Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Location is required even for non-filebased type e.g. PKCS11 #136

Open
mchoma opened this issue May 4, 2018 · 1 comment
Open

Location is required even for non-filebased type e.g. PKCS11 #136

mchoma opened this issue May 4, 2018 · 1 comment

Comments

@mchoma
Copy link

mchoma commented May 4, 2018

Description:

Wildfly Elytron tool is not aligned with fix for ELY-1460 - Do not reuse location attribute for externalPath attribute. Make externalPath required when external configured.
In Wildfly Elytron tool location is mandatory

        String location = cmdLine.getOptionValue(STORE_LOCATION_PARAM);
        if (location == null) {
            setStatus(GENERAL_CONFIGURATION_ERROR);
            throw ElytronToolMessages.msg.optionNotSpecified(STORE_LOCATION_PARAM);
        }

After relaxing this check, double check usage of location, e.g. here

        if ((cmdLine.hasOption(ALIASES_PARAM) || cmdLine.hasOption(CHECK_ALIAS_PARAM)) && !Files.exists(Paths.get(location))) {
            setStatus(GENERAL_CONFIGURATION_ERROR);
            throw ElytronToolMessages.msg.storageFileDoesNotExist(location);
        }

Reproducer:

/opt/java/jdk-9.0.4_fips/bin/java, -jar, /home/mchoma/Repos/tests-security/fips/target/dist/jboss-eap/bin/wildfly-elytron-tool.jar, credential-store, -c, -a, secret-key, -x, pass123+, -p, pass123+, -u, keyStoreType=PKCS11;external=true;keyAlias=my-key;externalPath=/home/mchoma/Repos/tests-security/fips/target/FipsCsElytronToolTestCase/secure-data-file, --debug
09:37:56,418 ERROR [com.redhat.eap.qe.cli.CommandExecutor] (main) Exception encountered executing the command:
org.apache.commons.cli.MissingArgumentException: ELYTOOL00016: Option "location" is not specified.
	at org.wildfly.security.tool.CredentialStoreCommand.execute(CredentialStoreCommand.java:157)
	at org.wildfly.security.tool.ElytronTool.main(ElytronTool.java:81)

Workaround:
use empty file

touch /home/mchoma/Repos/tests-security/fips/target/FipsCsElytronToolTestCase/workaround_file

09:35:42,218 INFO  [com.redhat.eap.qe.cli.CommandExecutor] (main) Command:[/opt/java/jdk-9.0.4_fips/bin/java, -jar, /home/mchoma/Repos/tests-security/fips/target/dist/jboss-eap/bin/wildfly-elytron-tool.jar, credential-store, -c, -a, secret-key, -x, pass123+, -p, pass123+, -l, /home/mchoma/Repos/tests-security/fips/target/FipsCsElytronToolTestCase/workaround_file, -u, keyStoreType=PKCS11;external=true;keyAlias=my-key;externalPath=/home/mchoma/Repos/tests-security/fips/target/FipsCsElytronToolTestCase/secure-data-file, --debug]
09:35:43,601 INFO  [com.redhat.eap.qe.cli.CommandExecutor] (main) Process output:
Alias "secret-key" has been successfully stored
@ivassile
Copy link
Contributor

ivassile commented May 4, 2018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants