1 2 Previous Next 15 Replies Latest reply on Jun 7, 2013 12:31 PM by mohammadwrk

Storing datasource password in Vault - Domain Mode

diegossilveira Jan 30, 2012 7:32 PM

Hello,

I'm trying to store my xa-datasources' passwords encrypted in VAULT. My JBoss is 7.1.0.CR1b and I followed the directions as explained here: https://community.jboss.org/wiki/JBossAS7SecuringPasswords

The problem is that when I start JBoss in domain mode, I get the following exception:

18:04:28,424 ERROR [org.jboss.as.controller.management-operation] (ServerService Thread Pool -- 51) JBAS014612: Operation ("enable") failed - address: ([
    ("subsystem" => "datasources"),
    ("xa-data-source" => "dbpd03")
]): java.lang.SecurityException: Vault is not initialized
        at org.jboss.as.security.vault.RuntimeVaultReader.retrieveFromVault(RuntimeVaultReader.java:97)
        at org.jboss.as.server.RuntimeExpressionResolver.resolvePluggableExpression(RuntimeExpressionResolver.java:45)
        at org.jboss.as.controller.ExpressionResolverImpl.resolveExpressionsRecursively(ExpressionResolverImpl.java:58) [jboss-as-controller-7.1.0.CR1b.jar:7.1.0.CR1b]
        at org.jboss.as.controller.ExpressionResolverImpl.resolveExpressions(ExpressionResolverImpl.java:40) [jboss-as-controller-7.1.0.CR1b.jar:7.1.0.CR1b]
        at org.jboss.as.controller.ModelControllerImpl.resolveExpressions(ModelControllerImpl.java:414) [jboss-as-controller-7.1.0.CR1b.jar:7.1.0.CR1b]
        at org.jboss.as.controller.OperationContextImpl.resolveExpressions(OperationContextImpl.java:622) [jboss-as-controller-7.1.0.CR1b.jar:7.1.0.CR1b]
        at org.jboss.as.controller.ParallelBootOperationContext.resolveExpressions(ParallelBootOperationContext.java:263) [jboss-as-controller-7.1.0.CR1b.jar:7.1.0.CR1b]
        at org.jboss.as.connector.subsystems.datasources.DataSourceModelNodeUtil.getResolvedStringIfSetOrGetDefault(DataSourceModelNodeUtil.java:359)
        at org.jboss.as.connector.subsystems.datasources.DataSourceModelNodeUtil.xaFrom(DataSourceModelNodeUtil.java:228)
        at org.jboss.as.connector.subsystems.datasources.DataSourceEnable$1.execute(DataSourceEnable.java:101)
        at org.jboss.as.controller.AbstractOperationContext.executeStep(AbstractOperationContext.java:359) [jboss-as-controller-7.1.0.CR1b.jar:7.1.0.CR1b]
        at org.jboss.as.controller.AbstractOperationContext.doCompleteStep(AbstractOperationContext.java:254) [jboss-as-controller-7.1.0.CR1b.jar:7.1.0.CR1b]
        at org.jboss.as.controller.AbstractOperationContext.completeStep(AbstractOperationContext.java:190) [jboss-as-controller-7.1.0.CR1b.jar:7.1.0.CR1b]
        at org.jboss.as.controller.ParallelBootOperationStepHandler$ParallelBootTask.run(ParallelBootOperationStepHandler.java:311) [jboss-as-controller-7.1.0.CR1b.jar:7.1.0.CR1b]
        at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886) [:1.6.0_25]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908) [:1.6.0_25]
        at java.lang.Thread.run(Thread.java:662) [:1.6.0_25]
        at org.jboss.threads.JBossThread.run(JBossThread.java:122) [jboss-threads-2.0.0.GA.jar:2.0.0.GA]

$JBOSS_HOME/domain/configuration/host.xml

<?xml version='1.0' encoding='UTF-8'?>


<host name="pdmaster" xmlns="urn:jboss:domain:1.1">
     <vault>
         <vault-option name="KEYSTORE_URL" value="/usr/local/jboss/vault.keystore"/>
         <vault-option name="KEYSTORE_PASSWORD" value="MASK-XXXXXXXXXX"/>
         <vault-option name="KEYSTORE_ALIAS" value="vault"/>
         <vault-option name="SALT" value="12345678"/>
         <vault-option name="ITERATION_COUNT" value="50"/>
         <vault-option name="ENC_FILE_DIR" value="/usr/local/jboss/"/>
     </vault>

     ....

     <servers>
        <server name="pd-master-vserver01" group="pd-server-group" auto-start="true">
        </server>
        <server name="pd-master-vserver02" group="pd-server-group" auto-start="true">
            <socket-bindings port-offset="100"/>
        </server>
        <server name="pd-master-vserver03" group="pd-server-group" auto-start="true">
            <socket-bindings port-offset="200"/>
        </server>
    </servers>
</host>

$JBOSS_HOME/domain/configuration/domain.xml

<domain  xmlns="urn:jboss:domain:1.1">
            ...
            <subsystem xmlns="urn:jboss:domain:datasources:1.0">
                <datasources>
                    <!-- DBPD03 -->
                    <xa-datasource jndi-name="java:jboss/datasources/dbpd03DS" pool-name="dbpd03" enabled="true" use-ccm="false">
                        <xa-datasource-property name="URL">jdbc:mysql://pdbd-ldr-01/dbpd03?autoReconnect=true</xa-datasource-property>
                        <driver>mysql</driver>
                        <xa-pool>
                            <min-pool-size>2</min-pool-size>
                            <max-pool-size>10</max-pool-size>
                            <prefill>true</prefill>
                            <is-same-rm-override>false</is-same-rm-override>
                            <interleaving>false</interleaving>
                            <pad-xid>false</pad-xid>
                            <wrap-xa-resource>false</wrap-xa-resource>
                        </xa-pool>
                        <security>
                            <user-name>pd_api</user-name>
                            <password>${VAULT::dbpd03DS::password::YWU2NTAxZmYtMGEyZi00ZjI2LWI5MmMtNDk5OGYxZjJlYzVkTElORV9CUkVBS3ZhdWx0;}</password>
                        </security>
                        <validation>
                            <validate-on-match>false</validate-on-match>
                            <background-validation>false</background-validation>
                            <background-validation-millis>0</background-validation-millis>
                        </validation>
                        <statement>
                            <prepared-statement-cache-size>0</prepared-statement-cache-size>
                            <share-prepared-statements>false</share-prepared-statements>
                        </statement>
                    </xa-datasource>
                     <drivers>
                        <driver name="mysql" module="com.mysql">
                            <driver-class>
                                com.mysql.jdbc.Driver
                            </driver-class>
                            <xa-datasource-class>
                                com.mysql.jdbc.jdbc2.optional.MysqlXADataSource
                            </xa-datasource-class>
                        </driver>
                    </drivers>
                </datasources>
            </subsystem>
            ...
</host>

It's important to say that in standalone mode, my keystore and datasources' encrypted passwords work fine. I noticed that in domain mode, even if I ommit the <vault> tag in host.xml, I got exactly the same error / exception.

Is there any error in my domain configuration files?

Thank you in advance!

1. Re: Storing datasource password in Vault - Domain Mode

anil.saldhana Jan 31, 2012 9:30 AM (in response to diegossilveira)

In the domain mode, each of the servers needs to have the vault locally. We do not transmit the vault stuff from the domain controller to the server. Let me verify it with our domain experts.
Actions
2. Re: Storing datasource password in Vault - Domain Mode

diegossilveira Jan 31, 2012 10:02 AM (in response to anil.saldhana)

Hello Anil,

Thank you for the reply! What do you mean by "each of the servers needs to have the vault locally"? Each JBoss machine in the domain here have the vault locally. But the *virtual* servers declared in my host.xml don't have any vault tag, should they have (I don't think so, looking at the xsd)? Even if I start a single Jboss (the domain controller), the problem occurs. I really need to store encrypted passwords, and domain mode would save us lot of work when configuring the nodes.
Actions
3. Re: Storing datasource password in Vault - Domain Mode

anil.saldhana Jan 31, 2012 10:44 AM (in response to diegossilveira)

Did you put the vault setting in the *server* element also in host.xml?
Actions
4. Re: Storing datasource password in Vault - Domain Mode

diegossilveira Jan 31, 2012 11:39 AM (in response to anil.saldhana)

No, according to the XSD, the server element in host.xml does not support a vault setting:

<xs:complexType name="serverType">
        <xs:all>
            <xs:element name="paths" type="specified-pathsType" minOccurs="0" maxOccurs="1" />
            <xs:element name="interfaces" type="specified-interfacesType" minOccurs="0"/>
            <xs:element name="socket-bindings" type="server-socket-bindingsType" minOccurs="0"/>
            
            <xs:element name="system-properties" type="properties-w            <xs:element name="socket-bindings" type="server-socket-bindingsType" minOccurs="0"/>ith-boottime" minOccurs="0"/>
            <xs:element name="jvm" minOccurs="0" type="serverJvmType"/>
        </xs:all>
        <xs:attribute name="name" type="xs:string" use="required"/>
        <xs:attribute name="group" type="xs:string" use="required"/>
        <xs:attribute name="auto-start" type="xs:boolean" default="true"/>
    </xs:complexType>

Am I wrong? If yes, how should I declare this vault in the server element in host.xml?
Actions
5. Re: Storing datasource password in Vault - Domain Mode

anil.saldhana Jan 31, 2012 3:04 PM (in response to diegossilveira)

Diego, if you look in https://github.com/jbossas/jboss-as/blob/master/build/src/main/resources/docs/schema/jboss-as-config_1_1.xsd

search for "vault". Line 112
Actions
6. Re: Storing datasource password in Vault - Domain Mode

diegossilveira Jan 31, 2012 3:20 PM (in response to anil.saldhana)

This is for server element which is the root element in standalone.xml, no? The server element for host.xml is declared at line 78. The type serversType is declared at line 748, tha references the serverType declared at line 754. It looks really weird, the configuration conforms to the XSD, but JBoss in domain mode seem to ignore that. The problem is that Jboss does not figure out that the <password>${VAULT::dbpd03DS::password::YWU2NTAxZmYtMGEyZi00ZjI2LWI5MmMtNDk5OGYxZjJlYzVkTElORV9CUkVBS3ZhdWx0;}</password> in domain.xml (datasource subsystem) references an entry of the vault declared at host.xml.
Actions
7. Re: Storing datasource password in Vault - Domain Mode

brian.stansberry Jan 31, 2012 3:24 PM (in response to diegossilveira)

I believe the issue here is when the Host Controller starts up the server it isn't setting up the vault services correctly.
Actions
8. Re: Storing datasource password in Vault - Domain Mode

brian.stansberry Jan 31, 2012 5:53 PM (in response to brian.stansberry)

Thanks for the JIRA!

https://issues.jboss.org/browse/AS7-3526
Actions
9. Re: Storing datasource password in Vault - Domain Mode

diegossilveira Jan 31, 2012 5:56 PM (in response to brian.stansberry)

You're welcome, it's nice to contribute to JBoss AS 7!
Actions
10. Re: Storing datasource password in Vault - Domain Mode

anil.saldhana Feb 1, 2012 5:59 PM (in response to diegossilveira)

Brian was right. I was missing some code.

I can now see the following:
---------------------------------
[Server:server-one] 16:40:17,009 INFO [org.picketbox.plugins.vault.PicketBoxSecurityVault] (Controller Boot Thread) Default Security Vault Implementation Initialized and Ready
--------------------------------

Diego, let me give you an instance of JBAS 7.1 to test and tell me if it is working for you. Then I can submit the pull request.
Actions
11. Re: Storing datasource password in Vault - Domain Mode

anil.saldhana Feb 1, 2012 6:12 PM (in response to anil.saldhana)

Diego, can you get this tar file (https://docs.google.com/open?id=0B1686J5nuKI6NjBiMjA1Y2EtY2UxYS00Y2Y2LWFlMjEtMzhkZGZiNTg5YjI4). It has a build of AS7.1

Can you test that the vault thing works for you? I can then send a pull request.
Actions
12. Re: Storing datasource password in Vault - Domain Mode

diegossilveira Feb 2, 2012 6:42 AM (in response to anil.saldhana)

Anil, I'll get this build and install on my test servers. As soon as I get a result I'll let you know, rigth?
Actions
13. Re: Storing datasource password in Vault - Domain Mode

diegossilveira Feb 2, 2012 5:10 PM (in response to diegossilveira)

Anil,

I tested the domain configuration with the instance of "JBoss 7.1.0.Final.SNAPSHOT" and the vault problem seems to be fixed:

Logs:
--------------------------------
[Server:pd-master-virtual-server-01] 19:58:42,077 INFO [org.jboss.security.vault.SecurityVaultFactory] (Controller Boot Thread) Getting Security Vault with implementation of org.picketbox.plugins.vault.PicketBoxSecurityVault
[Server:pd-master-virtual-server-01] 19:58:42,104 INFO [org.picketbox.plugins.vault.PicketBoxSecurityVault] (Controller Boot Thread) Default Security Vault Implementation Initialized and Ready
--------------------------------
Actions
14. Re: Storing datasource password in Vault - Domain Mode

anil.saldhana Feb 2, 2012 5:27 PM (in response to diegossilveira)

Yeah, I put in the pull request already and it has been merged. Thanks for confirming that it is working. Maybe you can get a nightly build if you are in need of the fix.

Thanks for reporting the issue.
Actions

1 2 Previous Next

Go to original post