[JBoss JIRA] (ELY-1105) FIPS mode, wildfly-config.xml does not support non-file based keystores (e.g. PKCS11)
by Darran Lofthouse (JIRA)
[ https://issues.jboss.org/browse/ELY-1105?page=com.atlassian.jira.plugin.s... ]
Darran Lofthouse updated ELY-1105:
----------------------------------
Fix Version/s: 1.1.0.Beta41
> FIPS mode, wildfly-config.xml does not support non-file based keystores (e.g. PKCS11)
> -------------------------------------------------------------------------------------
>
> Key: ELY-1105
> URL: https://issues.jboss.org/browse/ELY-1105
> Project: WildFly Elytron
> Issue Type: Bug
> Affects Versions: 1.1.0.Beta38
> Reporter: Martin Choma
> Assignee: Darran Lofthouse
> Priority: Blocker
> Fix For: 1.1.0.Beta41
>
>
> File is required during configuring key-store in wildfly-config.xml. This will make problem if user wants use non-file based keystore.
> Required file in xsd
> {code:xml|title=elytron-1_0.xsd}
> <xsd:complexType name="key-store-type">
> <xsd:sequence minOccurs="1" maxOccurs="1">
> <!-- Access source type -->
> <xsd:choice minOccurs="1" maxOccurs="1">
> <xsd:element name="file" type="name-type" minOccurs="1" maxOccurs="1"/>
> <xsd:element name="load-from" type="uri-type" minOccurs="1" maxOccurs="1"/>
> <xsd:element name="resource" type="name-type" minOccurs="1" maxOccurs="1"/>
> </xsd:choice>
> <!-- Protection parameter -->
> <xsd:choice minOccurs="0" maxOccurs="1">
> <xsd:element name="key-store-credential" type="key-store-ref-type" minOccurs="1" maxOccurs="1"/>
> <xsd:element name="key-store-clear-password" type="clear-password-type" minOccurs="1" maxOccurs="1"/>
> </xsd:choice>
> </xsd:sequence>
> <xsd:attribute name="name" type="xsd:string" use="required"/>
> <xsd:attribute name="type" type="xsd:string" use="required"/>
> <xsd:attribute name="provider" type="xsd:string" use="optional"/>
> <xsd:attribute name="wrap-passwords" type="xsd:boolean" use="optional" default="false"/>
> </xsd:complexType>
> {code}
> {code:xml|title=wildfly-config.xml}
> <key-stores>
> <key-store name="trustsore" type="PKCS11" provider="SunPKCS11-testPkcs">
> <file name="/does/not/exists"/>
> <key-store-clear-password password="pass123+"/>
> </key-store>
> </key-stores>
> {code}
> Error in server log
> {code:title=server.log}
> 14:12:58,961 ERROR [io.undertow.request] (default task-1) UT005023: Exception handling request to /wildfly-config-app/authenticationContext: java.lang.RuntimeException: org.wildfly.client.config.ConfigXMLParseException: ELY01135: Failed to load keystore data
> at vfs:/content/wildfly-config-app.war/META-INF/wildfly-config.xml:20:13
> at com.redhat.eap.qe.deployment.servlet.WildflyConfigXmlServlet.parseAndCreateAuthenticationClientConfiguration(WildflyConfigXmlServlet.java:119)
> at com.redhat.eap.qe.deployment.servlet.WildflyConfigXmlServlet.doGet(WildflyConfigXmlServlet.java:91)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:687)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
> at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
> at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
> at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
> at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
> at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
> at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
> at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
> at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
> at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
> at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
> at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
> at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
> at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
> at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
> at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
> at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
> at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
> at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
> at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
> at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
> at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1704)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1704)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1704)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1704)
> at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
> at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
> at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
> at io.undertow.server.Connectors.executeRootHandler(Connectors.java:211)
> at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:809)
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> at java.lang.Thread.run(Thread.java:745)
> Caused by: org.wildfly.client.config.ConfigXMLParseException: ELY01135: Failed to load keystore data
> at vfs:/content/wildfly-config-app.war/META-INF/wildfly-config.xml:20:13
> at org.wildfly.security.auth.client.ElytronXmlParser$AbstractLoadingKeyStoreFactory.get(ElytronXmlParser.java:2337)
> at org.wildfly.security.auth.client.ElytronXmlParser$AbstractLoadingKeyStoreFactory.get(ElytronXmlParser.java:2317)
> at org.wildfly.security.auth.client.ElytronXmlParser.parseAuthenticationClientType(ElytronXmlParser.java:303)
> at org.wildfly.security.auth.client.ElytronXmlParser.parseAuthenticationClientConfiguration(ElytronXmlParser.java:180)
> at org.wildfly.security.auth.client.ElytronXmlParser.parseAuthenticationClientConfiguration(ElytronXmlParser.java:141)
> at com.redhat.eap.qe.deployment.servlet.WildflyConfigXmlServlet.parseAndCreateAuthenticationClientConfiguration(WildflyConfigXmlServlet.java:116)
> ... 41 more
> Caused by: java.io.FileNotFoundException: /does/not/exists (No such file or directory)
> at java.io.FileInputStream.open0(Native Method)
> at java.io.FileInputStream.open(FileInputStream.java:195)
> at java.io.FileInputStream.<init>(FileInputStream.java:138)
> at java.io.FileInputStream.<init>(FileInputStream.java:93)
> at org.wildfly.security.auth.client.ElytronXmlParser$FileLoadingKeyStoreFactory.createStream(ElytronXmlParser.java:2354)
> at org.wildfly.security.auth.client.ElytronXmlParser$AbstractLoadingKeyStoreFactory.get(ElytronXmlParser.java:2332)
> ... 46 more
> {code}
> Relevant code
> {code:java|title=ElytronXmlParser.java}
> public KeyStore get() throws ConfigXMLParseException {
> try {
> KeyStore keyStore = delegateFactory.get();
> try (InputStream fis = createStream()) {
> keyStore.load(fis, passwordFactory == null ? null : passwordFactory.get());
> }
> return keyStore;
> } catch (GeneralSecurityException | IOException e) {
> throw xmlLog.xmlFailedToLoadKeyStoreData(location, e);
> }
> }
> {code}
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years
[JBoss JIRA] (ELY-1132) Unable to load passwords from wildfly-config.xml
by Darran Lofthouse (JIRA)
[ https://issues.jboss.org/browse/ELY-1132?page=com.atlassian.jira.plugin.s... ]
Darran Lofthouse commented on ELY-1132:
---------------------------------------
Thanks will take a look.
> Unable to load passwords from wildfly-config.xml
> ------------------------------------------------
>
> Key: ELY-1132
> URL: https://issues.jboss.org/browse/ELY-1132
> Project: WildFly Elytron
> Issue Type: Bug
> Reporter: Stuart Douglas
> Assignee: Darran Lofthouse
>
> I see the following exception, adding use-service-loader-providers does not help
> Caused by: java.security.NoSuchAlgorithmException: ELY08028: Invalid algorithm "clear"
> at org.wildfly.security.password.PasswordFactory.getInstance(PasswordFactory.java:121)
> at org.wildfly.security.auth.client.ElytronXmlParser.lambda$parseClearPassword$47(ElytronXmlParser.java:2009)
> ... 46 more
> Looks like this should just be hard coded to use the Elytron provider?
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years
[JBoss JIRA] (WFCORE-2147) Impossible to use environment variables or system properties in permissions.xml
by Adrian Boangiu (JIRA)
[ https://issues.jboss.org/browse/WFCORE-2147?page=com.atlassian.jira.plugi... ]
Adrian Boangiu commented on WFCORE-2147:
----------------------------------------
Is there a deadline or a release version targeted for this issue?
> Impossible to use environment variables or system properties in permissions.xml
> -------------------------------------------------------------------------------
>
> Key: WFCORE-2147
> URL: https://issues.jboss.org/browse/WFCORE-2147
> Project: WildFly Core
> Issue Type: Feature Request
> Components: Security
> Reporter: Adrian Boangiu
> Assignee: Darran Lofthouse
>
> Without this feature it is impossible to migrate "variable" Java file permissions such as:
> {noformat}
> permission java.io.FilePermission "${java.io.tmpdir}","read";
> permission java.io.FilePermission "${jboss.home.dir}${/}bin${/}javamelody${/}-","read,write,delete";
> permission java.io.FilePermission "${app.home.dir}${/}log${/}-","read,write,delete";
> {noformat}
> that were defined in Java policy file in previous verions of JBoss.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years
[JBoss JIRA] (DROOLS-1124) Unble to provision errors when creating KieContainor from KieServices in the Vert.X verticle
by leon v (JIRA)
[ https://issues.jboss.org/browse/DROOLS-1124?page=com.atlassian.jira.plugi... ]
leon v commented on DROOLS-1124:
--------------------------------
Mario, Were you able to reproduce this issue?
> Unble to provision errors when creating KieContainor from KieServices in the Vert.X verticle
> --------------------------------------------------------------------------------------------
>
> Key: DROOLS-1124
> URL: https://issues.jboss.org/browse/DROOLS-1124
> Project: Drools
> Issue Type: Bug
> Components: kie server
> Affects Versions: 6.4.0.CR2
> Environment: OS: MacOX and 10.10.5
> Vert.X: 3.2.1
> Reporter: xiaodong wang
> Assignee: Mario Fusco
> Attachments: Evaluation.zip, MavenTest.zip, MavenTest.zip
>
>
> WARN Sisu - Error injecting: org.apache.maven.execution.DefaultMavenExecutionRequestPopulator
> com.google.inject.ProvisionException: Unable to provision, see the following errors:
> 1) No implementation for org.apache.maven.repository.RepositorySystem was bound.
> while locating org.apache.maven.execution.DefaultMavenExecutionRequestPopulator
> 1 error
> at com.google.inject.internal.InjectorImpl$2.get(InjectorImpl.java:1018)
> at com.google.inject.internal.InjectorImpl.getInstance(InjectorImpl.java:1044)
> at org.eclipse.sisu.space.AbstractDeferredClass.get(AbstractDeferredClass.java:48)
> at com.google.inject.internal.ProviderInternalFactory.provision(ProviderInternalFactory.java:86)
> at com.google.inject.internal.InternalFactoryToInitializableAdapter.provision(InternalFactoryToInitializableAdapter.java:54)
> at com.google.inject.internal.ProviderInternalFactory$1.call(ProviderInternalFactory.java:70)
> at com.google.inject.internal.ProvisionListenerStackCallback$Provision.provision(ProvisionListenerStackCallback.java:113)
> at org.eclipse.sisu.bean.BeanScheduler$Activator.onProvision(BeanScheduler.java:176)
> at com.google.inject.internal.ProvisionListenerStackCallback$Provision.provision(ProvisionListenerStackCallback.java:122)
> at com.google.inject.internal.ProvisionListenerStackCallback.provision(ProvisionListenerStackCallback.java:68)
> at com.google.inject.internal.ProviderInternalFactory.circularGet(ProviderInternalFactory.java:68)
> at com.google.inject.internal.InternalFactoryToInitializableAdapter.get(InternalFactoryToInitializableAdapter.java:46)
> at com.google.inject.internal.ProviderToInternalFactoryAdapter$1.call(ProviderToInternalFactoryAdapter.java:46)
> at com.google.inject.internal.InjectorImpl.callInContext(InjectorImpl.java:1066)
> at com.google.inject.internal.ProviderToInternalFactoryAdapter.get(ProviderToInternalFactoryAdapter.java:40)
> at com.google.inject.Scopes$1$1.get(Scopes.java:59)
> at com.google.inject.internal.InternalFactoryToProviderAdapter.get(InternalFactoryToProviderAdapter.java:41)
> at com.google.inject.internal.InjectorImpl$2$1.call(InjectorImpl.java:1009)
> at com.google.inject.internal.InjectorImpl.callInContext(InjectorImpl.java:1059)
> at com.google.inject.internal.InjectorImpl$2.get(InjectorImpl.java:1005)
> at org.eclipse.sisu.inject.LazyBeanEntry.getValue(LazyBeanEntry.java:82)
> at org.eclipse.sisu.plexus.LazyPlexusBean.getValue(LazyPlexusBean.java:51)
> at org.codehaus.plexus.DefaultPlexusContainer.lookup(DefaultPlexusContainer.java:263)
> at org.codehaus.plexus.DefaultPlexusContainer.lookup(DefaultPlexusContainer.java:255)
> at org.codehaus.plexus.DefaultPlexusContainer.lookup(DefaultPlexusContainer.java:249)
> at org.kie.scanner.embedder.PlexusComponentProvider.lookup(PlexusComponentProvider.java:42)
> at org.kie.scanner.embedder.MavenEmbedder.buildMavenExecutionRequest(MavenEmbedder.java:119)
> at org.kie.scanner.embedder.MavenEmbedder.<init>(MavenEmbedder.java:90)
> at org.kie.scanner.embedder.MavenEmbedder.<init>(MavenEmbedder.java:81)
> at org.kie.scanner.embedder.MavenEmbedder.<init>(MavenEmbedder.java:75)
> at org.kie.scanner.embedder.MavenProjectLoader.parseMavenPom(MavenProjectLoader.java:42)
> at org.kie.scanner.embedder.MavenProjectLoader.loadMavenProject(MavenProjectLoader.java:96)
> at org.kie.scanner.Aether.<init>(Aether.java:62)
> at org.kie.scanner.Aether.getAether(Aether.java:74)
> at org.kie.scanner.MavenRepository.getMavenRepository(MavenRepository.java:80)
> at org.kie.scanner.ArtifactResolver.<init>(ArtifactResolver.java:53)
> at org.kie.scanner.KieRepositoryScannerImpl.getArtifactResolver(KieRepositoryScannerImpl.java:102)
> at org.kie.scanner.KieRepositoryScannerImpl.loadArtifact(KieRepositoryScannerImpl.java:119)
> at org.drools.compiler.kie.builder.impl.KieRepositoryImpl.loadKieModuleFromMavenRepo(KieRepositoryImpl.java:130)
> at org.drools.compiler.kie.builder.impl.KieRepositoryImpl.getKieModule(KieRepositoryImpl.java:116)
> at org.drools.compiler.kie.builder.impl.KieRepositoryImpl.getKieModule(KieRepositoryImpl.java:93)
> at org.drools.compiler.kie.builder.impl.KieServicesImpl.newKieContainer(KieServicesImpl.java:115)
> at org.drools.compiler.kie.builder.impl.KieServicesImpl.newKieContainer(KieServicesImpl.java:111)
> at com.cyngn.soothsayer.application.Server.init(Server.java:83)
> at io.vertx.core.impl.DeploymentManager.lambda$doDeploy$163(DeploymentManager.java:427)
> at io.vertx.core.impl.ContextImpl.lambda$wrapTask$18(ContextImpl.java:335)
> at io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:358)
> at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:357)
> at io.netty.util.concurrent.SingleThreadEventExecutor$2.run(SingleThreadEventExecutor.java:112)
> at java.lang.Thread.run(Thread.java:745)
> 14:22:39.388 [vert.x-eventloop-thread-1] ERROR o.kie.scanner.embedder.MavenEmbedder - Unable to build MavenEmbedder
> org.codehaus.plexus.component.repository.exception.ComponentLookupException: com.google.inject.ProvisionException: Unable to provision, see the following errors:
> 1) No implementation for org.apache.maven.repository.RepositorySystem was bound.
> while locating org.apache.maven.execution.DefaultMavenExecutionRequestPopulator
> at ClassRealm[maven, parent: ClassRealm[maven-parent, parent: null]] (via modules: org.eclipse.sisu.wire.WireModule -> org.eclipse.sisu.plexus.PlexusBindingModule)
> at ClassRealm[maven, parent: ClassRealm[maven-parent, parent: null]] (via modules: org.eclipse.sisu.wire.WireModule -> org.eclipse.sisu.plexus.PlexusBindingModule)
> while locating org.apache.maven.execution.MavenExecutionRequestPopulator
> 1 error
> role: org.apache.maven.execution.MavenExecutionRequestPopulator
> roleHint:
> at org.codehaus.plexus.DefaultPlexusContainer.lookup(DefaultPlexusContainer.java:267)
> at org.codehaus.plexus.DefaultPlexusContainer.lookup(DefaultPlexusContainer.java:255)
> at org.codehaus.plexus.DefaultPlexusContainer.lookup(DefaultPlexusContainer.java:249)
> at org.kie.scanner.embedder.PlexusComponentProvider.lookup(PlexusComponentProvider.java:42)
> at org.kie.scanner.embedder.MavenEmbedder.buildMavenExecutionRequest(MavenEmbedder.java:119)
> at org.kie.scanner.embedder.MavenEmbedder.<init>(MavenEmbedder.java:90)
> at org.kie.scanner.embedder.MavenEmbedder.<init>(MavenEmbedder.java:81)
> at org.kie.scanner.embedder.MavenEmbedder.<init>(MavenEmbedder.java:75)
> at org.kie.scanner.embedder.MavenProjectLoader.parseMavenPom(MavenProjectLoader.java:42)
> at org.kie.scanner.embedder.MavenProjectLoader.loadMavenProject(MavenProjectLoader.java:96)
> at org.kie.scanner.Aether.<init>(Aether.java:62)
> at org.kie.scanner.Aether.getAether(Aether.java:74)
> at org.kie.scanner.MavenRepository.getMavenRepository(MavenRepository.java:80)
> at org.kie.scanner.ArtifactResolver.<init>(ArtifactResolver.java:53)
> at org.kie.scanner.KieRepositoryScannerImpl.getArtifactResolver(KieRepositoryScannerImpl.java:102)
> at org.kie.scanner.KieRepositoryScannerImpl.loadArtifact(KieRepositoryScannerImpl.java:119)
> at org.drools.compiler.kie.builder.impl.KieRepositoryImpl.loadKieModuleFromMavenRepo(KieRepositoryImpl.java:130)
> at org.drools.compiler.kie.builder.impl.KieRepositoryImpl.getKieModule(KieRepositoryImpl.java:116)
> at org.drools.compiler.kie.builder.impl.KieRepositoryImpl.getKieModule(KieRepositoryImpl.java:93)
> at org.drools.compiler.kie.builder.impl.KieServicesImpl.newKieContainer(KieServicesImpl.java:115)
> at org.drools.compiler.kie.builder.impl.KieServicesImpl.newKieContainer(KieServicesImpl.java:111)
> at com.cyngn.soothsayer.application.Server.init(Server.java:83)
> at io.vertx.core.impl.DeploymentManager.lambda$doDeploy$163(DeploymentManager.java:427)
> at io.vertx.core.impl.ContextImpl.lambda$wrapTask$18(ContextImpl.java:335)
> at io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:358)
> at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:357)
> at io.netty.util.concurrent.SingleThreadEventExecutor$2.run(SingleThreadEventExecutor.java:112)
> at java.lang.Thread.run(Thread.java:745)
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years