Bug 901275 (JBPAPP6-1735)
| Summary: | [GSS] (6.3.0) Usage of vault for system-properties throws java.lang.SecurityException | ||
|---|---|---|---|
| Product: | [JBoss] JBoss Enterprise Application Platform 6 | Reporter: | Hisanobu Okuda <hokuda> |
| Component: | Domain Management | Assignee: | Brian Stansberry <brian.stansberry> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Josef Cacek <jcacek> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 6.0.0 | CC: | atangrin, bkundal, brian.stansberry, cdolphy, dehort, emuckenh, fbogyai, hokuda, jawilson, jcacek, jdoyle, jsightle, kkhan, myarboro, nsurtani, pjindal, pslavice, sgilda, smendenh, smumford, tfonteyn |
| Target Milestone: | DR2 | ||
| Target Release: | EAP 6.3.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| URL: | http://jira.jboss.org/jira/browse/JBPAPP6-1735 | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: |
Previous versions of JBoss EAP 6 could fail to boot if a system property with a vault expression in its value attribute was used.
This was because the system property resources in the XML configuration were processed before the security vault resources. This meant that the security vault was not available as a source for resolving expressions. Any resources using a vault attribute would result in the following error:
----
java.lang.SecurityException: JBAS013322: Vault is not initialized
----
In this release of the product, if a system property value expression fails to resolve, a second attempt is made later in the boot process, at a point after the vault (if one is configured) is installed. This resolves the issue and systems using vault expressions now boot as expected.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-06-28 15:40:04 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1076507, 1174871, 1179497 | ||
|
Description
Hisanobu Okuda
2012-12-18 11:43:37 UTC
Changing how this works may have far reaching affects. I think it's too late in the 6.1 cycle to consider this. There's a chicken and egg problem here. If we defer system property processing until after the vault is initialized, system properties cannot be used in the vault configuration itself. (It would also impact path configuration.) Solving this would require something clever (aka hacky) like having the handler for the system property add using an OperationContext attachment to signal the handler for the vault add to store the system property. But only if the handler for the system property add can't do it due to the missing vault. Add a step to fail if the signal isn't received (i.e. there's no vault add in the set of ops.) Could this not be solved like in domain mode where a system property has an attribute "boot-time" ? I have vaulted system properties set in <server-group> with "boot-time=false" and they work fine. Tom, please send me an example config where this works. I don't see why it would, so perhaps your config will give me a nice clue! In standalone, all system properties in standalone.xml have "boot-time=false" semantics. @Brian:
In domain mode, in host.xml I have the vault as per normal
Then in domain.xml, I have:
<server-groups>
<server-group name="idpgroup" profile="default">
<socket-binding-group ref="standard-sockets"/>
<deployments>
<deployment name="ShowSystemProperties.war"
runtime-name="ShowSystemProperties.war"/>
</deployments>
<system-properties>
<property name="testvault" value="${VAULT::system::property::NjQ0Njg1MmUtYzdjMy00NjkwLWE3OWItMmM3OTc5M2I3YTM4TElORV9CUkVBS3ZhdWx0}"
boot-time="false"/>
</system-properties>
</server-group>
</server-groups>
My deployment just loops over all system props and print them... and it shows the decoded "testvault" property.
The main difference that can be observed, is that "ps -auxww" will show this instance with the -Dtestvault=${...} when using boot-time=true
while with boot-time=false, the -Dtestvault=${...} does not show on ps -auxww
@Tom:
With 6.1, when server-group config includes a system property with an expression, I see it getting resolved either way, e.g.
<system-properties>
<property name="testprop" value="${foo:hello}"
boot-time="false"/>
</system-properties>
will result in testprop having a value of "hello" regardless of the value of boot-time.
This matches what I expect from reading the code.
This works because the HostController process actually resolves the expression before feeding it to the server process. That's arguably a bug in the boot-time=false case, since the server process should really be allowed to resolve it itself. In practice it's fine since the HC's resolution process is going to match what the server process would do anyway.
In EAP 6.0, the expression wasn't resolved no matter what the value of boot-time was. The resolution we see in 6.1 was the result of fixing a different bug.
In any case, this doesn't help with standalone, where there is no separate process to do the resolution.
Looks the request for inclusion to EAP6.2.0 is missed the deadline. I want to request inclusion to EAP 6.3.0. Customer requesting this fix in https://c.na7.visual.force.com/apex/Case_View?id=500A000000HoP8k&sfdc.override=1 as well. Verified in EAP 6.3.0.DR2 Replace <programlisting> tag with tick (`) to fix Bug 1096865 |