Secure storage of credentials in JBoss EAP

Prerequisites

• You have provided at least read/write access to the directory containing the KeyStoreCredentialStore for the user account under which JBoss EAP is running.

Procedure

• Create a KeyStoreCredentialStore using the following management CLI command:

  Syntax

  /subsystem=elytron/credential-store=<name_of_credential_store>:add(path="<path_to_store_file>", relative-to=<base_path_to_store_file>, credential-reference={clear-text=<store_password>}, create=true)

  Example

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:add(path="exampleKeyStoreCredentialStore.jceks", relative-to=jboss.server.data.dir, credential-reference={clear-text=password}, create=true)
  {"outcome" => "success"}

• Create a credential-store in each host controller and add credentials to each credential-store.
• Copy a populated credential-store from one host controller to all the other host controllers.
• Save your credential-store file in your Network File System (NFS), then use that file for all the credential-store resources you create.

Prerequisites

• JBoss EAP is running.
• You have provided at least read/write access to the directory containing the secret-key-credential-store for the user account under which JBoss EAP is running.

Procedure

• Use the following command to create a secret-key-credential-store using the management CLI:

  Syntax

  /subsystem=elytron/secret-key-credential-store=<name_of_credential_store>:add(path="<path_to_the_credential_store>", relative-to=<path_to_store_file>)

  Example

  /subsystem=elytron/secret-key-credential-store=examplePropertiesCredentialStore:add(path=examplePropertiesCredentialStore.cs, relative-to=jboss.server.config.dir)
  {"outcome" => "success"}

Prerequisites

• You have created a credential-store.

  For information about creating a credential-store, see Creating a credential-store for a standalone server.

Procedure

• Add a new PasswordCredential to a credential-store:

  Syntax

  /subsystem=elytron/credential-store=<name_of_credential_store>:add-alias(alias=<alias>, secret-value=<secret-value>)

  Example

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:add-alias(alias=passwordCredentialAlias, secret-value=StrongPassword)
  {"outcome" => "success"}

Verification

• Issue the following command to verify that the PasswordCredential was added to the credential-store:

  Syntax

  /subsystem=elytron/credential-store=<name_of_credential_store>:read-aliases()

  Example

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:read-aliases()
  {
      "outcome" => "success",
      "result" => ["passwordcredentialalias"]
  }

• credential-store attributes

Prerequisites

• You have created a credential-store.

  For information about creating a credential-store, see Creating a credential-store for a standalone server.

Procedure

• Generate a SecretKeyCredential in a credential-store using the following management CLI command:

  Syntax

  /subsystem=elytron/credential-store=<name_of_credential_store>:generate-secret-key(alias=<alias>, key-size=<128_or_192>)

  Example

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:generate-secret-key(alias=secretKeyCredentialAlias)

Verification

• Issue the following command to verify that Elytron stored your SecretKeyCredential in the credential-store:

  Syntax

  /subsystem=elytron/credential-store=<name_of_credential_store>:read-aliases()

  Example

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:read-aliases()
  {
      "outcome" => "success",
      "result" => [
          "secretkeycredentialalias"
      ]
  }

Prerequisites

• You have created a secret-key-credential-store.

  For information about creating a secret-key-credential-store, see Creating a secret-key-credential-store for a standalone server.

Procedure

• Generate a SecretKeyCredential in a secret-key-credential-store using the following management CLI command:

  Syntax

  /subsystem=elytron/secret-key-credential-store=<name_of_the_properties_credential_store>:generate-secret-key(alias=<alias>, key-size=<128_or_192>)

  Example

  /subsystem=elytron/secret-key-credential-store=examplePropertiesCredentialStore:generate-secret-key(alias=secretKeyCredentialAlias)
  {"outcome" => "success"}

Verification

• Issue the following command to verify that Elytron created a SecretKeyCredential:

  Syntax

  /subsystem=elytron/secret-key-credential-store=<name_of_the_properties_credential_store>:read-aliases()

  Example

  /subsystem=elytron/secret-key-credential-store=examplePropertiesCredentialStore:read-aliases()
  {
      "outcome" => "success",
      "result" => [
          "secretkeycredentialalias",
          "key"
      ]
  }

Prerequisites

• You have created a secret-key-credential-store.

  For information about creating a secret-key-credential-store, see Creating a secret-key-credential-store for a standalone server.

• You have exported a SecretKeyCredential.

  For information about exporting a SecretKeyCredential, see Exporting a SecretKeyCredential from a secret-key-credential-store.

Procedure

• List the credentials stored in a credential-store using the following management CLI command:

  Syntax

  /subsystem=elytron/credential-store=<name_of_credential_store>:read-aliases()

  Example

  {
      "outcome" => "success",
      "result" => [
          "passwordcredentialalias",
          "secretkeycredentialalias"
      ]
  }

Prerequisites

• You have generated a SecretKeyCredential the credential-store.

  For information about generating a SecretKeyCredential in a credential-store, see Generating a SecretKeyCredential in a credential-store.

Procedure

• Export a SecretKeyCredential from the credential-store using the following management CLI command:

  Syntax

  /subsystem=elytron/credential-store=<name_of_credential_store>:export-secret-key(alias=<alias>)

  Example

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:export-secret-key(alias=secretKeyCredentialAlias)
  {
      "outcome" => "success",
      "result" => {"key" => "RUxZAUui+8JkoDCE6mFyA3cCIbSAZaXq5wgYejj1scYgdDqWiw=="}
  }

Prerequisites

• You have either generated a SecretKeyCredential in the secret-key-credential-store or imported one to it.

  For information on generating a SecretKeyCredential in a secret-key-credential-store, Generating a SecretKeyCredential in a secret-key-credential-store.

  For information on importing a SecretKeyCredential to a secret-key-credential-store, see Importing a SecretKeyCredential to a secret-key-credential-store.

Procedure

• Export a SecretKeyCredential from the secret-key-credential-store using the following management CLI command:

  Syntax

  /subsystem=elytron/secret-key-credential-store=<name_of_credential_store>:export-secret-key(alias=<alias>)

  Example

  /subsystem=elytron/secret-key-credential-store=examplePropertiesCredentialStore:export-secret-key(alias=secretkeycredentialalias)
  {
      "outcome" => "success",
      "result" => {"key" => "RUxZAUtxXcYvz0aukZu+odOynIr0ByLhC72iwzlJsi+ZPmONgA=="}
  }

Procedure

• Remove a credential from the credential-store using the following management CLI command:

  Syntax

  /subsystem=elytron/credential-store=<name_of_credential_store>:remove-alias(alias=<alias>, entry-type=<credential_type>)

  Example removing a PasswordCredential

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:remove-alias(alias=passwordCredentialAlias)
  {
      "outcome" => "success",
      "response-headers" => {"warnings" => [{
          "warning" => "Update dependent resources as alias 'passwordCredentialAlias' does not exist anymore",
          "level" => "WARNING",
          "operation" => {
              "address" => [
                  ("subsystem" => "elytron"),
                  ("credential-store" => "exampleKeyStoreCredentialStore")
              ],
              "operation" => "remove-alias"
          }
      }]}
  }

  Example removing a SecretKeyCredential

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:remove-alias(alias=secretKeyCredentialAlias, entry-type=SecretKeyCredential)
  {
      "outcome" => "success",
      "response-headers" => {"warnings" => [{
          "warning" => "Update dependent resources as alias 'secretKeyCredentialAl
  ias' does not exist anymore",
          "level" => "WARNING",
          "operation" => {
              "address" => [
                  ("subsystem" => "elytron"),
                  ("credential-store" => "exampleKeyStoreCredentialStore")
              ],
              "operation" => "remove-alias"
          }
      }]}
  }

Verification

• Issue the following command to verify that Elytron removed the credential:

  Syntax

  /subsystem=elytron/credential-store=<name_of_credential_store>:read-aliases()

  Example

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:read-aliases()
  {
      "outcome" => "success",
      "result" => []
  }

  The credential you removed is not listed.

Procedure

• Remove a SecretKeyCredential from the secret-key-credential-store using the following command:

  Syntax

  /subsystem=elytron/secret-key-credential-store=<name_of_credential_store>:remove-alias(alias=<alias>)

  Example

  /subsystem=elytron/secret-key-credential-store=examplePropertiesCredentialStore:remove-alias(alias=secretKeyCredentialAlias)
  {
      "outcome" => "success",
      "response-headers" => {"warnings" => [{
          "warning" => "Update dependent resources as alias 'secretKeyCredentialAlias' does not exist anymore",
          "level" => "WARNING",
          "operation" => {
              "address" => [
                  ("subsystem" => "elytron"),
                  ("secret-key-credential-store" => "examplePropertiesCredentialSt
  ore")
              ],
              "operation" => "remove-alias"
          }
      }]}
  }

Verification

• Issue the following command to verify that Elytron removed the credential:

  Syntax

  /subsystem=elytron/secret-key-credential-store=<name_of_credential_store>:read-aliases()

  Example

  /subsystem=elytron/secret-key-credential-store=examplePropertiesCredentialStore:read-aliases()
  {
      "outcome" => "success",
      "result" => []
  }

  The credential you removed is not listed.

Procedure

• Create a credential-store using the WildFly Elytron tool with the following command:

  Syntax

  $ EAP_HOME/bin/elytron-tool.sh credential-store --create --location "<path_to_store_file>" --password <store_password>

  Example

  $ EAP_HOME/bin/elytron-tool.sh credential-store --create --location "../cred_stores/example-credential-store.jceks" --password storePassword
  Credential Store has been successfully created

  If you don’t want to include your store password in the command, omit that argument and then enter the password manually at the prompt. You can also use a masked password generated by the WildFly Elytron tool. For information about generating masked passwords, see Generating masked encrypted strings using the WildFly Elytron tool.

Prerequisites

• Make sure that your environment is configured to use Bouncy Castle.

Procedure

• Create a PropertiesCredentialStore using the WildFly Elytron tool with the following command:

  Syntax

  $ EAP_HOME/bin/elytron-tool.sh credential-store --create --location "<path_to_store_file>" --type PropertiesCredentialStore

  Example

  $ bin/elytron-tool.sh credential-store --create --location=standalone/configuration/properties-credential-store.cs --type PropertiesCredentialStore
  Credential Store has been successfully created

Prerequisites

• You have created a credential store with the WildFly Elytron tool.

  For more information, see Creating a credential-store using the WildFly Elytron tool.

Procedure

• Add the credential store to your running JBoss EAP server with the following management CLI command:

  Syntax

  /subsystem=elytron/credential-store=<store_name>:add(location="<path_to_store_file>",credential-reference={clear-text=<store_password>})

  Example

  /subsystem=elytron/credential-store=my_store:add(location="../cred_stores/example-credential-store.jceks",credential-reference={clear-text=storePassword})

Procedure

• To generate a masked string, use the following command and provide values for the salt and the iteration count:

  $ EAP_HOME/bin/elytron-tool.sh mask --salt <salt> --iteration <iteration_count> --secret <password>

  For example:

  $ EAP_HOME/bin/elytron-tool.sh mask --salt 12345678 --iteration 123 --secret supersecretstorepassword
  
  MASK-8VzWsSNwBaR676g8ujiIDdFKwSjOBHCHgnKf17nun3v;12345678;123

  If you do not want to provide the secret in the command, you can omit that argument and you will be prompted to enter the secret manually using standard input.

• OpenJDK 11
• OpenJDK 17

Prerequisites

• FIPS is enabled in RHEL.

  You can check whether FIPS is enabled using the following command:

  # fips-mode-setup --check

  For information about enabling FIPS in RHEL, see the following resources:

  • Installing the system in FIPS mode in the Red Hat Enterprise Linux documentation.
  • Switching the system to FIPS mode in the Red Hat Enterprise Linux documentation.

• NSS tools are installed.

  In Red Hat Enterprise Linux you can install NSS tools using the DNF package manager as follows:

  # dnf install -y nss-tools

• Your Java Development Kit (JDK) supports configuration of PKCS#11 with an NSS library.

  For information about JDKs that support FIPS, see JDKs that support FIPS.

• JBoss EAP is running.