I created a credential store and saved the application keystore password in it. Plan is to use the password alias in TLS keymanager and keystore.
So, here is what I tried.
/subsystem=elytron/key-store=LocalhostKeyStore:add(path=server.keystore,relative-to=jboss.server.config.dir,credential-reference={clear-text="keystore_password"},type=JKS)
/subsystem=elytron/key-manager=LocalhostKeyManager:add(key-store=LocalhostKeyStore,alias-filter=server,credential-reference={clear-text="key_password"})
/subsystem=elytron/server-ssl-context=LocalhostSslContext:add(key-manager=LocalhostKeyManager)
/subsystem=undertow/server=default-server/https-listener=https:undefine-attribute(name=security-realm)
/subsystem=undertow/server=default-server/https-listener=https:write-attribute(name=ssl-context,value=LocalhostSslContext)
Above one with clear text works flawlessly but when tried to substitute credential store it does not work.
Create a store and store the password.
/subsystem=elytron/credential-store=LocalhostKeyStore:add(relative-to=jboss.server.data.dir, location=appks.jceks,create=true,credential-reference={clear-text=kspass, type=JKS})
/subsystem=elytron/credential-store=LocalhostKeyStore:add-alias(alias=kspass,secret-value=secret)
/subsystem=elytron/key-store=LocalhostKeyStore:add(path=server.keystore,relative-to=jboss.server.config.dir,credential-reference={store=LocalhostKeyStore, alias=kspass})
Getting error in the below script.
/subsystem=elytron/key-manager=LocalhostKeyManager:add(key-store=LocalhostKeyStore,alias-filter=server,credential-reference={store="LocalhostKeyStore", alias=kspass})
Tried with clear text too, same issue.
/subsystem=elytron/key-manager=LocalhostKeyManager:add(key-store=LocalhostKeyStore,alias-filter=server,credential-reference={clear-text=kspass})
Outcome failure message:
{
"outcome" => "failed",
"failure-description" => "WFLYCTL0369: Required capabilities are not available:
org.wildfly.security.key-store.LocalhostKeyStore; Possible registration points for this capability:
/subsystem=security/elytron-key-store=*
/subsystem=security/elytron-trust-store=*
/subsystem=elytron/key-store=*
/subsystem=elytron/ldap-key-store=*
/subsystem=elytron/filtering-key-store=*",
"rolled-back" => true
}
What am I missing?
Help appreciated! Thank you!
Yes, the key manager can use the credential store to vaildate the keystore with the secured password stored in the credential store. I have incorrect pointing to the credential-store rather than the key-store in the statement that produced error.