[JBoss JIRA] (AS7-3419) JBossWeb::ssl element in connector settings should check for vaultified strings
12:41 p.m.
Anil Saldhana created AS7-3419:
----------------------------------
Summary: JBossWeb::ssl element in connector settings should check for
vaultified strings
Key: AS7-3419
URL: https://issues.jboss.org/browse/AS7-3419
Project: Application Server 7
Issue Type: Feature Request
Components: Web
Affects Versions: 7.1.0.CR1
Reporter: Anil Saldhana
Assignee: Jean-Frederic Clere
Fix For: 7.1.0.Final
Currently, the passwords in the ssl element of the connector settings are in clear text.
https://community.jboss.org/wiki/JBossAS7SecuringPasswords describes very simple ways of
checking whether a string is of the vault format and invoking the vault to get the
decrypted string value.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
4:49 p.m.
[
https://issues.jboss.org/browse/AS7-3419?page=com.atlassian.jira.plugin.s...
]
Anil Saldhana reassigned AS7-3419:
----------------------------------
Assignee: Anil Saldhana (was: Jean-Frederic Clere)
JBossWeb::ssl element in connector settings should check for
vaultified strings
-------------------------------------------------------------------------------
Key: AS7-3419
URL: https://issues.jboss.org/browse/AS7-3419
Project: Application Server 7
Issue Type: Feature Request
Components: Web
Affects Versions: 7.1.0.CR1
Reporter: Anil Saldhana
Assignee: Anil Saldhana
Fix For: 7.1.0.Final
Currently, the passwords in the ssl element of the connector settings are in clear text.
https://community.jboss.org/wiki/JBossAS7SecuringPasswords describes very simple ways
of checking whether a string is of the vault format and invoking the vault to get the
decrypted string value.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
4:53 p.m.
[
https://issues.jboss.org/browse/AS7-3419?page=com.atlassian.jira.plugin.s...
]
Anil Saldhana commented on AS7-3419:
------------------------------------
Write up on setting up SSL on JBoss AS7 for the web subsystem
https://community.jboss.org/wiki/JBossAS7ConfiguringSSLOnJBossWeb/
JBossWeb::ssl element in connector settings should check for
vaultified strings
-------------------------------------------------------------------------------
Key: AS7-3419
URL: https://issues.jboss.org/browse/AS7-3419
Project: Application Server 7
Issue Type: Feature Request
Components: Web
Affects Versions: 7.1.0.CR1
Reporter: Anil Saldhana
Assignee: Anil Saldhana
Fix For: 7.1.0.Final
Currently, the passwords in the ssl element of the connector settings are in clear text.
https://community.jboss.org/wiki/JBossAS7SecuringPasswords describes very simple ways
of checking whether a string is of the vault format and invoking the vault to get the
decrypted string value.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
9:30 a.m.
[
https://issues.jboss.org/browse/AS7-3419?page=com.atlassian.jira.plugin.s...
]
Anil Saldhana reassigned AS7-3419:
----------------------------------
Assignee: Brian Stansberry (was: Anil Saldhana)
What is needed is the ability for the web subsystem to set the modelnode for the password
to be of expression, type.
JBossWeb::ssl element in connector settings should check for
vaultified strings
-------------------------------------------------------------------------------
Key: AS7-3419
URL: https://issues.jboss.org/browse/AS7-3419
Project: Application Server 7
Issue Type: Feature Request
Components: Web
Affects Versions: 7.1.0.CR1
Reporter: Anil Saldhana
Assignee: Brian Stansberry
Fix For: 7.1.0.Final
Currently, the passwords in the ssl element of the connector settings are in clear text.
https://community.jboss.org/wiki/JBossAS7SecuringPasswords describes very simple ways
of checking whether a string is of the vault format and invoking the vault to get the
decrypted string value.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
12:21 p.m.
[
https://issues.jboss.org/browse/AS7-3419?page=com.atlassian.jira.plugin.s...
]
Brian Stansberry reassigned AS7-3419:
-------------------------------------
Assignee: Tomaz Cerar (was: Brian Stansberry)
Tomaz, could you look at this? Basically this means providing proper expression support
for this attribute.
This subsystem isn't using AttributeDefinition. For 7.1.0 I absolutely don't want
to try and change it to that (too late). If changing this one element to use
AttributeDefinition is the efficient way to fix this, it's ok by me. It will look a
bit odd having just one AttributeDefinition, but c'est la vie. AttributeDefinition
isn't required for proper expression support though; it just has most of the code
already there.
JBossWeb::ssl element in connector settings should check for
vaultified strings
-------------------------------------------------------------------------------
Key: AS7-3419
URL: https://issues.jboss.org/browse/AS7-3419
Project: Application Server 7
Issue Type: Feature Request
Components: Web
Affects Versions: 7.1.0.CR1
Reporter: Anil Saldhana
Assignee: Tomaz Cerar
Fix For: 7.1.0.Final
Currently, the passwords in the ssl element of the connector settings are in clear text.
https://community.jboss.org/wiki/JBossAS7SecuringPasswords describes very simple ways
of checking whether a string is of the vault format and invoking the vault to get the
decrypted string value.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
7:39 a.m.
[
https://issues.jboss.org/browse/AS7-3419?page=com.atlassian.jira.plugin.s...
]
Tomaz Cerar commented on AS7-3419:
----------------------------------
I have created quick fix that just resolves expression for attribute password and that
unmasked password is then used inside WebConnectorService.
Proper fix should be as Brian suggested using AttributeDefinition.
JBossWeb::ssl element in connector settings should check for
vaultified strings
-------------------------------------------------------------------------------
Key: AS7-3419
URL: https://issues.jboss.org/browse/AS7-3419
Project: Application Server 7
Issue Type: Feature Request
Components: Web
Affects Versions: 7.1.0.CR1
Reporter: Anil Saldhana
Assignee: Tomaz Cerar
Fix For: 7.1.0.Final
Currently, the passwords in the ssl element of the connector settings are in clear text.
https://community.jboss.org/wiki/JBossAS7SecuringPasswords describes very simple ways
of checking whether a string is of the vault format and invoking the vault to get the
decrypted string value.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
12:42 p.m.
[
https://issues.jboss.org/browse/AS7-3419?page=com.atlassian.jira.plugin.s...
]
Anil Saldhana commented on AS7-3419:
------------------------------------
Tomaz, I do not think it is working for web ssl. I understand Brian's instructions.
Since I have a test environment, I will fix this properly.
JBossWeb::ssl element in connector settings should check for
vaultified strings
-------------------------------------------------------------------------------
Key: AS7-3419
URL: https://issues.jboss.org/browse/AS7-3419
Project: Application Server 7
Issue Type: Feature Request
Components: Web
Affects Versions: 7.1.0.CR1
Reporter: Anil Saldhana
Assignee: Tomaz Cerar
Fix For: 7.1.0.Final
Currently, the passwords in the ssl element of the connector settings are in clear text.
https://community.jboss.org/wiki/JBossAS7SecuringPasswords describes very simple ways
of checking whether a string is of the vault format and invoking the vault to get the
decrypted string value.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
12:54 p.m.
[
https://issues.jboss.org/browse/AS7-3419?page=com.atlassian.jira.plugin.s...
]
Tomaz Cerar commented on AS7-3419:
----------------------------------
What does not work? I have tested it and it work properly...
i have tested with this configuration and all expressions resolved properly:
{code:xml}
<connector name="https" protocol="HTTP/1.1"
scheme="https" socket-binding="https" secure="true">
<ssl name="ssl.name" key-alias="alias"
password="${ssl.keystore.password:defaultPassword}"
certificate-key-file="${jboss.server.config.dir}/keystore.p12"
verify-client="true"
ca-certificate-file="${jboss.server.config.dir}/megapos.jks"
ca-certificate-password="${my.custom.sysprop:password}"
keystore-type="PKCS12" truststore-type="JKS"/>
</connector>
{code}
I didn't test with vault expression but other then that all expressions resolved
properly
JBossWeb::ssl element in connector settings should check for
vaultified strings
-------------------------------------------------------------------------------
Key: AS7-3419
URL: https://issues.jboss.org/browse/AS7-3419
Project: Application Server 7
Issue Type: Feature Request
Components: Web
Affects Versions: 7.1.0.CR1
Reporter: Anil Saldhana
Assignee: Tomaz Cerar
Fix For: 7.1.0.Final
Currently, the passwords in the ssl element of the connector settings are in clear text.
https://community.jboss.org/wiki/JBossAS7SecuringPasswords describes very simple ways
of checking whether a string is of the vault format and invoking the vault to get the
decrypted string value.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
12:58 p.m.
[
https://issues.jboss.org/browse/AS7-3419?page=com.atlassian.jira.plugin.s...
]
Anil Saldhana commented on AS7-3419:
------------------------------------
I tested with ${VAULT:::xxxxx}} expression. I have rebased and must have got your changes
also. Let me test it on a fresh branch I created.
JBossWeb::ssl element in connector settings should check for
vaultified strings
-------------------------------------------------------------------------------
Key: AS7-3419
URL: https://issues.jboss.org/browse/AS7-3419
Project: Application Server 7
Issue Type: Feature Request
Components: Web
Affects Versions: 7.1.0.CR1
Reporter: Anil Saldhana
Assignee: Tomaz Cerar
Fix For: 7.1.0.Final
Currently, the passwords in the ssl element of the connector settings are in clear text.
https://community.jboss.org/wiki/JBossAS7SecuringPasswords describes very simple ways
of checking whether a string is of the vault format and invoking the vault to get the
decrypted string value.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
1:28 p.m.
[
https://issues.jboss.org/browse/AS7-3419?page=com.atlassian.jira.plugin.s...
]
Anil Saldhana commented on AS7-3419:
------------------------------------
The issue seems to be in org.jboss.as.server.RuntimeExpressionResolver
Method: resolvePluggableExpression(ModelNode node)
https://github.com/jbossas/jboss-as/blob/master/server/src/main/java/org/...
Data:
expression
"${VAULT::keystore_pass::password::NmZiYmRmOGQtMTYzZS00MjE3LTllODMtZjI4OGM2NGJmODM4TElORV9CUkVBS3ZhdWx0}"
After the method invocation, turns into
VAULT::keystore_pass::password::NmZiYmRmOGQtMTYzZS00MjE3LTllODMtZjI4OGM2NGJmODM4TElORV9CUkVBS3ZhdWx
Basically, the step: expression = expression.substring(2, expression.length() -2);
is chopping the last "0" out of the expression value.
I wonder whether your expressions do not go through this class.
JBossWeb::ssl element in connector settings should check for
vaultified strings
-------------------------------------------------------------------------------
Key: AS7-3419
URL: https://issues.jboss.org/browse/AS7-3419
Project: Application Server 7
Issue Type: Feature Request
Components: Web
Affects Versions: 7.1.0.CR1
Reporter: Anil Saldhana
Assignee: Tomaz Cerar
Fix For: 7.1.0.Final
Currently, the passwords in the ssl element of the connector settings are in clear text.
https://community.jboss.org/wiki/JBossAS7SecuringPasswords describes very simple ways
of checking whether a string is of the vault format and invoking the vault to get the
decrypted string value.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
3:08 p.m.
[
https://issues.jboss.org/browse/AS7-3419?page=com.atlassian.jira.plugin.s...
]
Tomaz Cerar commented on AS7-3419:
----------------------------------
I see your problem, expressions are resolved the proper way, that is by calling
OperationContext.resolveExpression(node)
that one then decides how to resolve expression. RuntimeExpressionResolver class is the
one that actually resolves Vault expressions.
I can confirm that this is a bug in RuntimeExpressionResolver as it should not remove last
character... let me test this more toughly as resolver is global for resolving all
expressions
JBossWeb::ssl element in connector settings should check for
vaultified strings
-------------------------------------------------------------------------------
Key: AS7-3419
URL: https://issues.jboss.org/browse/AS7-3419
Project: Application Server 7
Issue Type: Feature Request
Components: Web
Affects Versions: 7.1.0.CR1
Reporter: Anil Saldhana
Assignee: Tomaz Cerar
Fix For: 7.1.0.Final
Currently, the passwords in the ssl element of the connector settings are in clear text.
https://community.jboss.org/wiki/JBossAS7SecuringPasswords describes very simple ways
of checking whether a string is of the vault format and invoking the vault to get the
decrypted string value.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
3:33 p.m.
[
https://issues.jboss.org/browse/AS7-3419?page=com.atlassian.jira.plugin.s...
]
Tomaz Cerar commented on AS7-3419:
----------------------------------
I have fixed the problem, pull request sent https://github.com/jbossas/jboss-as/pull/1359
JBossWeb::ssl element in connector settings should check for
vaultified strings
-------------------------------------------------------------------------------
Key: AS7-3419
URL: https://issues.jboss.org/browse/AS7-3419
Project: Application Server 7
Issue Type: Feature Request
Components: Web
Affects Versions: 7.1.0.CR1
Reporter: Anil Saldhana
Assignee: Tomaz Cerar
Fix For: 7.1.0.Final
Currently, the passwords in the ssl element of the connector settings are in clear text.
https://community.jboss.org/wiki/JBossAS7SecuringPasswords describes very simple ways
of checking whether a string is of the vault format and invoking the vault to get the
decrypted string value.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:47 p.m.
[
https://issues.jboss.org/browse/AS7-3419?page=com.atlassian.jira.plugin.s...
]
Tomaz Cerar commented on AS7-3419:
----------------------------------
Brian merged fix into upstream
JBossWeb::ssl element in connector settings should check for
vaultified strings
-------------------------------------------------------------------------------
Key: AS7-3419
URL: https://issues.jboss.org/browse/AS7-3419
Project: Application Server 7
Issue Type: Feature Request
Components: Web
Affects Versions: 7.1.0.CR1
Reporter: Anil Saldhana
Assignee: Tomaz Cerar
Fix For: 7.1.0.Final
Currently, the passwords in the ssl element of the connector settings are in clear text.
https://community.jboss.org/wiki/JBossAS7SecuringPasswords describes very simple ways
of checking whether a string is of the vault format and invoking the vault to get the
decrypted string value.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
9:29 a.m.
[
https://issues.jboss.org/browse/AS7-3419?page=com.atlassian.jira.plugin.s...
]
Anil Saldhana closed AS7-3419.
------------------------------
Can confirm it is working satisfactorily...
JBossWeb::ssl element in connector settings should check for
vaultified strings
-------------------------------------------------------------------------------
Key: AS7-3419
URL: https://issues.jboss.org/browse/AS7-3419
Project: Application Server 7
Issue Type: Feature Request
Components: Web
Affects Versions: 7.1.0.CR1
Reporter: Anil Saldhana
Assignee: Tomaz Cerar
Fix For: 7.1.0.Final
Currently, the passwords in the ssl element of the connector settings are in clear text.
https://community.jboss.org/wiki/JBossAS7SecuringPasswords describes very simple ways
of checking whether a string is of the vault format and invoking the vault to get the
decrypted string value.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
4630
days inactive
4641
days old
13 comments
3 participants
participants (3)
-
Anil Saldhana (JIRA) -
Brian Stansberry (JIRA)
-
Tomaz Cerar (JIRA)