Skip to content

Commit 35e7be3

Browse files
wdecostewdecoste
committed
CLOUD-294 Keystore key password for SSL
1 parent 98d343c commit 35e7be3

File tree

11 files changed

+127
-6
lines changed

11 files changed

+127
-6
lines changed

‎os-amq-launch/added/configure.sh

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -115,9 +115,13 @@ function configureSSL() {
115115
keyStorePath="$sslDir/$keyStoreFile"
116116
trustStorePath="$sslDir/$trustStoreFile"
117117

118+
if [ -n "$AMQ_KEY_PASSWORD" ]; then
119+
keyPassword="keyStoreKeyPassword=\"$AMQ_KEY_PASSWORD\""
120+
fi
121+
118122
sslElement="<sslContext>\n\
119123
<sslContext keyStore=\"file:$keyStorePath\"\n\
120-
keyStorePassword=\"$keyStorePassword\"\n\
124+
keyStorePassword=\"$keyStorePassword\" $keyPassword \n\
121125
trustStore=\"file:$trustStorePath\"\n\
122126
trustStorePassword=\"$trustStorePassword\" />\n\
123127
</sslContext>"

‎os-datavirt/added/launch/teiid.sh

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,15 @@ function prepareEnv() {
1111
unset DATAVIRT_TRANSPORT_KEY_ALIAS
1212
unset DATAVIRT_TRANSPORT_KEYSTORE
1313
unset DATAVIRT_TRANSPORT_KEYSTORE_PASSWORD
14+
unset DATAVIRT_TRANSPORT_KEY_PASSWORD
1415
unset DATAVIRT_TRANSPORT_KEYSTORE_TYPE
1516
unset DATAVIRT_TRANSPORT_KEYSTORE_DIR
17+
unset HTTPS_NAME
18+
unset HTTPS_PASSWORD
19+
unset HTTPS_KEY_PASSWORD
20+
unset HTTPS_KEYSTORE_DIR
21+
unset HTTPS_KEYSTORE
22+
unset HTTPS_KEYSTORE_TYPE
1623
unset DATAVIRT_USERS
1724
unset DATAVIRT_USER_PASSWORDS
1825
unset DATAVIRT_USER_GROUPS
@@ -69,6 +76,7 @@ function add_secure_transport(){
6976
local key_alias=${DATAVIRT_TRANSPORT_KEY_ALIAS}
7077
local keystore=${DATAVIRT_TRANSPORT_KEYSTORE-$HTTPS_KEYSTORE}
7178
local keystore_pwd=${DATAVIRT_TRANSPORT_KEYSTORE_PASSWORD-$HTTPS_PASSWORD}
79+
local key_pwd=${DATAVIRT_TRANSPORT_KEY_PASSWORD-$HTTPS_KEY_PASSWORD}
7280
local keystore_type=${DATAVIRT_TRANSPORT_KEYSTORE_TYPE-$HTTPS_KEYSTORE_TYPE}
7381
local keystore_dir=${DATAVIRT_TRANSPORT_KEYSTORE_DIR-$HTTPS_KEYSTORE_DIR}
7482
local auth_mode=${DATAVIRT_TRANSPORT_AUTHENTICATION_MODE}
@@ -91,11 +99,15 @@ function add_secure_transport(){
9199
fi
92100
fi
93101

102+
if [ -n "$key_pwd" ]; then
103+
key_password="key-password=\"${key_pwd}\""
104+
fi
105+
94106
# JDBC
95107
transport="<transport name=\"secure-jdbc\" socket-binding=\"secure-teiid-jdbc\" protocol=\"teiid\"><authentication security-domain=\"teiid-security\"/><ssl mode=\"enabled\" authentication-mode=\"$auth_mode\" ssl-protocol=\"TLSv1.2\" keymanagement-algorithm=\"SunX509\">"
96108

97109
if [ "$auth_mode" != "anonymous" ]; then
98-
transport="$transport <keystore name=\"${keystore_dir}/${keystore}\" password=\"$DATAVIRT_TRANSPORT_KEYSTORE_PASSWORD\" type=\"$keystore_type\" key-alias=\"$key_alias\"/><truststore name=\"${keystore_dir}/${keystore}\" password=\"$keystore_pwd\"/>"
110+
transport="$transport <keystore name=\"${keystore_dir}/${keystore}\" password=\"$keystore_pwd\" type=\"$keystore_type\" key-alias=\"$key_alias\" ${key_password} /><truststore name=\"${keystore_dir}/${keystore}\" password=\"$keystore_pwd\"/>"
99111
fi
100112

101113
transport="$transport </ssl></transport>"
@@ -104,7 +116,7 @@ function add_secure_transport(){
104116
transport="$transport <transport name=\"secure-odbc\" socket-binding=\"secure-teiid-odbc\" protocol=\"pg\"><authentication security-domain=\"teiid-security\"/><ssl mode=\"enabled\" authentication-mode=\"$auth_mode\" ssl-protocol=\"TLSv1.2\" keymanagement-algorithm=\"SunX509\">"
105117

106118
if [ "$auth_mode" != "anonymous" ]; then
107-
transport="$transport <keystore name=\"${keystore_dir}/${keystore}\" password=\"$DATAVIRT_TRANSPORT_KEYSTORE_PASSWORD\" type=\"$keystore_type\" key-alias=\"$key_alias\"/><truststore name=\"${keystore_dir}/${keystore}\" password=\"$keystore_pwd\"/>"
119+
transport="$transport <keystore name=\"${keystore_dir}/${keystore}\" password=\"$keystore_pwd\" type=\"$keystore_type\" key-alias=\"$key_alias\" ${key_password} /><truststore name=\"${keystore_dir}/${keystore}\" password=\"$keystore_pwd\"/>"
108120
fi
109121

110122
transport="$transport </ssl></transport>"

‎os-eap64-launch/added/launch/https.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ function configure_https() {
2525
fi
2626

2727
https="<connector name=\"https\" protocol=\"HTTP/1.1\" socket-binding=\"https\" scheme=\"https\" secure=\"true\"> \
28-
<ssl name=\"${HTTPS_NAME}\" password=\"${HTTPS_PASSWORD}\" certificate-key-file=\"${HTTPS_KEYSTORE_DIR}/${HTTPS_KEYSTORE}\" ${keystore_type}/> \
28+
<ssl name=\"${HTTPS_NAME}\" key-alias=\"${HTTPS_NAME}\" password=\"${HTTPS_PASSWORD}\" certificate-key-file=\"${HTTPS_KEYSTORE_DIR}/${HTTPS_KEYSTORE}\" ${keystore_type} /> \
2929
</connector>"
3030
elif [ -n "${HTTPS_NAME}" -o -n "${HTTPS_PASSWORD}" -o -n "${HTTPS_KEYSTORE_DIR}" -o -n "${HTTPS_KEYSTORE}" ] ; then
3131
echo "WARNING! Partial HTTPS configuration, the https connector WILL NOT be configured."

‎os-eap7-launch/added/launch/https.sh

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
function prepareEnv() {
44
unset HTTPS_NAME
55
unset HTTPS_PASSWORD
6+
unset HTTPS_KEY_PASSWORD
67
unset HTTPS_KEYSTORE_DIR
78
unset HTTPS_KEYSTORE
89
unset HTTPS_KEYSTORE_TYPE
@@ -25,9 +26,16 @@ function configure_https() {
2526
if [ -n "$HTTPS_KEYSTORE_TYPE" ]; then
2627
keystore_provider="provider=\"${HTTPS_KEYSTORE_TYPE}\""
2728
fi
29+
if [ -n "$HTTPS_NAME" ]; then
30+
keystore_alias="alias=\"${HTTPS_NAME}\""
31+
fi
32+
if [ -n "$HTTPS_KEY_PASSWORD" ]; then
33+
key_password="key-password=\"${HTTPS_KEY_PASSWORD}\""
34+
fi
35+
2836
ssl="<server-identities>\n\
2937
<ssl>\n\
30-
<keystore ${keystore_provider} path=\"${HTTPS_KEYSTORE_DIR}/${HTTPS_KEYSTORE}\" keystore-password=\"${HTTPS_PASSWORD}\"/>\n\
38+
<keystore ${keystore_provider} path=\"${HTTPS_KEYSTORE_DIR}/${HTTPS_KEYSTORE}\" keystore-password=\"${HTTPS_PASSWORD}\" ${keystore_alias} ${key_password} />\n\
3139
</ssl>\n\
3240
</server-identities>"
3341

‎os-jdg7-launch/added/launch/authentication-config.sh

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,12 @@ function prepareEnv() {
99
unset SECDOMAIN_LOGIN_MODULE
1010
unset SECDOMAIN_REALM
1111
unset REST_SECURITY_DOMAIN
12+
unset HTTPS_NAME
13+
unset HTTPS_PASSWORD
14+
unset HTTPS_KEY_PASSWORD
15+
unset HTTPS_KEYSTORE_DIR
16+
unset HTTPS_KEYSTORE
17+
unset HTTPS_KEYSTORE_TYPE
1218
}
1319

1420
function configure() {
@@ -79,9 +85,16 @@ function add_realm_domain_mapping() {
7985
if [ -n "$HTTPS_KEYSTORE_TYPE" ]; then
8086
keystore_provider="provider=\"${HTTPS_KEYSTORE_TYPE}\""
8187
fi
88+
if [ -n "$HTTPS_NAME" ]; then
89+
keystore_alias="alias=\"${HTTPS_NAME}\""
90+
fi
91+
if [ -n "$HTTPS_KEY_PASSWORD" ]; then
92+
key_password="key-password=\"${HTTPS_KEY_PASSWORD}\""
93+
fi
94+
8295
ssl="<server-identities>\n\
8396
<ssl>\n\
84-
<keystore ${keystore_provider} path=\"${HTTPS_KEYSTORE_DIR}/${HTTPS_KEYSTORE}\" keystore-password=\"${HTTPS_PASSWORD}\"/>\n\
97+
<keystore ${keystore_provider} path=\"${HTTPS_KEYSTORE_DIR}/${HTTPS_KEYSTORE}\" keystore-password=\"${HTTPS_PASSWORD}\" ${keystore_alias} ${key_password} />\n\
8598
</ssl>\n\
8699
</server-identities>"
87100
fi

‎os-jdg7-launch/added/launch/infinispan-config.sh

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,10 +139,15 @@ function configure_server_identities() {
139139
fi
140140
if [ -n "$SSL_KEYSTORE_ALIAS" ]; then
141141
keystore_alias="alias=\"$SSL_KEYSTORE_ALIAS\""
142+
elif [ -n "$HTTPS_NAME" ]; then
143+
keystore_alias="alias=\"$HTTPS_NAME\""
142144
fi
143145
if [ -n "$SSL_KEY_PASSWORD" ]; then
144146
key_password="key-password=\"$SSL_KEY_PASSWORD\""
147+
elif [ -n "$HTTPS_KEY_PASSWORD" ]; then
148+
key_password="key-password=\"$HTTPS_KEY_PASSWORD\""
145149
fi
150+
146151
ssl="\
147152
<ssl $ssl_protocol>\
148153
<keystore path=\"$keystore_path\" keystore-password=\"$keystore_password\" $keystore_relative_to $keystore_alias $key_password/>\

‎tests/features/amq/amq-common.feature

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,10 +81,12 @@ Feature: Openshift AMQ tests
8181
| AMQ_KEYSTORE_TRUSTSTORE_DIR | /opt/amq/conf |
8282
| AMQ_KEYSTORE | broker.ks |
8383
| AMQ_KEYSTORE_PASSWORD | password |
84+
| AMQ_KEY_PASSWORD | keypass |
8485
| AMQ_TRUSTSTORE | broker.ts |
8586
| AMQ_TRUSTSTORE_PASSWORD | password |
8687
Then XML file /opt/amq/conf/activemq.xml should contain value file:/opt/amq/conf/broker.ks on XPath //amq:sslContext/@keyStore
8788
And XML file /opt/amq/conf/activemq.xml should contain value password on XPath //amq:sslContext/@keyStorePassword
89+
And XML file /opt/amq/conf/activemq.xml should contain value keypass on XPath //amq:sslContext/@keyStoreKeyPassword
8890
And XML file /opt/amq/conf/activemq.xml should contain value file:/opt/amq/conf/broker.ts on XPath //amq:sslContext/@trustStore
8991
And XML file /opt/amq/conf/activemq.xml should contain value password on XPath //amq:sslContext/@trustStorePassword
9092

‎tests/features/datagrid/7.1/datagrid_variable_expansion.feature

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
@jboss-datagrid-7
2+
Feature: Check correct JDG variable expansion used
3+
Scenario: Check HTTPS basic config
4+
When container is started with env
5+
| variable | value |
6+
| USERNAME | tombrady |
7+
| PASSWORD | ringsix6! |
8+
| HTTPS_NAME | jboss |
9+
| HTTPS_PASSWORD | mykeystorepass |
10+
| HTTPS_KEY_PASSWORD | mykeypass |
11+
| HTTPS_KEYSTORE_DIR | /etc/eap-secret-volume |
12+
| HTTPS_KEYSTORE | keystore.jks |
13+
Then XML file /opt/datagrid/standalone/configuration/clustered-openshift.xml should contain value /etc/eap-secret-volume/keystore.jks on XPath //*[local-name()='security-realm'][@name='ApplicationRealm']/*[local-name()='server-identities']/*[local-name()='ssl']/*[local-name()='keystore']/@path
14+
And XML file /opt/datagrid/standalone/configuration/clustered-openshift.xml should contain value mykeystorepass on XPath //*[local-name()='security-realm'][@name='ApplicationRealm']/*[local-name()='server-identities']/*[local-name()='ssl']/*[local-name()='keystore']/@keystore-password
15+
And XML file /opt/datagrid/standalone/configuration/clustered-openshift.xml should contain value mykeypass on XPath //*[local-name()='security-realm'][@name='ApplicationRealm']/*[local-name()='server-identities']/*[local-name()='ssl']/*[local-name()='keystore']/@key-password
16+
And XML file /opt/datagrid/standalone/configuration/clustered-openshift.xml should contain value jboss on XPath //*[local-name()='security-realm'][@name='ApplicationRealm']/*[local-name()='server-identities']/*[local-name()='ssl']/*[local-name()='keystore']/@alias
17+
Then XML file /opt/datagrid/standalone/configuration/clustered-openshift.xml should contain value /etc/eap-secret-volume/keystore.jks on XPath //*[local-name()='security-realm'][@name='jdg-openshift']/*[local-name()='server-identities']/*[local-name()='ssl']/*[local-name()='keystore']/@path
18+
And XML file /opt/datagrid/standalone/configuration/clustered-openshift.xml should contain value mykeystorepass on XPath //*[local-name()='security-realm'][@name='jdg-openshift']/*[local-name()='server-identities']/*[local-name()='ssl']/*[local-name()='keystore']/@keystore-password
19+
And XML file /opt/datagrid/standalone/configuration/clustered-openshift.xml should contain value mykeypass on XPath //*[local-name()='security-realm'][@name='jdg-openshift']/*[local-name()='server-identities']/*[local-name()='ssl']/*[local-name()='keystore']/@key-password
20+
And XML file /opt/datagrid/standalone/configuration/clustered-openshift.xml should contain value jboss on XPath //*[local-name()='security-realm'][@name='jdg-openshift']/*[local-name()='server-identities']/*[local-name()='ssl']/*[local-name()='keystore']/@alias
21+

‎tests/features/datavirt/datavirt_variable_expansion.feature

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
@jboss-datavirt-6
2+
Feature: Check correct JDV variable expansion used
3+
Scenario: Check HTTPS basic config
4+
When container is started with env
5+
| variable | value |
6+
| DATAVIRT_TRANSPORT_KEY_ALIAS | jboss |
7+
| HTTPS_PASSWORD | mykeystorepass |
8+
| HTTPS_KEY_PASSWORD | mykeypass |
9+
| HTTPS_KEYSTORE_DIR | /etc/eap-secret-volume |
10+
| HTTPS_KEYSTORE | keystore.jks |
11+
| HTTPS_KEYSTORE_TYPE | JKS |
12+
Then XML file /opt/eap/standalone/configuration/standalone-openshift.xml should contain value /etc/eap-secret-volume/keystore.jks on XPath //*[local-name()='transport'][@name='secure-jdbc']/*[local-name()='ssl']/*[local-name()='keystore']/@name
13+
And XML file /opt/eap/standalone/configuration/standalone-openshift.xml should contain value mykeystorepass on XPath //*[local-name()='transport'][@name='secure-jdbc']/*[local-name()='ssl']/*[local-name()='keystore']/@password
14+
And XML file /opt/eap/standalone/configuration/standalone-openshift.xml should contain value JKS on XPath //*[local-name()='transport'][@name='secure-jdbc']/*[local-name()='ssl']/*[local-name()='keystore']/@type
15+
And XML file /opt/eap/standalone/configuration/standalone-openshift.xml should contain value mykeypass on XPath //*[local-name()='transport'][@name='secure-jdbc']/*[local-name()='ssl']/*[local-name()='keystore']/@key-password
16+
And XML file /opt/eap/standalone/configuration/standalone-openshift.xml should contain value jboss on XPath //*[local-name()='transport'][@name='secure-jdbc']/*[local-name()='ssl']/*[local-name()='keystore']/@key-alias
17+
And XML file /opt/eap/standalone/configuration/standalone-openshift.xml should contain value /etc/eap-secret-volume/keystore.jks on XPath //*[local-name()='transport'][@name='secure-jdbc']/*[local-name()='ssl']/*[local-name()='truststore']/@name
18+
And XML file /opt/eap/standalone/configuration/standalone-openshift.xml should contain value mykeystorepass on XPath //*[local-name()='transport'][@name='secure-jdbc']/*[local-name()='ssl']/*[local-name()='truststore']/@password
19+
Then XML file /opt/eap/standalone/configuration/standalone-openshift.xml should contain value /etc/eap-secret-volume/keystore.jks on XPath //*[local-name()='transport'][@name='secure-odbc']/*[local-name()='ssl']/*[local-name()='keystore']/@name
20+
And XML file /opt/eap/standalone/configuration/standalone-openshift.xml should contain value mykeystorepass on XPath //*[local-name()='transport'][@name='secure-odbc']/*[local-name()='ssl']/*[local-name()='keystore']/@password
21+
And XML file /opt/eap/standalone/configuration/standalone-openshift.xml should contain value JKS on XPath //*[local-name()='transport'][@name='secure-odbc']/*[local-name()='ssl']/*[local-name()='keystore']/@type
22+
And XML file /opt/eap/standalone/configuration/standalone-openshift.xml should contain value mykeypass on XPath //*[local-name()='transport'][@name='secure-odbc']/*[local-name()='ssl']/*[local-name()='keystore']/@key-password
23+
And XML file /opt/eap/standalone/configuration/standalone-openshift.xml should contain value jboss on XPath //*[local-name()='transport'][@name='secure-odbc']/*[local-name()='ssl']/*[local-name()='keystore']/@key-alias
24+
And XML file /opt/eap/standalone/configuration/standalone-openshift.xml should contain value /etc/eap-secret-volume/keystore.jks on XPath //*[local-name()='transport'][@name='secure-odbc']/*[local-name()='ssl']/*[local-name()='truststore']/@name
25+
And XML file /opt/eap/standalone/configuration/standalone-openshift.xml should contain value mykeystorepass on XPath //*[local-name()='transport'][@name='secure-odbc']/*[local-name()='ssl']/*[local-name()='truststore']/@password
26+

‎tests/features/eap/6.4/eap_variable_expansion.feature

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,3 +113,16 @@ Feature: Check correct variable expansion used
113113
| ns | urn:jboss:domain:security:1.2 |
114114
Then XML file /opt/eap/standalone/configuration/standalone-openshift.xml should have 1 elements on XPath //ns:security-domain[@name='eap-secdomain-name']/ns:authentication/ns:login-module/ns:module-option[@name='password-stacking']
115115

116+
Scenario: Check HTTPS basic config
117+
When container is started with env
118+
| variable | value |
119+
| HTTPS_NAME | jboss |
120+
| HTTPS_PASSWORD | mykeystorepass |
121+
| HTTPS_KEYSTORE_DIR | /etc/eap-secret-volume |
122+
| HTTPS_KEYSTORE | keystore.jks |
123+
| HTTPS_KEYSTORE_TYPE | JKS |
124+
Then XML file /opt/eap/standalone/configuration/standalone-openshift.xml should contain value /etc/eap-secret-volume/keystore.jks on XPath //*[local-name()='connector']/*[local-name()='ssl']/@certificate-key-file
125+
And XML file /opt/eap/standalone/configuration/standalone-openshift.xml should contain value mykeystorepass on XPath //*[local-name()='connector']/*[local-name()='ssl']/@password
126+
And XML file /opt/eap/standalone/configuration/standalone-openshift.xml should contain value jboss on XPath //*[local-name()='connector']/*[local-name()='ssl']/@key-alias
127+
And XML file /opt/eap/standalone/configuration/standalone-openshift.xml should contain value JKS on XPath //*[local-name()='connector']/*[local-name()='ssl']/@keystore-type
128+

‎tests/features/eap/7/eap_variable_expansion.feature

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
@jboss-eap-7
2+
Feature: Check correct variable expansion used
3+
Scenario: Check HTTPS basic config
4+
When container is started with env
5+
| variable | value |
6+
| HTTPS_NAME | jboss |
7+
| HTTPS_PASSWORD | mykeystorepass |
8+
| HTTPS_KEY_PASSWORD | mykeypass |
9+
| HTTPS_KEYSTORE_DIR | /etc/eap-secret-volume |
10+
| HTTPS_KEYSTORE | keystore.jks |
11+
| HTTPS_KEYSTORE_TYPE | JKS |
12+
Then XML file /opt/eap/standalone/configuration/standalone-openshift.xml should contain value /etc/eap-secret-volume/keystore.jks on XPath //*[local-name()='server-identities']/*[local-name()='ssl']/*[local-name()='keystore']/@path
13+
And XML file /opt/eap/standalone/configuration/standalone-openshift.xml should contain value mykeystorepass on XPath //*[local-name()='server-identities']/*[local-name()='ssl']/*[local-name()='keystore']/@keystore-password
14+
And XML file /opt/eap/standalone/configuration/standalone-openshift.xml should contain value jboss on XPath //*[local-name()='server-identities']/*[local-name()='ssl']/*[local-name()='keystore']/@alias
15+
And XML file /opt/eap/standalone/configuration/standalone-openshift.xml should contain value mykeypass on XPath //*[local-name()='server-identities']/*[local-name()='ssl']/*[local-name()='keystore']/@key-password
16+
And XML file /opt/eap/standalone/configuration/standalone-openshift.xml should contain value JKS on XPath //*[local-name()='server-identities']/*[local-name()='ssl']/*[local-name()='keystore']/@provider
17+

0 commit comments

Comments
 (0)