<div dir="ltr"><div class="gmail_quote"><div dir="ltr">On Tue, Nov 27, 2018 at 2:46 PM Jean-Francois Denise <<a href="mailto:jdenise@redhat.com">jdenise@redhat.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
<p>Hi Darran,</p>
<p>looking at "Automation of Updates to the Store" in which CLI
could be involved, I am listing potential issues if the CLI
handles it:</p>
<p>- it seems that the clear=>store+alias could be on a per
operation basis. User could still want to not rely on credential
store. So enabling globally the transformation would not work.<br></p></div></blockquote><div><br></div><div>I suspect it would be more a case of if they specify all three attributes we would automatically take the clear password and store it in the referenced credential store using the specified alias. Trying to automatically select a credential store and generate an alias seems more trouble than it would be worth,</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div text="#000000" bgcolor="#FFFFFF"><p>
</p>
<p>- Having an interactive workflow would not work well for scripts.</p>
<p>- Introducing new headers dedicated to automatic conversion
could work (they would have to be recognized and support
implemented on server), although with multiple
credential-references located in the same command, the syntax
could become complex.</p>
<p>After having played a bit with CLI+credential-references, I am
thinking that defining a new attribute in the credential-reference
(existing clear-text and store are alternatives, can't use both)
to express that the user wants automatic storage would seem quite
natural from CLI. Furthermore, it would work with CLI existing
support for operations.<br>
</p>
<p>Something like {clear-text=mypassword, update-store=mystore,
alias=ALIAS} I would enforce that the update-store already exists.</p>
<p>If that is possible in elytron subsystem, that would make for a
simple CLI workflow.<br>
</p>
<p>JF<br>
</p>
<div class="m_8742915455425551349moz-cite-prefix">On 26/09/2018 15:15, Darran Lofthouse
wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">During WildFly 15 and WildFly 16 I am looking at
the next stages for credential store development based on a few
feature requests we have not handled yet.
<div><br>
</div>
<div>We are at the stage where this development is likely to
affect multiple areas of the application server, additionally
we need to consider these requests as a set so we don't take a
decision for one that prevents us working on the remainder.</div>
<div><br>
</div>
<div>I have put together a blog post describing some of the
general issues we want to look into: -</div>
<div><br>
</div>
<div><a href="http://darranl.blogspot.com/2018/09/wildfly-elytron-credential-store-next.html" target="_blank">http://darranl.blogspot.com/2018/09/wildfly-elytron-credential-store-next.html</a><br>
</div>
<div><br>
</div>
<div>Some of these changes will have an impact on any subsystem
currently referencing the credential store.</div>
<div><br>
</div>
<div>Other changes we will need to decide if the solution lies
within WildFly Elytron, the management tier of the server, or
the admin tools - or possibly a combination of all three.</div>
<div><br>
</div>
<div>I am also going to share this link in the community forums
to try and obtain some additional feedback from end users.</div>
<div><br>
</div>
<div>Regards,</div>
<div>Darran Lofthouse.</div>
</div>
<br>
<fieldset class="m_8742915455425551349mimeAttachmentHeader"></fieldset>
<br>
<pre>_______________________________________________
wildfly-dev mailing list
<a class="m_8742915455425551349moz-txt-link-abbreviated" href="mailto:wildfly-dev@lists.jboss.org" target="_blank">wildfly-dev@lists.jboss.org</a>
<a class="m_8742915455425551349moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/wildfly-dev" target="_blank">https://lists.jboss.org/mailman/listinfo/wildfly-dev</a></pre>
</blockquote>
<br>
</div>
_______________________________________________<br>
wildfly-dev mailing list<br>
<a href="mailto:wildfly-dev@lists.jboss.org" target="_blank">wildfly-dev@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/wildfly-dev" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/wildfly-dev</a></blockquote></div></div>