Loading...

Details

Type: Bug
Resolution: Unresolved
Priority: Critical
Fix Version/s: None
Affects Version/s: 7.4.7.CR3
Component/s: OpenShift, Security
Labels:
- JDK17
- intersmash

Blocked:
False
Ready:
False
Target Release:

7.4.z.GA
Git Pull Request:
https://github.com/jboss-container-images/jboss-eap-modules/pull/280, https://github.com/jboss-container-images/jboss-eap-7-openshift-image/pull/522

SFDC Cases Counter:
SFDC Cases Links:

Description

Following the product docs [1], we are configuring SSL with env variables HTTPS_NAME, HTTPS_KEYSTORE and HTTPS_PASSWORD as documented in [2] to deploy an EAP secured application - actually the RH-SSO quickstarts, i.e. based on the eap74-https-s2i template and latest JDK 17 based images [3].

Based on the findings reported in https://issues.redhat.com/browse/WFWIP-461, we're setting HTTPS_KEYSTORE_TYPE=PKCS12 as well, but the deployment will fail anyway with the following traces:

...
07:56:07,730 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 81) MSC000001: Failed to start service jboss.deployment.unit."app-profile-jsp.war".undertow-deployment: org.jboss.msc.service.StartException in service jboss.deployment.unit."app-profile-jsp.war".undertow-deployment: java.lang.RuntimeException: java.lang.IllegalStateException: The required mechanism 'KEYCLOAK' is not available in mechanisms [BASIC, CLIENT_CERT, DIGEST, FORM] from the HttpAuthenticationFactory.
	at org.wildfly.extension.undertow@7.4.5.GA-redhat-00001//org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:81)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at org.jboss.threads@2.4.0.Final-redhat-00001//org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
	at org.jboss.threads@2.4.0.Final-redhat-00001//org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1990)
	at org.jboss.threads@2.4.0.Final-redhat-00001//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486)
	at org.jboss.threads@2.4.0.Final-redhat-00001//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377)
	at java.base/java.lang.Thread.run(Thread.java:833)
	at org.jboss.threads@2.4.0.Final-redhat-00001//org.jboss.threads.JBossThread.run(JBossThread.java:513)
Caused by: java.lang.RuntimeException: java.lang.IllegalStateException: The required mechanism 'KEYCLOAK' is not available in mechanisms [BASIC, CLIENT_CERT, DIGEST, FORM] from the HttpAuthenticationFactory.
	at io.undertow.servlet@2.2.17.SP4-redhat-00001//io.undertow.servlet.core.DeploymentManagerImpl.deploy(DeploymentManagerImpl.java:257)
	at org.wildfly.extension.undertow@7.4.5.GA-redhat-00001//org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:96)
	at org.wildfly.extension.undertow@7.4.5.GA-redhat-00001//org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:78)
	... 8 more
Caused by: java.lang.IllegalStateException: The required mechanism 'KEYCLOAK' is not available in mechanisms [BASIC, CLIENT_CERT, DIGEST, FORM] from the HttpAuthenticationFactory.
	at org.wildfly.security.elytron-web.undertow-server-servlet@1.9.2.Final-redhat-00001//org.wildfly.elytron.web.undertow.server.servlet.AuthenticationManager.initialSecurityHandler(AuthenticationManager.java:156)
	at org.wildfly.security.elytron-web.undertow-server-servlet@1.9.2.Final-redhat-00001//org.wildfly.elytron.web.undertow.server.servlet.AuthenticationManager.lambda$configure$2(AuthenticationManager.java:101)
	at io.undertow.servlet@2.2.17.SP4-redhat-00001//io.undertow.servlet.core.DeploymentManagerImpl.setupSecurityHandlers(DeploymentManagerImpl.java:445)
	at io.undertow.servlet@2.2.17.SP4-redhat-00001//io.undertow.servlet.core.DeploymentManagerImpl.access$600(DeploymentManagerImpl.java:122)
	at io.undertow.servlet@2.2.17.SP4-redhat-00001//io.undertow.servlet.core.DeploymentManagerImpl$1.call(DeploymentManagerImpl.java:226)
	at io.undertow.servlet@2.2.17.SP4-redhat-00001//io.undertow.servlet.core.DeploymentManagerImpl$1.call(DeploymentManagerImpl.java:187)
	at io.undertow.servlet@2.2.17.SP4-redhat-00001//io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)
	at io.undertow.servlet@2.2.17.SP4-redhat-00001//io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
	at org.wildfly.extension.undertow@7.4.5.GA-redhat-00001//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1551)
	at org.wildfly.extension.undertow@7.4.5.GA-redhat-00001//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1551)
	at org.wildfly.extension.undertow@7.4.5.GA-redhat-00001//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1551)
	at org.wildfly.extension.undertow@7.4.5.GA-redhat-00001//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1551)
	at io.undertow.servlet@2.2.17.SP4-redhat-00001//io.undertow.servlet.core.DeploymentManagerImpl.deploy(DeploymentManagerImpl.java:255)
	... 10 more
...

Setting this issue to Blocker since it is breaking backward compatibility - it doesn't happen with previous 7.4 stable and candidate images - and doesn't allow for a SSO secured application to be deployed.

[1]
https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html/getting_started_with_jboss_eap_for_openshift_container_platform/build_run_java_app_s2i#doc-wrapper

[2]
https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/getting_started_with_jboss_eap_for_openshift_container_platform/index#https_env_variables

[3]
https://brewweb.engineering.redhat.com/brew/buildinfo?buildID=2177160
https://brewweb.engineering.redhat.com/brew/buildinfo?buildID=2177043

Attachments

Issue Links

clones

WFWIP-461 [7.4.5 preview images] - Required HTTPS_KEYSTORE_TYPE won't let secured route to be configured

Resolved

[7.4.* JDK 17 images] - Missing required KEYCLOAK mechanism

Details

Description

Attachments

Issue Links

Activity

People

Dates