[JBoss JIRA] (ELY-1622) BC FIPS with CLI: SunX509 KeyManagerFactory not available
by Martin Choma (JIRA)
[ https://issues.jboss.org/browse/ELY-1622?page=com.atlassian.jira.plugin.s... ]
Martin Choma commented on ELY-1622:
-----------------------------------
Just a note. I tried to use workaround "set ssl.KeyManagerFactory.algorithm=X509 in java.security file" using elytron security properties but it does not work. Again probably it is applied late.
/subsystem=elytron:write-attribute(name=security-properties,value={ssl.KeyManagerFactory.algorithm=X509}
{code}
<subsystem xmlns="urn:wildfly:elytron:4.0" final-providers="combined-providers" disallowed-providers="OracleUcrypto">
<security-properties>
<security-property name="ssl.KeyManagerFactory.algorithm" value="X509"/>
</security-properties>
{code}
> BC FIPS with CLI: SunX509 KeyManagerFactory not available
> ---------------------------------------------------------
>
> Key: ELY-1622
> URL: https://issues.jboss.org/browse/ELY-1622
> Project: WildFly Elytron
> Issue Type: Bug
> Components: SSL
> Affects Versions: 1.5.1.Final
> Reporter: Martin Choma
> Assignee: Farah Juma
> Priority: Blocker
> Fix For: 1.5.2.Final
>
> Attachments: cli-test-wildfly-config.xml, jboss-cli.log, truststore.bcfks
>
>
> I am trying to connect from jboss-cli.sh to EAP server. To reproduce the problem it is enough BC FIPS is used only on client side.
> {code:java|titlejboss-cli.log}
> 11:50:25,147 ERROR [org.jboss.as.cli.impl.CliLauncher] Error processing CLI: org.jboss.as.cli.CliInitializationException: Failed to connect to the controller
> at org.jboss.as.cli.impl.CliLauncher.initCommandContext(CliLauncher.java:330)
> at org.jboss.as.cli.impl.CliLauncher.main(CliLauncher.java:291)
> at org.jboss.as.cli.CommandLineMain.main(CommandLineMain.java:45)
> at org.jboss.modules.Module.run(Module.java:352)
> at org.jboss.modules.Module.run(Module.java:320)
> at org.jboss.modules.Main.main(Main.java:593)
> Caused by: org.jboss.as.cli.CommandLineException: Failed to resolve host 'localhost'
> at org.jboss.as.cli.impl.CommandContextImpl.connectController(CommandContextImpl.java:1256)
> at org.jboss.as.cli.impl.CommandContextImpl.connectController(CommandContextImpl.java:1203)
> at org.jboss.as.cli.impl.CommandContextImpl.connectController(CommandContextImpl.java:1198)
> at org.jboss.as.cli.impl.CliLauncher.initCommandContext(CliLauncher.java:328)
> ... 5 more
> Caused by: java.io.IOException: Failed to obtain SSLContext
> at org.jboss.as.cli.impl.CLIModelControllerClient.<init>(CLIModelControllerClient.java:156)
> at org.jboss.as.cli.impl.ModelControllerClientFactory$2.getClient(ModelControllerClientFactory.java:85)
> at org.jboss.as.cli.impl.CommandContextImpl.connectController(CommandContextImpl.java:1222)
> ... 8 more
> Caused by: java.security.KeyManagementException: java.security.NoSuchAlgorithmException: SunX509 KeyManagerFactory not available
> at org.bouncycastle.jsse.provider.ProvSSLContextSpi.selectKeyManager(ProvSSLContextSpi.java:589)
> at org.bouncycastle.jsse.provider.ProvSSLContextSpi.engineInit(ProvSSLContextSpi.java:531)
> at javax.net.ssl.SSLContext.init(SSLContext.java:282)
> at org.wildfly.security.ssl.SSLContextBuilder.lambda$build$0(SSLContextBuilder.java:372)
> at org.wildfly.security.OneTimeSecurityFactory.create(OneTimeSecurityFactory.java:53)
> at org.wildfly.security.auth.client.AuthenticationContextConfigurationClient.getSSLContext(AuthenticationContextConfigurationClient.java:221)
> at org.wildfly.security.auth.client.AuthenticationContextConfigurationClient.getSSLContext(AuthenticationContextConfigurationClient.java:208)
> at org.jboss.as.cli.impl.CLIModelControllerClient.<init>(CLIModelControllerClient.java:153)
> ... 10 more
> Caused by: java.security.NoSuchAlgorithmException: SunX509 KeyManagerFactory not available
> at sun.security.jca.GetInstance.getInstance(GetInstance.java:159)
> at javax.net.ssl.KeyManagerFactory.getInstance(KeyManagerFactory.java:137)
> at org.bouncycastle.jsse.provider.ProvSSLContextSpi.selectKeyManager(ProvSSLContextSpi.java:583)
> ... 17 more
> {code}
> When I use non-FIPS java with CLI I can make it work. It does occure also when connecting to default unsecured port 9990.
> When I use BCFKS truststore on server side, e.g. in 2-way http communication it works.
> I believe problem is I cant configure algorithm for keymanager on client side in wildfly-config.xml. (At least I don't see how could I do so).
> BC provider does not know SunX509 arlgorithm, rather X509, X.509 or PKIX could be used.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
7 years, 10 months
[JBoss JIRA] (WFCORE-4089) Update subsystem and core-model tests to use EAP 7.2.0 rather than WF14
by Kabir Khan (JIRA)
[ https://issues.jboss.org/browse/WFCORE-4089?page=com.atlassian.jira.plugi... ]
Kabir Khan updated WFCORE-4089:
-------------------------------
Labels: blocker-WF15 (was: )
> Update subsystem and core-model tests to use EAP 7.2.0 rather than WF14
> -----------------------------------------------------------------------
>
> Key: WFCORE-4089
> URL: https://issues.jboss.org/browse/WFCORE-4089
> Project: WildFly Core
> Issue Type: Task
> Components: Management
> Reporter: Kabir Khan
> Assignee: Jeff Mesnil
> Priority: Blocker
> Labels: blocker-WF16
> Fix For: 8.0.0.Alpha
>
>
> Once EAP 7.2.0 is out, remove ModelTestControllerVersion.EAP_7_2_0_TMP and add EAP_7_2_0 proper, and go through and adjust all the tests using the tmp version. I think this is ok, as there are some more advances subsystem tests which specify additional maven artifacts. Those maven artifacts will need to be updated to use the proper EAP 7.2.0 artifacts once it is released, and having to do this replacement will serve as a reminder.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
7 years, 10 months
[JBoss JIRA] (WFCORE-4089) Update subsystem and core-model tests to use EAP 7.2.0 rather than WF14
by Kabir Khan (JIRA)
[ https://issues.jboss.org/browse/WFCORE-4089?page=com.atlassian.jira.plugi... ]
Kabir Khan updated WFCORE-4089:
-------------------------------
Labels: blocker-WF16 (was: blocker-WF15)
> Update subsystem and core-model tests to use EAP 7.2.0 rather than WF14
> -----------------------------------------------------------------------
>
> Key: WFCORE-4089
> URL: https://issues.jboss.org/browse/WFCORE-4089
> Project: WildFly Core
> Issue Type: Task
> Components: Management
> Reporter: Kabir Khan
> Assignee: Jeff Mesnil
> Priority: Blocker
> Labels: blocker-WF16
> Fix For: 8.0.0.Alpha
>
>
> Once EAP 7.2.0 is out, remove ModelTestControllerVersion.EAP_7_2_0_TMP and add EAP_7_2_0 proper, and go through and adjust all the tests using the tmp version. I think this is ok, as there are some more advances subsystem tests which specify additional maven artifacts. Those maven artifacts will need to be updated to use the proper EAP 7.2.0 artifacts once it is released, and having to do this replacement will serve as a reminder.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
7 years, 10 months
[JBoss JIRA] (JGRP-2284) Discovery protocol for members in the same process
by Bela Ban (JIRA)
Bela Ban created JGRP-2284:
------------------------------
Summary: Discovery protocol for members in the same process
Key: JGRP-2284
URL: https://issues.jboss.org/browse/JGRP-2284
Project: JGroups
Issue Type: Feature Request
Reporter: Bela Ban
Assignee: Bela Ban
Fix For: 4.0.14
Discovery protocol that works for members in the same process. Something like SHARED_LOOPBACK_PING, but without the requirement for SHARED_LOOPBACK as transport, but it should work over UDP, TCP, TCP_NIO2 etc.
Similar to TEST_PING in Infinispan.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
7 years, 10 months