[JBoss JIRA] (WFCORE-2767) Elytron Keystore resource needs restart when is changed credential-reference attribute but restart-required is set to "no-services"
by Yeray Borges (JIRA)
[ https://issues.jboss.org/browse/WFCORE-2767?page=com.atlassian.jira.plugi... ]
Yeray Borges updated WFCORE-2767:
---------------------------------
Steps to Reproduce:
{code}
/subsystem=elytron/credential-store=cs001:add(credential-reference={clear-text=pass123}, create=true, location=cs001.jceks)
{code}
{code}
/subsystem=elytron/credential-store=cs001:add-alias(alias=ff,secret-value=Elytron)
{code}
Copy firefly.keystore from attachment to JBOSS_HOME/standalone/data
{code}
/subsystem=elytron/key-store=firefly:add(path=firefly.keystore,relative-to=jboss.server.data.dir,type=JKS,credential-reference= {store=cs001,alias=ff})
{code}
You can list all aliases in keystore
{code}
/subsystem=elytron/key-store=firefly:read-aliases
{
"outcome" => "success",
"result" => [
"ca",
"firefly"
]
}
{code}
We create another credential store with same alias entry but different value
{code}
/subsystem=elytron/credential-store=cs002:add(credential-reference={clear-text=pass123}, create=true, location=cs002.jceks)
{code}
{code}
/subsystem=elytron/credential-store=cs002:add-alias(alias=ff, secret-value=ElytronWrong)
{code}
*Now we change credential-reference for keystore to second credential store with invalid password to keystore access.*
{code}
/subsystem=elytron/key-store=firefly:write-attribute(name=credential-reference.store, value=cs002)
{
"outcome" => "success",
"response-headers" => {
"operation-requires-reload" => true,
"process-state" => "reload-required"
}
}
{code}
Reload is required for credential-reference but in model we see "restart-required" => "no-services"
{code:collapse}
"credential-reference" => {
"type" => OBJECT,
"description" => "The reference to credential stored in CredentialStore under defined alias or clear text password.",
"expressions-allowed" => false,
"required" => true,
"nillable" => false,
"access-constraints" => {"sensitive" => {"credential" => {"type" => "core"}}},
"value-type" => {
"store" => {
"type" => STRING,
"description" => "The name of the credential store holding the alias to credential.",
"expressions-allowed" => false,
"required" => false,
"nillable" => true,
"capability-reference" => "org.wildfly.security.credential-store",
"min-length" => 1L,
"max-length" => 2147483647L
},
"alias" => {
"type" => STRING,
"description" => "The alias which denotes stored secret or credential in the store.",
"expressions-allowed" => true,
"required" => false,
"nillable" => true,
"min-length" => 1L,
"max-length" => 2147483647L
},
"type" => {
"type" => STRING,
"description" => "The type of credential this reference is denoting.",
"expressions-allowed" => true,
"required" => false,
"nillable" => true,
"min-length" => 1L,
"max-length" => 2147483647L
},
"clear-text" => {
"type" => STRING,
"description" => "Secret specified using clear text. Check credential store way of supplying credential/secrets to services.",
"expressions-allowed" => true,
"required" => false,
"nillable" => true,
"min-length" => 1L,
"max-length" => 2147483647L
}
},
"access-type" => "read-write",
"storage" => "configuration",
"restart-required" => "no-services"
}
{code}
*Set allow-resource-service-restart header property to true doesn't help*
{code}
/subsystem=elytron/key-store=firefly:write-attribute(name=credential-reference.store, value=cs002){allow-resource-service-restart=true}
{
"outcome" => "success",
"response-headers" => {
"operation-requires-reload" => true,
"process-state" => "reload-required"
}
}
{code}
was:
{code}
/subsystem=elytron/credential-store=cs001:add(credential-reference={clear-text=pass123}, create=true, location=cs001.jceks)
{code}
{code}
/subsystem=elytron/credential-store=cs001:add-alias(alias=ff,secret-value=Elytron)
{code}
Copy firefly.keystore from attachment to JBOSS_HOME/standalone/data
{code}
/subsystem=elytron/key-store=firefly:add(path=firefly.keystore,relative-to=jboss.server.data.dir,type=JKS,credential-reference= {store=cs001,alias=ff})
{code}
You can list all aliases in keystore
{code}
/subsystem=elytron/key-store=firefly:read-children-names(child-type=alias)
{
"outcome" => "success",
"result" => [
"ca",
"firefly"
]
}
{code}
We create another credential store with same alias entry but different value
{code}
/subsystem=elytron/credential-store=cs002:add(credential-reference={clear-text=pass123}, create=true, location=cs002.jceks)
{code}
{code}
/subsystem=elytron/credential-store=cs002/alias=ff:add(secret-value=ElytronWrong)
{code}
*Now we change credential-reference for keystore to second credential store with invalid password to keystore access.*
{code}
/subsystem=elytron/key-store=firefly:write-attribute(name=credential-reference.store, value=cs002)
{
"outcome" => "success",
"response-headers" => {
"operation-requires-reload" => true,
"process-state" => "reload-required"
}
}
{code}
Reload is required for credential-reference but in model we see "restart-required" => "no-services"
{code:collapse}
"credential-reference" => {
"type" => OBJECT,
"description" => "The reference to credential stored in CredentialStore under defined alias or clear text password.",
"expressions-allowed" => false,
"required" => true,
"nillable" => false,
"access-constraints" => {"sensitive" => {"credential" => {"type" => "core"}}},
"value-type" => {
"store" => {
"type" => STRING,
"description" => "The name of the credential store holding the alias to credential.",
"expressions-allowed" => false,
"required" => false,
"nillable" => true,
"capability-reference" => "org.wildfly.security.credential-store",
"min-length" => 1L,
"max-length" => 2147483647L
},
"alias" => {
"type" => STRING,
"description" => "The alias which denotes stored secret or credential in the store.",
"expressions-allowed" => true,
"required" => false,
"nillable" => true,
"min-length" => 1L,
"max-length" => 2147483647L
},
"type" => {
"type" => STRING,
"description" => "The type of credential this reference is denoting.",
"expressions-allowed" => true,
"required" => false,
"nillable" => true,
"min-length" => 1L,
"max-length" => 2147483647L
},
"clear-text" => {
"type" => STRING,
"description" => "Secret specified using clear text. Check credential store way of supplying credential/secrets to services.",
"expressions-allowed" => true,
"required" => false,
"nillable" => true,
"min-length" => 1L,
"max-length" => 2147483647L
}
},
"access-type" => "read-write",
"storage" => "configuration",
"restart-required" => "no-services"
}
{code}
*Set allow-resource-service-restart header property to true doesn't help*
{code}
/subsystem=elytron/key-store=firefly:write-attribute(name=credential-reference.store, value=cs002){allow-resource-service-restart=true}
{
"outcome" => "success",
"response-headers" => {
"operation-requires-reload" => true,
"process-state" => "reload-required"
}
}
{code}
> Elytron Keystore resource needs restart when is changed credential-reference attribute but restart-required is set to "no-services"
> -----------------------------------------------------------------------------------------------------------------------------------
>
> Key: WFCORE-2767
> URL: https://issues.jboss.org/browse/WFCORE-2767
> Project: WildFly Core
> Issue Type: Bug
> Components: Security
> Reporter: Hynek Švábek
> Assignee: Yeray Borges
> Priority: Critical
>
> Elytron Keystore resource needs restart when is changed credential-reference attribute but restart-required is set to "no-services"
> There should be rather restart-required set to "resource-services" and ability to use allow-resource-service-restart=true header property
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 11 months
[JBoss JIRA] (WFCORE-2767) Elytron Keystore resource needs restart when is changed credential-reference attribute but restart-required is set to "no-services"
by Yeray Borges (JIRA)
[ https://issues.jboss.org/browse/WFCORE-2767?page=com.atlassian.jira.plugi... ]
Yeray Borges updated WFCORE-2767:
---------------------------------
Steps to Reproduce:
{code}
/subsystem=elytron/credential-store=cs001:add(credential-reference={clear-text=pass123}, create=true, location=cs001.jceks)
{code}
{code}
/subsystem=elytron/credential-store=cs001:add-alias(alias=ff,secret-value=Elytron)
{code}
Copy firefly.keystore from attachment to JBOSS_HOME/standalone/data
{code}
/subsystem=elytron/key-store=firefly:add(path=firefly.keystore,relative-to=jboss.server.data.dir,type=JKS,credential-reference= {store=cs001,alias=ff})
{code}
You can list all aliases in keystore
{code}
/subsystem=elytron/key-store=firefly:read-children-names(child-type=alias)
{
"outcome" => "success",
"result" => [
"ca",
"firefly"
]
}
{code}
We create another credential store with same alias entry but different value
{code}
/subsystem=elytron/credential-store=cs002:add(credential-reference={clear-text=pass123}, create=true, location=cs002.jceks)
{code}
{code}
/subsystem=elytron/credential-store=cs002/alias=ff:add(secret-value=ElytronWrong)
{code}
*Now we change credential-reference for keystore to second credential store with invalid password to keystore access.*
{code}
/subsystem=elytron/key-store=firefly:write-attribute(name=credential-reference.store, value=cs002)
{
"outcome" => "success",
"response-headers" => {
"operation-requires-reload" => true,
"process-state" => "reload-required"
}
}
{code}
Reload is required for credential-reference but in model we see "restart-required" => "no-services"
{code:collapse}
"credential-reference" => {
"type" => OBJECT,
"description" => "The reference to credential stored in CredentialStore under defined alias or clear text password.",
"expressions-allowed" => false,
"required" => true,
"nillable" => false,
"access-constraints" => {"sensitive" => {"credential" => {"type" => "core"}}},
"value-type" => {
"store" => {
"type" => STRING,
"description" => "The name of the credential store holding the alias to credential.",
"expressions-allowed" => false,
"required" => false,
"nillable" => true,
"capability-reference" => "org.wildfly.security.credential-store",
"min-length" => 1L,
"max-length" => 2147483647L
},
"alias" => {
"type" => STRING,
"description" => "The alias which denotes stored secret or credential in the store.",
"expressions-allowed" => true,
"required" => false,
"nillable" => true,
"min-length" => 1L,
"max-length" => 2147483647L
},
"type" => {
"type" => STRING,
"description" => "The type of credential this reference is denoting.",
"expressions-allowed" => true,
"required" => false,
"nillable" => true,
"min-length" => 1L,
"max-length" => 2147483647L
},
"clear-text" => {
"type" => STRING,
"description" => "Secret specified using clear text. Check credential store way of supplying credential/secrets to services.",
"expressions-allowed" => true,
"required" => false,
"nillable" => true,
"min-length" => 1L,
"max-length" => 2147483647L
}
},
"access-type" => "read-write",
"storage" => "configuration",
"restart-required" => "no-services"
}
{code}
*Set allow-resource-service-restart header property to true doesn't help*
{code}
/subsystem=elytron/key-store=firefly:write-attribute(name=credential-reference.store, value=cs002){allow-resource-service-restart=true}
{
"outcome" => "success",
"response-headers" => {
"operation-requires-reload" => true,
"process-state" => "reload-required"
}
}
{code}
was:
{code}
/subsystem=elytron/credential-store=cs001:add(credential-reference={clear-text=pass123}, create=true, location=cs001.jceks)
{code}
{code}
/subsystem=elytron/credential-store=cs001/alias=ff:add(secret-value=Elytron)
{code}
Copy firefly.keystore from attachment to JBOSS_HOME/standalone/data
{code}
/subsystem=elytron/key-store=firefly:add(path=firefly.keystore,relative-to=jboss.server.data.dir,type=JKS,credential-reference= {store=cs001,alias=ff})
{code}
You can list all aliases in keystore
{code}
/subsystem=elytron/key-store=firefly:read-children-names(child-type=alias)
{
"outcome" => "success",
"result" => [
"ca",
"firefly"
]
}
{code}
We create another credential store with same alias entry but different value
{code}
/subsystem=elytron/credential-store=cs002:add(credential-reference={clear-text=pass123}, create=true, location=cs002.jceks)
{code}
{code}
/subsystem=elytron/credential-store=cs002/alias=ff:add(secret-value=ElytronWrong)
{code}
*Now we change credential-reference for keystore to second credential store with invalid password to keystore access.*
{code}
/subsystem=elytron/key-store=firefly:write-attribute(name=credential-reference.store, value=cs002)
{
"outcome" => "success",
"response-headers" => {
"operation-requires-reload" => true,
"process-state" => "reload-required"
}
}
{code}
Reload is required for credential-reference but in model we see "restart-required" => "no-services"
{code:collapse}
"credential-reference" => {
"type" => OBJECT,
"description" => "The reference to credential stored in CredentialStore under defined alias or clear text password.",
"expressions-allowed" => false,
"required" => true,
"nillable" => false,
"access-constraints" => {"sensitive" => {"credential" => {"type" => "core"}}},
"value-type" => {
"store" => {
"type" => STRING,
"description" => "The name of the credential store holding the alias to credential.",
"expressions-allowed" => false,
"required" => false,
"nillable" => true,
"capability-reference" => "org.wildfly.security.credential-store",
"min-length" => 1L,
"max-length" => 2147483647L
},
"alias" => {
"type" => STRING,
"description" => "The alias which denotes stored secret or credential in the store.",
"expressions-allowed" => true,
"required" => false,
"nillable" => true,
"min-length" => 1L,
"max-length" => 2147483647L
},
"type" => {
"type" => STRING,
"description" => "The type of credential this reference is denoting.",
"expressions-allowed" => true,
"required" => false,
"nillable" => true,
"min-length" => 1L,
"max-length" => 2147483647L
},
"clear-text" => {
"type" => STRING,
"description" => "Secret specified using clear text. Check credential store way of supplying credential/secrets to services.",
"expressions-allowed" => true,
"required" => false,
"nillable" => true,
"min-length" => 1L,
"max-length" => 2147483647L
}
},
"access-type" => "read-write",
"storage" => "configuration",
"restart-required" => "no-services"
}
{code}
*Set allow-resource-service-restart header property to true doesn't help*
{code}
/subsystem=elytron/key-store=firefly:write-attribute(name=credential-reference.store, value=cs002){allow-resource-service-restart=true}
{
"outcome" => "success",
"response-headers" => {
"operation-requires-reload" => true,
"process-state" => "reload-required"
}
}
{code}
> Elytron Keystore resource needs restart when is changed credential-reference attribute but restart-required is set to "no-services"
> -----------------------------------------------------------------------------------------------------------------------------------
>
> Key: WFCORE-2767
> URL: https://issues.jboss.org/browse/WFCORE-2767
> Project: WildFly Core
> Issue Type: Bug
> Components: Security
> Reporter: Hynek Švábek
> Assignee: Yeray Borges
> Priority: Critical
>
> Elytron Keystore resource needs restart when is changed credential-reference attribute but restart-required is set to "no-services"
> There should be rather restart-required set to "resource-services" and ability to use allow-resource-service-restart=true header property
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 11 months
[JBoss JIRA] (ELY-1207) Incorrectly named attribute match-user in authentication-context in Elytron subsystem
by Jan Kalina (JIRA)
[ https://issues.jboss.org/browse/ELY-1207?page=com.atlassian.jira.plugin.s... ]
Jan Kalina moved WFCORE-2875 to ELY-1207:
-----------------------------------------
Project: WildFly Elytron (was: WildFly Core)
Key: ELY-1207 (was: WFCORE-2875)
Component/s: XML
(was: Security)
> Incorrectly named attribute match-user in authentication-context in Elytron subsystem
> -------------------------------------------------------------------------------------
>
> Key: ELY-1207
> URL: https://issues.jboss.org/browse/ELY-1207
> Project: WildFly Elytron
> Issue Type: Bug
> Components: XML
> Reporter: Ondrej Lukas
> Assignee: Darran Lofthouse
> Priority: Critical
> Labels: user_experience
>
> Rule matcher {{match-user}} in authentication-context in Elytron subsystem internally uses {{org.wildfly.security.auth.client.MatchUserRule}}. This matcher works based on passed userinfo. However naming of {{match-user}} in Elytron subsystem indicates that just user part of userinfo should be used in matching.
> Also description in CLI is not correct, it says: _The user to match against._
> It means one of following should be changed:
> * name of {{match-user}}
> * functionality of {{MatchUserRule}}
> Since Elytron client configuration file includes for the same matcher with name {{match-userinfo}} then I suggest to rename attribute {{match-user}} in {{authentication-context}} in Elytron subsystem to {{match-userinfo}} and improve description in CLI and XSD.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 11 months
[JBoss JIRA] (ELY-1207) Incorrectly named attribute match-user in authentication-context in Elytron subsystem
by Jan Kalina (JIRA)
[ https://issues.jboss.org/browse/ELY-1207?page=com.atlassian.jira.plugin.s... ]
Jan Kalina reassigned ELY-1207:
-------------------------------
Assignee: Jan Kalina (was: Darran Lofthouse)
> Incorrectly named attribute match-user in authentication-context in Elytron subsystem
> -------------------------------------------------------------------------------------
>
> Key: ELY-1207
> URL: https://issues.jboss.org/browse/ELY-1207
> Project: WildFly Elytron
> Issue Type: Bug
> Components: XML
> Reporter: Ondrej Lukas
> Assignee: Jan Kalina
> Priority: Critical
> Labels: user_experience
>
> Rule matcher {{match-user}} in authentication-context in Elytron subsystem internally uses {{org.wildfly.security.auth.client.MatchUserRule}}. This matcher works based on passed userinfo. However naming of {{match-user}} in Elytron subsystem indicates that just user part of userinfo should be used in matching.
> Also description in CLI is not correct, it says: _The user to match against._
> It means one of following should be changed:
> * name of {{match-user}}
> * functionality of {{MatchUserRule}}
> Since Elytron client configuration file includes for the same matcher with name {{match-userinfo}} then I suggest to rename attribute {{match-user}} in {{authentication-context}} in Elytron subsystem to {{match-userinfo}} and improve description in CLI and XSD.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 11 months
[JBoss JIRA] (WFCORE-2880) remove-alias should fail when remove non-existent alias from credential store.
by Hynek Švábek (JIRA)
Hynek Švábek created WFCORE-2880:
------------------------------------
Summary: remove-alias should fail when remove non-existent alias from credential store.
Key: WFCORE-2880
URL: https://issues.jboss.org/browse/WFCORE-2880
Project: WildFly Core
Issue Type: Bug
Components: Security
Reporter: Hynek Švábek
Assignee: Darran Lofthouse
Priority: Critical
remove-alias should fail when remove non-existent alias from credential store.
There is expected fail when we try to remove non-existent alias from credential store.
*How to reproduce*
*create credential store*
{code}
/subsystem=elytron/credential-store=cs001:add(create=true, credential-reference={clear-text=pass123},location=cs001.jceks)
{code}
*Try to remove alias from empty credential store*
{code}
/subsystem=elytron/credential-store=cs001:remove-alias(alias=alias001)
{
"outcome" => "success",
"result" => undefined
}
{code}
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 11 months