Chapter 1. Credentials and credential stores in Elytron

Prerequisites

• You have provided at least read/write access to the directory containing the KeyStoreCredentialStore for the user account under which JBoss EAP is running.

Procedure

• Create a KeyStoreCredentialStore using the following management CLI command:

  Syntax

  /subsystem=elytron/credential-store=<name_of_credential_store>:add(path="<path_to_store_file>", relative-to=<base_path_to_store_file>, credential-reference={clear-text=<store_password>}, create=true)

  Copy to Clipboard Toggle word wrap

  Example

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:add(path="exampleKeyStoreCredentialStore.jceks", relative-to=jboss.server.data.dir, credential-reference={clear-text=password}, create=true)
  {"outcome" => "success"}

  Copy to Clipboard Toggle word wrap

• Create a credential-store in each host controller and add credentials to each credential-store.
• Copy a populated credential-store from one host controller to all the other host controllers.
• Save your credential-store file in your Network File System (NFS), then use that file for all the credential-store resources you create.

Prerequisites

• JBoss EAP is running.
• You have provided at least read/write access to the directory containing the secret-key-credential-store for the user account under which JBoss EAP is running.

Procedure

• Use the following command to create a secret-key-credential-store using the management CLI:

  Syntax

  /subsystem=elytron/secret-key-credential-store=<name_of_credential_store>:add(path="<path_to_the_credential_store>", relative-to=<path_to_store_file>)

  Copy to Clipboard Toggle word wrap

  Example

  /subsystem=elytron/secret-key-credential-store=examplePropertiesCredentialStore:add(path=examplePropertiesCredentialStore.cs, relative-to=jboss.server.config.dir)
  {"outcome" => "success"}

  Copy to Clipboard Toggle word wrap

Prerequisites

• You have created a credential-store.

  For information about creating a credential-store, see Creating a credential-store for a standalone server.

Procedure

• Add a new PasswordCredential to a credential-store:

  Syntax

  /subsystem=elytron/credential-store=<name_of_credential_store>:add-alias(alias=<alias>, secret-value=<secret-value>)

  Copy to Clipboard Toggle word wrap

  Example

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:add-alias(alias=passwordCredentialAlias, secret-value=StrongPassword)
  {"outcome" => "success"}

  Copy to Clipboard Toggle word wrap

Verification

• Issue the following command to verify that the PasswordCredential was added to the credential-store:

  Syntax

  /subsystem=elytron/credential-store=<name_of_credential_store>:read-aliases()

  Copy to Clipboard Toggle word wrap

  Example

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:read-aliases()
  {
      "outcome" => "success",
      "result" => ["passwordcredentialalias"]
  }

  Copy to Clipboard Toggle word wrap

Prerequisites

• You have created a credential-store.

  For information about creating a credential-store, see Creating a credential-store for a standalone server.

Procedure

• Generate a SecretKeyCredential in a credential-store using the following management CLI command:

  Syntax

  /subsystem=elytron/credential-store=<name_of_credential_store>:generate-secret-key(alias=<alias>, key-size=<128_or_192>)

  Copy to Clipboard Toggle word wrap

  Example

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:generate-secret-key(alias=secretKeyCredentialAlias)

  Copy to Clipboard Toggle word wrap

Verification

• Issue the following command to verify that Elytron stored your SecretKeyCredential in the credential-store:

  Syntax

  /subsystem=elytron/credential-store=<name_of_credential_store>:read-aliases()

  Copy to Clipboard Toggle word wrap

  Example

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:read-aliases()
  {
      "outcome" => "success",
      "result" => [
          "secretkeycredentialalias"
      ]
  }

  Copy to Clipboard Toggle word wrap

Prerequisites

• You have created a secret-key-credential-store.

  For information about creating a secret-key-credential-store, see Creating a secret-key-credential-store for a standalone server.

Procedure

• Generate a SecretKeyCredential in a secret-key-credential-store using the following management CLI command:

  Syntax

  /subsystem=elytron/secret-key-credential-store=<name_of_the_properties_credential_store>:generate-secret-key(alias=<alias>, key-size=<128_or_192>)

  Copy to Clipboard Toggle word wrap

  Example

  /subsystem=elytron/secret-key-credential-store=examplePropertiesCredentialStore:generate-secret-key(alias=secretKeyCredentialAlias)
  {"outcome" => "success"}

  Copy to Clipboard Toggle word wrap

Verification

• Issue the following command to verify that Elytron created a SecretKeyCredential:

  Syntax

  /subsystem=elytron/secret-key-credential-store=<name_of_the_properties_credential_store>:read-aliases()

  Copy to Clipboard Toggle word wrap

  Example

  /subsystem=elytron/secret-key-credential-store=examplePropertiesCredentialStore:read-aliases()
  {
      "outcome" => "success",
      "result" => [
          "secretkeycredentialalias",
          "key"
      ]
  }

  Copy to Clipboard Toggle word wrap

Prerequisites

• You have created a secret-key-credential-store.

  For information about creating a secret-key-credential-store, see Creating a secret-key-credential-store for a standalone server.

• You have exported a SecretKeyCredential.

  For information about exporting a SecretKeyCredential, see Exporting a SecretKeyCredential from a secret-key-credential-store.

Procedure

• List the credentials stored in a credential-store using the following management CLI command:

  Syntax

  /subsystem=elytron/credential-store=<name_of_credential_store>:read-aliases()

  Copy to Clipboard Toggle word wrap

  Example

  {
      "outcome" => "success",
      "result" => [
          "passwordcredentialalias",
          "secretkeycredentialalias"
      ]
  }

  Copy to Clipboard Toggle word wrap

Prerequisites

• You have generated a SecretKeyCredential the credential-store.

  For information about generating a SecretKeyCredential in a credential-store, see Generating a SecretKeyCredential in a credential-store.

Procedure

• Export a SecretKeyCredential from the credential-store using the following management CLI command:

  Syntax

  /subsystem=elytron/credential-store=<name_of_credential_store>:export-secret-key(alias=<alias>)

  Copy to Clipboard Toggle word wrap

  Example

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:export-secret-key(alias=secretKeyCredentialAlias)
  {
      "outcome" => "success",
      "result" => {"key" => "RUxZAUui+8JkoDCE6mFyA3cCIbSAZaXq5wgYejj1scYgdDqWiw=="}
  }

  Copy to Clipboard Toggle word wrap

Prerequisites

• You have either generated a SecretKeyCredential in the secret-key-credential-store or imported one to it.

  For information on generating a SecretKeyCredential in a secret-key-credential-store, Generating a SecretKeyCredential in a secret-key-credential-store.

  For information on importing a SecretKeyCredential to a secret-key-credential-store, see Importing a SecretKeyCredential to a secret-key-credential-store.

Procedure

• Export a SecretKeyCredential from the secret-key-credential-store using the following management CLI command:

  Syntax

  /subsystem=elytron/secret-key-credential-store=<name_of_credential_store>:export-secret-key(alias=<alias>)

  Copy to Clipboard Toggle word wrap

  Example

  /subsystem=elytron/secret-key-credential-store=examplePropertiesCredentialStore:export-secret-key(alias=secretkeycredentialalias)
  {
      "outcome" => "success",
      "result" => {"key" => "RUxZAUtxXcYvz0aukZu+odOynIr0ByLhC72iwzlJsi+ZPmONgA=="}
  }

  Copy to Clipboard Toggle word wrap

Procedure

• Remove a credential from the credential-store using the following management CLI command:

  Syntax

  /subsystem=elytron/credential-store=<name_of_credential_store>:remove-alias(alias=<alias>, entry-type=<credential_type>)

  Copy to Clipboard Toggle word wrap

  Example removing a PasswordCredential

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:remove-alias(alias=passwordCredentialAlias)
  {
      "outcome" => "success",
      "response-headers" => {"warnings" => [{
          "warning" => "Update dependent resources as alias 'passwordCredentialAlias' does not exist anymore",
          "level" => "WARNING",
          "operation" => {
              "address" => [
                  ("subsystem" => "elytron"),
                  ("credential-store" => "exampleKeyStoreCredentialStore")
              ],
              "operation" => "remove-alias"
          }
      }]}
  }

  Copy to Clipboard Toggle word wrap

  Example removing a SecretKeyCredential

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:remove-alias(alias=secretKeyCredentialAlias, entry-type=SecretKeyCredential)
  {
      "outcome" => "success",
      "response-headers" => {"warnings" => [{
          "warning" => "Update dependent resources as alias 'secretKeyCredentialAl
  ias' does not exist anymore",
          "level" => "WARNING",
          "operation" => {
              "address" => [
                  ("subsystem" => "elytron"),
                  ("credential-store" => "exampleKeyStoreCredentialStore")
              ],
              "operation" => "remove-alias"
          }
      }]}
  }

  Copy to Clipboard Toggle word wrap

Verification

• Issue the following command to verify that Elytron removed the credential:

  Syntax

  /subsystem=elytron/credential-store=<name_of_credential_store>:read-aliases()

  Copy to Clipboard Toggle word wrap

  Example

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:read-aliases()
  {
      "outcome" => "success",
      "result" => []
  }

  Copy to Clipboard Toggle word wrap

  The credential you removed is not listed.

Procedure

• Remove a SecretKeyCredential from the secret-key-credential-store using the following command:

  Syntax

  /subsystem=elytron/secret-key-credential-store=<name_of_credential_store>:remove-alias(alias=<alias>)

  Copy to Clipboard Toggle word wrap

  Example

  /subsystem=elytron/secret-key-credential-store=examplePropertiesCredentialStore:remove-alias(alias=secretKeyCredentialAlias)
  {
      "outcome" => "success",
      "response-headers" => {"warnings" => [{
          "warning" => "Update dependent resources as alias 'secretKeyCredentialAlias' does not exist anymore",
          "level" => "WARNING",
          "operation" => {
              "address" => [
                  ("subsystem" => "elytron"),
                  ("secret-key-credential-store" => "examplePropertiesCredentialSt
  ore")
              ],
              "operation" => "remove-alias"
          }
      }]}
  }

  Copy to Clipboard Toggle word wrap

Verification

• Issue the following command to verify that Elytron removed the credential:

  Syntax

  /subsystem=elytron/secret-key-credential-store=<name_of_credential_store>:read-aliases()

  Copy to Clipboard Toggle word wrap

  Example

  /subsystem=elytron/secret-key-credential-store=examplePropertiesCredentialStore:read-aliases()
  {
      "outcome" => "success",
      "result" => []
  }

  Copy to Clipboard Toggle word wrap

  The credential you removed is not listed.

Procedure

• Create a credential-store using the WildFly Elytron tool with the following command:

  Syntax

  $ EAP_HOME/bin/elytron-tool.sh credential-store --create --location "<path_to_store_file>" --password <store_password>

  Copy to Clipboard Toggle word wrap

  Example

  $ EAP_HOME/bin/elytron-tool.sh credential-store --create --location "../cred_stores/example-credential-store.jceks" --password storePassword
  Credential Store has been successfully created

  Copy to Clipboard Toggle word wrap

  If you don’t want to include your store password in the command, omit that argument and then enter the password manually at the prompt. You can also use a masked password generated by the WildFly Elytron tool. For information about generating masked passwords, see Generating masked encrypted strings using the WildFly Elytron tool.

Prerequisites

• Make sure that your environment is configured to use Bouncy Castle.

Procedure

• Create a PropertiesCredentialStore using the WildFly Elytron tool with the following command:

  Syntax

  $ EAP_HOME/bin/elytron-tool.sh credential-store --create --location "<path_to_store_file>" --type PropertiesCredentialStore

  Copy to Clipboard Toggle word wrap

  Example

  $ bin/elytron-tool.sh credential-store --create --location=standalone/configuration/properties-credential-store.cs --type PropertiesCredentialStore
  Credential Store has been successfully created

  Copy to Clipboard Toggle word wrap

Prerequisites

• You have created a credential store with the WildFly Elytron tool.

  For more information, see Creating a credential-store using the WildFly Elytron tool.

Procedure

• Add the credential store to your running JBoss EAP server with the following management CLI command:

  Syntax

  /subsystem=elytron/credential-store=<store_name>:add(location="<path_to_store_file>",credential-reference={clear-text=<store_password>})

  Copy to Clipboard Toggle word wrap

  Example

  /subsystem=elytron/credential-store=my_store:add(location="../cred_stores/example-credential-store.jceks",credential-reference={clear-text=storePassword})

  Copy to Clipboard Toggle word wrap

Procedure

• To generate a masked string, use the following command and provide values for the salt and the iteration count:

  $ EAP_HOME/bin/elytron-tool.sh mask --salt <salt> --iteration <iteration_count> --secret <password>

  Copy to Clipboard Toggle word wrap

  For example:

  $ EAP_HOME/bin/elytron-tool.sh mask --salt 12345678 --iteration 123 --secret supersecretstorepassword
  
  MASK-8VzWsSNwBaR676g8ujiIDdFKwSjOBHCHgnKf17nun3v;12345678;123

  Copy to Clipboard Toggle word wrap

  If you do not want to provide the secret in the command, you can omit that argument and you will be prompted to enter the secret manually using standard input.

• BouncyCastle FIPS provider for the Java Cryptography Extension (JCE) and the Java Cryptography Architecture (JCA).
• BouncyCastle FIPS provider for the Java Secure Socket Extension (JSSE).