-
Enhancement
-
Resolution: Obsolete
-
Major
-
None
-
7.1.0.DR16
-
None
To configure TLS in FIPS mode there have to be java.security file configured as follows (this works fine as expected)
security.provider.1=sun.security.pkcs11.SunPKCS11 /usr/java/jdk1.8.0_66_fips_mode/__fips_config_material/pkcs11.cfg security.provider.2=sun.security.provider.Sun security.provider.3=com.sun.net.ssl.internal.ssl.Provider SunPKCS11-testPkcs
Elytron subsystem have capablity to configure security providers. So expectation was the same could be configured purely via elytron subsystem. However it is not true and trying these commands leads to error
[standalone@localhost:9990 /] /subsystem=elytron/provider-loader=b:add(class-names=[com.sun.net.ssl.internal.ssl.Provider]) { "outcome" => "failed", "failure-description" => {"WFLYCTL0080: Failed services" => {"org.wildfly.security.providers.b" => "java.lang.ClassNotFoundException: com.sun.net.ssl.internal.ssl.Provider from [Module \"org.wildfly.extension.elytron\" from local module loader @282ba1e (finder: local module finder @13b6d03 (roots: /home/mchoma/workspace/eap-versions/7.1.0.DR16/jboss-eap-7.1/modules,/home/mchoma/workspace/eap-versions/7.1.0.DR16/jboss-eap-7.1/modules/system/layers/base))] Caused by: java.lang.ClassNotFoundException: com.sun.net.ssl.internal.ssl.Provider from [Module \"org.wildfly.extension.elytron\" from local module loader @282ba1e (finder: local module finder @13b6d03 (roots: /home/mchoma/workspace/eap-versions/7.1.0.DR16/jboss-eap-7.1/modules,/home/mchoma/workspace/eap-versions/7.1.0.DR16/jboss-eap-7.1/modules/system/layers/base))]"}}, "rolled-back" => true } [standalone@localhost:9990 /] /subsystem=elytron/provider-loader=a:add(class-names=[sun.security.pkcs11.SunPKCS11], argument="/usr/java/jdk1.8.0_66_fips_mode/__fips_config_material/pkcs11.cfg") {"outcome" => "success"} [standalone@localhost:9990 /] /subsystem=elytron/provider-loader=b:add(class-names=[sun.security.provider.Sun]) {"outcome" => "success"}
After workarounding first problem by adding <path name="com/sun/net/ssl/internal/ssl"/> into module.xml of sun.jdk module there is another error
[standalone@localhost:9990 /] /subsystem=elytron/provider-loader=c:add(class-names=[com.sun.net.ssl.internal.ssl.Provider], argument="SunPKCS11-testPkcs") { "outcome" => "failed", "failure-description" => {"WFLYCTL0080: Failed services" => {"org.wildfly.security.providers.c" => "java.lang.reflect.InvocationTargetException Caused by: java.lang.reflect.InvocationTargetException Caused by: java.security.ProviderException: Crypto provider not installed: SunPKCS11-testPkcs"}}, "rolled-back" => true }
server.log
11:07:40,787 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-2) MSC000001: Failed to start service org.wildfly.security.providers.c: org.jboss.msc.service.StartException in service org.wildfly.security.providers.c: java.lang.reflect.InvocationTargetException at org.wildfly.extension.elytron.ProviderDefinitions$1$1.get(ProviderDefinitions.java:214) at org.wildfly.extension.elytron.ProviderDefinitions$1$1.get(ProviderDefinitions.java:154) at org.wildfly.extension.elytron.TrivialService.start(TrivialService.java:53) at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:2032) at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1955) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:745) Caused by: java.lang.reflect.InvocationTargetException at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) at java.lang.reflect.Constructor.newInstance(Constructor.java:422) at org.wildfly.extension.elytron.ProviderDefinitions$1$1.get(ProviderDefinitions.java:179) ... 7 more Caused by: java.security.ProviderException: Crypto provider not installed: SunPKCS11-testPkcs at sun.security.ssl.SunJSSE.<init>(SunJSSE.java:142) at sun.security.ssl.SunJSSE.<init>(SunJSSE.java:123) at com.sun.net.ssl.internal.ssl.Provider.<init>(Provider.java:51) ... 12 more 11:07:40,791 ERROR [org.jboss.as.controller.management-operation] (management-handler-thread - 3) WFLYCTL0013: Operation ("add") failed - address: ([ ("subsystem" => "elytron"), ("provider-loader" => "c") ]) - failure description: {"WFLYCTL0080: Failed services" => {"org.wildfly.security.providers.c" => "java.lang.reflect.InvocationTargetException Caused by: java.lang.reflect.InvocationTargetException Caused by: java.security.ProviderException: Crypto provider not installed: SunPKCS11-testPkcs"}}
Please provide possibility to configure EAP in FIPS mode just with elytron subsystem.
- is duplicated by
-
JBEAP-10282 Elytron subsystem, ClassNotFoundException: com.sun.net.ssl.internal.ssl.Provider
- Closed