August 2019 - jboss-jira - Jboss List Archives

[JBoss JIRA] (WFCORE-944) truststore path is ignored if provider is not JKS

by Brian Stansberry (Jira)

[ https://issues.jboss.org/browse/WFCORE-944?page=com.atlassian.jira.plugin... ] Brian Stansberry updated WFCORE-944: ------------------------------------ Fix Version/s: 10.0.0.Beta6 (was: 10.0.0.Beta5) > truststore path is ignored if provider is not JKS > ------------------------------------------------- > > Key: WFCORE-944 > URL: https://issues.jboss.org/browse/WFCORE-944 > Project: WildFly Core > Issue Type: Bug > Components: Security > Reporter: Arto Huusko > Priority: Major > Fix For: 10.0.0.Beta6 > > > truststore configuration ignores the path and relative-to parameters if the truststore provider is anything else than JKS. > This works as documented, but it is not correct. There can be and are truststore implementations that need to load parameters or whatever data from a file, and the current implementation prevents these truststore providers from working. > We have a custom truststore that is loaded from database, and database access parameters are read from a properties file. When trying to use this with Wildfly 9, the keystore engineLoad parameter is passed in as null, even though path and relative-to are configured. > Even standard java supports PKCS12 truststores, where the same problem would occur. > So I would suggest that > - if provider is JKS, path is mandatory > - if provider is not JKS, but path is specified, it is passed to the provider -- This message was sent by Atlassian Jira (v7.13.5#713005)

6 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-4172) Add support for TLS 1.3

by Brian Stansberry (Jira)

[ https://issues.jboss.org/browse/WFCORE-4172?page=com.atlassian.jira.plugi... ] Brian Stansberry updated WFCORE-4172: ------------------------------------- Fix Version/s: 10.0.0.Beta6 (was: 10.0.0.Beta5) > Add support for TLS 1.3 > ----------------------- > > Key: WFCORE-4172 > URL: https://issues.jboss.org/browse/WFCORE-4172 > Project: WildFly Core > Issue Type: Feature Request > Components: Security > Reporter: Farah Juma > Assignee: Farah Juma > Priority: Major > Labels: affects-model, eap-7.2.0-deferred > Fix For: 10.0.0.Beta6 > > > It presently appears as though TLS 1.3 support could be available from Java 11. -- This message was sent by Atlassian Jira (v7.13.5#713005)

6 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-4150) Support automatically adding / updating credentials in the CredentialStore

by Brian Stansberry (Jira)

[ https://issues.jboss.org/browse/WFCORE-4150?page=com.atlassian.jira.plugi... ] Brian Stansberry updated WFCORE-4150: ------------------------------------- Fix Version/s: 10.0.0.Beta6 (was: 10.0.0.Beta5) > Support automatically adding / updating credentials in the CredentialStore > -------------------------------------------------------------------------- > > Key: WFCORE-4150 > URL: https://issues.jboss.org/browse/WFCORE-4150 > Project: WildFly Core > Issue Type: Feature Request > Components: Security > Reporter: Darran Lofthouse > Assignee: Farah Juma > Priority: Major > Fix For: 10.0.0.Beta6 > > -- This message was sent by Atlassian Jira (v7.13.5#713005)

6 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-3747) Enhance credential-store description related to location and type attributes

by Brian Stansberry (Jira)

[ https://issues.jboss.org/browse/WFCORE-3747?page=com.atlassian.jira.plugi... ] Brian Stansberry updated WFCORE-3747: ------------------------------------- Fix Version/s: 10.0.0.Beta6 (was: 10.0.0.Beta5) > Enhance credential-store description related to location and type attributes > ---------------------------------------------------------------------------- > > Key: WFCORE-3747 > URL: https://issues.jboss.org/browse/WFCORE-3747 > Project: WildFly Core > Issue Type: Enhancement > Components: Security > Reporter: Claudio Miranda > Assignee: Darran Lofthouse > Priority: Major > Fix For: 10.0.0.Beta6 > > > The description for "location" and "type" for credential-store resource is displayed below. > Following discussion of WFCORE-3458, the "location" attribute is required only when the "type" is file based, but the description doesn't says that, the description may be improved to reflect this behavior and list the possible file based types. > When the user doesn't set the "type" attribute it defaults to "JCEKS", but there is no "default" value on resource description for "type" attribute. > {code} > "location" => { > "type" => STRING, > "description" => "File name of credential store storage.", > "attribute-group" => "implementation", > "expressions-allowed" => true, > "required" => false, > "nillable" => true, > "min-length" => 1L, > "max-length" => 2147483647L, > "access-type" => "read-write", > "storage" => "configuration", > "restart-required" => "all-services" > }, > "type" => { > "type" => STRING, > "description" => "The credential store type, e.g. KeyStoreCredentialStore.", > "attribute-group" => "implementation", > "expressions-allowed" => true, > "required" => false, > "nillable" => true, > "min-length" => 1L, > "max-length" => 2147483647L, > "access-type" => "read-write", > "storage" => "configuration", > "restart-required" => "all-services" > } > {code} -- This message was sent by Atlassian Jira (v7.13.5#713005)

6 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2496) Functionality in WildFly to encrypt database passwords

by Brian Stansberry (Jira)

[ https://issues.jboss.org/browse/WFCORE-2496?page=com.atlassian.jira.plugi... ] Brian Stansberry updated WFCORE-2496: ------------------------------------- Fix Version/s: 10.0.0.Beta6 (was: 10.0.0.Beta5) > Functionality in WildFly to encrypt database passwords > ------------------------------------------------------ > > Key: WFCORE-2496 > URL: https://issues.jboss.org/browse/WFCORE-2496 > Project: WildFly Core > Issue Type: Feature Request > Components: Security > Affects Versions: 3.0.0.Beta7 > Reporter: Carlton Zachary > Assignee: Farah Juma > Priority: Major > Fix For: 10.0.0.Beta6 > > > Is it possible to add functionality to WildFly to encrypt a data source password when the data source is being created? Currently WildFly/EAP stores the password as plain text in the domain.xml/standalone.xml. > Thanks -- This message was sent by Atlassian Jira (v7.13.5#713005)

6 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-4407) Cannot configure Elytron security domain using embedded server in admin mode

by Brian Stansberry (Jira)

[ https://issues.jboss.org/browse/WFCORE-4407?page=com.atlassian.jira.plugi... ] Brian Stansberry updated WFCORE-4407: ------------------------------------- Fix Version/s: 10.0.0.Beta6 (was: 10.0.0.Beta5) > Cannot configure Elytron security domain using embedded server in admin mode > ---------------------------------------------------------------------------- > > Key: WFCORE-4407 > URL: https://issues.jboss.org/browse/WFCORE-4407 > Project: WildFly Core > Issue Type: Bug > Components: Embedded > Environment: > Reporter: Yeray Borges > Assignee: Yeray Borges > Priority: Major > Fix For: 10.0.0.Beta6 > > > There are some configurations that are impossible to do using the embedded server, for example, we cannot create a security domain in Elytron that references a security domain in the security subsystem: > {noformat} > embed-server --server-config=standalone-full-ha.xml --std-out=echo > /subsystem=security/security-domain=my-sec-domain:add(cache-type=default) > /subsystem=security/security-domain=my-sec-domain/authentication=classic:add(login-modules=[{code=RealmUsersRoles, flag=required, module=RealmUsersRoles, module-options=[("usersProperties"=>"usersProperties"),("rolesProperties"=>"rolesProperties")]}]) > /subsystem=security/elytron-realm=my-sec-domain:add(legacy-jaas-config=my-sec-domain) > /subsystem=elytron/security-domain=my-sec-domain:add(realms=[{realm=my-sec-domain}],default-realm=my-sec-domain,permission-mapper=default-permission-mapper) > stop-embedded-server > {noformat} > The execution of these operations in an embedded server running in admin-mode throws the following error: > {noformat} > [standalone@embedded /] /subsystem=elytron/security-domain=my-sec-domain:add(realms=[{realm=my-sec-domain}],default-realm=my-sec-domain,permission-mapper=default-permission-mapper) > 12:30:53,429 ERROR [org.jboss.as.controller.management-operation] (pool-3-thread-1) WFLYCTL0013: Operation ("add") failed - address: ([ > ("subsystem" => "elytron"), > ("security-domain" => "my-sec-domain") > ]) - failure description: { > "WFLYCTL0412: Required services that are not installed:" => ["org.wildfly.security.security-realm.my-sec-domain"], > "WFLYCTL0180: Services with missing/unavailable dependencies" => ["org.wildfly.security.security-domain.my-sec-domain.initial is missing [org.wildfly.security.security-realm.my-sec-domain]"] > } > { > "outcome" => "failed", > "failure-description" => { > "WFLYCTL0412: Required services that are not installed:" => ["org.wildfly.security.security-realm.my-sec-domain"], > "WFLYCTL0180: Services with missing/unavailable dependencies" => ["org.wildfly.security.security-domain.my-sec-domain.initial is missing [org.wildfly.security.security-realm.my-sec-domain]"] > }, > "rolled-back" => true > } > {noformat} > The problem here is Elytron security domain services cannot be up because they require the legacy installed realm services, which are not up when we are using embedded in admin-only mode. > The SecurityDomain advertises no runtime operation, if no services are installed that would ever depend on security domain we may be able to skip installing some of these services entirely and allow their configuration in embedded / admin-only. -- This message was sent by Atlassian Jira (v7.13.5#713005)

6 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-4391) Upgrade apacheds-all to 2.0.0-M24 for Elytron tests

by Brian Stansberry (Jira)

[ https://issues.jboss.org/browse/WFCORE-4391?page=com.atlassian.jira.plugi... ] Brian Stansberry updated WFCORE-4391: ------------------------------------- Fix Version/s: 10.0.0.Beta6 (was: 10.0.0.Beta5) > Upgrade apacheds-all to 2.0.0-M24 for Elytron tests > --------------------------------------------------- > > Key: WFCORE-4391 > URL: https://issues.jboss.org/browse/WFCORE-4391 > Project: WildFly Core > Issue Type: Component Upgrade > Reporter: Farah Juma > Assignee: Farah Juma > Priority: Major > Fix For: 10.0.0.Beta6 > > > This upgrade is needed to avoid a race condition in Apache Directory Server that causes a hang in {{org.wildfly.extension.elytron.LdapTestCase}} with TLS 1.3. -- This message was sent by Atlassian Jira (v7.13.5#713005)

6 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-4314) Enchance keystore CLI commands

by Brian Stansberry (Jira)

[ https://issues.jboss.org/browse/WFCORE-4314?page=com.atlassian.jira.plugi... ] Brian Stansberry updated WFCORE-4314: ------------------------------------- Fix Version/s: 10.0.0.Beta6 (was: 10.0.0.Beta5) > Enchance keystore CLI commands > ------------------------------ > > Key: WFCORE-4314 > URL: https://issues.jboss.org/browse/WFCORE-4314 > Project: WildFly Core > Issue Type: Feature Request > Components: Security > Reporter: Bartosz Baranowski > Assignee: Bartosz Baranowski > Priority: Major > Fix For: 10.0.0.Beta6 > > -- This message was sent by Atlassian Jira (v7.13.5#713005)

6 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-4227) Add the ability for the CLI SSL security commands to be able to obtain a server certificate from Let's Encrypt

by Brian Stansberry (Jira)

[ https://issues.jboss.org/browse/WFCORE-4227?page=com.atlassian.jira.plugi... ] Brian Stansberry updated WFCORE-4227: ------------------------------------- Fix Version/s: 10.0.0.Beta6 (was: 10.0.0.Beta5) > Add the ability for the CLI SSL security commands to be able to obtain a server certificate from Let's Encrypt > -------------------------------------------------------------------------------------------------------------- > > Key: WFCORE-4227 > URL: https://issues.jboss.org/browse/WFCORE-4227 > Project: WildFly Core > Issue Type: Feature Request > Reporter: Marek Marusic > Assignee: Marek Marusic > Priority: Major > Fix For: 10.0.0.Beta6 > > > WFCORE-3447 introduced high-level security commands (ssl enable-ssl-management and ssl enable-ssl-http-server) for enabling one-way and two-way SSL easily. To generate the server certificate, these high-level security commands made use of key-store management operations to generate a self-signed certificate. Since it is now possible to obtain certificates from the Let's Encrypt certificate authority using the CLI, the high-level security commands should be updated so that in addition to being able to generate a self-signed server certificate, they can also obtain a server certificate from Let's Encrypt. Details on the new management operations for obtaining and managing certificates from Let's Encrypt can be found in the analysis document and in this blog post. -- This message was sent by Atlassian Jira (v7.13.5#713005)

6 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-4583) Add SecretKey manipulation operations to the credential-store resource

by Brian Stansberry (Jira)

[ https://issues.jboss.org/browse/WFCORE-4583?page=com.atlassian.jira.plugi... ] Brian Stansberry updated WFCORE-4583: ------------------------------------- Fix Version/s: 10.0.0.Beta6 (was: 10.0.0.Beta5) > Add SecretKey manipulation operations to the credential-store resource > ---------------------------------------------------------------------- > > Key: WFCORE-4583 > URL: https://issues.jboss.org/browse/WFCORE-4583 > Project: WildFly Core > Issue Type: Sub-task > Components: Security > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > Priority: Major > Fix For: 10.0.0.Beta6 > > -- This message was sent by Atlassian Jira (v7.13.5#713005)

6 years, 10 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-jira August 2019