[JBoss JIRA] (WFLY-6634) Add remote-cache-container configuration to Infinispan subsystem
by Radoslav Husar (JIRA)
[ https://issues.jboss.org/browse/WFLY-6634?page=com.atlassian.jira.plugin.... ]
Radoslav Husar commented on WFLY-6634:
--------------------------------------
[~kabirkhan] This is being tracked by EAP7-942.
[~rjanik] I am not following -- last week you informed me that you will not be taking this issue but instead [~mvinkler] will be the tester for this. Has this changed again?
> Add remote-cache-container configuration to Infinispan subsystem
> ----------------------------------------------------------------
>
> Key: WFLY-6634
> URL: https://issues.jboss.org/browse/WFLY-6634
> Project: WildFly
> Issue Type: Feature Request
> Components: Clustering
> Affects Versions: 10.0.0.Final
> Reporter: Paul Ferraro
> Assignee: Radoslav Husar
>
> Need to establish schema/model.
> We probably want to create new capabilities for existing container/caches to expose generic BasicCache/BasicCacheContainer types.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 4 months
[JBoss JIRA] (WFLY-6634) Add remote-cache-container configuration to Infinispan subsystem
by Richard Janík (JIRA)
[ https://issues.jboss.org/browse/WFLY-6634?page=com.atlassian.jira.plugin.... ]
Richard Janík commented on WFLY-6634:
-------------------------------------
Based on our discussions with [~mjurc], I'll handle this for QE. We're happy with option 1 - we'll need an EAP7 issue to track this and we'll need to create some integration tests for the new configuration options + test injecting the RemoteCacheManager-s.
> Add remote-cache-container configuration to Infinispan subsystem
> ----------------------------------------------------------------
>
> Key: WFLY-6634
> URL: https://issues.jboss.org/browse/WFLY-6634
> Project: WildFly
> Issue Type: Feature Request
> Components: Clustering
> Affects Versions: 10.0.0.Final
> Reporter: Paul Ferraro
> Assignee: Radoslav Husar
>
> Need to establish schema/model.
> We probably want to create new capabilities for existing container/caches to expose generic BasicCache/BasicCacheContainer types.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 4 months
[JBoss JIRA] (WFLY-6634) Add remote-cache-container configuration to Infinispan subsystem
by Kabir Khan (JIRA)
[ https://issues.jboss.org/browse/WFLY-6634?page=com.atlassian.jira.plugin.... ]
Kabir Khan commented on WFLY-6634:
----------------------------------
[~rhusar] [~pferraro] - Can we go with option 1? Since this part is more or less done, and it sounds like [~mjurc] is happy with what is done. So getting the docs and tests in order should be more of a formality, and then the later work is unblocked
> Add remote-cache-container configuration to Infinispan subsystem
> ----------------------------------------------------------------
>
> Key: WFLY-6634
> URL: https://issues.jboss.org/browse/WFLY-6634
> Project: WildFly
> Issue Type: Feature Request
> Components: Clustering
> Affects Versions: 10.0.0.Final
> Reporter: Paul Ferraro
> Assignee: Radoslav Husar
>
> Need to establish schema/model.
> We probably want to create new capabilities for existing container/caches to expose generic BasicCache/BasicCacheContainer types.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 4 months
[JBoss JIRA] (WFLY-10014) Unable to configure comma delimited enabled-protocols in remote-connector
by Nagaraju Chitimilla (JIRA)
[ https://issues.jboss.org/browse/WFLY-10014?page=com.atlassian.jira.plugin... ]
Nagaraju Chitimilla edited comment on WFLY-10014 at 3/14/18 7:03 AM:
---------------------------------------------------------------------
I have tried escaping the with the following options, but its always giving exception:
<param name="enabled-protocols" value="TLSv1.1\\\,TLSv1.2"/>
*Error:* java.lang.IllegalArgumentException: Invalid expression TLSv1.2 at enabledProtocols=TLSv1.1\\\,TLSv1.2
<param name="enabled-protocols" value="TLSv1.1"\\\,"TLSv1.2"/>
*Error:*
<param name="enabled-protocols" value="TLSv1.1"\\\,"TLSv1.2"/>
^^^^ Unexpected character '\' (code 92) excepted space, or '>' or "/>"
at [row,col {unknown-source}]: [656,53]
Can you let me know the exact behavior?
*Note*: If i specified two escape characters in the comments section some how its not showing in the comments. So have added it as \\\ slashes but in the actual configuration its only two slashes.
Thanks in advance
-Nagaraju
was (Author: n_nagraj321):
I have tried escaping the with the following options, but its always giving exception:
<param name="enabled-protocols" value="TLSv1.1*\\\*,TLSv1.2"/>
*Error:* java.lang.IllegalArgumentException: Invalid expression TLSv1.2 at enabledProtocols=TLSv1.1*\\\*,TLSv1.2
<param name="enabled-protocols" value="TLSv1.1*"\\\,"*TLSv1.2"/>
*Error:*
<param name="enabled-protocols" value="TLSv1.1*"\\\,"*TLSv1.2"/>
^^^^ Unexpected character '\' (code 92) excepted space, or '>' or "/>"
at [row,col {unknown-source}]: [656,53]
Can you let me know the exact behavior?
*Note*: If i specified two escape characters in the comments section some how its not showing in the comments. So have added it as \\\ slashes but in the actual configuration its only two slashes.
Thanks in advance
-Nagaraju
> Unable to configure comma delimited enabled-protocols in remote-connector
> -------------------------------------------------------------------------
>
> Key: WFLY-10014
> URL: https://issues.jboss.org/browse/WFLY-10014
> Project: WildFly
> Issue Type: Bug
> Components: JMS
> Affects Versions: 12.0.0.Final
> Reporter: Nagaraju Chitimilla
> Assignee: Jeff Mesnil
> Priority: Critical
>
> When I want to configure enabled SSL protocols, Netty requires to use comma delimited list to be passed into enabled-protocols param in remote-connector
> {noformat}
> <param name="enabled-protocols" value="TLSv1.1,TLSv1.2"/>
> {noformat}
> But when comma is used in value in configuration string passed into ActiveMQRaUtils.parseConfig, parsing fails:
> {code:java}
> Caused by: java.lang.IllegalArgumentException: Invalid expression TLSv1.2 at enabledProtocols=TLSv1.1,TLSv1.2;trustStorePassword=N0tall0wed;keyStorePassword=N0tall0wed;port=61616;localAddress=0.0.0.0;sslEnabled=true;host=localhost;trustStorePath=C:/ActiveMQ/conf/keystore.p12;keyStorePath=C:/ActiveMQ/conf/keystore.p12
> at org.apache.activemq.artemis.ra.ActiveMQRaUtils.parseConfig(ActiveMQRaUtils.java:205)
> at org.apache.activemq.artemis.ra.ActiveMQResourceAdapter.setConnectionParameters(ActiveMQResourceAdapter.java:342)
> ... 18 more
> {code}
> I set this as critical as it prevent setting more then one allowed SSLContext protocol.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 4 months
[JBoss JIRA] (WFLY-10014) Unable to configure comma delimited enabled-protocols in remote-connector
by Nagaraju Chitimilla (JIRA)
[ https://issues.jboss.org/browse/WFLY-10014?page=com.atlassian.jira.plugin... ]
Nagaraju Chitimilla edited comment on WFLY-10014 at 3/14/18 7:03 AM:
---------------------------------------------------------------------
I have tried escaping the with the following options, but its always giving exception:
<param name="enabled-protocols" value="TLSv1.1*\\\*,TLSv1.2"/>
*Error:* java.lang.IllegalArgumentException: Invalid expression TLSv1.2 at enabledProtocols=TLSv1.1*\\\*,TLSv1.2
<param name="enabled-protocols" value="TLSv1.1*"\\\,"*TLSv1.2"/>
*Error:*
<param name="enabled-protocols" value="TLSv1.1*"\\\,"*TLSv1.2"/>
^^^^ Unexpected character '\' (code 92) excepted space, or '>' or "/>"
at [row,col {unknown-source}]: [656,53]
Can you let me know the exact behavior?
*Note*: If i specified two escape characters in the comments section some how its not showing in the comments. So have added it as \\\ slashes but in the actual configuration its only two slashes.
Thanks in advance
-Nagaraju
was (Author: n_nagraj321):
I have tried escaping the with the following options, but its always giving exception:
<param name="enabled-protocols" value="TLSv1.1\\,TLSv1.2"/>
*Error:* java.lang.IllegalArgumentException: Invalid expression TLSv1.2 at enabledProtocols=TLSv1.1\\,TLSv1.2
<param name="enabled-protocols" value="TLSv1.1"\\,"TLSv1.2"/>
*Error:*
<param name="enabled-protocols" value="TLSv1.1"\\,"TLSv1.2"/>
^^^^ Unexpected character '\' (code 92) excepted space, or '>' or "/>"
at [row,col {unknown-source}]: [656,53]
Can you let me know the exact behavior?
Thanks in advance
-Nagaraju
> Unable to configure comma delimited enabled-protocols in remote-connector
> -------------------------------------------------------------------------
>
> Key: WFLY-10014
> URL: https://issues.jboss.org/browse/WFLY-10014
> Project: WildFly
> Issue Type: Bug
> Components: JMS
> Affects Versions: 12.0.0.Final
> Reporter: Nagaraju Chitimilla
> Assignee: Jeff Mesnil
> Priority: Critical
>
> When I want to configure enabled SSL protocols, Netty requires to use comma delimited list to be passed into enabled-protocols param in remote-connector
> {noformat}
> <param name="enabled-protocols" value="TLSv1.1,TLSv1.2"/>
> {noformat}
> But when comma is used in value in configuration string passed into ActiveMQRaUtils.parseConfig, parsing fails:
> {code:java}
> Caused by: java.lang.IllegalArgumentException: Invalid expression TLSv1.2 at enabledProtocols=TLSv1.1,TLSv1.2;trustStorePassword=N0tall0wed;keyStorePassword=N0tall0wed;port=61616;localAddress=0.0.0.0;sslEnabled=true;host=localhost;trustStorePath=C:/ActiveMQ/conf/keystore.p12;keyStorePath=C:/ActiveMQ/conf/keystore.p12
> at org.apache.activemq.artemis.ra.ActiveMQRaUtils.parseConfig(ActiveMQRaUtils.java:205)
> at org.apache.activemq.artemis.ra.ActiveMQResourceAdapter.setConnectionParameters(ActiveMQResourceAdapter.java:342)
> ... 18 more
> {code}
> I set this as critical as it prevent setting more then one allowed SSLContext protocol.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 4 months
[JBoss JIRA] (WFLY-9969) JDK9 + FIPS BC, unable to configure
by Martin Choma (JIRA)
[ https://issues.jboss.org/browse/WFLY-9969?page=com.atlassian.jira.plugin.... ]
Martin Choma edited comment on WFLY-9969 at 3/14/18 7:01 AM:
-------------------------------------------------------------
[~dmlloyd] how do you mean
{code}
you could add a resource root like this (in the module.xml):
<resource-root path="content"/>
then create a "content" directory in the same directory as the module.xml
and add a "META-INF/services/java.security.Provider" file there
{code}
Where should I put jar?
{code}
├── content
│ ├── bc-fips-1.0.0.jar
│ └── META-INF
│ └── services
│ └── java.security.Provider
└── module.xml
{code}
was (Author: mchoma):
[~dmlloyd] how do you mean
you could add a resource root like this (in the module.xml):
<resource-root path="content"/>
then create a "content" directory in the same directory as the module.xml
and add a "META-INF/services/java.security.Provider" file there
Where should I put jar?
├── content
│ ├── bc-fips-1.0.0.jar
│ └── META-INF
│ └── services
│ └── java.security.Provider
└── module.xml
> JDK9 + FIPS BC, unable to configure
> -----------------------------------
>
> Key: WFLY-9969
> URL: https://issues.jboss.org/browse/WFLY-9969
> Project: WildFly
> Issue Type: Bug
> Components: Security
> Affects Versions: 12.0.0.Final
> Reporter: Martin Choma
>
> * Configure BouncyCastleFipsProvider in java
> {code:title=$\{jdk9_home\}/conf/security/java.security}
> security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
> security.provider.2=SUN
> security.provider.3=SunRsaSign
> security.provider.4=SunEC
> security.provider.5=SunJSSE BCFIPS
> security.provider.6=SunJCE
> security.provider.7=SunJGSS
> security.provider.8=SunSASL
> security.provider.9=XMLDSig
> security.provider.10=SunPCSC
> security.provider.11=JdkLDAP
> security.provider.12=JdkSASL
> security.provider.13=SunPKCS11
> {code}
> * configure -cp of java process based on https://docs.oracle.com/javase/9/security/howtoimplaprovider.htm#JSSEC-GU.... It means in $\{jboss_home\}/bin/standalone.conf put -cp option with bcfips jar
> {{JAVA_OPTS="-Xms1303m -Xmx1303m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -cp /home/mchoma/.m2/repository/org/bouncycastle/fips/bc-fips/1.0.0/bc-fips-1.0.0.jar"}}
> * Configure additional logging
> {code}
> /subsystem=logging/console-handler=CONSOLE:write-attribute(name=level, value=ALL)
> /subsystem=logging/logger=org.wildfly.extension.elytron:add(level=ALL)
> {code}
> * Run CLI command usink BCFKS key store type
> {{/subsystem=elytron/key-store=bcfks_keystore:add(path=keystore.bcfks,relative-to=jboss.server.config.dir, type="BCFKS", credential-reference=\{clear-text=password\})}}
> * For some reason BouncyCastleFipsProvider is not listed among providers returned by Security.getProviders() and therefore BCFKS can't be resolved
> {code}
> =========================================================================
> JBoss Bootstrap Environment
> JBOSS_HOME: /home/mchoma/eap/7.2.0.EL12.CR1/jboss-eap-7.2
> JAVA: /opt/java/jdk-9.0.1_bcfips/bin/java
> JAVA_OPTS: -server -Xms1303m -Xmx1303m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -cp /home/mchoma/.m2/repository/org/bouncycastle/fips/bc-fips/1.0.0/bc-fips-1.0.0.jar -Djboss.modules.system.pkgs=org.jboss.byteman -Djava.awt.headless=true -agentlib:jdwp=transport=dt_socket,address=8787,server=y,suspend=n
> =========================================================================
> ...
> 09:20:16,630 TRACE [org.wildfly.extension.elytron] (MSC service thread 1-3) No provider identified for name [null] and algorithm [BCFKS] between [SUN version 9, ApacheXMLDSig version 2.11, SunRsaSign version 9, SunEC version 9, SunJSSE version 9, SunJCE version 9, SunJGSS version 9, SunSASL version 9, XMLDSig version 9, SunPCSC version 9, JdkLDAP version 9, JdkSASL version 9, SunPKCS11 version 9, SunDeploy-MozillaJSS version 1.5, WildFlyElytron version 1.0, TLSP version 1.0, openssl version 1.0]
> 09:20:16,632 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-3) MSC000001: Failed to start service org.wildfly.security.key-store.bcfks_keystore: org.jboss.msc.service.StartException in service org.wildfly.security.key-store.bcfks_keystore: WFLYELY00004: Unable to start the service.
> at org.wildfly.extension.elytron@4.0.0.CR1-redhat-1-20180228//org.wildfly.extension.elytron.KeyStoreService.start(KeyStoreService.java:148)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1714)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1693)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1540)
> at org.jboss.threads@2.3.1.Final-redhat-1//org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
> at org.jboss.threads@2.3.1.Final-redhat-1//org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
> at org.jboss.threads@2.3.1.Final-redhat-1//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
> at org.jboss.threads@2.3.1.Final-redhat-1//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
> at java.base/java.lang.Thread.run(Thread.java:844)
> Caused by: org.jboss.msc.service.StartException in anonymous service: WFLYELY00012: No suitable provider found for type 'BCFKS'
> at org.wildfly.extension.elytron@4.0.0.CR1-redhat-1-20180228//org.wildfly.extension.elytron.KeyStoreService.resolveProvider(KeyStoreService.java:156)
> at org.wildfly.extension.elytron@4.0.0.CR1-redhat-1-20180228//org.wildfly.extension.elytron.KeyStoreService.start(KeyStoreService.java:110)
> ... 8 more
> {code}
> * With same java I can run succesfully this java code
> {code:java|title=TestBCLoaded.java}
> import java.security.*;
> public class TestBCLoaded {
> public static void main(String[] args) {
> Provider p = Security.getProvider("org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider");
> if (p==null){
> System.out.println("Not Loaded: org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider");
> }
> p = Security.getProvider("BouncyCastleFipsProvider");
> if (p==null){
> System.out.println("Not Loaded: BouncyCastleFipsProvider");
> }
> p = Security.getProvider("BCFIPS");
> if (p==null){
> System.out.println("Not Loaded: BCFIPS");
> } else {
> System.out.println("Provider name is " + p.getName());
> System.out.println("Provider version # is " + p.getVersion());
> System.out.println("Provider info is " + p.getInfo());
> }
> }
> }
> {code}
> {code}
> [mchoma@localhost jdk9Test]$ java -cp .:/home/mchoma/.m2/repository/org/bouncycastle/fips/bc-fips/1.0.0/bc-fips-1.0.0.jar TestBCLoaded
> Not Loaded: org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
> Not Loaded: BouncyCastleFipsProvider
> Provider name is BCFIPS
> Provider version # is 0.9
> Provider info is BouncyCastle Security Provider (FIPS edition) v0.90
> {code}
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 4 months
[JBoss JIRA] (WFLY-9969) JDK9 + FIPS BC, unable to configure
by Martin Choma (JIRA)
[ https://issues.jboss.org/browse/WFLY-9969?page=com.atlassian.jira.plugin.... ]
Martin Choma edited comment on WFLY-9969 at 3/14/18 7:01 AM:
-------------------------------------------------------------
[~dmlloyd] how do you mean
you could add a resource root like this (in the module.xml):
<resource-root path="content"/>
then create a "content" directory in the same directory as the module.xml
and add a "META-INF/services/java.security.Provider" file there
Where should I put jar?
├── content
│ ├── bc-fips-1.0.0.jar
│ └── META-INF
│ └── services
│ └── java.security.Provider
└── module.xml
was (Author: mchoma):
[~dmlloyd] how do you mean
{{you could add a resource root like this (in the module.xml):
<resource-root path="content"/>
then create a "content" directory in the same directory as the module.xml
and add a "META-INF/services/java.security.Provider" file there}}
Where should I put jar?
├── content
│ ├── bc-fips-1.0.0.jar
│ └── META-INF
│ └── services
│ └── java.security.Provider
└── module.xml
> JDK9 + FIPS BC, unable to configure
> -----------------------------------
>
> Key: WFLY-9969
> URL: https://issues.jboss.org/browse/WFLY-9969
> Project: WildFly
> Issue Type: Bug
> Components: Security
> Affects Versions: 12.0.0.Final
> Reporter: Martin Choma
>
> * Configure BouncyCastleFipsProvider in java
> {code:title=$\{jdk9_home\}/conf/security/java.security}
> security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
> security.provider.2=SUN
> security.provider.3=SunRsaSign
> security.provider.4=SunEC
> security.provider.5=SunJSSE BCFIPS
> security.provider.6=SunJCE
> security.provider.7=SunJGSS
> security.provider.8=SunSASL
> security.provider.9=XMLDSig
> security.provider.10=SunPCSC
> security.provider.11=JdkLDAP
> security.provider.12=JdkSASL
> security.provider.13=SunPKCS11
> {code}
> * configure -cp of java process based on https://docs.oracle.com/javase/9/security/howtoimplaprovider.htm#JSSEC-GU.... It means in $\{jboss_home\}/bin/standalone.conf put -cp option with bcfips jar
> {{JAVA_OPTS="-Xms1303m -Xmx1303m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -cp /home/mchoma/.m2/repository/org/bouncycastle/fips/bc-fips/1.0.0/bc-fips-1.0.0.jar"}}
> * Configure additional logging
> {code}
> /subsystem=logging/console-handler=CONSOLE:write-attribute(name=level, value=ALL)
> /subsystem=logging/logger=org.wildfly.extension.elytron:add(level=ALL)
> {code}
> * Run CLI command usink BCFKS key store type
> {{/subsystem=elytron/key-store=bcfks_keystore:add(path=keystore.bcfks,relative-to=jboss.server.config.dir, type="BCFKS", credential-reference=\{clear-text=password\})}}
> * For some reason BouncyCastleFipsProvider is not listed among providers returned by Security.getProviders() and therefore BCFKS can't be resolved
> {code}
> =========================================================================
> JBoss Bootstrap Environment
> JBOSS_HOME: /home/mchoma/eap/7.2.0.EL12.CR1/jboss-eap-7.2
> JAVA: /opt/java/jdk-9.0.1_bcfips/bin/java
> JAVA_OPTS: -server -Xms1303m -Xmx1303m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -cp /home/mchoma/.m2/repository/org/bouncycastle/fips/bc-fips/1.0.0/bc-fips-1.0.0.jar -Djboss.modules.system.pkgs=org.jboss.byteman -Djava.awt.headless=true -agentlib:jdwp=transport=dt_socket,address=8787,server=y,suspend=n
> =========================================================================
> ...
> 09:20:16,630 TRACE [org.wildfly.extension.elytron] (MSC service thread 1-3) No provider identified for name [null] and algorithm [BCFKS] between [SUN version 9, ApacheXMLDSig version 2.11, SunRsaSign version 9, SunEC version 9, SunJSSE version 9, SunJCE version 9, SunJGSS version 9, SunSASL version 9, XMLDSig version 9, SunPCSC version 9, JdkLDAP version 9, JdkSASL version 9, SunPKCS11 version 9, SunDeploy-MozillaJSS version 1.5, WildFlyElytron version 1.0, TLSP version 1.0, openssl version 1.0]
> 09:20:16,632 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-3) MSC000001: Failed to start service org.wildfly.security.key-store.bcfks_keystore: org.jboss.msc.service.StartException in service org.wildfly.security.key-store.bcfks_keystore: WFLYELY00004: Unable to start the service.
> at org.wildfly.extension.elytron@4.0.0.CR1-redhat-1-20180228//org.wildfly.extension.elytron.KeyStoreService.start(KeyStoreService.java:148)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1714)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1693)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1540)
> at org.jboss.threads@2.3.1.Final-redhat-1//org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
> at org.jboss.threads@2.3.1.Final-redhat-1//org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
> at org.jboss.threads@2.3.1.Final-redhat-1//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
> at org.jboss.threads@2.3.1.Final-redhat-1//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
> at java.base/java.lang.Thread.run(Thread.java:844)
> Caused by: org.jboss.msc.service.StartException in anonymous service: WFLYELY00012: No suitable provider found for type 'BCFKS'
> at org.wildfly.extension.elytron@4.0.0.CR1-redhat-1-20180228//org.wildfly.extension.elytron.KeyStoreService.resolveProvider(KeyStoreService.java:156)
> at org.wildfly.extension.elytron@4.0.0.CR1-redhat-1-20180228//org.wildfly.extension.elytron.KeyStoreService.start(KeyStoreService.java:110)
> ... 8 more
> {code}
> * With same java I can run succesfully this java code
> {code:java|title=TestBCLoaded.java}
> import java.security.*;
> public class TestBCLoaded {
> public static void main(String[] args) {
> Provider p = Security.getProvider("org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider");
> if (p==null){
> System.out.println("Not Loaded: org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider");
> }
> p = Security.getProvider("BouncyCastleFipsProvider");
> if (p==null){
> System.out.println("Not Loaded: BouncyCastleFipsProvider");
> }
> p = Security.getProvider("BCFIPS");
> if (p==null){
> System.out.println("Not Loaded: BCFIPS");
> } else {
> System.out.println("Provider name is " + p.getName());
> System.out.println("Provider version # is " + p.getVersion());
> System.out.println("Provider info is " + p.getInfo());
> }
> }
> }
> {code}
> {code}
> [mchoma@localhost jdk9Test]$ java -cp .:/home/mchoma/.m2/repository/org/bouncycastle/fips/bc-fips/1.0.0/bc-fips-1.0.0.jar TestBCLoaded
> Not Loaded: org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
> Not Loaded: BouncyCastleFipsProvider
> Provider name is BCFIPS
> Provider version # is 0.9
> Provider info is BouncyCastle Security Provider (FIPS edition) v0.90
> {code}
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 4 months
[JBoss JIRA] (WFLY-9969) JDK9 + FIPS BC, unable to configure
by Martin Choma (JIRA)
[ https://issues.jboss.org/browse/WFLY-9969?page=com.atlassian.jira.plugin.... ]
Martin Choma edited comment on WFLY-9969 at 3/14/18 7:00 AM:
-------------------------------------------------------------
[~dmlloyd] how do you mean
{{you could add a resource root like this (in the module.xml):
<resource-root path="content"/>
then create a "content" directory in the same directory as the module.xml
and add a "META-INF/services/java.security.Provider" file there}}
Where should I put jar?
├── content
│ ├── bc-fips-1.0.0.jar
│ └── META-INF
│ └── services
│ └── java.security.Provider
└── module.xml
was (Author: mchoma):
[~dmlloyd] how do you mean
??you could add a resource root like this (in the module.xml):
<resource-root path="content"/>
then create a "content" directory in the same directory as the module.xml
and add a "META-INF/services/java.security.Provider" file there??
Where should I put jar?
{{├── content
│ ├── bc-fips-1.0.0.jar
│ └── META-INF
│ └── services
│ └── java.security.Provider
└── module.xml}}
> JDK9 + FIPS BC, unable to configure
> -----------------------------------
>
> Key: WFLY-9969
> URL: https://issues.jboss.org/browse/WFLY-9969
> Project: WildFly
> Issue Type: Bug
> Components: Security
> Affects Versions: 12.0.0.Final
> Reporter: Martin Choma
>
> * Configure BouncyCastleFipsProvider in java
> {code:title=$\{jdk9_home\}/conf/security/java.security}
> security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
> security.provider.2=SUN
> security.provider.3=SunRsaSign
> security.provider.4=SunEC
> security.provider.5=SunJSSE BCFIPS
> security.provider.6=SunJCE
> security.provider.7=SunJGSS
> security.provider.8=SunSASL
> security.provider.9=XMLDSig
> security.provider.10=SunPCSC
> security.provider.11=JdkLDAP
> security.provider.12=JdkSASL
> security.provider.13=SunPKCS11
> {code}
> * configure -cp of java process based on https://docs.oracle.com/javase/9/security/howtoimplaprovider.htm#JSSEC-GU.... It means in $\{jboss_home\}/bin/standalone.conf put -cp option with bcfips jar
> {{JAVA_OPTS="-Xms1303m -Xmx1303m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -cp /home/mchoma/.m2/repository/org/bouncycastle/fips/bc-fips/1.0.0/bc-fips-1.0.0.jar"}}
> * Configure additional logging
> {code}
> /subsystem=logging/console-handler=CONSOLE:write-attribute(name=level, value=ALL)
> /subsystem=logging/logger=org.wildfly.extension.elytron:add(level=ALL)
> {code}
> * Run CLI command usink BCFKS key store type
> {{/subsystem=elytron/key-store=bcfks_keystore:add(path=keystore.bcfks,relative-to=jboss.server.config.dir, type="BCFKS", credential-reference=\{clear-text=password\})}}
> * For some reason BouncyCastleFipsProvider is not listed among providers returned by Security.getProviders() and therefore BCFKS can't be resolved
> {code}
> =========================================================================
> JBoss Bootstrap Environment
> JBOSS_HOME: /home/mchoma/eap/7.2.0.EL12.CR1/jboss-eap-7.2
> JAVA: /opt/java/jdk-9.0.1_bcfips/bin/java
> JAVA_OPTS: -server -Xms1303m -Xmx1303m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -cp /home/mchoma/.m2/repository/org/bouncycastle/fips/bc-fips/1.0.0/bc-fips-1.0.0.jar -Djboss.modules.system.pkgs=org.jboss.byteman -Djava.awt.headless=true -agentlib:jdwp=transport=dt_socket,address=8787,server=y,suspend=n
> =========================================================================
> ...
> 09:20:16,630 TRACE [org.wildfly.extension.elytron] (MSC service thread 1-3) No provider identified for name [null] and algorithm [BCFKS] between [SUN version 9, ApacheXMLDSig version 2.11, SunRsaSign version 9, SunEC version 9, SunJSSE version 9, SunJCE version 9, SunJGSS version 9, SunSASL version 9, XMLDSig version 9, SunPCSC version 9, JdkLDAP version 9, JdkSASL version 9, SunPKCS11 version 9, SunDeploy-MozillaJSS version 1.5, WildFlyElytron version 1.0, TLSP version 1.0, openssl version 1.0]
> 09:20:16,632 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-3) MSC000001: Failed to start service org.wildfly.security.key-store.bcfks_keystore: org.jboss.msc.service.StartException in service org.wildfly.security.key-store.bcfks_keystore: WFLYELY00004: Unable to start the service.
> at org.wildfly.extension.elytron@4.0.0.CR1-redhat-1-20180228//org.wildfly.extension.elytron.KeyStoreService.start(KeyStoreService.java:148)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1714)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1693)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1540)
> at org.jboss.threads@2.3.1.Final-redhat-1//org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
> at org.jboss.threads@2.3.1.Final-redhat-1//org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
> at org.jboss.threads@2.3.1.Final-redhat-1//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
> at org.jboss.threads@2.3.1.Final-redhat-1//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
> at java.base/java.lang.Thread.run(Thread.java:844)
> Caused by: org.jboss.msc.service.StartException in anonymous service: WFLYELY00012: No suitable provider found for type 'BCFKS'
> at org.wildfly.extension.elytron@4.0.0.CR1-redhat-1-20180228//org.wildfly.extension.elytron.KeyStoreService.resolveProvider(KeyStoreService.java:156)
> at org.wildfly.extension.elytron@4.0.0.CR1-redhat-1-20180228//org.wildfly.extension.elytron.KeyStoreService.start(KeyStoreService.java:110)
> ... 8 more
> {code}
> * With same java I can run succesfully this java code
> {code:java|title=TestBCLoaded.java}
> import java.security.*;
> public class TestBCLoaded {
> public static void main(String[] args) {
> Provider p = Security.getProvider("org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider");
> if (p==null){
> System.out.println("Not Loaded: org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider");
> }
> p = Security.getProvider("BouncyCastleFipsProvider");
> if (p==null){
> System.out.println("Not Loaded: BouncyCastleFipsProvider");
> }
> p = Security.getProvider("BCFIPS");
> if (p==null){
> System.out.println("Not Loaded: BCFIPS");
> } else {
> System.out.println("Provider name is " + p.getName());
> System.out.println("Provider version # is " + p.getVersion());
> System.out.println("Provider info is " + p.getInfo());
> }
> }
> }
> {code}
> {code}
> [mchoma@localhost jdk9Test]$ java -cp .:/home/mchoma/.m2/repository/org/bouncycastle/fips/bc-fips/1.0.0/bc-fips-1.0.0.jar TestBCLoaded
> Not Loaded: org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
> Not Loaded: BouncyCastleFipsProvider
> Provider name is BCFIPS
> Provider version # is 0.9
> Provider info is BouncyCastle Security Provider (FIPS edition) v0.90
> {code}
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 4 months
[JBoss JIRA] (WFLY-9969) JDK9 + FIPS BC, unable to configure
by Martin Choma (JIRA)
[ https://issues.jboss.org/browse/WFLY-9969?page=com.atlassian.jira.plugin.... ]
Martin Choma commented on WFLY-9969:
------------------------------------
[~dmlloyd] how do you mean
??
you could add a resource root like this (in the module.xml):
<resource-root path="content"/>
then create a "content" directory in the same directory as the module.xml
and add a "META-INF/services/java.security.Provider" file there
??
Where should I put jar?
{{
├── content
│ ├── bc-fips-1.0.0.jar
│ └── META-INF
│ └── services
│ └── java.security.Provider
└── module.xml
}}
> JDK9 + FIPS BC, unable to configure
> -----------------------------------
>
> Key: WFLY-9969
> URL: https://issues.jboss.org/browse/WFLY-9969
> Project: WildFly
> Issue Type: Bug
> Components: Security
> Affects Versions: 12.0.0.Final
> Reporter: Martin Choma
>
> * Configure BouncyCastleFipsProvider in java
> {code:title=$\{jdk9_home\}/conf/security/java.security}
> security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
> security.provider.2=SUN
> security.provider.3=SunRsaSign
> security.provider.4=SunEC
> security.provider.5=SunJSSE BCFIPS
> security.provider.6=SunJCE
> security.provider.7=SunJGSS
> security.provider.8=SunSASL
> security.provider.9=XMLDSig
> security.provider.10=SunPCSC
> security.provider.11=JdkLDAP
> security.provider.12=JdkSASL
> security.provider.13=SunPKCS11
> {code}
> * configure -cp of java process based on https://docs.oracle.com/javase/9/security/howtoimplaprovider.htm#JSSEC-GU.... It means in $\{jboss_home\}/bin/standalone.conf put -cp option with bcfips jar
> {{JAVA_OPTS="-Xms1303m -Xmx1303m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -cp /home/mchoma/.m2/repository/org/bouncycastle/fips/bc-fips/1.0.0/bc-fips-1.0.0.jar"}}
> * Configure additional logging
> {code}
> /subsystem=logging/console-handler=CONSOLE:write-attribute(name=level, value=ALL)
> /subsystem=logging/logger=org.wildfly.extension.elytron:add(level=ALL)
> {code}
> * Run CLI command usink BCFKS key store type
> {{/subsystem=elytron/key-store=bcfks_keystore:add(path=keystore.bcfks,relative-to=jboss.server.config.dir, type="BCFKS", credential-reference=\{clear-text=password\})}}
> * For some reason BouncyCastleFipsProvider is not listed among providers returned by Security.getProviders() and therefore BCFKS can't be resolved
> {code}
> =========================================================================
> JBoss Bootstrap Environment
> JBOSS_HOME: /home/mchoma/eap/7.2.0.EL12.CR1/jboss-eap-7.2
> JAVA: /opt/java/jdk-9.0.1_bcfips/bin/java
> JAVA_OPTS: -server -Xms1303m -Xmx1303m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -cp /home/mchoma/.m2/repository/org/bouncycastle/fips/bc-fips/1.0.0/bc-fips-1.0.0.jar -Djboss.modules.system.pkgs=org.jboss.byteman -Djava.awt.headless=true -agentlib:jdwp=transport=dt_socket,address=8787,server=y,suspend=n
> =========================================================================
> ...
> 09:20:16,630 TRACE [org.wildfly.extension.elytron] (MSC service thread 1-3) No provider identified for name [null] and algorithm [BCFKS] between [SUN version 9, ApacheXMLDSig version 2.11, SunRsaSign version 9, SunEC version 9, SunJSSE version 9, SunJCE version 9, SunJGSS version 9, SunSASL version 9, XMLDSig version 9, SunPCSC version 9, JdkLDAP version 9, JdkSASL version 9, SunPKCS11 version 9, SunDeploy-MozillaJSS version 1.5, WildFlyElytron version 1.0, TLSP version 1.0, openssl version 1.0]
> 09:20:16,632 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-3) MSC000001: Failed to start service org.wildfly.security.key-store.bcfks_keystore: org.jboss.msc.service.StartException in service org.wildfly.security.key-store.bcfks_keystore: WFLYELY00004: Unable to start the service.
> at org.wildfly.extension.elytron@4.0.0.CR1-redhat-1-20180228//org.wildfly.extension.elytron.KeyStoreService.start(KeyStoreService.java:148)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1714)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1693)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1540)
> at org.jboss.threads@2.3.1.Final-redhat-1//org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
> at org.jboss.threads@2.3.1.Final-redhat-1//org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
> at org.jboss.threads@2.3.1.Final-redhat-1//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
> at org.jboss.threads@2.3.1.Final-redhat-1//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
> at java.base/java.lang.Thread.run(Thread.java:844)
> Caused by: org.jboss.msc.service.StartException in anonymous service: WFLYELY00012: No suitable provider found for type 'BCFKS'
> at org.wildfly.extension.elytron@4.0.0.CR1-redhat-1-20180228//org.wildfly.extension.elytron.KeyStoreService.resolveProvider(KeyStoreService.java:156)
> at org.wildfly.extension.elytron@4.0.0.CR1-redhat-1-20180228//org.wildfly.extension.elytron.KeyStoreService.start(KeyStoreService.java:110)
> ... 8 more
> {code}
> * With same java I can run succesfully this java code
> {code:java|title=TestBCLoaded.java}
> import java.security.*;
> public class TestBCLoaded {
> public static void main(String[] args) {
> Provider p = Security.getProvider("org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider");
> if (p==null){
> System.out.println("Not Loaded: org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider");
> }
> p = Security.getProvider("BouncyCastleFipsProvider");
> if (p==null){
> System.out.println("Not Loaded: BouncyCastleFipsProvider");
> }
> p = Security.getProvider("BCFIPS");
> if (p==null){
> System.out.println("Not Loaded: BCFIPS");
> } else {
> System.out.println("Provider name is " + p.getName());
> System.out.println("Provider version # is " + p.getVersion());
> System.out.println("Provider info is " + p.getInfo());
> }
> }
> }
> {code}
> {code}
> [mchoma@localhost jdk9Test]$ java -cp .:/home/mchoma/.m2/repository/org/bouncycastle/fips/bc-fips/1.0.0/bc-fips-1.0.0.jar TestBCLoaded
> Not Loaded: org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
> Not Loaded: BouncyCastleFipsProvider
> Provider name is BCFIPS
> Provider version # is 0.9
> Provider info is BouncyCastle Security Provider (FIPS edition) v0.90
> {code}
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 4 months