Bug 893609

Here are some error messages when trying to use expressions in web connector ssl configuration attributes:

keystore-type:

Caused by: LifecycleException:  Protocol handler initialization failed: java.io.IOException: Failed to load keystore type ${x:JKS} with path /home/mazz/source/rhq/dev-container/jbossas/standalone/configuration/rhq.keystore due to ${x:JKS} not found

key-alias:

Caused by: LifecycleException:  Protocol handler initialization failed: java.io.IOException: Alias name ${x:RHQ} does not identify a key entry

I don't believe verify-client works with expressions - when I see the read-resource() on the ssl resource, I see:

        "verify-client" => "${x:false}",

Same with protocol:

        "protocol" => "${x:TLS}",

With those two, it doesn't say the value is an expression (if it is, it would say: expression "${x:TLS}") so I don't think these two work.

As for the password attribs, I do see this:

        "ca-certificate-password" => expression "${x:RHQManagement}",
        "password" => expression "${x:RHQManagement}",

so its possible passwords are working as expressions (I don't see any errors at startup about not being able to read the stores, so this might be working).

One problem with ca-certificate-file and certificate-key-file is if you set that to:

  ${x}

and x is a system prop whose value is

  ${jboss.server.config.dir}/my.keystore

the web connector fails to start with:

Caused by: LifecycleException:  Protocol handler initialization failed: java.io.FileNotFoundException: ${jboss.server.config.dir}/my.keystore (No such file or directory)

So the web connector fails to do further sysprop expansion if a sysprop value itself has a sysprop expression in it.

For now, I think RHQ will assume that you can't use expressions in our own sys prop values for these file settings. You'll have to use absolute paths.

another thing to remove is in rhq-container.build.xml - the target "add-auto-reconfig"

regarding comment #2 - I'll leave it the way it works now (we'll reconfigure the setting with an absolute path - if you just give a relative path, we assume its relative to the config dir).

But, we will need to change some code inside

org.rhq.enterprise.server.installer.ServerInstallUtil.buildSecureConnectorConfiguration

once AS7 is fixed. The keystore/truststore attributes has a problem. They actually do support expressions like "${jboss.server.config.dir}" but our problem is we use properties like "rhq.server.tomcat.security.keystore.file" and its value itself could have an expression in it like jboss.server.config.dir. This doesn't work in 7.1.1.Final and is supposed to be fixed in 7.1.2.Final, as per:

https://issues.jboss.org/browse/AS7-6127?focusedCommentId=12744492&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-12744492

   "what you are asking for is different issue but that was fixed in 7.1.2
see AS7-6233 and AS7-5665 for that

as goes for web subsystem you can see all attributes that support expression by looking at what we test for https://github.com/jbossas/jboss-as/blob/master/web/src/test/resources/org/jboss/as/web/test/subsystem.xml"

another place where expression support is needed is:

/subsystem=logging/logger=org.rhq

If we remove the installer --reconfig workaround, the following wiki pages need to be updated to remove references to that option:

https://docs.jboss.org/author/display/RHQ/Running+The+Installer
https://docs.jboss.org/author/display/RHQ/Securing+Communications
https://docs.jboss.org/author/display/RHQ/Startup+Properties

regarding comment #2 and comment #4, this is still not fixed in EAP 6.1 Alpha. There is a WildFly issue for what we need:

https://issues.jboss.org/browse/WFLY-1177

to test and see if there are expressions in the resources of interest, these are the CLI commands to run:

./jboss-cli.sh --connect --controller=localhost:6999 '/subsystem=security/security-domain=RHQDSSecurityDomain/authentication=classic:read-resource()'

./jboss-cli.sh --connect --controller=localhost:6999 '/socket-binding-group=standard-sockets/remote-destination-outbound-socket-binding=mail-smtp:read-resource()'

./jboss-cli.sh --connect --controller=localhost:6999 '/subsystem=web/connector=http:read-resource()'

./jboss-cli.sh --connect --controller=localhost:6999 '/subsystem=web/connector=https/ssl=configuration:read-resource()'

./jboss-cli.sh --connect --controller=localhost:6999 '/subsystem=logging/logger=org.rhq:read-resource()'

Here's the resource data after the fixes - the server runs fine which means "almost" everything has been fixed in EAP 6.1.alpha (see comment #7 for what wasn't fixed - you can see we still work around it here in the ssl=configuration resource below):

$ ./jboss-cli.sh --connect --controller=localhost:6999 '/subsystem=security/security-domain=RHQDSSecurityDomain/authentication=classic:read-resource()'

{
    "outcome" => "success",
    "result" => {
        "login-modules" => [{
            "code" => "SecureIdentity",
            "flag" => "required",
            "module" => undefined,
            "module-options" => {
                "username" => expression "${rhq.server.database.user-name:rhqadmin}",
                "password" => expression "${rhq.server.database.password:1eeb2f255e832171df8592078de921bc}"
            }
        }],
        "login-module" => {"SecureIdentity" => undefined}
    }
}

$ ./jboss-cli.sh --connect --controller=localhost:6999 '/socket-binding-group=standard-sockets/remote-destination-outbound-socket-binding=mail-smtp:read-resource()'
{
    "outcome" => "success",
    "result" => {
        "fixed-source-port" => false,
        "host" => expression "${rhq.server.email.smtp-host:localhost}",
        "port" => expression "${rhq.server.email.smtp-port:25}",
        "source-interface" => undefined,
        "source-port" => undefined
    }
}

$ ./jboss-cli.sh --connect --controller=localhost:6999 '/subsystem=web/connector=http:read-resource()'
{
    "outcome" => "success",
    "result" => {
        "configuration" => undefined,
        "enable-lookups" => false,
        "enabled" => true,
        "executor" => undefined,
        "max-connections" => expression "${rhq.server.startup.web.max-connections:200}",
        "max-post-size" => 2097152,
        "max-save-post-size" => 4096,
        "name" => "http",
        "protocol" => "HTTP/1.1",
        "proxy-name" => undefined,
        "proxy-port" => undefined,
        "redirect-port" => expression "${rhq.server.socket.binding.port.https:7443}",
        "scheme" => "http",
        "secure" => false,
        "socket-binding" => "http",
        "ssl" => undefined,
        "virtual-server" => undefined
    }
}

$ ./jboss-cli.sh --connect --controller=localhost:6999 '/subsystem=web/connector=https/ssl=configuration:read-resource()'
{
    "outcome" => "success",
    "result" => {
        "ca-certificate-file" => "/home/mazz/source/rhq/dev-container/jbossas/standalone/configuration/rhq.truststore",
        "ca-certificate-password" => expression "${rhq.server.tomcat.security.truststore.password:RHQManagement}",
        "ca-revocation-url" => undefined,
        "certificate-file" => undefined,
        "certificate-key-file" => "/home/mazz/source/rhq/dev-container/jbossas/standalone/configuration/rhq.keystore",
        "cipher-suite" => undefined,
        "key-alias" => expression "${rhq.server.tomcat.security.keystore.alias:RHQ}",
        "keystore-type" => expression "${rhq.server.tomcat.security.keystore.type:JKS}",
        "name" => undefined,
        "password" => expression "${rhq.server.tomcat.security.keystore.password:RHQManagement}",
        "protocol" => expression "${rhq.server.tomcat.security.secure-socket-protocol:TLS}",
        "session-cache-size" => undefined,
        "session-timeout" => undefined,
        "truststore-type" => expression "${rhq.server.tomcat.security.truststore.type:JKS}",
        "verify-client" => expression "${rhq.server.tomcat.security.client-auth-mode:false}",
        "verify-depth" => undefined
    }
}

$ ./jboss-cli.sh --connect --controller=localhost:6999 '/subsystem=logging/logger=org.rhq:read-resource()'
{
    "outcome" => "success",
    "result" => {
        "category" => undefined,
        "filter" => undefined,
        "filter-spec" => undefined,
        "handlers" => undefined,
        "level" => expression "${rhq.server.log-level:INFO}",
        "use-parent-handlers" => true
    }
}

Note that, as per comment #7, ca-certificate-file and certificate-key-file attributes in the ssl=configuration resource are evaluated and their actual values are stored, we cannot use ${x} notation here. So, if users want to change the name or location of their keystore/truststore, they will have to hand-edit standalone-full.xml to have the change take effect. I added a comment in rhq-server.properties to let users know this. This is a minor issue though because people will rarely, if ever, need to rename these files. And if they need to, there is an easy way to do it (just edit standalone-full.xml).

git commit to master: 4c50679d28c84c2d0057c2438bb985c562fc8ac5

I'd like to see some testing around this before RHQ 4.7 is released. 
While I am sure mazz did a good job here, install failures for users will bring us bad press, so the most common install scenarios need testing
(fresh install, upgrade, ??)

Updated all the relevant wiki pages as appropriate. However, since WildFly/EAP still does not support recursive evaluations of properties, we still have two settings that won't take effect by modifying rhq-server.properties after the initial install (see bug #958494 where I talk about this). In the wiki pages, I added a blurb about this.

This issue can now be considered ready for QA. All wiki docs updates and code changes are done.