[JBoss JIRA] Created: (TEIID-548) When a cluster node added the original certificate is not being copied
10:54 p.m.
When a cluster node added the original certificate is not being copied
----------------------------------------------------------------------
Key: TEIID-548
URL: https://jira.jboss.org/jira/browse/TEIID-548
Project: Teiid
Issue Type: Bug
Components: Server
Affects Versions: 6.0.0
Reporter: Ramesh Reddy
Fix For: 6.1.0
Cluster host setup is not copying the keystore certificate from the original host to the
newly added cluster node. Now that "JGroups" messages are by default encrypted,
not having this will result in node not being joined in the cluster as JGroups discards
any messages it gets with wrong keystore.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:45 p.m.
New subject: [JBoss JIRA] Commented: (TEIID-548) When a cluster node added the original certificate is not being copied
[
https://jira.jboss.org/jira/browse/TEIID-548?page=com.atlassian.jira.plug...
]
Ramesh Reddy commented on TEIID-548:
------------------------------------
Since copying the certificate through the API is security hole, it may be sufficient to
give a visual cue to the user at the end of the installation of the cluster node, asking
the user to copy the "teiid.keystore" from primary server to newly added cluster
node.
When a cluster node added the original certificate is not being
copied
----------------------------------------------------------------------
Key: TEIID-548
URL: https://jira.jboss.org/jira/browse/TEIID-548
Project: Teiid
Issue Type: Bug
Components: Server
Affects Versions: 6.0.0
Reporter: Ramesh Reddy
Fix For: 6.1.0
Cluster host setup is not copying the keystore certificate from the original host to the
newly added cluster node. Now that "JGroups" messages are by default encrypted,
not having this will result in node not being joined in the cluster as JGroups discards
any messages it gets with wrong keystore.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:52 p.m.
New subject: [JBoss JIRA] Commented: (TEIID-548) When a cluster node added the original certificate is not being copied
[
https://jira.jboss.org/jira/browse/TEIID-548?page=com.atlassian.jira.plug...
]
Steven Hawkins commented on TEIID-548:
--------------------------------------
Copying through admin api is not a security hole. The admin session (with client
encryption turned on by default) will have a negotiated connection key used to encrypt the
admin traffic.
When a cluster node added the original certificate is not being
copied
----------------------------------------------------------------------
Key: TEIID-548
URL: https://jira.jboss.org/jira/browse/TEIID-548
Project: Teiid
Issue Type: Bug
Components: Server
Affects Versions: 6.0.0
Reporter: Ramesh Reddy
Assignee: Van Halbert
Fix For: 6.1.0
Cluster host setup is not copying the keystore certificate from the original host to the
newly added cluster node. Now that "JGroups" messages are by default encrypted,
not having this will result in node not being joined in the cluster as JGroups discards
any messages it gets with wrong keystore.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
12:12 a.m.
New subject: [JBoss JIRA] Commented: (TEIID-548) When a cluster node added the original certificate is not being copied
[
https://jira.jboss.org/jira/browse/TEIID-548?page=com.atlassian.jira.plug...
]
Ramesh Reddy commented on TEIID-548:
------------------------------------
so, then can we add a new admin api method "byte[] getSecurityKeystore()"? If
this keystore has more than the certificate that been added at the installation time, is
that going to be an issue?
When a cluster node added the original certificate is not being
copied
----------------------------------------------------------------------
Key: TEIID-548
URL: https://jira.jboss.org/jira/browse/TEIID-548
Project: Teiid
Issue Type: Bug
Components: Server
Affects Versions: 6.0.0
Reporter: Ramesh Reddy
Assignee: Van Halbert
Fix For: 6.1.0
Cluster host setup is not copying the keystore certificate from the original host to the
newly added cluster node. Now that "JGroups" messages are by default encrypted,
not having this will result in node not being joined in the cluster as JGroups discards
any messages it gets with wrong keystore.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
4:18 p.m.
New subject: [JBoss JIRA] Commented: (TEIID-548) When a cluster node added the original certificate is not being copied
[
https://jira.jboss.org/jira/browse/TEIID-548?page=com.atlassian.jira.plug...
]
Steven Hawkins commented on TEIID-548:
--------------------------------------
From TEIID-266 there are already calls to get the bootstrap properties
and the cluster key. The call only returns the key since 6.0.0 did not use a keystore.
6.1.0 is using a keystore, but we don't expect there to be any additional contents.
When a cluster node added the original certificate is not being
copied
----------------------------------------------------------------------
Key: TEIID-548
URL: https://jira.jboss.org/jira/browse/TEIID-548
Project: Teiid
Issue Type: Bug
Components: Server
Affects Versions: 6.0.0
Reporter: Ramesh Reddy
Assignee: Van Halbert
Fix For: 6.1.0
Cluster host setup is not copying the keystore certificate from the original host to the
newly added cluster node. Now that "JGroups" messages are by default encrypted,
not having this will result in node not being joined in the cluster as JGroups discards
any messages it gets with wrong keystore.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
7:21 p.m.
New subject: [JBoss JIRA] Assigned: (TEIID-548) When a cluster node added the original certificate is not being copied
[
https://jira.jboss.org/jira/browse/TEIID-548?page=com.atlassian.jira.plug...
]
Ramesh Reddy reassigned TEIID-548:
----------------------------------
Assignee: Ramesh Reddy (was: Van Halbert)
When a cluster node added the original certificate is not being
copied
----------------------------------------------------------------------
Key: TEIID-548
URL: https://jira.jboss.org/jira/browse/TEIID-548
Project: Teiid
Issue Type: Bug
Components: Server
Affects Versions: 6.0.0
Reporter: Ramesh Reddy
Assignee: Ramesh Reddy
Fix For: 6.1.0
Cluster host setup is not copying the keystore certificate from the original host to the
newly added cluster node. Now that "JGroups" messages are by default encrypted,
not having this will result in node not being joined in the cluster as JGroups discards
any messages it gets with wrong keystore.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
7:44 p.m.
New subject: [JBoss JIRA] Resolved: (TEIID-548) When a cluster node added the original certificate is not being copied
[
https://jira.jboss.org/jira/browse/TEIID-548?page=com.atlassian.jira.plug...
]
Ramesh Reddy resolved TEIID-548.
--------------------------------
Resolution: Done
Moved the generation of the keystore only for the main server, and for secondary cluster
node servers, the keystore is retrieved using the admin api and saved to the config
directory.
When a cluster node added the original certificate is not being
copied
----------------------------------------------------------------------
Key: TEIID-548
URL: https://jira.jboss.org/jira/browse/TEIID-548
Project: Teiid
Issue Type: Bug
Components: Server
Affects Versions: 6.0.0
Reporter: Ramesh Reddy
Assignee: Ramesh Reddy
Fix For: 6.1.0
Cluster host setup is not copying the keystore certificate from the original host to the
newly added cluster node. Now that "JGroups" messages are by default encrypted,
not having this will result in node not being joined in the cluster as JGroups discards
any messages it gets with wrong keystore.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
5536
days inactive
5538
days old
6 comments
2 participants
participants (2)
-
Ramesh Reddy (JIRA) -
Steven Hawkins (JIRA)