[JBoss JIRA] (WFCORE-3909) jboss-cli script does not delegate -D properties to java process
by Brian Stansberry (JIRA)
[ https://issues.jboss.org/browse/WFCORE-3909?page=com.atlassian.jira.plugi... ]
Brian Stansberry commented on WFCORE-3909:
------------------------------------------
This sounds like an RFE to me. It's not a bug that there are differences in how software we write functions.
Note that standalone.sh does _not_ work by ensuring that all -D arg are passed as args to java. Most are passed as args to org.jboss.modules.Main, which in turn passes them through to org.jboss.as.server.Main, which in turn sets the system property. Same as the CLI CommandLineMain. This is done well after JVM launch and after quite a lot of system properties are read. IOW if you want to be sure your property is set before it's read, you need to edit standalone.conf. Using -D args to standalone.sh as a way to configure logging definitely doesn't work. Passing properties as args to standalone.sh is actually somewhat an anti-pattern that we support for historical reasons.
Having the CLI script process all args and ensure that any -D is passed to java means a lot of script complication that would need to be maintained for all variations. And then, if the requirement is all scripts have the same functionality, that means we have to alter all the other scripts, including standalone.sh, to do the same thing.
> jboss-cli script does not delegate -D properties to java process
> ----------------------------------------------------------------
>
> Key: WFCORE-3909
> URL: https://issues.jboss.org/browse/WFCORE-3909
> Project: WildFly Core
> Issue Type: Bug
> Components: CLI, Scripts
> Affects Versions: 5.0.0.Final
> Reporter: Erich Duda
> Assignee: Marek Marusic
>
> *Scenario:* I want to change logging configuration of CLI using system properties. My expectation is that I just put the properties on command line as arguments.
> {code}
> ./jboss-cli.sh -Dlogging.configuration=... -Djboss.cli.log.level=TRACE -Djboss.cli.log.level=TRACE
> {code}
> However what I actually have to do is to put the properties into the {{JAVA_OPTS}} env variable.
> {code}
> JAVA_OPTS="-Dlogging.configuration=... -Djboss.cli.log.level=TRACE -Djboss.cli.log.level=TRACE" ./jboss-cli.sh
> {code}
> This is different behavior than I am used to standalone.sh script. IMO it is more natural to put the properties as arguments of the script.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
7 years, 9 months
[JBoss JIRA] (WFCORE-3970) Reload Elytron ldap-key-store using JBoss CLI
by Farah Juma (JIRA)
[ https://issues.jboss.org/browse/WFCORE-3970?page=com.atlassian.jira.plugi... ]
Farah Juma commented on WFCORE-3970:
------------------------------------
Since an {{ldap-key-store}} already loads its entries in real-time, the focus of this task should actually be to add a management operation to allow an Elytron {{trust-manager}} to be re-initialized, similar to the {{key-manager}} {{init}} operation. I'm going to update the title of this issue to reflect this.
> Reload Elytron ldap-key-store using JBoss CLI
> ---------------------------------------------
>
> Key: WFCORE-3970
> URL: https://issues.jboss.org/browse/WFCORE-3970
> Project: WildFly Core
> Issue Type: Feature Request
> Components: Security
> Reporter: Farah Juma
> Assignee: Justin Cook
>
> It is not possible to reload the certificates dynamically for Elytron's *ldap-key-store*.
> If some changes have been made in the certificates present in LDAP directory then EAP needs to be restarted first in order to see those changes done in LDAP directory which is not ideal for production environments.
> For simple file based keystores, *load* operation is available :
> -------------------------
> [standalone@localhost:9990 /] /subsystem=elytron/key-store=twoWayKS:load()
> -------------------------
> But this option is missing for *ldap-key-store* :
> -------------------------
> [standalone@localhost:9990 /] /subsystem=elytron/ldap-key-store=LKS1:load()
> {
> "outcome" => "failed",
> "failure-description" => "WFLYCTL0031: No operation named 'load' exists at address [
> (\"subsystem\" => \"elytron\"),
> (\"ldap-key-store\" => \"LKS1\")
> ]",
> "rolled-back" => true
> }
> -------------------------
> There should be such option available to reload the content of ldap-key-store without restarting the EAP server.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
7 years, 9 months
[JBoss JIRA] (WFCORE-3970) Add a management operation to allow an Elytron trust-manager to be re-initialized
by Farah Juma (JIRA)
[ https://issues.jboss.org/browse/WFCORE-3970?page=com.atlassian.jira.plugi... ]
Farah Juma updated WFCORE-3970:
-------------------------------
Summary: Add a management operation to allow an Elytron trust-manager to be re-initialized (was: Reload Elytron ldap-key-store using JBoss CLI)
> Add a management operation to allow an Elytron trust-manager to be re-initialized
> ---------------------------------------------------------------------------------
>
> Key: WFCORE-3970
> URL: https://issues.jboss.org/browse/WFCORE-3970
> Project: WildFly Core
> Issue Type: Feature Request
> Components: Security
> Reporter: Farah Juma
> Assignee: Justin Cook
>
> It is not possible to reload the certificates dynamically for Elytron's *ldap-key-store*.
> If some changes have been made in the certificates present in LDAP directory then EAP needs to be restarted first in order to see those changes done in LDAP directory which is not ideal for production environments.
> For simple file based keystores, *load* operation is available :
> -------------------------
> [standalone@localhost:9990 /] /subsystem=elytron/key-store=twoWayKS:load()
> -------------------------
> But this option is missing for *ldap-key-store* :
> -------------------------
> [standalone@localhost:9990 /] /subsystem=elytron/ldap-key-store=LKS1:load()
> {
> "outcome" => "failed",
> "failure-description" => "WFLYCTL0031: No operation named 'load' exists at address [
> (\"subsystem\" => \"elytron\"),
> (\"ldap-key-store\" => \"LKS1\")
> ]",
> "rolled-back" => true
> }
> -------------------------
> There should be such option available to reload the content of ldap-key-store without restarting the EAP server.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
7 years, 9 months