1.4. 使用 JBoss EAP 管理 CLI 的凭据存储操作

先决条件

• 您对在其下运行 JBoss EAP 的用户帐户至少提供了对包含 KeyStoreCredentialStore 目录的读/写权限。

流程

• 使用以下管理 CLI 命令，创建一个 KeyStoreCredentialStore：

  语法

  /subsystem=elytron/credential-store=<name_of_credential_store>:add(path="<path_to_store_file>", relative-to=<base_path_to_store_file>, credential-reference={clear-text=<store_password>}, create=true)

  示例

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:add(path="exampleKeyStoreCredentialStore.jceks", relative-to=jboss.server.data.dir, credential-reference={clear-text=password}, create=true)
  {"outcome" => "success"}

• 在每个主机控制器中创建一个 credential-store，并向每一个 credential-store 添加凭证。
• 将填充的 credential-store 从一个主机控制器拷贝到所有其他主机控制器。
• 将 credential-store 文件保存在网络文件系统(NFS)中，然后对您创建的所有 credential-store 资源使用该文件。

先决条件

• JBoss EAP 正在运行。
• 您为在其下运行 JBoss EAP 的用户帐户至少提供了对包含 secret-key-credential-store 的目录的读/写权限。

流程

• 使用以下命令，使用管理 CLI 来创建一个 secret-key-credential-store ：

  语法

  /subsystem=elytron/secret-key-credential-store=<name_of_credential_store>:add(path="<path_to_the_credential_store>", relative-to=<path_to_store_file>)

  Example

  /subsystem=elytron/secret-key-credential-store=examplePropertiesCredentialStore:add(path=examplePropertiesCredentialStore.cs, relative-to=jboss.server.config.dir)
  {"outcome" => "success"}

先决条件

• 您已创建了一个 credential-store。

  有关创建 credential-store 的详情，请参考 为独立服务器创建一个 credential-store 。

流程

• 将新的 PasswordCredential 添加到 credential-store 中：

  语法

  /subsystem=elytron/credential-store=<name_of_credential_store>:add-alias(alias=<alias>, secret-value=<secret-value>)

  示例

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:add-alias(alias=passwordCredentialAlias, secret-value=StrongPassword)
  {"outcome" => "success"}

验证

• 发出以下命令来验证 PasswordCredential 是否已添加到 credential-store 中：

  语法

  /subsystem=elytron/credential-store=<name_of_credential_store>:read-aliases()

  示例

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:read-aliases()
  {
      "outcome" => "success",
      "result" => ["passwordcredentialalias"]
  }

先决条件

• 您已创建了一个 credential-store。

  有关创建 credential-store 的详情，请参考 为独立服务器创建一个 credential-store 。

流程

• 使用以下管理 CLI 命令，在 credential-store 中生成一个 SecretKeyCredential：

  语法

  /subsystem=elytron/credential-store=<name_of_credential_store>:generate-secret-key(alias=<alias>, key-size=<128_or_192>)

  示例

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:generate-secret-key(alias=secretKeyCredentialAlias)

验证

• 发出以下命令以验证您的 SecretKeyCredential 是否存储在 credential-store 中：

  语法

  /subsystem=elytron/credential-store=<name_of_credential_store>:read-aliases()

  示例

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:read-aliases()
  {
      "outcome" => "success",
      "result" => [
          "secretkeycredentialalias"
      ]
  }

先决条件

• 您已创建了一个 secret-key-credential-store。

  有关创建 secret-key-credential-store 的详情，请参考 为独立服务器创建一个 secret-key-credential-store 。

流程

• 使用以下管理 CLI 命令在 secret-key-credential-store 中生成一个 SecretKeyCredential：

  语法

  /subsystem=elytron/secret-key-credential-store=<name_of_the_properties_credential_store>:generate-secret-key(alias=<alias>, key-size=<128_or_192>)

  示例

  /subsystem=elytron/secret-key-credential-store=examplePropertiesCredentialStore:generate-secret-key(alias=secretKeyCredentialAlias)
  {"outcome" => "success"}

验证

• 发出以下命令以验证 Elytron 创建了 SecretKeyCredential:

  语法

  /subsystem=elytron/secret-key-credential-store=<name_of_the_properties_credential_store>:read-aliases()

  示例

  /subsystem=elytron/secret-key-credential-store=examplePropertiesCredentialStore:read-aliases()
  {
      "outcome" => "success",
      "result" => [
          "secretkeycredentialalias",
          "key"
      ]
  }

先决条件

• 您已创建了一个 secret-key-credential-store。

  有关创建 secret-key-credential-store 的详情，请参考 为独立服务器创建一个 secret-key-credential-store 。

• 您已导出了一个 SecretKeyCredential。

  有关导出 SecretKeyCredential 的详情，请参考从 secret-key-credential-store中导出 SecretKeyCredential。

流程

• 使用以下管理 CLI 命令列出存储在 credential-store 中的凭证：

  语法

  /subsystem=elytron/credential-store=<name_of_credential_store>:read-aliases()

  示例

  {
      "outcome" => "success",
      "result" => [
          "passwordcredentialalias",
          "secretkeycredentialalias"
      ]
  }

先决条件

• 您已在 credentials-store 中生成了一个 SecretKeyCredential。

  有关在 credential-store 中生成 SecretKeyCredential 的信息，请参阅在 credential-store中生成 SecretKeyCredential。

流程

• 使用以下管理 CLI 命令，从 credential-store 中导出 SecretKeyCredential：

  语法

  /subsystem=elytron/credential-store=<name_of_credential_store>:export-secret-key(alias=<alias>)

  示例

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:export-secret-key(alias=secretKeyCredentialAlias)
  {
      "outcome" => "success",
      "result" => {"key" => "RUxZAUui+8JkoDCE6mFyA3cCIbSAZaXq5wgYejj1scYgdDqWiw=="}
  }

先决条件

• 您已在 secret-key-credential-store 中生成了一个 SecretKeyCredential，或者已将其导入到其中。

  有关在 secret-key-credential-store 中生成一个 SecretKeyCredential 的信息，请在 secret-key-credential-store中生成一个 Secret KeyCredential。

  有关将 SecretKeyCredential 导入到 secret-key-credential-store 中的信息，请参阅将 SecretKeyCredential 导入到 secret-key-credential-store 中。

流程

• 使用以下管理 CLI 命令从 secret-key-credential-store 中导出一个 SecretKeyCredential：

  语法

  /subsystem=elytron/secret-key-credential-store=<name_of_credential_store>:export-secret-key(alias=<alias>)

  示例

  /subsystem=elytron/secret-key-credential-store=examplePropertiesCredentialStore:export-secret-key(alias=secretkeycredentialalias)
  {
      "outcome" => "success",
      "result" => {"key" => "RUxZAUtxXcYvz0aukZu+odOynIr0ByLhC72iwzlJsi+ZPmONgA=="}
  }

流程

• 使用以下管理 CLI 命令，从 credential-store 中删除一个凭证：

  语法

  /subsystem=elytron/credential-store=<name_of_credential_store>:remove-alias(alias=<alias>, entry-type=<credential_type>)

  删除 PasswordCredential 的示例

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:remove-alias(alias=passwordCredentialAlias)
  {
      "outcome" => "success",
      "response-headers" => {"warnings" => [{
          "warning" => "Update dependent resources as alias 'passwordCredentialAlias' does not exist anymore",
          "level" => "WARNING",
          "operation" => {
              "address" => [
                  ("subsystem" => "elytron"),
                  ("credential-store" => "exampleKeyStoreCredentialStore")
              ],
              "operation" => "remove-alias"
          }
      }]}
  }

  删除 SecretKeyCredential 的示例

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:remove-alias(alias=secretKeyCredentialAlias, entry-type=SecretKeyCredential)
  {
      "outcome" => "success",
      "response-headers" => {"warnings" => [{
          "warning" => "Update dependent resources as alias 'secretKeyCredentialAl
  ias' does not exist anymore",
          "level" => "WARNING",
          "operation" => {
              "address" => [
                  ("subsystem" => "elytron"),
                  ("credential-store" => "exampleKeyStoreCredentialStore")
              ],
              "operation" => "remove-alias"
          }
      }]}
  }

验证

• 发出以下命令来验证 Elytron 是否删除了凭证：

  语法

  /subsystem=elytron/credential-store=<name_of_credential_store>:read-aliases()

  示例

  /subsystem=elytron/credential-store=exampleKeyStoreCredentialStore:read-aliases()
  {
      "outcome" => "success",
      "result" => []
  }

  您删除的凭证不会被列出。

流程

• 使用以下命令，从 secret-key-credential-store 中删除一个 SecretKeyCredential：

  语法

  /subsystem=elytron/secret-key-credential-store=<name_of_credential_store>:remove-alias(alias=<alias>)

  示例

  /subsystem=elytron/secret-key-credential-store=examplePropertiesCredentialStore:remove-alias(alias=secretKeyCredentialAlias)
  {
      "outcome" => "success",
      "response-headers" => {"warnings" => [{
          "warning" => "Update dependent resources as alias 'secretKeyCredentialAlias' does not exist anymore",
          "level" => "WARNING",
          "operation" => {
              "address" => [
                  ("subsystem" => "elytron"),
                  ("secret-key-credential-store" => "examplePropertiesCredentialSt
  ore")
              ],
              "operation" => "remove-alias"
          }
      }]}
  }

验证

• 发出以下命令来验证 Elytron 是否删除了凭证：

  语法

  /subsystem=elytron/secret-key-credential-store=<name_of_credential_store>:read-aliases()

  示例

  /subsystem=elytron/secret-key-credential-store=examplePropertiesCredentialStore:read-aliases()
  {
      "outcome" => "success",
      "result" => []
  }

  您删除的凭证不会被列出。