Migrating from password vault to credential store, getting an error with masked password

[Tung Pham]

Hi All,

I'm moving from the password vault to the credential store on Wildfly 26.0.1 and I'm getting an error when I use the masked password generated from elytron-tool.bat in place of the vault reference in my standalone.xml file.

    <system-properties>
        <property name="javax.net.ssl.keyStorePassword" value="${VAULT::certpass::keystore::1}"/>
        <property name="javax.net.ssl.trustStorePassword" value="${VAULT::certpass::truststore::1}"/>       
    </system-properties>

The "${VAULT::certpass::truststore::1}" was replaced with "MASK-3FXhT5tLhL51VfY1okUAgV;saltsalt;32"

When I set "${VAULT::certpass::truststore::1}" to the plain text password I don't get any errors.

Is there another way to obscure the password since these properties are not part of any subsystem?

Using <credential-reference clear-text="MASK-3FXhT5tLhL51VfY1okUAgV;saltsalt;32"/> for setting the elytron subsystem key-store and key-manager for tls works but not at system-properties.

When the datasource subsystem is trying to create the connection pool to the database it is using ssl thus it is trying to access the keystore to retrieve the certificate by decrypting the password provided in the system-properties and failing.  Again, when I put in the plain text password it works.

This is the error that is logged during startup:

2023-01-30 12:33:09,812 WARN  [org.jboss.jca.core.connectionmanager.pool.strategy.OnePool] (JCA PoolFiller) IJ000610: Unable to fill pool: java:jboss/datasources/gisDB: javax.resource.ResourceException: IJ031084: Unable to create connection
    at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createLocalManagedConnection(LocalManagedConnectionFactory.java:364)
    at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.getLocalManagedConnection(LocalManagedConnectionFactory.java:371)
    at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createManagedConnection(LocalManagedConnectionFactory.java:287)
    at org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.createConnectionEventListener(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:1328)
    at org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.fillTo(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:1148)
    at org.jboss.jca.core.connectionmanager.pool.mcp.PoolFiller.run(PoolFiller.java:97)
    at java.lang.Thread.run(Thread.java:748)
Caused by: org.postgresql.util.PSQLException: SSL error: java.security.NoSuchAlgorithmException: Error constructing implementation (algorithm: Default, provider: SunJSSE, class: sun.security.ssl.SSLContextImpl$DefaultSSLContext)
    at org.postgresql.ssl.MakeSSL.convert(MakeSSL.java:64)
    at org.postgresql.core.v3.ConnectionFactoryImpl.enableSSL(ConnectionFactoryImpl.java:361)
    at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:148)
    at org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:52)
    at org.postgresql.jdbc.PgConnection.<init>(PgConnection.java:216)
    at org.postgresql.Driver.makeConnection(Driver.java:404)
    at org.postgresql.Driver.connect(Driver.java:272)
    at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createLocalManagedConnection(LocalManagedConnectionFactory.java:335)
    ... 6 more
Caused by: java.net.SocketException: java.security.NoSuchAlgorithmException: Error constructing implementation (algorithm: Default, provider: SunJSSE, class: sun.security.ssl.SSLContextImpl$DefaultSSLContext)
    at javax.net.ssl.DefaultSSLSocketFactory.throwException(SSLSocketFactory.java:248)
    at javax.net.ssl.DefaultSSLSocketFactory.createSocket(SSLSocketFactory.java:270)
    at org.postgresql.ssl.MakeSSL.convert(MakeSSL.java:56)
    ... 13 more
Caused by: java.security.NoSuchAlgorithmException: Error constructing implementation (algorithm: Default, provider: SunJSSE, class: sun.security.ssl.SSLContextImpl$DefaultSSLContext)
    at java.security.Provider$Service.newInstance(Provider.java:1617)
    at sun.security.jca.GetInstance.getInstance(GetInstance.java:236)
    at sun.security.jca.GetInstance.getInstance(GetInstance.java:164)
    at javax.net.ssl.SSLContext.getInstance(SSLContext.java:156)
    at javax.net.ssl.SSLContext.getDefault(SSLContext.java:96)
    at javax.net.ssl.SSLSocketFactory.getDefault(SSLSocketFactory.java:122)
    at org.postgresql.ssl.MakeSSL.convert(MakeSSL.java:41)
    ... 13 more
Caused by: java.io.IOException: Keystore was tampered with, or password was incorrect
    at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:780)
    at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:56)
    at sun.security.provider.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:224)
    at sun.security.provider.JavaKeyStore$DualFormatJKS.engineLoad(JavaKeyStore.java:70)
    at java.security.KeyStore.load(KeyStore.java:1445)
    at sun.security.ssl.TrustManagerFactoryImpl.getCacertsKeyStore(TrustManagerFactoryImpl.java:226)
    at sun.security.ssl.SSLContextImpl$DefaultManagersHolder.getTrustManagers(SSLContextImpl.java:771)
    at sun.security.ssl.SSLContextImpl$DefaultManagersHolder.<clinit>(SSLContextImpl.java:748)
    at sun.security.ssl.SSLContextImpl$DefaultSSLContext.<init>(SSLContextImpl.java:913)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
    at java.security.Provider$Service.newInstance(Provider.java:1595)
    ... 19 more
Caused by: java.security.UnrecoverableKeyException: Password verification failed
    at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:778)
    ... 32 more

Any suggestions are really appreciated.

Regards,
Tung

[Cameron Rodriguez]

Hi Tung,

I'm personally not as familiar with this area, but you should be able to use the credential store once it's set up in Elytron. The datasource configuration has a credential-reference attribute[1], so you can reference the store and alias from Elytron. The configuration appears in this JBoss forum post[2], so you probably won't need to set a system-property. You can also use the same referencing format for the key store and key store manager[3], so you won't need to copy the password multiple times.

[1]: https://docs.wildfly.org/27/wildscribe/subsystem/datasources/data-source/ExampleDS/index.html#attr-credential-reference

[2]: https://developer.jboss.org/thread/279576#987806

[3]: https://docs.wildfly.org/27/WildFly_Elytron_Security.html#create-and-use-a-credential-store

--
You received this message because you are subscribed to the Google Groups "WildFly" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wildfly+u...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wildfly/4ad35574-9b5e-4cb6-910d-79097928151an%40googlegroups.com.

--

Cameron Rodriguez (he/him)

Software Engineering Intern

WildFly Elytron

caro...@redhat.com

[Arulkumar Ponnusamy]

Hi Tung,

could you able to solve this problem? am also facing the similar issues and want to know the solution which you tried.