]
Darran Lofthouse commented on WFWIP-373:
----------------------------------------
I wonder if this method would have worked for Vault expressions, I will have a look.
As we discussed a little bit in the analysis it may be preferable to not support
decryption using the management model but even if that is the case this method should fail
with an appropriate error and not try and handle it as a system property.
:resolve-expression does not resolve encrypted expressions
----------------------------------------------------------
Key: WFWIP-373
URL:
https://issues.redhat.com/browse/WFWIP-373
Project: WildFly WIP
Issue Type: Bug
Components: Security
Reporter: Ondrej Kotek
Assignee: Darran Lofthouse
Priority: Major
TheĀ {{:resolve-expression}} operation does not resolve encrypted expressions.
{noformat}
[standalone@localhost:9990 /] /subsystem=elytron/expression=encryption:read-resource
{
"outcome" => "success",
"result" => {
"default-resolver" => "Default",
"prefix" => "ENC",
"resolvers" => [
{
"name" => "Default",
"credential-store" => "credentialstorethree",
"secret-key" => "secretkey"
},
{
"name" => "resolver2",
"credential-store" => "credentialstorethree",
"secret-key" => "secretkey2"
}
]
}
}
[standalone@localhost:9990 /]
/subsystem=elytron/expression=encryption:create-expression(clear-text=CredentialStoreTwoPassword)
{
"outcome" => "success",
"result" => {"expression" =>
"${ENC::RUxZAUMQHrI7PMuvU+0pJ9EgITJmFPWa9iIb5yZ6i9K3mtgnY2kLo3AIL4d/GIeo7GKzSkXB}"}
}
[standalone@localhost:9990 /]
:resolve-expression(expression="${ENC::RUxZAUMQHrI7PMuvU+0pJ9EgITJmFPWa9iIb5yZ6i9K3mtgnY2kLo3AIL4d/GIeo7GKzSkXB}")
{
"outcome" => "success",
"result" =>
":RUxZAUMQHrI7PMuvU+0pJ9EgITJmFPWa9iIb5yZ6i9K3mtgnY2kLo3AIL4d/GIeo7GKzSkXB"
}
{noformat}