可以密钥管理器在WildFly中引用凭据存储吗?

huangapple go评论62阅读模式
英文:

Can a key manger reference a credential store in WildFly?

问题

我创建了一个凭据存储并将应用程序密钥库密码保存在其中。计划是在TLS密钥管理器和密钥库中使用密码别名。

所以,这是我尝试过的。

/subsystem=elytron/key-store=LocalhostKeyStore:add(path=server.keystore,relative-to=jboss.server.config.dir,credential-reference={clear-text="keystore_password"},type=JKS)

/subsystem=elytron/key-manager=LocalhostKeyManager:add(key-store=LocalhostKeyStore,alias-filter=server,credential-reference={clear-text="key_password"})

/subsystem=elytron/server-ssl-context=LocalhostSslContext:add(key-manager=LocalhostKeyManager)

/subsystem=undertow/server=default-server/https-listener=https:undefine-attribute(name=security-realm)

/subsystem=undertow/server=default-server/https-listener=https:write-attribute(name=ssl-context,value=LocalhostSslContext)

上述明文文本的方法运行良好,但是当尝试使用凭据存储替代时,无法工作。

创建存储并存储密码。

/subsystem=elytron/credential-store=LocalhostKeyStore:add(relative-to=jboss.server.data.dir, location=appks.jceks,create=true,credential-reference={clear-text=kspass, type=JKS})

/subsystem=elytron/credential-store=LocalhostKeyStore:add-alias(alias=kspass,secret-value=secret)

/subsystem=elytron/key-store=LocalhostKeyStore:add(path=server.keystore,relative-to=jboss.server.config.dir,credential-reference={store=LocalhostKeyStore, alias=kspass})

在下面的脚本中出现错误。

/subsystem=elytron/key-manager=LocalhostKeyManager:add(key-store=LocalhostKeyStore,alias-filter=server,credential-reference={store="LocalhostKeyStore", alias=kspass})

也尝试过明文文本,问题相同。

/subsystem=elytron/key-manager=LocalhostKeyManager:add(key-store=LocalhostKeyStore,alias-filter=server,credential-reference={clear-text=kspass})

失败消息如下:

{
    "outcome" => "failed",
    "failure-description" => "WFLYCTL0369: Required capabilities are not available:
    org.wildfly.security.key-store.LocalhostKeyStore; Possible registration points for this capability:
                /subsystem=security/elytron-key-store=*
                /subsystem=security/elytron-trust-store=*
                /subsystem=elytron/key-store=*
                /subsystem=elytron/ldap-key-store=*
                /subsystem=elytron/filtering-key-store=*",
    "rolled-back" => true
}

我漏掉了什么?非常感谢您的帮助!谢谢!

英文:

I created a credential store and saved the application keystore password in it.
Plan is to use the password alias in TLS keymanager and keystore.

So, here is what I tried.

/subsystem=elytron/key-store=LocalhostKeyStore:add(path=server.keystore,relative-to=jboss.server.config.dir,credential-reference={clear-text="keystore_password"},type=JKS)

/subsystem=elytron/key-manager=LocalhostKeyManager:add(key-store=LocalhostKeyStore,alias-filter=server,credential-reference={clear-text="key_password"})

/subsystem=elytron/server-ssl-context=LocalhostSslContext:add(key-manager=LocalhostKeyManager)

/subsystem=undertow/server=default-server/https-listener=https:undefine-attribute(name=security-realm)

/subsystem=undertow/server=default-server/https-listener=https:write-attribute(name=ssl-context,value=LocalhostSslContext)

Above one with clear text works flawlessly but when tried to substitute credential store it does not work.

Create a store and store the password.

/subsystem=elytron/credential-store=LocalhostKeyStore:add(relative-to=jboss.server.data.dir, location=appks.jceks,create=true,credential-reference={clear-text=kspass, type=JKS})

/subsystem=elytron/credential-store=LocalhostKeyStore:add-alias(alias=kspass,secret-value=secret)

/subsystem=elytron/key-store=LocalhostKeyStore:add(path=server.keystore,relative-to=jboss.server.config.dir,credential-reference={store=LocalhostKeyStore, alias=kspass})

Getting error in the below script.

/subsystem=elytron/key-manager=LocalhostKeyManager:add(key-store=LocalhostKeyStore,alias-filter=server,credential-reference={store="LocalhostKeyStore", alias=kspass})

Tried with clear text too, same issue.

/subsystem=elytron/key-manager=LocalhostKeyManager:add(key-store=LocalhostKeyStore,alias-filter=server,credential-reference={clear-text=kspass})

Outcome failure message:

{
    "outcome" => "failed",
    "failure-description" => "WFLYCTL0369: Required capabilities are not available:
    org.wildfly.security.key-store.LocalhostKeyStore; Possible registration points for this capability:
                /subsystem=security/elytron-key-store=*
                /subsystem=security/elytron-trust-store=*
                /subsystem=elytron/key-store=*
                /subsystem=elytron/ldap-key-store=*
                /subsystem=elytron/filtering-key-store=*",
    "rolled-back" => true
}

What am I missing?

Help appreciated! Thank you!

答案1

得分: 0

是的,密钥管理器可以使用凭证存储来验证使用凭证存储中存储的安全密码的密钥库。在产生错误的语句中,我错误地将指向凭证存储而不是密钥库。

英文:

Yes, the key manager can use the credential store to vaildate the keystore with the secured password stored in the credential store. I have incorrect pointing to the credential-store rather than the key-store in the statement that produced error.

huangapple
  • 本文由 发表于 2020年3月16日 23:24:59
  • 转载请务必保留本文链接:https://go.coder-hub.com/60708712.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定