[JBoss JIRA] (ELY-816) Support for masked passwords in client XML config
by Jan Kalina (JIRA)
[ https://issues.jboss.org/browse/ELY-816?page=com.atlassian.jira.plugin.sy... ]
Jan Kalina commented on ELY-816:
--------------------------------
When considering PR, there is only one place left in elytron xml where clear password is supported but masked is not: *credential-store-reference-type* - but everywhere this type is used, clear-password-type and masked-password-type are allowed too.
>From this point of view, not only masked-text, but also *clear-text* in credential-store-reference-type seems redundant.
[~dmlloyd] Do we want to add the masked-text through? And do we want to keep the clear-text?
https://github.com/hkalina/wildfly-elytron/blob/maskedpasswords/src/main/...
> Support for masked passwords in client XML config
> -------------------------------------------------
>
> Key: ELY-816
> URL: https://issues.jboss.org/browse/ELY-816
> Project: WildFly Elytron
> Issue Type: Task
> Reporter: David Lloyd
> Assignee: Jan Kalina
> Priority: Critical
> Fix For: 1.3.2.CR1
>
>
> We need a way to support masked passwords in the auth configuration file, either as:
> * A dedicated masked-password-type XML type
> * Adding necessary fields to hashed-password-type
> * Adding a modular crypt format
> Needs to be supported anywhere passwords are allowed.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 2 months
[JBoss JIRA] (SWSQE-203) Apply "sysctl -w vm.max_map_count=262144 " to B12 cluster
by Kevin Earls (JIRA)
Kevin Earls created SWSQE-203:
---------------------------------
Summary: Apply "sysctl -w vm.max_map_count=262144 " to B12 cluster
Key: SWSQE-203
URL: https://issues.jboss.org/browse/SWSQE-203
Project: Kiali QE
Issue Type: QE Task
Reporter: Kevin Earls
Assignee: Guilherme Baufaker Rêgo
As part of https://issues.jboss.org/browse/SWSQE-113 the command "sudo sysctl -w vm.max_map_count=262144 " was executed on the B12 cluster in order to allow ElasticSearch to run correctly.
However I tried to run a performance test this morning and the ES deployment failed with
ERROR: [1] bootstrap checks failed
[1]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
Can you reapply this and do whatever is needed to make sure it persists over cluster rebuilds or restarts? Thanks.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 2 months
[JBoss JIRA] (ELY-1578) Upgrade to Fedora 28 breaks FIPS scenarios
by Martin Choma (JIRA)
[ https://issues.jboss.org/browse/ELY-1578?page=com.atlassian.jira.plugin.s... ]
Martin Choma edited comment on ELY-1578 at 5/7/18 4:59 AM:
-----------------------------------------------------------
[~rlucente-se-jboss] exceptions looks different. However I am trying on JDK9 because of WFCORE-3799
But I am not comfortable with proposed change [1]. Seems to me they expect "dbm:/" to be default. But starting with NSS 3.35 sql format is default [1]. I dont know how to comment on jdk issue though.
[1] https://bugs.openjdk.java.net/browse/JDK-8165996
[2] https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.35_re...
was (Author: mchoma):
[~rlucente-se-jboss] exceptions looks different. However I am trying on JDK9 because of WFCORE-3799
But I am not comfortable with proposed change. Seems to me they expect "dbm:/" to be default. But starting with NSS 3.35 sql format is default. I dont know how to comment on jdk issue though.
[1] https://bugs.openjdk.java.net/browse/JDK-8165996
[2] https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.35_re...
> Upgrade to Fedora 28 breaks FIPS scenarios
> ------------------------------------------
>
> Key: ELY-1578
> URL: https://issues.jboss.org/browse/ELY-1578
> Project: WildFly Elytron
> Issue Type: Bug
> Affects Versions: 1.3.1.Final
> Reporter: Martin Choma
>
> On Fedora 28 I get
> {code}
> 14:52:28,813 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-2) MSC000001: Failed to start service jboss.as: org.jboss.msc.service.StartException in service jboss.as: Failed to start service
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1706)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1540)
> at org.jboss.threads@2.3.2.Final//org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
> at org.jboss.threads@2.3.2.Final//org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
> at org.jboss.threads@2.3.2.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
> at org.jboss.threads@2.3.2.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
> at java.base/java.lang.Thread.run(Thread.java:844)
> Caused by: java.security.ProviderException: NSS module not available: fips
> at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:278)
> at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11$1.run(SunPKCS11.java:113)
> at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11$1.run(SunPKCS11.java:110)
> at java.base/java.security.AccessController.doPrivileged(Native Method)
> at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.configure(SunPKCS11.java:110)
> at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:247)
> at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:238)
> at java.base/java.security.AccessController.doPrivileged(Native Method)
> at java.base/sun.security.jca.ProviderConfig.doLoadProvider(ProviderConfig.java:238)
> at java.base/sun.security.jca.ProviderConfig.getProvider(ProviderConfig.java:218)
> at java.base/sun.security.jca.ProviderList.getProvider(ProviderList.java:266)
> at java.base/sun.security.jca.ProviderList.getService(ProviderList.java:379)
> at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:157)
> at java.base/java.security.Security.getImpl(Security.java:697)
> at java.base/java.security.MessageDigest.getInstance(MessageDigest.java:178)
> at org.jboss.as.deployment-repository(a)5.0.0.Alpha-redhat-20180502//org.jboss.as.repository.ContentRepositoryImpl.<init>(ContentRepositoryImpl.java:90)
> at org.jboss.as.deployment-repository@5.0.0.Alpha-redhat-20180502//org.jboss.as.repository.ContentRepository$Factory.addService(ContentRepository.java:185)
> at org.jboss.as.server@5.0.0.Alpha-redhat-20180502//org.jboss.as.server.ApplicationServerService.start(ApplicationServerService.java:144)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1714)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1693)
> ... 6 more
> {code}
> In Fedora 28 there is nss 3.36.1 (dnf info nss.x86_64)
> In Fedora 27 there was 3.33 https://fedora.pkgs.org/27/fedora-x86_64/nss-3.33.0-1.0.fc27.x86_64.rpm.html
> In nss 3.35 there was switch of format to SQL [1]
> ??Applications using NSS may explicitly request to use a specific database format, by adding a type prefix to the database directory, provided at NSS initialization time. ??
> But I am not sure how to define that in java. I am using
> {code:pkcs11.cfg}
> name = testPkcs
> nssLibraryDirectory = /usr/lib64
> nssSecmodDirectory = /opt/java/jdk-9.0.1_fips/fips/nssdb
> nssDbMode = readOnly
> nssModule = fips
> {code}
> I am awaer there is probably nothing that can be done in Elytron. I think it is matter of NSS/SunPKCS11 configuration. I create this JIRA as a place for finding out what the problem is.
> [1] https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.35_re...
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 2 months
[JBoss JIRA] (ELY-1578) Upgrade to Fedora 28 breaks FIPS scenarios
by Martin Choma (JIRA)
[ https://issues.jboss.org/browse/ELY-1578?page=com.atlassian.jira.plugin.s... ]
Martin Choma edited comment on ELY-1578 at 5/7/18 4:58 AM:
-----------------------------------------------------------
[~rlucente-se-jboss] exceptions looks different. However I am trying on JDK9 because of WFCORE-3799
But I am not comfortable with proposed change. Seems to me they expect "dbm:/" to be default. But starting with NSS 3.35 sql format is default. I dont know how to comment on jdk issue though.
[1] https://bugs.openjdk.java.net/browse/JDK-8165996
[2] https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.35_re...
was (Author: mchoma):
[~rlucente-se-jboss] exceptions looks different. However I am trying on JDK9 because of WFCORE-3799
> Upgrade to Fedora 28 breaks FIPS scenarios
> ------------------------------------------
>
> Key: ELY-1578
> URL: https://issues.jboss.org/browse/ELY-1578
> Project: WildFly Elytron
> Issue Type: Bug
> Affects Versions: 1.3.1.Final
> Reporter: Martin Choma
>
> On Fedora 28 I get
> {code}
> 14:52:28,813 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-2) MSC000001: Failed to start service jboss.as: org.jboss.msc.service.StartException in service jboss.as: Failed to start service
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1706)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1540)
> at org.jboss.threads@2.3.2.Final//org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
> at org.jboss.threads@2.3.2.Final//org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
> at org.jboss.threads@2.3.2.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
> at org.jboss.threads@2.3.2.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
> at java.base/java.lang.Thread.run(Thread.java:844)
> Caused by: java.security.ProviderException: NSS module not available: fips
> at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:278)
> at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11$1.run(SunPKCS11.java:113)
> at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11$1.run(SunPKCS11.java:110)
> at java.base/java.security.AccessController.doPrivileged(Native Method)
> at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.configure(SunPKCS11.java:110)
> at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:247)
> at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:238)
> at java.base/java.security.AccessController.doPrivileged(Native Method)
> at java.base/sun.security.jca.ProviderConfig.doLoadProvider(ProviderConfig.java:238)
> at java.base/sun.security.jca.ProviderConfig.getProvider(ProviderConfig.java:218)
> at java.base/sun.security.jca.ProviderList.getProvider(ProviderList.java:266)
> at java.base/sun.security.jca.ProviderList.getService(ProviderList.java:379)
> at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:157)
> at java.base/java.security.Security.getImpl(Security.java:697)
> at java.base/java.security.MessageDigest.getInstance(MessageDigest.java:178)
> at org.jboss.as.deployment-repository(a)5.0.0.Alpha-redhat-20180502//org.jboss.as.repository.ContentRepositoryImpl.<init>(ContentRepositoryImpl.java:90)
> at org.jboss.as.deployment-repository@5.0.0.Alpha-redhat-20180502//org.jboss.as.repository.ContentRepository$Factory.addService(ContentRepository.java:185)
> at org.jboss.as.server@5.0.0.Alpha-redhat-20180502//org.jboss.as.server.ApplicationServerService.start(ApplicationServerService.java:144)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1714)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1693)
> ... 6 more
> {code}
> In Fedora 28 there is nss 3.36.1 (dnf info nss.x86_64)
> In Fedora 27 there was 3.33 https://fedora.pkgs.org/27/fedora-x86_64/nss-3.33.0-1.0.fc27.x86_64.rpm.html
> In nss 3.35 there was switch of format to SQL [1]
> ??Applications using NSS may explicitly request to use a specific database format, by adding a type prefix to the database directory, provided at NSS initialization time. ??
> But I am not sure how to define that in java. I am using
> {code:pkcs11.cfg}
> name = testPkcs
> nssLibraryDirectory = /usr/lib64
> nssSecmodDirectory = /opt/java/jdk-9.0.1_fips/fips/nssdb
> nssDbMode = readOnly
> nssModule = fips
> {code}
> I am awaer there is probably nothing that can be done in Elytron. I think it is matter of NSS/SunPKCS11 configuration. I create this JIRA as a place for finding out what the problem is.
> [1] https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.35_re...
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 2 months
[JBoss JIRA] (ELY-1578) Upgrade to Fedora 28 breaks FIPS scenarios
by Martin Choma (JIRA)
[ https://issues.jboss.org/browse/ELY-1578?page=com.atlassian.jira.plugin.s... ]
Martin Choma edited comment on ELY-1578 at 5/7/18 4:43 AM:
-----------------------------------------------------------
[~rlucente-se-jboss] exceptions looks different. However I am trying on JDK9 because of WFCORE-3799
was (Author: mchoma):
[~rlucente-se-jboss] exceptions looks different. I think it will be another problem.
> Upgrade to Fedora 28 breaks FIPS scenarios
> ------------------------------------------
>
> Key: ELY-1578
> URL: https://issues.jboss.org/browse/ELY-1578
> Project: WildFly Elytron
> Issue Type: Bug
> Affects Versions: 1.3.1.Final
> Reporter: Martin Choma
>
> On Fedora 28 I get
> {code}
> 14:52:28,813 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-2) MSC000001: Failed to start service jboss.as: org.jboss.msc.service.StartException in service jboss.as: Failed to start service
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1706)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1540)
> at org.jboss.threads@2.3.2.Final//org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
> at org.jboss.threads@2.3.2.Final//org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
> at org.jboss.threads@2.3.2.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
> at org.jboss.threads@2.3.2.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
> at java.base/java.lang.Thread.run(Thread.java:844)
> Caused by: java.security.ProviderException: NSS module not available: fips
> at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:278)
> at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11$1.run(SunPKCS11.java:113)
> at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11$1.run(SunPKCS11.java:110)
> at java.base/java.security.AccessController.doPrivileged(Native Method)
> at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.configure(SunPKCS11.java:110)
> at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:247)
> at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:238)
> at java.base/java.security.AccessController.doPrivileged(Native Method)
> at java.base/sun.security.jca.ProviderConfig.doLoadProvider(ProviderConfig.java:238)
> at java.base/sun.security.jca.ProviderConfig.getProvider(ProviderConfig.java:218)
> at java.base/sun.security.jca.ProviderList.getProvider(ProviderList.java:266)
> at java.base/sun.security.jca.ProviderList.getService(ProviderList.java:379)
> at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:157)
> at java.base/java.security.Security.getImpl(Security.java:697)
> at java.base/java.security.MessageDigest.getInstance(MessageDigest.java:178)
> at org.jboss.as.deployment-repository(a)5.0.0.Alpha-redhat-20180502//org.jboss.as.repository.ContentRepositoryImpl.<init>(ContentRepositoryImpl.java:90)
> at org.jboss.as.deployment-repository@5.0.0.Alpha-redhat-20180502//org.jboss.as.repository.ContentRepository$Factory.addService(ContentRepository.java:185)
> at org.jboss.as.server@5.0.0.Alpha-redhat-20180502//org.jboss.as.server.ApplicationServerService.start(ApplicationServerService.java:144)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1714)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1693)
> ... 6 more
> {code}
> In Fedora 28 there is nss 3.36.1 (dnf info nss.x86_64)
> In Fedora 27 there was 3.33 https://fedora.pkgs.org/27/fedora-x86_64/nss-3.33.0-1.0.fc27.x86_64.rpm.html
> In nss 3.35 there was switch of format to SQL [1]
> ??Applications using NSS may explicitly request to use a specific database format, by adding a type prefix to the database directory, provided at NSS initialization time. ??
> But I am not sure how to define that in java. I am using
> {code:pkcs11.cfg}
> name = testPkcs
> nssLibraryDirectory = /usr/lib64
> nssSecmodDirectory = /opt/java/jdk-9.0.1_fips/fips/nssdb
> nssDbMode = readOnly
> nssModule = fips
> {code}
> I am awaer there is probably nothing that can be done in Elytron. I think it is matter of NSS/SunPKCS11 configuration. I create this JIRA as a place for finding out what the problem is.
> [1] https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.35_re...
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 2 months
[JBoss JIRA] (DROOLS-2530) DMN Decision Table - wrong evaluation of parameter named "product"
by David Le Moing (JIRA)
David Le Moing created DROOLS-2530:
--------------------------------------
Summary: DMN Decision Table - wrong evaluation of parameter named "product"
Key: DROOLS-2530
URL: https://issues.jboss.org/browse/DROOLS-2530
Project: Drools
Issue Type: Bug
Components: dmn engine
Reporter: David Le Moing
Assignee: Edson Tirelli
Attachments: product_issue.dmn
We have an input named "product" that is used in a decision table.
We upgraded to Drools 7.7.0.Final and noticed that now, what was evaluated was not the object passed as parameter, but an object of type ProductFunction.
The same issue is present in version 7.5.0.Final and 7.6.0.Final. It was working fine previously.
I think the issue is coming from the method getAllValues() of EvaluationContextImpl. Maybe the stack should be reversed before iterating over it and putting the values in the map.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 2 months
[JBoss JIRA] (ELY-1578) Upgrade to Fedora 28 breaks FIPS scenarios
by Martin Choma (JIRA)
[ https://issues.jboss.org/browse/ELY-1578?page=com.atlassian.jira.plugin.s... ]
Martin Choma commented on ELY-1578:
-----------------------------------
[~rlucente-se-jboss] exceptions looks different. I think it will be another problem.
> Upgrade to Fedora 28 breaks FIPS scenarios
> ------------------------------------------
>
> Key: ELY-1578
> URL: https://issues.jboss.org/browse/ELY-1578
> Project: WildFly Elytron
> Issue Type: Bug
> Affects Versions: 1.3.1.Final
> Reporter: Martin Choma
>
> On Fedora 28 I get
> {code}
> 14:52:28,813 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-2) MSC000001: Failed to start service jboss.as: org.jboss.msc.service.StartException in service jboss.as: Failed to start service
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1706)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1540)
> at org.jboss.threads@2.3.2.Final//org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
> at org.jboss.threads@2.3.2.Final//org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
> at org.jboss.threads@2.3.2.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
> at org.jboss.threads@2.3.2.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
> at java.base/java.lang.Thread.run(Thread.java:844)
> Caused by: java.security.ProviderException: NSS module not available: fips
> at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:278)
> at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11$1.run(SunPKCS11.java:113)
> at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11$1.run(SunPKCS11.java:110)
> at java.base/java.security.AccessController.doPrivileged(Native Method)
> at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.configure(SunPKCS11.java:110)
> at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:247)
> at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:238)
> at java.base/java.security.AccessController.doPrivileged(Native Method)
> at java.base/sun.security.jca.ProviderConfig.doLoadProvider(ProviderConfig.java:238)
> at java.base/sun.security.jca.ProviderConfig.getProvider(ProviderConfig.java:218)
> at java.base/sun.security.jca.ProviderList.getProvider(ProviderList.java:266)
> at java.base/sun.security.jca.ProviderList.getService(ProviderList.java:379)
> at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:157)
> at java.base/java.security.Security.getImpl(Security.java:697)
> at java.base/java.security.MessageDigest.getInstance(MessageDigest.java:178)
> at org.jboss.as.deployment-repository(a)5.0.0.Alpha-redhat-20180502//org.jboss.as.repository.ContentRepositoryImpl.<init>(ContentRepositoryImpl.java:90)
> at org.jboss.as.deployment-repository@5.0.0.Alpha-redhat-20180502//org.jboss.as.repository.ContentRepository$Factory.addService(ContentRepository.java:185)
> at org.jboss.as.server@5.0.0.Alpha-redhat-20180502//org.jboss.as.server.ApplicationServerService.start(ApplicationServerService.java:144)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1714)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1693)
> ... 6 more
> {code}
> In Fedora 28 there is nss 3.36.1 (dnf info nss.x86_64)
> In Fedora 27 there was 3.33 https://fedora.pkgs.org/27/fedora-x86_64/nss-3.33.0-1.0.fc27.x86_64.rpm.html
> In nss 3.35 there was switch of format to SQL [1]
> ??Applications using NSS may explicitly request to use a specific database format, by adding a type prefix to the database directory, provided at NSS initialization time. ??
> But I am not sure how to define that in java. I am using
> {code:pkcs11.cfg}
> name = testPkcs
> nssLibraryDirectory = /usr/lib64
> nssSecmodDirectory = /opt/java/jdk-9.0.1_fips/fips/nssdb
> nssDbMode = readOnly
> nssModule = fips
> {code}
> I am awaer there is probably nothing that can be done in Elytron. I think it is matter of NSS/SunPKCS11 configuration. I create this JIRA as a place for finding out what the problem is.
> [1] https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.35_re...
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 2 months
[JBoss JIRA] (ELY-1578) Upgrade to Fedora 28 breaks FIPS scenarios
by Martin Choma (JIRA)
[ https://issues.jboss.org/browse/ELY-1578?page=com.atlassian.jira.plugin.s... ]
Martin Choma updated ELY-1578:
------------------------------
Description:
On Fedora 28 I get
{code}
14:52:28,813 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-2) MSC000001: Failed to start service jboss.as: org.jboss.msc.service.StartException in service jboss.as: Failed to start service
at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1706)
at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1540)
at org.jboss.threads@2.3.2.Final//org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
at org.jboss.threads@2.3.2.Final//org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
at org.jboss.threads@2.3.2.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
at org.jboss.threads@2.3.2.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
at java.base/java.lang.Thread.run(Thread.java:844)
Caused by: java.security.ProviderException: NSS module not available: fips
at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:278)
at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11$1.run(SunPKCS11.java:113)
at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11$1.run(SunPKCS11.java:110)
at java.base/java.security.AccessController.doPrivileged(Native Method)
at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.configure(SunPKCS11.java:110)
at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:247)
at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:238)
at java.base/java.security.AccessController.doPrivileged(Native Method)
at java.base/sun.security.jca.ProviderConfig.doLoadProvider(ProviderConfig.java:238)
at java.base/sun.security.jca.ProviderConfig.getProvider(ProviderConfig.java:218)
at java.base/sun.security.jca.ProviderList.getProvider(ProviderList.java:266)
at java.base/sun.security.jca.ProviderList.getService(ProviderList.java:379)
at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:157)
at java.base/java.security.Security.getImpl(Security.java:697)
at java.base/java.security.MessageDigest.getInstance(MessageDigest.java:178)
at org.jboss.as.deployment-repository(a)5.0.0.Alpha-redhat-20180502//org.jboss.as.repository.ContentRepositoryImpl.<init>(ContentRepositoryImpl.java:90)
at org.jboss.as.deployment-repository@5.0.0.Alpha-redhat-20180502//org.jboss.as.repository.ContentRepository$Factory.addService(ContentRepository.java:185)
at org.jboss.as.server@5.0.0.Alpha-redhat-20180502//org.jboss.as.server.ApplicationServerService.start(ApplicationServerService.java:144)
at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1714)
at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1693)
... 6 more
{code}
In Fedora 28 there is nss 3.36.1 (dnf info nss.x86_64)
In Fedora 27 there was 3.33 https://fedora.pkgs.org/27/fedora-x86_64/nss-3.33.0-1.0.fc27.x86_64.rpm.html
In nss 3.35 there was switch of format to SQL [1]
??Applications using NSS may explicitly request to use a specific database format, by adding a type prefix to the database directory, provided at NSS initialization time. ??
But I am not sure how to define that in java. I am using
{code:pkcs11.cfg}
name = testPkcs
nssLibraryDirectory = /usr/lib64
nssSecmodDirectory = /opt/java/jdk-9.0.1_fips/fips/nssdb
nssDbMode = readOnly
nssModule = fips
{code}
I am awaer there is probably nothing that can be done in Elytron. I think it is matter of NSS/SunPKCS11 configuration. I create this JIRA as a place for finding out what the problem is.
[1] https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.35_re...
was:
On Fedora 28 I get
{code}
14:52:28,813 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-2) MSC000001: Failed to start service jboss.as: org.jboss.msc.service.StartException in service jboss.as: Failed to start service
at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1706)
at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1540)
at org.jboss.threads@2.3.2.Final//org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
at org.jboss.threads@2.3.2.Final//org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
at org.jboss.threads@2.3.2.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
at org.jboss.threads@2.3.2.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
at java.base/java.lang.Thread.run(Thread.java:844)
Caused by: java.security.ProviderException: NSS module not available: fips
at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:278)
at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11$1.run(SunPKCS11.java:113)
at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11$1.run(SunPKCS11.java:110)
at java.base/java.security.AccessController.doPrivileged(Native Method)
at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.configure(SunPKCS11.java:110)
at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:247)
at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:238)
at java.base/java.security.AccessController.doPrivileged(Native Method)
at java.base/sun.security.jca.ProviderConfig.doLoadProvider(ProviderConfig.java:238)
at java.base/sun.security.jca.ProviderConfig.getProvider(ProviderConfig.java:218)
at java.base/sun.security.jca.ProviderList.getProvider(ProviderList.java:266)
at java.base/sun.security.jca.ProviderList.getService(ProviderList.java:379)
at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:157)
at java.base/java.security.Security.getImpl(Security.java:697)
at java.base/java.security.MessageDigest.getInstance(MessageDigest.java:178)
at org.jboss.as.deployment-repository(a)5.0.0.Alpha-redhat-20180502//org.jboss.as.repository.ContentRepositoryImpl.<init>(ContentRepositoryImpl.java:90)
at org.jboss.as.deployment-repository@5.0.0.Alpha-redhat-20180502//org.jboss.as.repository.ContentRepository$Factory.addService(ContentRepository.java:185)
at org.jboss.as.server@5.0.0.Alpha-redhat-20180502//org.jboss.as.server.ApplicationServerService.start(ApplicationServerService.java:144)
at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1714)
at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1693)
... 6 more
{code}
In Fedora 28 there is nss 3.36.1 (dnf info nss.x86_64)
In nss 3.35 there was switch of format to SQL [1]
??Applications using NSS may explicitly request to use a specific database format, by adding a type prefix to the database directory, provided at NSS initialization time. ??
But I am not sure how to define that in java. I am using
{code:pkcs11.cfg}
name = testPkcs
nssLibraryDirectory = /usr/lib64
nssSecmodDirectory = /opt/java/jdk-9.0.1_fips/fips/nssdb
nssDbMode = readOnly
nssModule = fips
{code}
I am awaer there is probably nothing that can be done in Elytron. I think it is matter of NSS/SunPKCS11 configuration. I create this JIRA as a place for finding out what the problem is.
[1] https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.35_re...
> Upgrade to Fedora 28 breaks FIPS scenarios
> ------------------------------------------
>
> Key: ELY-1578
> URL: https://issues.jboss.org/browse/ELY-1578
> Project: WildFly Elytron
> Issue Type: Bug
> Affects Versions: 1.3.1.Final
> Reporter: Martin Choma
>
> On Fedora 28 I get
> {code}
> 14:52:28,813 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-2) MSC000001: Failed to start service jboss.as: org.jboss.msc.service.StartException in service jboss.as: Failed to start service
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1706)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1540)
> at org.jboss.threads@2.3.2.Final//org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
> at org.jboss.threads@2.3.2.Final//org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
> at org.jboss.threads@2.3.2.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
> at org.jboss.threads@2.3.2.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
> at java.base/java.lang.Thread.run(Thread.java:844)
> Caused by: java.security.ProviderException: NSS module not available: fips
> at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:278)
> at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11$1.run(SunPKCS11.java:113)
> at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11$1.run(SunPKCS11.java:110)
> at java.base/java.security.AccessController.doPrivileged(Native Method)
> at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.configure(SunPKCS11.java:110)
> at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:247)
> at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:238)
> at java.base/java.security.AccessController.doPrivileged(Native Method)
> at java.base/sun.security.jca.ProviderConfig.doLoadProvider(ProviderConfig.java:238)
> at java.base/sun.security.jca.ProviderConfig.getProvider(ProviderConfig.java:218)
> at java.base/sun.security.jca.ProviderList.getProvider(ProviderList.java:266)
> at java.base/sun.security.jca.ProviderList.getService(ProviderList.java:379)
> at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:157)
> at java.base/java.security.Security.getImpl(Security.java:697)
> at java.base/java.security.MessageDigest.getInstance(MessageDigest.java:178)
> at org.jboss.as.deployment-repository(a)5.0.0.Alpha-redhat-20180502//org.jboss.as.repository.ContentRepositoryImpl.<init>(ContentRepositoryImpl.java:90)
> at org.jboss.as.deployment-repository@5.0.0.Alpha-redhat-20180502//org.jboss.as.repository.ContentRepository$Factory.addService(ContentRepository.java:185)
> at org.jboss.as.server@5.0.0.Alpha-redhat-20180502//org.jboss.as.server.ApplicationServerService.start(ApplicationServerService.java:144)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1714)
> at org.jboss.msc@1.3.2.Final-redhat-1//org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1693)
> ... 6 more
> {code}
> In Fedora 28 there is nss 3.36.1 (dnf info nss.x86_64)
> In Fedora 27 there was 3.33 https://fedora.pkgs.org/27/fedora-x86_64/nss-3.33.0-1.0.fc27.x86_64.rpm.html
> In nss 3.35 there was switch of format to SQL [1]
> ??Applications using NSS may explicitly request to use a specific database format, by adding a type prefix to the database directory, provided at NSS initialization time. ??
> But I am not sure how to define that in java. I am using
> {code:pkcs11.cfg}
> name = testPkcs
> nssLibraryDirectory = /usr/lib64
> nssSecmodDirectory = /opt/java/jdk-9.0.1_fips/fips/nssdb
> nssDbMode = readOnly
> nssModule = fips
> {code}
> I am awaer there is probably nothing that can be done in Elytron. I think it is matter of NSS/SunPKCS11 configuration. I create this JIRA as a place for finding out what the problem is.
> [1] https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.35_re...
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 2 months
[JBoss JIRA] (JBJCA-1376) if a security domain is used for an XA datasource in WildFly 11 and later, recovery will not work
by Martin Simka (JIRA)
[ https://issues.jboss.org/browse/JBJCA-1376?page=com.atlassian.jira.plugin... ]
Martin Simka updated JBJCA-1376:
--------------------------------
Affects Version/s: 1.4.6
1.4.7
1.4.8
1.4.9
> if a security domain is used for an XA datasource in WildFly 11 and later, recovery will not work
> -------------------------------------------------------------------------------------------------
>
> Key: JBJCA-1376
> URL: https://issues.jboss.org/browse/JBJCA-1376
> Project: IronJacamar
> Issue Type: Bug
> Components: Deployer
> Affects Versions: 1.4.6, 1.4.7, 1.4.8, 1.4.9
> Reporter: Martin Simka
> Assignee: Martin Simka
> Priority: Critical
>
> {noformat}
> 17:05:32,521 WARN [org.jboss.jca.core.tx.jbossts.XAResourceRecoveryImpl] (Periodic Recovery) IJ000904: No security domain defined for crash recovery: java:jboss/datasources/oraclexa1
> 17:05:32,521 WARN [org.jboss.jca.core.tx.jbossts.XAResourceRecoveryImpl] (Periodic Recovery) IJ000905: Subject for crash recovery was null: java:jboss/datasources/oraclexa1
> {noformat}
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 2 months