Secure Service Fabric Cluster But Make API Public

1
votes

I am looking into using a service fabric cluster for a service with a public API. When creating a service fabric cluster I have the ability to choose either secured mode and use a certificate, or use unsecured mode.

In unsecured mode, anyone can call the API which is what I want, however it also means that anyone can go to the management page at *northeurope.cloudapp.azure.com:19080 and do anything which is obviously not ok.

I tried using the secure mode with a certificate, and this prevents anyone without the certificate from using the management page, but also seems to prevent anyone calling the API.

Am I missing something simple? How do I keep the management side of the cluster secured, while making the API public so that anyone can call it?

Edit: After looking more carefully it seems to me that the intended behaviour is that as I've configured a custom endpoint when setting up the cluster that I should be able to call the service. So I believe it may just be an error in my code.

1
securityazureazure-service-fabric
Just curious, have you actually created a cluster in north europe? I thought it wasn't available there... – Edward Rixon
Yes, I've deployed several clusters in north europe – QTom
When you refer to "API", do you mean your own custom API or the built-in Service Fabric management API? – Matt Thalman
A Stateless Web API service that I have made. – QTom
That shouldn't be the case. My cluster doesn't have this issue, what is the behavior you are seeing? – Firoso

1 Answers

1
votes

Securing a cluster has nothing to do with your application endpoints. There is a separation of concerns between securing the system (management endpoints, node authentication) and securing your applications (SSL, user auth, etc.). There is some other problem here, most likely you have configured the Azure Load Balancer to allow traffic into your cluster on the ports that your services are listening on. See here for more info on that: https://azure.microsoft.com/en-us/documentation/articles/service-fabric-connect-and-communicate-with-services/#service-fabric-in-azure