Hide Forgot
Description of problem: We should add some validation for Keystore/Truststore URL field on JSSE configuration screen. Version-Release number of selected component (if applicable): EAP 6.2.0.ER7 How reproducible: Always Steps to Reproduce: 1. Run GUI installer. Go to Post-Install configuration screen using default values. 2. Select to Add a security-domain. 3. Press next on Security domain configuration screen to get to JSSE screen. 4. Check to "add jsse option" to show other values. 5. Choose to either "Add keystore element", or "Add truststore element" option. 6. Enter some values to password fields and keystore/truststore URL field. Actual results: keystore/truststore URL field could contain any non empty value. Expected results: We should verify that URL is accessible.
I was looking into this today. I was thinking of going beyond the "is it accessible" to actually checking the password given, to see if the keystore can be accessed through the Java KeyStore APIs. However, there seem to be a myriad of keystore types that the user could be using; Should I attempt to check all possible keystore types that the JRE is aware of (requires more work) Or should I just attempt with the type JKS, and warn if this fails? (This is already implemented and requires a little tuning, that's it, as well as localization) Thanks, Tom
Hi Tom, I guess that checking of JKS is enough. Petr
Check implemented. If validation fails, the user is warned that they may have entered the wrong password, but it cannot be guaranteed unless the keystore is of type JKS.
I found an issue while testing this. The "accessibility check" itself works fine, but I found a case which can walk-around it. Truststore validation is bypassed once I enter valid keystore element. Way to reproduce: 1. Go to Security-domain configuration screen with JSSE configuration. Select to "Add jsse element", "Add keystore element" and "Add truststore element". 2. Enter valid values into Keystore password and keystore URL so the accessibility check will pass. Now you can enter arbitrary truststore password (must match) and Truststore URL, and validation will always pass. Once you un-select "Add keystore element" option the truststore validation works as expected.
Validation has been updated. http://git.app.eng.bos.redhat.com/jbossas-installer.git/commit/?h=eap-6.2&id=40c15bc29499ff8a2e1f5da9b8314abb6410a3c2
Verified on EAP 6.2.0.CR.3.1 (re-spin caused by BZ1007833) installer.