4:13 p.m.
[
https://issues.jboss.org/browse/ELY-1622?page=com.atlassian.jira.plugin.s...
]
Farah Juma commented on ELY-1622:
---------------------------------
This issue only occurs when there is no {{key-store-ssl-certificate}} configured in the
wildfly-config.xml file. When there is a {{key-store-ssl-certificate}} configured, I'm
able to successfully connect to EAP from the CLI. One thing to note is that ELY-1385 added
an option to override the algorithm for {{TrustManager}}. However, a similar option was
[not
added|https://issues.jboss.org/browse/ELY-1385?focusedCommentId=13478645&...]
for {{KeyManager}} because we're actually using our own custom {{KeyManager}} impl so
there was no need to override that one.
To fix this, I wonder if our custom {{ConfigurationKeyManager.Builder}} should also be
used for the case where no {{key-store-ssl-certificate}} is specified, i.e., something
like:
{code}
diff --git a/src/main/java/org/wildfly/security/auth/client/ElytronXmlParser.java
b/src/main/java/org/wildfly/security/auth/client/ElytronXmlParser.java
index c999217a4..4cb517e07 100644
--- a/src/main/java/org/wildfly/security/auth/client/ElytronXmlParser.java
+++ b/src/main/java/org/wildfly/security/auth/client/ElytronXmlParser.java
@@ -508,13 +508,13 @@ public final class ElytronXmlParser {
if (finalProtocolSelector != null) {
sslContextBuilder.setProtocolSelector(finalProtocolSelector);
}
+ final ConfigurationKeyManager.Builder builder = new
ConfigurationKeyManager.Builder();
if (finalCredentialFactory != null) {
- final ConfigurationKeyManager.Builder builder = new
ConfigurationKeyManager.Builder();
final X509CertificateChainPrivateCredential privateCredential;
privateCredential = finalCredentialFactory.get();
builder.addCredential(privateCredential);
- sslContextBuilder.setKeyManager(builder.build());
}
+ sslContextBuilder.setKeyManager(builder.build());
if (initTrustManager) {
{code}
[~dlofthouse] [~mchoma] WDYT?
BC FIPS with CLI: SunX509 KeyManagerFactory not available
---------------------------------------------------------
Key: ELY-1622
URL: https://issues.jboss.org/browse/ELY-1622
Project: WildFly Elytron
Issue Type: Bug
Components: SSL
Affects Versions: 1.5.1.Final
Reporter: Martin Choma
Assignee: Farah Juma
Priority: Blocker
Attachments: cli-test-wildfly-config.xml, jboss-cli.log, truststore.bcfks
I am trying to connect from jboss-cli.sh to EAP server. To reproduce the problem it is
enough BC FIPS is used only on client side.
{code:java|titlejboss-cli.log}
11:50:25,147 ERROR [org.jboss.as.cli.impl.CliLauncher] Error processing CLI:
org.jboss.as.cli.CliInitializationException: Failed to connect to the controller
at org.jboss.as.cli.impl.CliLauncher.initCommandContext(CliLauncher.java:330)
at org.jboss.as.cli.impl.CliLauncher.main(CliLauncher.java:291)
at org.jboss.as.cli.CommandLineMain.main(CommandLineMain.java:45)
at org.jboss.modules.Module.run(Module.java:352)
at org.jboss.modules.Module.run(Module.java:320)
at org.jboss.modules.Main.main(Main.java:593)
Caused by: org.jboss.as.cli.CommandLineException: Failed to resolve host
'localhost'
at
org.jboss.as.cli.impl.CommandContextImpl.connectController(CommandContextImpl.java:1256)
at
org.jboss.as.cli.impl.CommandContextImpl.connectController(CommandContextImpl.java:1203)
at
org.jboss.as.cli.impl.CommandContextImpl.connectController(CommandContextImpl.java:1198)
at org.jboss.as.cli.impl.CliLauncher.initCommandContext(CliLauncher.java:328)
... 5 more
Caused by: java.io.IOException: Failed to obtain SSLContext
at
org.jboss.as.cli.impl.CLIModelControllerClient.<init>(CLIModelControllerClient.java:156)
at
org.jboss.as.cli.impl.ModelControllerClientFactory$2.getClient(ModelControllerClientFactory.java:85)
at
org.jboss.as.cli.impl.CommandContextImpl.connectController(CommandContextImpl.java:1222)
... 8 more
Caused by: java.security.KeyManagementException: java.security.NoSuchAlgorithmException:
SunX509 KeyManagerFactory not available
at
org.bouncycastle.jsse.provider.ProvSSLContextSpi.selectKeyManager(ProvSSLContextSpi.java:589)
at
org.bouncycastle.jsse.provider.ProvSSLContextSpi.engineInit(ProvSSLContextSpi.java:531)
at javax.net.ssl.SSLContext.init(SSLContext.java:282)
at
org.wildfly.security.ssl.SSLContextBuilder.lambda$build$0(SSLContextBuilder.java:372)
at
org.wildfly.security.OneTimeSecurityFactory.create(OneTimeSecurityFactory.java:53)
at
org.wildfly.security.auth.client.AuthenticationContextConfigurationClient.getSSLContext(AuthenticationContextConfigurationClient.java:221)
at
org.wildfly.security.auth.client.AuthenticationContextConfigurationClient.getSSLContext(AuthenticationContextConfigurationClient.java:208)
at
org.jboss.as.cli.impl.CLIModelControllerClient.<init>(CLIModelControllerClient.java:153)
... 10 more
Caused by: java.security.NoSuchAlgorithmException: SunX509 KeyManagerFactory not
available
at sun.security.jca.GetInstance.getInstance(GetInstance.java:159)
at javax.net.ssl.KeyManagerFactory.getInstance(KeyManagerFactory.java:137)
at
org.bouncycastle.jsse.provider.ProvSSLContextSpi.selectKeyManager(ProvSSLContextSpi.java:583)
... 17 more
{code}
When I use non-FIPS java with CLI I can make it work. It does occure also when connecting
to default unsecured port 9990.
When I use BCFKS truststore on server side, e.g. in 2-way http communication it works.
I believe problem is I cant configure algorithm for keymanager on client side in
wildfly-config.xml. (At least I don't see how could I do so).
BC provider does not know SunX509 arlgorithm, rather X509, X.509 or PKIX could be used.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
2906
days inactive
2906
days old
0 comments
1 participants
participants (1)
-
Farah Juma (JIRA)