我正在将 KeyCloak v15(WildFly v23)密码从旧保险库迁移到 elytron 凭证存储。它对于标准用例来说运行良好。在 中standalone.xml
,我有
/server/extensions/extension
::
<extension module="org.wildfly.extension.elytron"/>
/server/profile/subsystem
:
<subsystem xmlns="urn:wildfly:elytron:13.0" final-providers="elytron" disallowed-providers="OracleUcrypto">
<providers>
<provider-loader name="elytron" module="org.wildfly.security.elytron"/>
</providers>
<audit-logging>
<file-audit-log name="local-audit" path="audit-log.log" relative-to="jboss.server.log.dir" format="JSON"/>
</audit-logging>
<credential-stores>
<credential-store name="credStore" location="/data/credStore.jceks">
<implementation-properties>
<property name="keyStoreType" value="JCEKS"/>
</implementation-properties>
<credential-reference clear-text="MASK-123456789;salt123;42"/>
</credential-store>
</credential-stores>
</subsystem>
我使用以下方法访问密码
/server/profile/subsystem[@xmlns="urn:jboss:domain:jgroups:8.0"]/stacks/stack[@name="tcp"]/auth-protocol/digest-token/shared-secret-reference
:
<shared-secret-reference store="credStore" alias="myBlock::mySecret"/>
但是,我需要将一个秘密传递给属性中的 SPI。你知道怎么做吗?这是旧的保险库方式:
/server/system-properties/property
:
<property name="secret" value="${VAULT::myBlock::mySecret::1}"/>
/server/profile/subsystem[@xmlns="urn:jboss:domain:keycloak-server:1.1"]/spi
:
<spi name="mySpi">
<provider name="file" enabled="true">
<properties>
<property name="password" value="${secret}"/>
</properties>
</provider>
</spi>
答案1
我发现了两种可能性:
- 重写 SPI 以使用 Java 直接从 Elytron 凭证存储中检索机密
- 预先设置一个环境变量(
export SECRET="$(secret-getter-script)"
)并在以下情况下使用该变量standalone.xml
:
<spi name="mySpi">
<provider name="file" enabled="true">
<properties>
<property name="password" value="${env.SECRET}"/>
</properties>
</provider>
</spi>
答案2
我必须重写我们的 SPI 来读取 Elytron 凭证存储内容:
import org.jboss.as.server.CurrentServiceContainer;
import org.jboss.msc.service.ServiceController;
import org.jboss.msc.service.ServiceName;
import org.jboss.msc.service.ServiceRegistry;
import org.wildfly.security.credential.PasswordCredential;
import org.wildfly.security.credential.store.CredentialStore;
import org.wildfly.security.credential.store.CredentialStoreException;
import org.wildfly.security.password.Password;
import org.wildfly.security.password.interfaces.ClearPassword;
private static String getClientSecret(String credentialStore, String secretAlias) {
final ServiceName SERVICE_NAME_CRED_STORE = ServiceName.of("org", "wildfly", "security", "credential-store");
final ServiceName sn = ServiceName.of(SERVICE_NAME_CRED_STORE, credentialStore);
final ServiceRegistry registry = CurrentServiceContainer.getServiceContainer();
final ServiceController<?> credStoreService = registry.getService(sn);
final CredentialStore cs = (CredentialStore) credStoreService.getValue();
// if (!cs.exists(secretAlias, PasswordCredential.class)) {
// throw new CredentialStoreException("Alias " + secretAlias + " not found in credential store.");
// }
final Password password;
try {
password = cs.retrieve(secretAlias, PasswordCredential.class).getPassword();
} catch (CredentialStoreException e) {
e.printStackTrace();
return null;
}
if (!(password instanceof ClearPassword)) {
throw new ClassCastException("Password is not of type ClearPassword");
}
return new String(((ClearPassword) password).getPassword());
}