[JBoss JIRA] (WFCORE-2671) CLI Opertation 'load' for Elytron key-store does not correctly re-read keystore
by Jan Kalina (JIRA)
[ https://issues.jboss.org/browse/WFCORE-2671?page=com.atlassian.jira.plugi... ]
Jan Kalina updated WFCORE-2671:
-------------------------------
Affects Version/s: 3.0.0.Beta21
> CLI Opertation 'load' for Elytron key-store does not correctly re-read keystore
> -------------------------------------------------------------------------------
>
> Key: WFCORE-2671
> URL: https://issues.jboss.org/browse/WFCORE-2671
> Project: WildFly Core
> Issue Type: Bug
> Components: Security
> Affects Versions: 3.0.0.Beta21
> Reporter: Ondrej Lukas
> Assignee: Jan Kalina
> Priority: Blocker
>
> When keystore (or cerficate in keystore) is changed during server runtime then CLI opertation {{load}} can be used for {{/subsystem=elytron/key-store=...}} to re-reading this keystore in server. However after calling this operation server still works with original keystore/certificate. Then CLI reads current keystore correctly, but in case when ssl-context which uses that key-store is used then original keystore is still used by server. Reload of server is required to correctly re-read the new keystore. See Steps to Reproduce for more details.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 1 month
[JBoss JIRA] (ELY-1164) Wildfly Elytron Tool, credential-store command doesn't support redirection (<, <<) when multiple options are missing which show prompts.
by Ilia Vassilev (JIRA)
[ https://issues.jboss.org/browse/ELY-1164?page=com.atlassian.jira.plugin.s... ]
Ilia Vassilev reassigned ELY-1164:
----------------------------------
Assignee: Ilia Vassilev (was: Darran Lofthouse)
> Wildfly Elytron Tool, credential-store command doesn't support redirection (<, <<) when multiple options are missing which show prompts.
> -----------------------------------------------------------------------------------------------------------------------------------------
>
> Key: ELY-1164
> URL: https://issues.jboss.org/browse/ELY-1164
> Project: WildFly Elytron
> Issue Type: Bug
> Components: Credential Store
> Reporter: Hynek Švábek
> Assignee: Ilia Vassilev
> Priority: Blocker
>
> Wildfly Elytron Tool, credential-store command doesn't support redirection (<, <<) when multiple options are missing which show prompts.
> User omit --password and --secret options and then get two (four: there is confirmation) prompts but user isn't able to redirect data to second one.
> Expected behaviour is that it must work.
> *How to reproduce*
> {code}
> java -jar wildfly-elytron-tool.jar credential-store --add secret_alias --create -l cs001.jceks --summary << EOF
> pass123
> pass123
> secret_value
> secret_value
> EOF
> {code}
> *has this output:*
> {code}
> Exception encountered executing the command:
> java.lang.Exception: java.io.IOException: Stream closed
> at org.wildfly.security.tool.Command.prompt(Command.java:115)
> at org.wildfly.security.tool.CredentialStoreCommand.execute(CredentialStoreCommand.java:184)
> at org.wildfly.security.tool.ElytronTool.main(ElytronTool.java:75)
> Caused by: java.io.IOException: Stream closed
> at java.io.BufferedInputStream.getBufIfOpen(BufferedInputStream.java:170)
> at java.io.BufferedInputStream.read(BufferedInputStream.java:336)
> at sun.nio.cs.StreamDecoder.readBytes(StreamDecoder.java:284)
> at sun.nio.cs.StreamDecoder.implRead(StreamDecoder.java:326)
> at sun.nio.cs.StreamDecoder.read(StreamDecoder.java:178)
> at java.io.InputStreamReader.read(InputStreamReader.java:184)
> at java.io.BufferedReader.fill(BufferedReader.java:161)
> at java.io.BufferedReader.readLine(BufferedReader.java:324)
> at java.io.BufferedReader.readLine(BufferedReader.java:389)
> at org.wildfly.security.tool.Command.prompt(Command.java:100)
> ... 2 more
> {code}
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 1 month
[JBoss JIRA] (ELY-1165) Wildfly Elytron Tool, credential-store command "add" option doesn't contain entry-type in summary for adding new alias to credential store storage.
by Ilia Vassilev (JIRA)
[ https://issues.jboss.org/browse/ELY-1165?page=com.atlassian.jira.plugin.s... ]
Ilia Vassilev reassigned ELY-1165:
----------------------------------
Assignee: Ilia Vassilev (was: Darran Lofthouse)
> Wildfly Elytron Tool, credential-store command "add" option doesn't contain entry-type in summary for adding new alias to credential store storage.
> ---------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: ELY-1165
> URL: https://issues.jboss.org/browse/ELY-1165
> Project: WildFly Elytron
> Issue Type: Bug
> Components: Credential Store
> Reporter: Hynek Švábek
> Assignee: Ilia Vassilev
> Priority: Critical
>
> Wildfly Elytron Tool credential-store command "add" option doesn't contain entry-type in summary for adding new alias to credential store storage.
> When user uses non-default entry-type that is expected entry-type in CLI command as in example below:
> {code}
> /subsystem=elytron/credential-store=test/alias=secret_alias:add(secret-value="secret_password", entry-type="org.wildfly.security.credential.PasswordCredential")
> {code}
> *How to reproduce*
> {code}
> java -jar ./bin/wildfly-elytron-tool.jar credential-store --create --add secret_alias --password pass123 --secret secret_password --location store.jceks -n org.wildfly.security.credential.PasswordCredential --summary
> Alias "secret_alias" has been successfully stored
> Credential store command summary:
> --------------------------------------
> /subsystem=elytron/credential-store=cs:add(relative-to=jboss.server.data.dir,create=true,modifiable=true,location="store.jceks",implementation-properties={"keyStoreType"=>"JCEKS"},credential-reference={clear-text="pass123"})
> /subsystem=elytron/credential-store=test/alias=secret_alias:add(secret-value="secret_password")
> {code}
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 1 month
[JBoss JIRA] (WFCORE-2632) write-attribute with {allow-resource-service-restart=true} causes DuplicateServiceException for Elytron security-domain
by Darran Lofthouse (JIRA)
[ https://issues.jboss.org/browse/WFCORE-2632?page=com.atlassian.jira.plugi... ]
Darran Lofthouse reassigned WFCORE-2632:
----------------------------------------
Assignee: Chao Wang (was: Darran Lofthouse)
> write-attribute with {allow-resource-service-restart=true} causes DuplicateServiceException for Elytron security-domain
> -----------------------------------------------------------------------------------------------------------------------
>
> Key: WFCORE-2632
> URL: https://issues.jboss.org/browse/WFCORE-2632
> Project: WildFly Core
> Issue Type: Bug
> Components: Security
> Affects Versions: 3.0.0.Beta13
> Reporter: Ondrej Lukas
> Assignee: Chao Wang
> Priority: Critical
>
> In case when some attribute of Elytron security-domain is changed through CLI write-attribute with {{allow-resource-service-restart=true}} flag then it finishes with DuplicateServiceException. In case when it is executed again then in passes correctly.
> See:
> {code}
> /subsystem=elytron/security-domain=ManagementDomain:write-attribute(name=realm-mapper,value=local){allow-resource-service-restart=true}
> {
> "outcome" => "failed",
> "failure-description" => "WFLYCTL0158: Operation handler failed: org.jboss.msc.service.DuplicateServiceException: Service org.wildfly.security.security-domain.ManagementDomain.initial is already registered",
> "rolled-back" => true
> }
> /subsystem=elytron/security-domain=ManagementDomain:write-attribute(name=realm-mapper,value=local){allow-resource-service-restart=true}
> {"outcome" => "success"}
> {code}
> Thrown exception to server log:
> {code}
> ERROR [org.jboss.as.controller.management-operation] (management-handler-thread - 4) WFLYCTL0013: Operation ("write-attribute") failed - address: ([
> ("subsystem" => "elytron"),
> ("security-domain" => "ManagementDomain")
> ]): org.jboss.msc.service.DuplicateServiceException: Service org.wildfly.security.security-domain.ManagementDomain.initial is already registered
> at org.jboss.msc.service.ServiceRegistrationImpl.setInstance(ServiceRegistrationImpl.java:158)
> at org.jboss.msc.service.ServiceControllerImpl.startInstallation(ServiceControllerImpl.java:235)
> at org.jboss.msc.service.ServiceContainerImpl.install(ServiceContainerImpl.java:768)
> at org.jboss.msc.service.ServiceTargetImpl.install(ServiceTargetImpl.java:223)
> at org.jboss.msc.service.ServiceControllerImpl$ChildServiceTarget.install(ServiceControllerImpl.java:2555)
> at org.jboss.msc.service.ServiceTargetImpl.install(ServiceTargetImpl.java:223)
> at org.jboss.msc.service.ServiceControllerImpl$ChildServiceTarget.install(ServiceControllerImpl.java:2555)
> at org.jboss.msc.service.ServiceBuilderImpl.install(ServiceBuilderImpl.java:317)
> at org.jboss.as.controller.OperationContextImpl.installService(OperationContextImpl.java:2015)
> at org.jboss.as.controller.OperationContextImpl.access$500(OperationContextImpl.java:132)
> at org.jboss.as.controller.OperationContextImpl$2$1.installService(OperationContextImpl.java:749)
> at org.jboss.as.controller.OperationContextImpl$ContextServiceBuilder.install(OperationContextImpl.java:2209)
> at org.jboss.as.controller.DelegatingServiceBuilder.install(DelegatingServiceBuilder.java:218)
> at org.wildfly.extension.elytron.DomainDefinition.installInitialService(DomainDefinition.java:307)
> at org.wildfly.extension.elytron.DomainDefinition.installService(DomainDefinition.java:324)
> at org.wildfly.extension.elytron.DomainDefinition.access$400(DomainDefinition.java:96)
> at org.wildfly.extension.elytron.DomainDefinition$WriteAttributeHandler.recreateParentService(DomainDefinition.java:494)
> at org.jboss.as.controller.RestartParentWriteAttributeHandler.applyUpdateToRuntime(RestartParentWriteAttributeHandler.java:72)
> at org.jboss.as.controller.AbstractWriteAttributeHandler$1.execute(AbstractWriteAttributeHandler.java:104)
> at org.jboss.as.controller.AbstractOperationContext.executeStep(AbstractOperationContext.java:979)
> at org.jboss.as.controller.AbstractOperationContext.processStages(AbstractOperationContext.java:722)
> at org.jboss.as.controller.AbstractOperationContext.executeOperation(AbstractOperationContext.java:441)
> at org.jboss.as.controller.OperationContextImpl.executeOperation(OperationContextImpl.java:1397)
> at org.jboss.as.controller.ModelControllerImpl.internalExecute(ModelControllerImpl.java:421)
> at org.jboss.as.controller.ModelControllerImpl.lambda$execute$1(ModelControllerImpl.java:243)
> at org.wildfly.security.auth.server.SecurityIdentity.runAs(SecurityIdentity.java:263)
> at org.wildfly.security.auth.server.SecurityIdentity.runAs(SecurityIdentity.java:229)
> at org.jboss.as.controller.ModelControllerImpl.execute(ModelControllerImpl.java:243)
> at org.jboss.as.controller.remote.ModelControllerClientOperationHandler$ExecuteRequestHandler.doExecute(ModelControllerClientOperationHandler.java:217)
> at org.jboss.as.controller.remote.ModelControllerClientOperationHandler$ExecuteRequestHandler.access$400(ModelControllerClientOperationHandler.java:137)
> at org.jboss.as.controller.remote.ModelControllerClientOperationHandler$ExecuteRequestHandler$1$1.run(ModelControllerClientOperationHandler.java:161)
> at org.jboss.as.controller.remote.ModelControllerClientOperationHandler$ExecuteRequestHandler$1$1.run(ModelControllerClientOperationHandler.java:157)
> at org.wildfly.security.auth.server.SecurityIdentity.runAs(SecurityIdentity.java:287)
> at org.wildfly.security.auth.server.SecurityIdentity.runAs(SecurityIdentity.java:244)
> at org.jboss.as.controller.AccessAuditContext.doAs(AccessAuditContext.java:254)
> at org.jboss.as.controller.AccessAuditContext.doAs(AccessAuditContext.java:225)
> at org.jboss.as.controller.remote.ModelControllerClientOperationHandler$ExecuteRequestHandler$1.execute(ModelControllerClientOperationHandler.java:157)
> at org.jboss.as.protocol.mgmt.ManagementRequestContextImpl$1.doExecute(ManagementRequestContextImpl.java:70)
> at org.jboss.as.protocol.mgmt.ManagementRequestContextImpl$AsyncTaskRunner.run(ManagementRequestContextImpl.java:160)
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> at java.lang.Thread.run(Thread.java:745)
> at org.jboss.threads.JBossThread.run(JBossThread.java:320)
> {code}
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 1 month