Uploaded image for project: 'WildFly Core'
  1. WildFly Core
  2. WFCORE-5710

Allow system-property resources to not resolve expression strings

    XMLWordPrintable

Details

    • Feature Request
    • Resolution: Unresolved
    • Minor
    • None
    • None
    • Management, Security
    • None

    Description

      If the string you use for the value of a system-property resource's value attribute looks like an expression, SystemPropertyAddHandler will resolve the expression and set the JVM system property to the resolved value.

      There should be a boolean attribute on the resource that can be used to turn this off such that the JVM system property is set to the unresolved expression string.

      The use case for this is credential store expressions, where the expression string will vary depending on the clear text value. Having to put that changeable expression in chunks of configuration ties that chunk of configuration to a particular clear text value. Putting a fixed system property expression in that configuration chunk removes that coupling, since when the clear text value is needed at runtime WildFly's recursive expression resolution functionality allows that fixed system property expression to resolve to a credential store expression, which in turn resolves to clear text. But for the system property expression to resolve to a credential store expression, the user needs to be able to store the unresolved credential store expression in the JVM system property. This can be done using -D or a properties file passed to server boot using -p, but the system property resource should also allow this.

      Examples of 'chunks of configuration' where this kind of decoupling from the credential store expression would be useful:

      • Deployment descriptors
      • Deployment annotation values
      • CLI scripts that are meant for reuse in different environments
      • Test code involving secure expressions, where the test author can deal only with the clear text and the system property name, leaving the relatively complex calculation and handling of the credential store expression to utility code that runs at test execution time.

      The test use case in particular can benefit from this. The -D and -p options for setting the system property are cumbersome to use in testsuites, since they require a server server JVM launch in order to take effect. Adding and removing system-property resources in tests that can use an already running target server is much more convenient.

      Attachments

        Activity

          People

            jmesnil1@redhat.com Jeff Mesnil
            bstansbe@redhat.com Brian Stansberry
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated: