How to Enable HTTPS Authentication in Mule 4: Step-by-Step Guide

Securing your APIs and data is crucial in today's digital world. With Mule 4 it's easier to implement strong authentication and encryption for safe, reliable integrations. Compared to Mule 3, Mule 4 improvements have provided significant API-led connectivity solutions to smooth the process of API development and testing with enhanced security. The basic authentication process in Mule 4 using the HTTPS protocol will ensure solid security for Mule applications.

Let's understand the process of creating and enabling the HTTPS configuration for providing HTTPS service, security filters and authorization filters for validating the HTTPS request based on Spring module with basic mule authentication.

Types of MuleSoft Authentication

MuleSoft authentication helps in keeping data, APIs, and apps safe. The common types of MuleSoft Authentication include:

• Basic Authentication: Uses a simple username and password sent with the request. Implementing it is easy, and it works well for simple use cases with the MuleSoft http request.
• OAuth 2.0: This is a token-based authentication system that doesn't require sharing a password. It supports multiple grant types like Authorization Code and Client Credentials, often used with MuleSoft http listener configuration in APIs.
• NTLM Authentication: This authentication is used in corporate networks, and it is majorly used in Microsoft Windows environments for single sign-on.
• LDAP Authentication: Connects to directory servers to authenticate users against central user stores. This is beneficial for enterprises already using LDAP or Active Directory.
• Multi-Factor Authentication (MFA): Beyond the password, it adds another level of security, such as a security key, enhancing overall security on platforms like MuleSoft Anypoint.

Each authentication type affects how you configure your MuleSoft http listener and how your MuleSoft http request configuration handles security.

What is HTTPS Authentication in Mule 4?

HTTPS authentication in Mule 4 is the process of securing the data exchanged through the MuleSoft HTTP listener component by encrypting traffic and verifying client/server identities. When an HTTPS endpoint is configured, requests are transmitted over Secure Sockets Layer (SSL), so that sensitive information is encrypted and protected from interception.

Moreover, Spring Security or API Manager policies can enforce MuleSoft authentication methods like Basic Authentication or OAuth on protected endpoints. Enabling HTTPS for MuleSoft http request operations safeguards sensitive business data transferred via API calls.

Prerequisites for Enabling HTTPS in Mule 4

There are many prerequisites to be met before enabling HTTPS in Mule 4.

• A valid SSL certificate and a keystore file for storing keys.
• MuleSoft Anypoint Studio with Mule 4 runtime installed.
• Knowledge of MuleSoft http listener configuration, including ports and protocol settings.
• A truststore for Two-Way SSL, though it is optional.
• Maven dependencies on any required authentication policies or Spring modules.
• Secure handling practices for credentials and certificates. Setting appropriate MuleSoft http request timeout is advised for both security and performance.

Process for Applying and Enabling HTTPS Configuration for Mule 4 HTTP Connector

Steps to Create Mule4 HTTPS Listener Configuration:

Step 1: Create and import certificates.

Here, we cover the process of generating and using Keystore configuration. The standard Java JDK distribution does not include a Keystore by default. So, use Keytool to generate Keystores and certificates. The Keystore generated contains a private key and a public certificate, which is self-signed. Here is the command to create a self-signed certificate:

keytool -genkey -alias mule -keyalg RSA -keystore keystore.jks

Executing the above command results in the following commands to populate and provide necessary details:

Upon successful execution, the Keystore.jks file will be generated. Move this into the Mule application location (src/main/resources).

Step 2: Run Anypoint Studio and create a new Mule project.

As illustrated in the image below, create a sample flow with HTTP Connector for HTTPS configuration, security filter and authorization filter for validating the HTTPS request based on the Spring module with basic authentication. In the Mule configuration file, drag the MuleSoft HTTP Listener and other required connectors from the palette and then test the application.

Here is how to configure HTTPS Listener in Mule 4:

Start by adding an HTTP Listener component in your flow and set the protocol to HTTPS.

• Define the port in the MuleSoft http listener configuration.
• Under TLS settings, provide the keystore type, location, password, and optionally the truststore for mutual SSL (Two-Way SSL).
• The listener validates incoming requests, supporting both Basic and OAuth authentication when configured via policies or Spring modules.
• Proper configuration ensures secure transmission and facilitates enforcement of your chosen MuleSoft authentication type.

Step 3: Under HTTP Listener general configuration, set the protocol to HTTPS and use the 8082 as the port.

Here is how to configure HTTPS client-side request in Mule 4:

On the client side, use the MuleSoft HTTP request component and set the URL to use HTTPS.

• Under the MuleSoft http request configuration, specify SSL properties, such as the truststore and keystore if mutual authentication is needed.
• Set authentication headers relevant to the endpoint's requirements (e.g., username and password for Basic, bearer token for OAuth).
• Tune MuleSoft http request timeout to enhance request reliability and avoid hanging connections.

Ensure that certificates and keys are securely stored and referenced during connection initiation.

Step 4: Under HTTP Listener TLS configuration, provide Keystore configuration parameters to apply HTTPS secured protocol policy.

The Keystore contains private keys and is essential only when a server is running on an SSL connection. Store public keys and the certificates issued by the certificate authority. Here, the focus is on the process of using the Keystore configuration.

Under HTTP Listener TLS Keystore configuration, pass Keystore type, location of the Keystore authenticated file (like .JKS file if Type=JKS) and other parameters.

The Mule application is now ready to provide HTTPS-based Listener service for all requests which are using this HTTPS configuration. Test this process using the application URL: https://localhost:8082/testPath. The screenshot below illustrates the request submitted successfully.

Process for Applying and Enabling Spring Authentication of HTTPS Requests

In this process, set up and configure the Mule application to be able to use the authorization filter with the Spring security manager for providing basic authentication to the HTTP/HTTPS Listener.

Steps in Applying HTTP/HTTPS Listener Basic Authentication

Step 1: Create a project in Studio 7 and add the Spring module from Exchange.

Step 2: Create an XML in the resources/basic-auth folder to define the bean configuration.

Step 3: Go to the global elements tab of your configuration and create the configuration below:

Spring configuration to import basic-auth/beans.xml:

Spring Security Manager to provide authentication-manager (defined in bean configuration XML: basic-auth/beans.xml) as delegate reference:

Here, the developer should make sure the POM file must contain the following dependencies in the POM. Check the POM file for the Mule Maven plugin containing the following shared libraries:

Step 4: Design and execute the below flow with an HTTP Listener and add the security filter from the palette: 

Step 5: It's common to test the HTTPS and basic authentication of Mule 4 HTTP Listener. Upon successful application deployment, perform the following steps:

1. In Postman under Authorization, select Basic Auth as the Type.
2. Provide a valid username and password.
3. Trigger the application URL: https://localhost:8082/testPath

Note: If the request submitted is valid, then it will be successful, and the response status will be “Success (200).” If the request submitted is invalid, then the response status will be “Not Authorized (401).”

Best Practices for HTTPS in Mule 4

Here are the best practices for secure and reliable implementation:

• Always use strong, CA-issued certificates whenever possible, for production.
• Change keystore and truststore passwords from defaults and restrict access.
• Regularly update dependencies and policies for Spring or API Manager.
• Set reasonable MuleSoft http request timeout values to mitigate denial-of-service and resource locking risks.
• Monitor audit logs for suspicious activity and employ MuleSoft authentication checks at all integration points, including the MuleSoft http listener and API gateways.
• Consider using Two-Way SSL for sensitive integrations, configuring both server and client certificates to maximize mutual trust and defense against unauthorized access.

Related Resources

• To learn more about MUnit testing in MuleSoft Mule 4, check out this guide: Understanding MUnit Test in MuleSoft Mule 4.
• Want to compare Mule 4 and Mule 3? See: Mule 4 vs Mule 3 Release – Which Is More Beneficial?
• Facing integration challenges with MuleSoft? Discover advanced integration strategies in our blog: How to Overcome Integration Challenges with MuleSoft.

Conclusion

Enabling HTTPS authentication in Mule 4 is essential to keep your APIs and data secure. By properly configuring the MuleSoft https listener and setting up authentication like Basic Auth or OAuth, you can protect sensitive information from unauthorized access. Always prepare with required certificates and keystore files before starting. Follow the above-discussed best practices like setting request timeouts and using trust certificates to enhance security and performance. Overall, enabling HTTPS authentication in Mule 4 helps provide a reliable, safe environment for your integrations.

FAQs