| Summary: | Check that keystore/truststore is accessible during JSSE configuration | ||
|---|---|---|---|
| Product: | [JBoss] JBoss Enterprise Application Platform 6 | Reporter: | Petr Kremensky <pkremens> |
| Component: | Installer | Assignee: | Thomas Hauser <thauser> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Petr Kremensky <pkremens> |
| Severity: | low | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 6.2.0 | CC: | mtjandra |
| Target Milestone: | CR3 | ||
| Target Release: | EAP 6.2.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-12-15 16:23:37 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
Petr Kremensky
2013-11-08 14:09:57 UTC
I was looking into this today. I was thinking of going beyond the "is it accessible" to actually checking the password given, to see if the keystore can be accessed through the Java KeyStore APIs. However, there seem to be a myriad of keystore types that the user could be using; Should I attempt to check all possible keystore types that the JRE is aware of (requires more work) Or should I just attempt with the type JKS, and warn if this fails? (This is already implemented and requires a little tuning, that's it, as well as localization) Thanks, Tom Hi Tom, I guess that checking of JKS is enough. Petr Check implemented. If validation fails, the user is warned that they may have entered the wrong password, but it cannot be guaranteed unless the keystore is of type JKS. I found an issue while testing this. The "accessibility check" itself works fine, but I found a case which can walk-around it. Truststore validation is bypassed once I enter valid keystore element. Way to reproduce: 1. Go to Security-domain configuration screen with JSSE configuration. Select to "Add jsse element", "Add keystore element" and "Add truststore element". 2. Enter valid values into Keystore password and keystore URL so the accessibility check will pass. Now you can enter arbitrary truststore password (must match) and Truststore URL, and validation will always pass. Once you un-select "Add keystore element" option the truststore validation works as expected. |