[wildfly-dev] WildFly Elytron - Credential Store - Next Stages

Fri Dec 7 06:32:42 EST 2018

On Fri, Dec 7, 2018 at 1:34 AM Brian Stansberry <brian.stansberry at redhat.com>
wrote:

>
>
> On Tue, Dec 4, 2018 at 12:31 PM Martin Choma <mchoma at redhat.com> wrote:
>
>> A few thoughts:
>>
>> Real Time Updates
>>   - Runtime changes in era of OpenShift become less and less important
>> as configuration should be immutable. Runtime changes should be
>> addressed on OpenShift level. At least in past some of my "runtime
>> changes" issues were denied with this argument.
>>
>
> This is certainly something to consider when considering any new
> management functionality.
>
> Another thing to consider is what services are going to utilize any
> real-time update? Are there many resources that respond to a credential
> attribute value change (e.g. write-attribute) without triggering
> reload-required? If they do trigger reload-required it seems likely that's
> because making a new value take effect was considered to be too difficult
> compared to the gain. In an immutable world the gain is likely even less.
>

Yes the real time updates could only ever be approached on a resource by
resource basis so existing resources (at least we have a finite set to
consider) would either need to already update real time password updates or
be retrospectively modified to support them - for the credential store the
best we can do it make this a possibility.

>   - If this will be decided to accomplish I think it is enough when
>> updates take in action on explicit administrator command.
>>
>> Support for Expressions
>>   - Really question here is if vault wasn't misused as external
>> configuration storage for standalone.xml holding environment
>> properties on one place. Which could be more convenient as specifying
>> bunch of system properties. If so we should address this feature
>> separately - way to specify configuration property file for server
>> standalone.xml.
>>
>
> I hope people aren't using a vault just for that. If you want to group
> together properties you can use bin/standalone.sh -P.  On OpenShift you can
> mount a ConfigMap as a source of env var values, and env vars are used in
> expression resolution.
>
> I could imagine people sticking a username in a vault just because they
> put the password in the vault and administratively it was simpler to manage
> the two related values together. No idea if that's really done; I just can
> imagine it. ;)
>

Rather than focusing on the management side of the credential store and
features like real time updates it feels to me that emphasis should be on
this username / password problem - any enhancements in this area having a
better chance for long term relevance.

As I have mentioned previously we know we have some resources that only
require a credential, such as unlocking a local KeyStore.

The username / password pairing is a common issue - we don't really have a
clean solution for this yet so would be a good area to focus.

However a number of newer authentication mechanisms have moved beyond the
traditional username / password combo, some need an alternative to a
password, some don't need a username at all.  These also often have an
option to delegate the callers identity to the remote endpoint etc...

Better solving these last two would seem to be a better investment of
effort, regardless of how static future configurations do or do not become
this would still be relevant.

We already have the client side authentication context which provides a
very flexible configuration selection approach based on the endpoint being
connected to and additional information available as the connection is
requested.  Whilst very flexible this does add a level of complexity in
understanding how the configuration is assembled and how mappings are
applied.

The next resource we have is the existing authentication-configuration,
this is effectively a single client side authentication policy for an
outbound connection.

I think from an end users perspective it is clearer to visualise a 1:1
relationship between the resource defining the outbound connection and the
resource defining the authentication policy.  From a tooling perspective as
these are linked by capabilities a user doesn't even need to fully see the
separation, e.g. as you edited a datasource the console could offer an
option to edit the authentication-configuration which could open without
forcing the user to navigate to a different location in the model hierarchy.

We would need to look into more detail as to the suitability of this
resource and exactly how we would integrate it but this would generally be
my preferred starting point over trying to replicate expression expansion.

>
>   - If purpose is to really treat different arguments as security
>> sensitive then proposed encryption/decryption way seems promising to
>> me.
>>
>> On Wed, Sep 26, 2018 at 3:22 PM Darran Lofthouse
>> <darran.lofthouse at jboss.com> wrote:
>> >
>> > During WildFly 15 and WildFly 16 I am looking at the next stages for
>> credential store development based on a few feature requests we have not
>> handled yet.
>> >
>> > We are at the stage where this development is likely to affect multiple
>> areas of the application server, additionally we need to consider these
>> requests as a set so we don't take a decision for one that prevents us
>> working on the remainder.
>> >
>> > I have put together a blog post describing some of the general issues
>> we want to look into: -
>> >
>> >
>> http://darranl.blogspot.com/2018/09/wildfly-elytron-credential-store-next.html
>> >
>> > Some of these changes will have an impact on any subsystem currently
>> referencing the credential store.
>> >
>> > Other changes we will need to decide if the solution lies within
>> WildFly Elytron, the management tier of the server, or the admin tools - or
>> possibly a combination of all three.
>> >
>> > I am also going to share this link in the community forums to try and
>> obtain some additional feedback from end users.
>> >
>> > Regards,
>> > Darran Lofthouse.
>> > _______________________________________________
>> > wildfly-dev mailing list
>> > wildfly-dev at lists.jboss.org
>> > https://lists.jboss.org/mailman/listinfo/wildfly-dev
>> _______________________________________________
>> wildfly-dev mailing list
>> wildfly-dev at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/wildfly-dev
>>
>
>
> --
> Brian Stansberry
> Manager, Senior Principal Software Engineer
> Red Hat
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/wildfly-dev/attachments/20181207/c39e3cec/attachment-0001.html 