ORA-01005: null password given; logon denied with BCFIPS

[andreimatei]

Hi everyone,

Here's a strange issue on wildfly 10.1:

After switching to Bouncy Castle as the security provider, bc-fips-1.0.0, I started getting errors like:

2017-02-20 13:15:05,933 WARN Thread-64 [org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool] [fillTo] IJ000610: Unable to fill pool: java:jboss/datasources/TwistDS

javax.resource.ResourceException: IJ031084: Unable to create connection

        at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createLocalManagedConnection(LocalManagedConnectionFactory.java:345)

        at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.getLocalManagedConnection(LocalManagedConnectionFactory.java:352)

        at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.access$200(LocalManagedConnectionFactory.java:62)

        at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory$1$1.run(LocalManagedConnectionFactory.java:259)

        at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory$1$1.run(LocalManagedConnectionFactory.java:250)

        at java.security.AccessController.doPrivileged(Native Method)

        at javax.security.auth.Subject.doAs(Subject.java:422)

        at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory$1.run(LocalManagedConnectionFactory.java:249)

        at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory$1.run(LocalManagedConnectionFactory.java:246)

        at java.security.AccessController.doPrivileged(Native Method)

        at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createManagedConnection(LocalManagedConnectionFactory.java:245)

        at org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.createConnectionEventListener(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:1320)

        at org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.fillTo(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:1136)

        at org.jboss.jca.core.connectionmanager.pool.mcp.PoolFiller.run(PoolFiller.java:97)

        at java.lang.Thread.run(Thread.java:745)

Caused by: java.sql.SQLException: ORA-01005: null password given; logon denied

        at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:450)

        at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:392)

        at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:385)

        at oracle.jdbc.driver.T4CTTIfun.processError(T4CTTIfun.java:1018)

        at oracle.jdbc.driver.T4CTTIoauthenticate.processError(T4CTTIoauthenticate.java:501)

        at oracle.jdbc.driver.T4CTTIfun.receive(T4CTTIfun.java:522)

        at oracle.jdbc.driver.T4CTTIfun.doRPC(T4CTTIfun.java:257)

        at oracle.jdbc.driver.T4CTTIoauthenticate.doOAUTH(T4CTTIoauthenticate.java:437)

        at oracle.jdbc.driver.T4CTTIoauthenticate.doOAUTH(T4CTTIoauthenticate.java:954)

        at oracle.jdbc.driver.T4CConnection.logon(T4CConnection.java:639)

        at oracle.jdbc.driver.PhysicalConnection.connect(PhysicalConnection.java:666)

        at oracle.jdbc.driver.T4CDriverExtension.getConnection(T4CDriverExtension.java:32)

        at oracle.jdbc.driver.OracleDriver.connect(OracleDriver.java:566)

        at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createLocalManagedConnection(LocalManagedConnectionFactory.java:321)

        ... 14 more

Does anyone have any idea what's happening, I tried to google it and nothing. The sole thing that I changes is the java.security.conf file by adding: "security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider" + the jars  via: -Djava.ext.dirs

[mchoma]

Strange. Could you post your configuration, please? Could you turn logging of security stuff to DEBUG. Is SSL somehow used?

My first thought is if some DIGEST algorithm isn't used which is not fips compliant.

[andreimatei]

standalone-full attached.

tried using :

    <logger category="org.jboss.security">

        <level name="DEBUG"/>

    </logger>

    <logger category="org.bouncycastle">

        <level name="DEBUG"/>

    </logger>

nothing extra in server.log

[mchoma]

I assume org.picketbox.datasource.security.SecureIdentityLoginModule doesn't work properly with BCFIPS. Althought, Blowfish should be avalaible in BCFIPS, there can be used unsufficient parameters or different implementation details. To confirm this try to use plain password instead of SecureIdentityLoginModule. Try to debug SecureIdentityLoginModule and you will see what exactly is wrong.

Try this CLI to add debug logging

/subsystem=logging/console-handler=CONSOLE:write-attribute(name=level, value=ALL)

/subsystem=logging/logger=org.jboss.security:add(level=ALL)

/subsystem=logging/logger=org.jboss.as.security:add(level=ALL)

/subsystem=logging/logger=org.picketbox:add(level=ALL)

/subsystem=logging/logger=org.apache.catalina.authenticator:add(level=ALL)

/subsystem=logging/logger=org.jboss.as.web.security:add(level=ALL)

/subsystem=logging/logger=org.jboss.as.domain.management.security:add(level=ALL)

/subsystem=logging/logger=org.wildfly.security:add(level=ALL)

/subsystem=logging/logger=org.wildfly.elytron:add(level=ALL)

I noticed you use JKS for ssl configuration. It shouldn't work in fips mode. You should set "security.provider.N=com.sun.net.ssl.internal.ssl.Provider BCFIPS" in java.security to properly configure ssl to use bcfips.

[andreimatei]

Tried plain text password but no luck, the same error. Also added all the requested loggers but no extra info.

As for the "com.sun.net.ssl.internal.ssl.Provider BCFIPS", I left it for the moment behind to avoid the extra errors with the keystore.

The sole thing that I found in the logs is " ELY01077: Invalid alias "TLS_RSA_WITH_DES_CBC_SHA" for missing mechanism database entry "TLS_RSA_FIPS_WITH_DES_CBC_SHA""  which is in fact a bug in Wildfly that is fixed in a later version of Elytron  (tried to patch the elytron jar, but seams to be unrelated).

I also get the db user account locked, after 3 wildfly restarts.

[mchoma]

And doesn't have oracle jdbc driver some requirements for beeing fips compliant? Isn't it necessary to tweak somehow its configuration?

[mayerw01]

From https://www.bouncycastle.org/fips/UserGuide-20151229.pdf I understand that all 3 security providers must be provided

security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider

security.provider.2=com.sun.net.ssl.internal.ssl.Provider BCFIPS

security.provider.3=sun.security.provider.Sun

[andreimatei]

tried that as well.

Beside the "KeyStore must be from provider BCFIPS" error, everything is the same.

Currently I'm google-ing for possible incompatibilities with the oracle driver (12.1.0.2.0) but it's weird because we're migrating from BSAFE to Bouncy Castle and with the BSAFE libs, everything worked fine.

[andreimatei]

I managed to reproduce this issue in a simple standalone app using the latest oracle jdbc driver. The following lines of code ware enough:

    Security.addProvider(new BouncyCastleFipsProvider());

    Class.forName("oracle.jdbc.driver.OracleDriver");Connection connection = null;          

    connection = DriverManager.getConnection("jdbc:oracle:thin:@host:1521:truth","user","password");

It fails the same, so Martin, you ware right.

[andreimatei]

so, the driver (12.1.0.2) is buggy. Switched to the older 12.1.0.1 and it works fine.

[mchoma]

Great to hear