[JBoss JIRA] (ELY-1106) Unable to configure protocol and cipher-suite in wildfly-config.xml ssl-context
by David Lloyd (JIRA)
[ https://issues.jboss.org/browse/ELY-1106?page=com.atlassian.jira.plugin.s... ]
David Lloyd commented on ELY-1106:
----------------------------------
Looks like a case where the XSD is out of sync with the actual parser. The parser supports these elements:
* {{key-store-ssl-certificate}}
* {{ssl-cipher-suite}}
* {{ssl-protocol}}
* {{provider-name}}
* {{use-system-providers}}
* {{use-service-loader-providers}}
* {{trust-store}}
But the XSD defines these elements:
* {{key-store-ssl-certificate}}
* {{cipher-suite}}
* {{protocol}}
* {{provider-name}}
* {{use-system-providers}}
* {{use-service-loader-providers}}
* {{trust-store}}
> Unable to configure protocol and cipher-suite in wildfly-config.xml ssl-context
> -------------------------------------------------------------------------------
>
> Key: ELY-1106
> URL: https://issues.jboss.org/browse/ELY-1106
> Project: WildFly Elytron
> Issue Type: Bug
> Affects Versions: 1.1.0.Beta38
> Reporter: Martin Choma
> Assignee: Darran Lofthouse
> Priority: Blocker
> Labels: eap7.1-rfe-failure
>
> Setting {{cipher-suite}} or {{protocol}} attribute
> {code:xml|title=wildfly-config.xml}
> <ssl-context name="client-ssl-context">
> <trust-store key-store-name="trustsore"/>
> <cipher-suite selector="TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_anon_WITH_AES_128_CBC_SHA,TLS_ECDH_anon_WITH_AES_256_CBC_SHA"/>
> <protocol names="TLSv1.1"/>
> <use-system-providers/>
> </ssl-context>
> {code}
> leads to
> {code:server.log}
> 13:47:57,206 ERROR [io.undertow.request] (default task-1) UT005023: Exception handling request to /wildfly-config-app/authenticationContext: java.lang.RuntimeException: org.wildfly.client.config.ConfigXMLParseException: CONF0005: Unexpected element "cipher-suite" in namespace "urn:elytron:1.0" encountered
> at vfs:/content/wildfly-config-app.war/META-INF/wildfly-config.xml:21:17
> at com.redhat.eap.qe.deployment.servlet.WildflyConfigXmlServlet.parseAndCreateAuthenticationClientConfiguration(WildflyConfigXmlServlet.java:119)
> at com.redhat.eap.qe.deployment.servlet.WildflyConfigXmlServlet.doGet(WildflyConfigXmlServlet.java:91)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:687)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
> at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
> at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
> at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
> at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
> at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
> at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
> at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
> at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
> at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
> at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
> at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
> at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
> at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
> at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
> at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
> at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
> at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
> at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
> at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
> at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
> at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1704)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1704)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1704)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1704)
> at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
> at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
> at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
> at io.undertow.server.Connectors.executeRootHandler(Connectors.java:211)
> at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:809)
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> at java.lang.Thread.run(Thread.java:745)
> Caused by: org.wildfly.client.config.ConfigXMLParseException: CONF0005: Unexpected element "cipher-suite" in namespace "urn:elytron:1.0" encountered
> at vfs:/content/wildfly-config-app.war/META-INF/wildfly-config.xml:21:17
> at org.wildfly.client.config.ConfigurationXMLStreamReader.unexpectedElement(ConfigurationXMLStreamReader.java:245)
> at org.wildfly.security.auth.client.ElytronXmlParser.parseSslContextType(ElytronXmlParser.java:420)
> at org.wildfly.security.auth.client.ElytronXmlParser.parseSslContextsType(ElytronXmlParser.java:342)
> at org.wildfly.security.auth.client.ElytronXmlParser.parseAuthenticationClientType(ElytronXmlParser.java:265)
> at org.wildfly.security.auth.client.ElytronXmlParser.parseAuthenticationClientConfiguration(ElytronXmlParser.java:172)
> at org.wildfly.security.auth.client.ElytronXmlParser.parseAuthenticationClientConfiguration(ElytronXmlParser.java:133)
> at com.redhat.eap.qe.deployment.servlet.WildflyConfigXmlServlet.parseAndCreateAuthenticationClientConfiguration(WildflyConfigXmlServlet.java:116)
> ... 41 more
> {code}
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years
[JBoss JIRA] (ELY-1107) Summary CLI command for adding new credential store contain duplicity for "create" and "location" attribute, "modification" attr is wrongly placed..
by Hynek Švábek (JIRA)
[ https://issues.jboss.org/browse/ELY-1107?page=com.atlassian.jira.plugin.s... ]
Hynek Švábek updated ELY-1107:
------------------------------
Component/s: Credential Store
> Summary CLI command for adding new credential store contain duplicity for "create" and "location" attribute, "modification" attr is wrongly placed..
> ----------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: ELY-1107
> URL: https://issues.jboss.org/browse/ELY-1107
> Project: WildFly Elytron
> Issue Type: Bug
> Components: Credential Store
> Reporter: Hynek Švábek
> Assignee: Darran Lofthouse
>
> Summary CLI command for adding new credential store contain duplicity for "create" and "location" attribute, "modification" attr is wrongly placed..
> Create, location and modifiable attributes cannot be included in implementation-properties. "modifiable" attribute should be present in same way as "create" and "location" in its own attribute.
> *How to reproduce*
> {code}
> java -jar wildfly-elytron-tool.jar credential-store --add secret_alias --password pass123 --create -x secret_password -l store.jceks --summary
> {code}
> {code}
> /subsystem=elytron/credential-store=cs:add(relative-to=jboss.server.data.dir,location="store.jceks",create=true,implementation-properties={"keyStoreType"=>"JCEKS","create"=>"true","location"=>"store.jceks","modifiable"=>"true"},credential-reference={clear-text="pass123"})
> {code}
> *It is expected some like this*
> {code}
> /subsystem=elytron/credential-store=cs:add(relative-to=jboss.server.data.dir,location="store.jceks",create=true, modifiable=true,implementation-properties={"keyStoreType"=>"JCEKS"},credential-reference={clear-text="pass123"})
> {code}
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years