[WFLY-18475] helloworld-mutual-ssl-secured Quickstart Common Enhancements CY2023Q3 #729

PrarthonaPaul · 2023-10-10T19:59:40Z

Jira Issue: https://issues.redhat.com/browse/WFLY-18475
Notes:

This QS is not open shift compatible, as a result, the Openshift profile has not been added.
When running mvn verify -Pintegration-testing we need to add another param called -Djboss.server.config.dir, where the value for the param is the path to the standalone/configuration directory for the server. mvn verify -Pintegration-testing -Djboss.server.config.dir=target/server/standalone/configuration -Dserver.host=https://localhost:8443 README would need to be updated to reflect this. CI would also need to be updated for this. Currently there is a null pointer exception for getting the system property for DJboss.server.config.dir.
New script has been added to create the client truststore from the server keystore. This is used to configure the client when setting up the SSL programmatically.

openshift-ci · 2023-10-10T19:59:50Z

Hi @PrarthonaPaul. Thanks for your PR.

I'm waiting for a wildfly member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

fjuma · 2023-10-19T15:47:08Z

helloworld-mutual-ssl-secured/configure-certs.cli

@@ -0,0 +1,19 @@
+#configure a key-store in the Elytron subsystem. The path to the keystore file doesn’t actually have to exist yet.
+/subsystem=elytron/key-store=mutualKS:add(path=clientCert.P12, relative-to=jboss.server.config.dir, credential-reference={clear-text=secret}, type=PKCS12)


Maybe we should call it clientKS (just to make it more obvious that this is used for the client cert)

The path could be client.keystore or something like that

Thats true, I will change it to clientKS.
WRT the path, I named it clientCert.p12 to make it consistent with the naming from the README file. In case someone wanted to use the cli script while going through the QS interactively. But I can change it too. Feel free to let me know what you think.

Just checked the README. Looks like we are using "client.keystore" for the path there (see keytool -genkey -keystore client.keystore ...)

fjuma · 2023-10-19T15:48:08Z

helloworld-mutual-ssl-secured/configure-certs.cli

+/subsystem=elytron/key-store=mutualKS:export-certificate(alias=example, path=clientCert.crt, relative-to=jboss.server.config.dir, pem=true)
+
+#Create a truststore in the elytron subsystem. 
+/subsystem=elytron/key-store=mutualTS:add(path=client.keystore, relative-to=jboss.server.config.dir, credential-reference={clear-text=secret}, type=PKCS12)


Maybe we should call this serverTS (just to make it more obvious that this is used for the server's trust store)

The path could be server.truststore or something like that

Same as above, I only named it client.keystore to keep it consistent with the README naming

Just checked the README, you're right, we were using client.truststore before but I think server.truststore is a better name that reflects the purpose of this file.

For the resource name, we're actually using qsTrustStore in the README so we can either update that to serverTS or just use qsTrustStore here to be consistent.

fjuma · 2023-10-19T15:50:55Z

helloworld-mutual-ssl-secured/configure-certs.cli

+/subsystem=elytron/key-store=mutualTS:add(path=client.keystore, relative-to=jboss.server.config.dir, credential-reference={clear-text=secret}, type=PKCS12)
+
+# Import a certificate into a truststore
+/subsystem=elytron/key-store=mutualTS:import-certificate(alias=example, path=clientCert.crt, relative-to=jboss.server.config.dir, credential-reference={clear-text=secret}, trust-cacerts=true, validate=false)


Do we need trust-cacerts to be specified or can we just use the default?

it seemed okay without it. I will update the script to remove it.
Thanks for pointing out

.github/workflows/quickstart_helloworld-mutual-ssl-secured_ci.yml

helloworld-mutual-ssl-secured/certs.sh

helloworld-mutual-ssl-secured/pom.xml

helloworld/pom.xml

shared-doc/build-and-run-the-quickstart-with-provisioned-server.adoc

shared-doc/run-integration-tests-with-provisioned-server.adoc

...rld-mutual-ssl-secured/src/test/java/org/jboss/as/quickstarts/helloworld/BasicRuntimeIT.java

ejb-security-context-propagation/pom.xml

fjuma · 2023-12-13T19:30:19Z

helloworld-mutual-ssl-secured/configure-ssl.cli

+/subsystem=elytron/key-manager=applicationKM:write-attribute(name=key-store, value=applicationKS)
+
+#add the key-manager to the ssl-context for the server
+/subsystem=elytron/server-ssl-context=applicationSSC:write-attribute(name=key-manager, value=applicationKM)


Same here, why is this needed?

fjuma · 2023-12-13T19:31:36Z

helloworld-mutual-ssl-secured/restore-certs.cli

@@ -0,0 +1,8 @@
+#remove the keypairs and certificates from the keystore and truststore
+/subsystem=elytron/key-store=serverTS:remove-alias(alias=example)
+/subsystem=elytron/key-store=clientKS:remove-alias(alias=example)


I think the alias needs to be updated based on the values used in the cli scripts above.

fixed!
Thanks @fjuma

emmartins · 2023-12-14T13:54:52Z

I guess this one in under development and not ready to review?

PrarthonaPaul · 2023-12-14T14:12:22Z

I guess this one in under development and not ready to review?

A few small things, and should be good afterwards.
I will ping you once it is ready to review.

fjuma · 2023-12-15T20:31:01Z

helloworld-mutual-ssl-secured/configure-client-certs.cli

@@ -0,0 +1,19 @@
+# Configure a key-store in the Elytron subsystem. The path to the keystore file doesn’t actually have to exist yet.


Configure the client's keystore. This will be used to generate the client's certificate. The path to the keystore file doesn’t actually have to exist yet

fjuma · 2023-12-15T20:31:12Z

helloworld-mutual-ssl-secured/configure-client-certs.cli

@@ -0,0 +1,19 @@
+# Configure a key-store in the Elytron subsystem. The path to the keystore file doesn’t actually have to exist yet.


Just minor, but configure-client-certs.cli could be renamed to just configure-client-cert.cli.

fjuma · 2023-12-15T20:31:32Z

helloworld-mutual-ssl-secured/configure-client-certs.cli

+# Generate a new key pair for the client. We'll use an RSA key of size 2048 and we'll use CN=quickstartUser
+/subsystem=elytron/key-store=clientKS:generate-key-pair(alias=quickstartUser, algorithm=RSA, key-size=2048, validity=365, credential-reference={clear-text=secret}, distinguished-name="cn=quickstartUser")
+
+# Export the certificate to a file called clientCert.crt


s/the certificate/the client's certificate

fjuma · 2023-12-15T20:31:46Z

helloworld-mutual-ssl-secured/configure-client-certs.cli

+# Export the certificate to a file called clientCert.crt
+/subsystem=elytron/key-store=clientKS:export-certificate(alias=quickstartUser, path=clientCert.crt, relative-to=jboss.server.config.dir, pem=true)
+
+# Create a the server's truststore


s/a the/the

fjuma · 2023-12-15T20:32:03Z

helloworld-mutual-ssl-secured/configure-client-certs.cli

+# Create a the server's truststore
+/subsystem=elytron/key-store=serverTS:add(path=server.truststore, relative-to=jboss.server.config.dir, credential-reference={clear-text=secret}, type=PKCS12)
+
+# Import a certificate into the server's truststore


s/a certificate/the client's certificate

fjuma · 2023-12-15T20:34:18Z

helloworld-mutual-ssl-secured/configure-ssl.cli

@@ -29,10 +29,13 @@ batch
 # Add an application-security-domain in the undertow subsystem to map the client_cert_domain from the quickstart app to the http-authentication-factory
 /subsystem=undertow/application-security-domain=client_cert_domain:add(http-authentication-factory=quickstart-http-authentication)

+#generate the key pair that the server would use for its keystore


Generate the server's certificate

fjuma · 2023-12-15T20:34:55Z

helloworld-mutual-ssl-secured/pom.xml

@@ -44,8 +44,12 @@
    </licenses>

    <properties>
-        <!-- The versions for BOMs, Dependencies and Plugins -->
-        <version.server.bom>30.0.0.Final</version.server.bom>
+         <!-- Version for the server -->


I think  isn't aligned with the rest.

fjuma · 2023-12-15T20:36:04Z

...l-ssl-secured/src/test/java/org/jboss/as/quickstarts/helloworld_mutual_ssl/keystoreUtil.java

+ * @author <a href="mailto:[email protected]">Prarthona Paul</a>
+ */
+
+public class keystoreUtil {


The k should be uppercase, KeystoreUtil.

fjuma · 2023-12-15T20:37:07Z

...l-ssl-secured/src/test/java/org/jboss/as/quickstarts/helloworld_mutual_ssl/keystoreUtil.java

+
+public class keystoreUtil {
+
+    public static KeyStore loadKeyPairFromKeyStore(String serverDir, String keyStoreFile, String storePassword, String keyAlias, String keyStoreType) throws KeyStoreException {


Since this method creates a truststore and adds a cert entry to it, maybe it could be called createTrustStore

fixed!
Thanks @fjuma !
@emmartins This should be good to review once we resolve this comment: #729 (comment)

emmartins · 2023-12-21T11:07:53Z

WFLY 31.0.0.Beta1 has been released, please rebase this PR with upstream/main branch, and update:

All pom.xml to 31.0.0.Final-SNAPSHOT
All pom.xml to 6
Property named version.server to 31.0.0.Beta1
Property named version.plugin.wildfly to 4.2.1.Final

…ents CY2023Q3

PrarthonaPaul · 2023-12-21T14:38:46Z

Hi @emmartins
I have made the version updates to the pom.xml file.
This QS should be good to go! Thanks

… use a CLI script instead of keytool

emmartins · 2024-03-25T14:30:03Z

Hi @PrarthonaPaul, this PR required some changes to bring it up in sync with current main branch, plus a few minor enhancements similar to #885 , so I made a replacement PR for this at #886 , please have a look

PrarthonaPaul · 2024-03-26T19:50:01Z

Superseded by #886

openshift-ci bot added the needs-ok-to-test label Oct 10, 2023

PrarthonaPaul force-pushed the helloworld-mutual-ssl-secured-enhancement branch 5 times, most recently from c2ef03a to c5399b6 Compare October 16, 2023 19:26

PrarthonaPaul force-pushed the helloworld-mutual-ssl-secured-enhancement branch 5 times, most recently from f21448f to abb9e1a Compare October 19, 2023 15:39

fjuma reviewed Oct 19, 2023

View reviewed changes

PrarthonaPaul force-pushed the helloworld-mutual-ssl-secured-enhancement branch 2 times, most recently from 100814d to f917738 Compare October 20, 2023 18:30

PrarthonaPaul force-pushed the helloworld-mutual-ssl-secured-enhancement branch from f917738 to 3b50b5f Compare October 30, 2023 15:04