Secure Communication¶

In the Enterprise On-Prem deployment, the Object Service, Compute Service, Hub Frontend Server, and Dashboard Server communicate via HTTP requests. They may run on the same machine or across multiple machines. See the Object Service Deployment Guide for details and options.

The primary source of security in the Enterprise On-Prem deployment comes from the services running on machines that are part of the enterprise network without general internet access, which means they are not exposed to threats from the open internet.

Shared Authentication Secret¶

3LC provides a further mechanism to ensure that services only handle requests from trusted peers. This is done by providing a shared authentication secret to all four services when starting them.

Part of the authentication check done in the Object Service is a comparison of the timestamp for the request, set based on the time of the machine running the Dashboard, against the current time of the machine running the Object Service. The difference is allowed to be up to five minutes, allowing for some delay in the time it takes a request from the Dashboard to reach the Object Service, but with a limit to protect against potential replay attacks.

There can be issues with this check if there is significant skew (i.e. approaching or exceeding five minutes) between the time on the machine running the Dashboard and the machine running the Object Service. We recommend both machines be set to control time based on NTP so they automatically stay compatible.

The shared authentication secret should be a strong, random string known only to the services. It must be provided to all four services: Object Service, Compute Service, Hub Frontend Server, and Dashboard Server. Set the TLC_OBJECT_SERVICE_AUTH_SECRET environment variable to the same value in each service’s environment before starting it — see the Enterprise On-Prem installation page for the full startup sequence.

export TLC_OBJECT_SERVICE_AUTH_SECRET=<auth_secret>

set TLC_OBJECT_SERVICE_AUTH_SECRET=<auth_secret>