.client.rest.ComProtocolHandlerRestImpl: Configuring HTTP client: connection timeout [20000], response timeout [100000], max HTTP connections (total) [20], HTTP connections per route [10]
2022-05-02 11:44:03,531 DEBUG [main] ch.swisscom.mid.client.rest.ComProtocolHandlerRestImpl: MSS Profile Query: Serializing object of type MSSProfileQueryRequest to JSON
2022-05-02 11:44:03,613 INFO  [main] ch.swisscom.mid.client.cli.PrettyPrintingTrafficObserver: Outgoing request: [{
  "MSS_ProfileReq" : {
    "AP_Info" : {
      "AP_ID" : "mid://***.swisscom.com",
      "AP_PWD" : "disabled",
      "AP_TransID" : "ID-9acea038-ed81-4ab7-8de5-77c188d652f6",
      "Instant" : "2022-05-02T11:44:03.527+02:00"
    },
    "MSSP_Info" : {
      "MSSP_ID" : {
        "URI" : "http://mid.swisscom.ch/"
      }
    },
    "MajorVersion" : "2",
    "MinorVersion" : "0",
    "MobileUser" : {
      "MSISDN" : "4179****608"
    },
    "Params" : "sscds state certs pinstatus rcstatus aastatus"
  }
}]
2022-05-02 11:44:03,617 INFO  [main] ch.swisscom.mid.client.rest.ComProtocolHandlerRestImpl: MSS Profile Query: Sending request to: [https://mobileid.swisscom.com/rest/service]
2022-05-02 11:44:03,617 INFO  [main] ch.swisscom.mid.client.rest.ComProtocolHandlerRestImpl: MSS Profile Query: Sending JSON to: [https://mobileid.swisscom.com/rest/service], content: [{"MSS_ProfileReq":{"AP_Info":{"AP_ID":"mid://***.swisscom.com","AP_PWD":"disabled","AP_TransID":"ID-9acea038-ed81-4ab7-8de5-77c188d652f6","Instant":"2022-05-02T11:44:03.527+02:00"},"MSSP_Info":{"MSSP_ID":{"URI":"http://mid.swisscom.ch/"}},"MajorVersion":"2","MinorVersion":"0","MobileUser":{"MSISDN":"4179****608"},"Params":"sscds state certs pinstatus rcstatus aastatus"}}]
2022-05-02 11:44:03,621 DEBUG [main] org.apache.hc.client5.http.impl.classic.InternalHttpClient: ex-00000001: preparing request execution
2022-05-02 11:44:03,626 DEBUG [main] org.apache.hc.client5.http.protocol.RequestAddCookies: Cookie spec selected: strict
2022-05-02 11:44:03,630 DEBUG [main] org.apache.hc.client5.http.protocol.RequestAuthCache: Auth cache not set in the context
2022-05-02 11:44:03,631 DEBUG [main] org.apache.hc.client5.http.impl.classic.ProtocolExec: ex-00000001: target auth state: UNCHALLENGED
2022-05-02 11:44:03,631 DEBUG [main] org.apache.hc.client5.http.impl.classic.ProtocolExec: ex-00000001: proxy auth state: UNCHALLENGED
2022-05-02 11:44:03,631 DEBUG [main] org.apache.hc.client5.http.impl.classic.ConnectExec: ex-00000001: acquiring connection with route {s}->https://mobileid.swisscom.com:443
2022-05-02 11:44:03,632 DEBUG [main] org.apache.hc.client5.http.impl.classic.InternalExecRuntime: ex-00000001: acquiring endpoint (3 MINUTES)
2022-05-02 11:44:03,633 DEBUG [main] org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager: ex-00000001: endpoint lease request (3 MINUTES) [route: {s}->https://mobileid.swisscom.com:443][total available: 0; route allocated: 0 of 10; total allocated: 0 of 20]
2022-05-02 11:44:03,636 DEBUG [main] org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager$1: ex-00000001: endpoint leased [route: {s}->https://mobileid.swisscom.com:443][total available: 0; route allocated: 1 of 10; total allocated: 1 of 20]
2022-05-02 11:44:03,645 DEBUG [main] org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager$1: ex-00000001: acquired ep-00000000
2022-05-02 11:44:03,645 DEBUG [main] org.apache.hc.client5.http.impl.classic.InternalExecRuntime: ex-00000001: acquired endpoint ep-00000000
2022-05-02 11:44:03,645 DEBUG [main] org.apache.hc.client5.http.impl.classic.ConnectExec: ex-00000001: opening connection {s}->https://mobileid.swisscom.com:443
2022-05-02 11:44:03,646 DEBUG [main] org.apache.hc.client5.http.impl.classic.InternalExecRuntime: ep-00000000: connecting endpoint (20000 MILLISECONDS)
2022-05-02 11:44:03,647 DEBUG [main] org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager: ep-00000000: connecting endpoint to https://mobileid.swisscom.com:443 (20000 MILLISECONDS)
2022-05-02 11:44:03,664 DEBUG [main] org.apache.hc.client5.http.impl.io.DefaultHttpClientConnectionOperator: http-outgoing-0: connecting to mobileid.swisscom.com/195.65.194.58:443
2022-05-02 11:44:03,664 DEBUG [main] org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory: Connecting socket to mobileid.swisscom.com/195.65.194.58:443 with timeout 20000 MILLISECONDS
2022-05-02 11:44:03,675 DEBUG [main] org.apache.hc.client5.http.impl.io.DefaultManagedHttpClientConnection: http-outgoing-0: close connection IMMEDIATE
2022-05-02 11:44:03,676 DEBUG [main] org.apache.hc.client5.http.impl.classic.InternalExecRuntime: ep-00000000: endpoint closed
2022-05-02 11:44:03,676 DEBUG [main] org.apache.hc.client5.http.impl.classic.InternalExecRuntime: ep-00000000: discarding endpoint
2022-05-02 11:44:03,676 DEBUG [main] org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager: ep-00000000: releasing endpoint
2022-05-02 11:44:03,676 DEBUG [main] org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager: ep-00000000: connection released [route: {s}->https://mobileid.swisscom.com:443][total available: 0; route allocated: 0 of 10; total allocated: 0 of 20]
2022-05-02 11:44:03,679 DEBUG [main] org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager: Shutdown connection pool GRACEFUL
2022-05-02 11:44:03,679 DEBUG [main] org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager: Connection pool shut down
ch.swisscom.mid.client.MIDFlowException: Communication failure for MSS Profile Query
        at ch.swisscom.mid.client.rest.ComProtocolHandlerRestImpl.sendAndReceive(ComProtocolHandlerRestImpl.java:367)
        at ch.swisscom.mid.client.rest.ComProtocolHandlerRestImpl.requestProfile(ComProtocolHandlerRestImpl.java:197)
        at ch.swisscom.mid.client.impl.MIDClientImpl.requestProfile(MIDClientImpl.java:88)
        at ch.swisscom.mid.client.cli.Cli.main(Cli.java:143)
Caused by: org.apache.hc.client5.http.HttpHostConnectException: Connect to https://mobileid.swisscom.com:443 [mobileid.swisscom.com/195.65.194.58] failed: Connection refused (Connection refused)
        at java.base/java.net.PlainSocketImpl.socketConnect(Native Method)
        at java.base/java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:412)
        at java.base/java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:255)
        at java.base/java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:237)
        at java.base/java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)
        at java.base/java.net.Socket.connect(Socket.java:609)
        at org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory$1.run(SSLConnectionSocketFactory.java:222)
        at java.base/java.security.AccessController.doPrivileged(Native Method)
        at org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:219)
        at org.apache.hc.client5.http.impl.io.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:148)
        at org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:409)
        at org.apache.hc.client5.http.impl.classic.InternalExecRuntime.connectEndpoint(InternalExecRuntime.java:164)
        at org.apache.hc.client5.http.impl.classic.InternalExecRuntime.connectEndpoint(InternalExecRuntime.java:174)
        at org.apache.hc.client5.http.impl.classic.ConnectExec.execute(ConnectExec.java:135)
        at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
        at org.apache.hc.client5.http.impl.classic.ExecChainElement$1.proceed(ExecChainElement.java:57)
        at org.apache.hc.client5.http.impl.classic.ProtocolExec.execute(ProtocolExec.java:165)
        at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
        at org.apache.hc.client5.http.impl.classic.ExecChainElement$1.proceed(ExecChainElement.java:57)
        at org.apache.hc.client5.http.impl.classic.HttpRequestRetryExec.execute(HttpRequestRetryExec.java:93)
        at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
        at org.apache.hc.client5.http.impl.classic.ExecChainElement$1.proceed(ExecChainElement.java:57)
        at org.apache.hc.client5.http.impl.classic.RedirectExec.execute(RedirectExec.java:116)
        at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
        at org.apache.hc.client5.http.impl.classic.ExecChainElement$1.proceed(ExecChainElement.java:57)
        at org.apache.hc.client5.http.impl.classic.ContentCompressionExec.execute(ContentCompressionExec.java:128)
        at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
        at org.apache.hc.client5.http.impl.classic.InternalHttpClient.doExecute(InternalHttpClient.java:178)
        at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute(CloseableHttpClient.java:75)
        at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute(CloseableHttpClient.java:89)
        at ch.swisscom.mid.client.rest.ComProtocolHandlerRestImpl.sendAndReceive(ComProtocolHandlerRestImpl.java:327)
        ... 3 more
--------------------------------------------------------------------------------
Fault{failureReason=HOST_CONNECTION_FAILURE, failureDetail='Connect to https://mobileid.swisscom.com:443 [mobileid.swisscom.com/195.65.194.58] failed: Connection refused (Connection refused)', statusCodeString='INTERNAL_ERROR', statusCode=INTERNAL_ERROR, statusDetail='null', statusFaultReason='null'}
---
Exception stack:
  MIDFlowException = Communication failure for MSS Profile Query
  HttpHostConnectException = Connect to https://mobileid.swisscom.com:443 [mobileid.swisscom.com/195.65.194.58] failed: Connection refused (Connection refused)

[bmocanu]

I extended the client configuration file to support these parameters:

client.proxy.enabled=true
client.proxy.host=localhost
client.proxy.port=3128
client.proxy.username=myuser
client.proxy.password=mypass

The username and password can be left empty or commented for non-authentication proxies.
I created pre-release 1.4.0-beta1 with these changes.

For now, only the REST protocol uses the proxy configuration. The SOAP one will follow shortly. Also, this configuration is possible in code, using something like this during client configuration:

ProxyConfiguration proxy = config.getProxy();
proxy.setHost("localhost");
proxy.setPort(3128);
proxy.setUsername("myuser");
proxy.setPassword("mypass");

[phaupt]

Thanks! I've done a quick test using VPN/corproot network and cntlm service running on localhost:3128.
It seems to work!

My config.properties content:

client.msspApId=mid://dev.swisscom.ch
client.msspApPassword=none
# --
client.keyStore.file=keystore.jks
client.keyStore.password=***
client.keyStore.keyPassword=***
client.keyStore.certAlias=dev.swisscom.ch
# --
client.http.connectionTimeoutInSeconds=20
client.http.responseTimeoutInSeconds=100
# --
client.proxy.enabled=true
client.proxy.host=localhost
client.proxy.port=3128
#client.proxy.username=myuser
#client.proxy.password=mypass
# --
server.trustStore.file=truststore.jks
server.trustStore.password=***
server.hostnameVerification=true
# --
server.rest.url=https://mobileid.swisscom.com/rest/service
server.soap.signatureUrl=https://mobileid.swisscom.com/soap/services/MSS_SignaturePort
server.soap.statusQueryUrl=https://mobileid.swisscom.com/soap/services/MSS_StatusQueryPort
server.soap.receiptUrl=https://mobileid.swisscom.com/soap/services/MSS_ReceiptPort
server.soap.profileQueryUrl=https://mobileid.swisscom.com/soap/services/MSS_ProfileQueryPort

Test output:

$ ./bin/mid-client.sh -profile-query -msisdn 41700092501
--------------------------------------------------------------------------------
Swisscom Mobile ID Java client version 1.4.0, built on May/13/2022, git #c85dc87
--------------------------------------------------------------------------------
Starting with following parameters:
Operation             : profile-query
MSISDN                : 41700092501
Config                : config.properties
Interface             : rest
Verbose level         : 0
--------------------------------------------------------------------------------
2022-05-13 18:05:47,597 INFO  [main] ch.swisscom.mid.client.rest.ComProtocolHandlerRestImpl: Confi
guring TLS connection factory for MID client: key store source: [file: [keystore.jks]], key store type: [JKS], key store alias: [dev.s
wisscom.ch], trust store source: [file: [truststore.jks]], trust store type: [JKS]
2022-05-13 18:05:47,920 INFO  [main] ch.swisscom.mid.client.rest.ComProtocolHandlerRestImpl: Confi
guring PROXY parameters: enabled [true], host [localhost], port [3128], username [null], password [null]
2022-05-13 18:05:47,920 INFO  [main] ch.swisscom.mid.client.rest.ComProtocolHandlerRestImpl: Confi
guring HTTP client: connection timeout [20000], response timeout [100000], max HTTP connections (total) [20], HTTP connections per rou
te [10]
2022-05-13 18:05:48,001 INFO  [main] ch.swisscom.mid.client.cli.PrettyPrintingTrafficObserver: Out
going request: [{
  "MSS_ProfileReq" : {
    "AP_Info" : {
      "AP_ID" : "mid://dev.swisscom.ch",
      "AP_PWD" : "none",
      "AP_TransID" : "ID-8795ea52-693d-436b-9447-a0d584e0dc42",
      "Instant" : "2022-05-13T18:05:47.954+02:00"
    },
    "MSSP_Info" : {
      "MSSP_ID" : {
        "URI" : "http://mid.swisscom.ch/"
      }
    },
    "MajorVersion" : "2",
    "MinorVersion" : "0",
    "MobileUser" : {
      "MSISDN" : "41700092501"
    },
    "Params" : "sscds state certs pinstatus rcstatus aastatus"
  }
}]
2022-05-13 18:05:48,001 INFO  [main] ch.swisscom.mid.client.rest.ComProtocolHandlerRestImpl: MSS P
rofile Query: Sending request to: [https://mobileid.swisscom.com/rest/service]
2022-05-13 18:05:49,211 INFO  [main] ch.swisscom.mid.client.rest.ComProtocolHandlerRestImpl: MSS P
rofile Query: Received HTTP status code: 200
2022-05-13 18:05:49,220 INFO  [main] ch.swisscom.mid.client.cli.PrettyPrintingTrafficObserver: Inc
oming response: [{
  "MSS_ProfileResp" : {
    "AP_Info" : {
      "AP_ID" : "mid://dev.swisscom.ch",
      "AP_TransID" : "ID-8795ea52-693d-436b-9447-a0d584e0dc42",
      "Instant" : "2022-05-13T16:05:47.954Z"
    },
    "MSSP_Info" : {
      "Instant" : "2022-05-13T16:05:49.015Z",
      "MSSP_ID" : {
        "URI" : "http://mid.swisscom.ch/"
      }
    },
    "MajorVersion" : "2",
    "MinorVersion" : "0",
    "SignatureProfile" : [ "http://mid.swisscom.ch/Any-LoA4", "http://mid.swisscom.ch/MID/v1/AuthProfile1", "http://mid.swisscom.ch/MI
D/v1/AuthProfile1.ECC", "http://mid.swisscom.ch/STK-LoA4" ],
    "Status" : {
      "StatusCode" : {
        "Value" : "100"
      },
      "StatusDetail" : {
        "ProfileQueryExtension" : {
          "MobileUser" : {
            "AutoActivation" : false,
            "RecoveryCodeCreated" : false
          },
          "Sscds" : {
            "Sim" : {
              "MobileUserCertificate" : [ {
                "Algorithm" : "EC",
                "State" : "ACTIVE",
                "X509Certificate" : [ "MIIEVT...kx2Q==" ],
                "X509SubjectName" : [ "cn=midche218cr40c88:pn,serialnumber=midche218cr40c88", "c=ch,o=swisscom,ou=digital certificate
services,cn=swisscom rubin ca 3", "cn=swisscom root ca 2,ou=digital certificate services,o=swisscom,c=ch" ]
              } ],
              "PinStatus" : {
                "Blocked" : false
              },
              "State" : "ACTIVE"
            }
          }
        }
      },
      "StatusMessage" : "REQUEST_OK"
    }
  }
}]
--------------------------------------------------------------------------------
Profile response:
{
  "signatureProfiles" : [ "http://mid.swisscom.ch/Any-LoA4", "http://mid.swisscom.ch/MID/v1/AuthProfile1", "http://mid.swisscom.ch/MID
/v1/AuthProfile1.ECC", "http://mid.swisscom.ch/STK-LoA4" ],
  "mobileUser" : {
    "recoveryCodeCreated" : false,
    "autoActivation" : false
  },
  "simDevices" : [ {
    "state" : "ACTIVE",
    "pinState" : "ACTIVE",
    "certificates" : [ {
      "state" : "ACTIVE",
      "algorithm" : "EC",
      "userCertificate" : {
        "subjectName" : "cn=midche218cr40c88:pn,serialnumber=midche218cr40c88",
        "certificateAsBase64" : "MIIEV...a0M9"
      },
      "caCertificates" : [ {
        "subjectName" : "c=ch,o=swisscom,ou=digital certificate services,cn=swisscom rubin ca 3",
        "certificateAsBase64" : "MIIGSzC...01AuJjtwg=="
      }, {
        "subjectName" : "cn=swisscom root ca 2,ou=digital certificate services,o=swisscom,c=ch",
        "certificateAsBase64" : "MIIF2...tkx2Q=="
      } ]
    } ]
  } ],
  "appDevices" : [ ]
}
--------------------------------------------------------------------------------

[bmocanu]

I added proxy configuration for the SOAP protocol. I also refactored the documentation a bit, to provide a page specialized on HTTP proxy configuration.

You can find a new beta release, v1.4.0-beta2 that allows proxy configuration for SOAP.

Please note that we currently support only HTTP proxies without auth or with Basic auth, Other auth methods or other proxy types will need extra dev effort.

[bmocanu]

Merged the "2-proxy-configuration" branch to "develop" and then to "main".
Pushed final version 1.4.0 to Maven Central.
Created a new final release v1.4.0.

I think this issue can be closed.