GizzlerandCursor
58b7826162
Configure CertificateCheckUrl per container for curl-like TLS checks, classify Sonic permission errors, and extend setup wizard for container management. Co-authored-by: Cursor <cursoragent@cursor.com>
68 lines
1.9 KiB
Markdown
68 lines
1.9 KiB
Markdown
# Datenbank EsbZertifikatManager
|
||
|
||
Schlankes Schema (6 Tabellen) + Always Encrypted.
|
||
|
||
## Einmalige Reihenfolge
|
||
|
||
1. **Zertifikat importieren** (auf jedem Client-PC):
|
||
|
||
```powershell
|
||
cd Database\AlwaysEncrypted
|
||
.\Install-Certificate.ps1
|
||
```
|
||
|
||
- PFX: `ESB_ZertifikatManager_AE.pfx`
|
||
- Passwort: siehe `pfx-password.txt` (`ESB-AE-Dev-Only!`)
|
||
- Thumbprint: `95E906CCC9C5F227969877CF3BD46D2AD7168853`
|
||
|
||
2. In SSMS:
|
||
|
||
1. `00_DropExisting.sql`
|
||
2. `01_CreateDatabase.sql`
|
||
3. `02_CreateSchema.sql` (CMK/CEK + Tabellen)
|
||
4. `03_Seed.sql` (**komplett**: Companies, Environments, DE-Test, Container, Target)
|
||
|
||
3. App starten → Einstellungen → System **DE-Test** → Benutzerprofil anlegen → Übernehmen.
|
||
|
||
## Seed-Inhalt (`03_Seed.sql`)
|
||
|
||
| Objekt | Werte |
|
||
|---|---|
|
||
| Company | DE, PL, AT |
|
||
| Environment | TEST2, TEST, PROD |
|
||
| SonicConnection | DE-Test → `tcp://dekun-painwbdet:13070`, Domain `proalpha-test`, Env TEST |
|
||
| SonicContainer | ct-ZADBService (Company DE) |
|
||
| CertificateTarget | Demo-UNC `\\dekun-painwbdet\e$\...\certs\server.p12` |
|
||
| SonicCredential | **nicht** geseedet (Setup-Wizard / AE) |
|
||
|
||
## Demo-Pfad nachziehen (bestehende DB)
|
||
|
||
Wenn der alte Platzhalter noch in SQL liegt:
|
||
|
||
```text
|
||
04_EnsureDemoPath.sql
|
||
```
|
||
|
||
Zusätzlich: in `appsettings.json` ist `"Demo": { "Enabled": true, ... }` –
|
||
die App zeigt den Demo-Pfad auch ohne SQL-Update in der Zielliste (Kopieren testen).
|
||
|
||
## TLS-Prüf-URL am Container (bestehende DB)
|
||
|
||
Für Live-Zertifikatsprüfung (curl-ähnlich) die Spalte nachziehen:
|
||
|
||
```text
|
||
05_AddCertificateCheckUrl.sql
|
||
```
|
||
|
||
Danach in Einstellungen → Container die Prüf-URL setzen, z. B. `https://server:8443`.
|
||
|
||
## Always Encrypted
|
||
|
||
| Objekt | Name |
|
||
|---|---|
|
||
| CMK | `CMK_ESB_ZertifikatManager` → `CurrentUser/My/95E906CCC9C5F227969877CF3BD46D2AD7168853` |
|
||
| CEK | `CEK_ESB_ZertifikatManager` |
|
||
| Spalten | `SonicCredential.CredentialUserName`, `CredentialSecret` |
|
||
|
||
Connection String braucht `Column Encryption Setting=Enabled`.
|