[jboss-jira] [JBoss JIRA] (WFCORE-2617) When failed credential store flush to file on the disk then we have inconsistency between credential store in memory and persisted file.

When failed credential store flush to file on the disk then we have inconsistency between credential store in memory and persisted file. ---------------------------------------------------------------------------------------------------------------------------------------- Key: WFCORE-2617 URL: https://issues.jboss.org/browse/WFCORE-2617 Project: WildFly Core Issue Type: Bug Components: Security Reporter: Hynek Švábek Assignee: Tomas Hofman Priority: Critical When failed credential store flush to file on the disk then we have inconsistency between credential store in memory and persisted file. I expect consistent state, same aliases in memory and persisted on disk. We must not add new aliases only to memory. This problem is exported from issue https://issues.jboss.org/browse/JBEAP-6866 where is noted as secondary problem. *HOW TO REPRODUCE* {code} /subsystem=elytron/credential-store=cs001:add(uri="cr-store://test/cs/credentialstore.jceks?create=true", credential-reference={clear-text=pass123}, relative-to="jboss.server.data.dir") {code} {code} /subsystem=elytron/credential-store=cs001/alias=alias001:add(secret-value=secretvalue) {code} Now is credentialstore.jceks file persisted on disk here *JBOSS_HOME/standalone/data/cs* Please remove write permission for folder "cs" {code} chmod g-w cs chmod u-w cs {code} Try add another entry to credential store /subsystem=elytron/credential-store=cs001/alias=alias002:add(secret-value=secretvalue) { "outcome" => "failed", "failure-description" => "WFLYELY00009: Unable to complete operation. 'ELY09525: Unable to flush credential store to storage'", "rolled-back" => true } And you get error message as above. Now you list all aliases in credential store: {code} /subsystem=elytron/credential-store=cs001:read-children-names(child-type=alias) { "outcome" => "success", "result" => [ "alias001", "alias002" ] } {code} There is non persisted "alias002" too. *Now we check aliases in persisted file**:* {code} reload {code} There isn't any alias "alias002" after reload. {code} /subsystem=elytron/credential-store=cs001:read-children-names(child-type=alias) { "outcome" => "success", "result" => ["alias001"] } {code}