WF 10 Vaults Not Working with 1.8.0_172

[walkerca]

I was doing some A / B testing with a WildFly 10 instance and JDKs 1.8.0_162 and 1.8.0_172.  For 162, my .xml config with a vault element is read successfully.  The app server starts up.  However, using 172, I get the following

Caused by: java.io.IOException: Invalid secret key format

    at com.sun.crypto.provider.JceKeyStore.engineLoad(JceKeyStore.java:856)

    at java.security.KeyStore.load(KeyStore.java:1445)

There was a KeyStore change in 172.  It seems related to poast Java Serialization problems.

It looks like there might be a migration flag that can be set to go back to the old way.  I'll post if no one finds it first.

[mchoma]

Interesting. Vault (and Credential Stores) are based on JCEKS and there was change in JCEKS format in update 171. If you find a way how to return to compatible behaviour please post.

[1] http://www.oracle.com/technetwork/java/javase/8u171-relnotes-4308888.html#JDK-8189997

[dmlloyd]

Can you share more of the stack trace?

[mchoma]

walkerca can you post details about your usage? I was trying to reproduce but wasn't able.

Is vault created with older java and loaded with latest. Or you see this even when vault is created with latest?

[mchoma]

Please add this dependency line <module name="sun.jdk"/> to modules/system/layers/base/org/picketbox/main

Or migrate to wildlfy 11 which already contains this dependency

[walkerca]

Thanks Martin.  I added the line to the WF 10 module and was able to start with 1.8.0_172.

[jperata]

The problem with picketbox is the same as with vault.sh.

A workaround that worked for me is executing vault.sh this way:

$ JAVA_OPTS="-Djboss.modules.system.pkgs=com.sun.crypto.provider" ./vault.sh

More details: https://access.redhat.com/solutions/3419621Invalid secret key format when accessing to a vault / ObjectInputFilter REJECTED when trying to create vault in JBoss EA…