Uploaded image for project: 'WildFly Elytron'
  1. WildFly Elytron
  2. ELY-1332

NSS tools based PKCS11 provider defined in Elytron doesn't survive server reload

    XMLWordPrintable

Details

    • Bug
    • Resolution: Unresolved
    • Major
    • None
    • None
    • None
    • None
    • Hide 
      mkdir /tmp/nssdb
echo "pass123+" > /tmp/newpass.txt
echo "dsadasdasdasdadasdasdasdasdsadfwerwerjfdksdjfksdlfhjsdk" > /tmp/noise.txt
MODUTIL_CMD="modutil -force -dbdir /tmp/nssdb"
$MODUTIL_CMD -create
$MODUTIL_CMD -fips true
$MODUTIL_CMD -changepw "NSS FIPS 140-2 Certificate DB" -newpwfile /tmp/newpass.txt
certutil -S -v 240 -k rsa -n "CN=localhost"  -t "u,u,u" -x -s "CN=localhost" -d /tmp/nssdb -f /tmp/newpass.txt -z /tmp/noise.txt

$JBOSS_HOME/bin/standalone.sh &
# wait until started
sleep 10

$JBOSS_HOME/bin/jboss-cli.sh -c << EOT
/subsystem=elytron/provider-loader=nss:add(class-names=["sun.security.pkcs11.SunPKCS11"], configuration={name=testPkcs11, nssLibraryDirectory=/usr/lib64, nssSecmodDirectory=/tmp/nssdb, nssModule=fips, name=testPkcs11})

reload
EOT
      Show
      mkdir /tmp/nssdb echo "pass123+" > /tmp/newpass.txt echo "dsadasdasdasdadasdasdasdasdsadfwerwerjfdksdjfksdlfhjsdk" > /tmp/noise.txt MODUTIL_CMD= "modutil -force -dbdir /tmp/nssdb" $MODUTIL_CMD -create $MODUTIL_CMD -fips true $MODUTIL_CMD -changepw "NSS FIPS 140-2 Certificate DB" -newpwfile /tmp/newpass.txt certutil -S -v 240 -k rsa -n "CN=localhost" -t "u,u,u" -x -s "CN=localhost" -d /tmp/nssdb -f /tmp/newpass.txt -z /tmp/noise.txt $JBOSS_HOME/bin/standalone.sh & # wait until started sleep 10 $JBOSS_HOME/bin/jboss-cli.sh -c << EOT /subsystem=elytron/provider-loader=nss:add(class-names=[ "sun.security.pkcs11.SunPKCS11" ], configuration={name=testPkcs11, nssLibraryDirectory=/usr/lib64, nssSecmodDirectory=/tmp/nssdb, nssModule=fips, name=testPkcs11}) reload EOT

    Description

      When a SunPKCS11 provider is defined in Elytron subsystem on the top of NSS keystore (e.g. a FIPS one), then the server reload fails with "ProviderException: Secmod module already configured".

      The server.log contains:

      08:12:56,073 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-3) MSC000001: Failed to start service org.wildfly.security.providers.nss: org.jboss.msc.service.StartException in service org.wildfly.security.providers.nss: java.lang.reflect.InvocationTargetException
	at org.wildfly.extension.elytron.ProviderDefinitions$1$1.get(ProviderDefinitions.java:224)
	at org.wildfly.extension.elytron.ProviderDefinitions$1$1.get(ProviderDefinitions.java:160)
	at org.wildfly.extension.elytron.TrivialService.start(TrivialService.java:53)
	at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:2032)
	at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1955)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
	at java.lang.Thread.run(Thread.java:748)
Caused by: java.lang.reflect.InvocationTargetException
	at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
	at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
	at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
	at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
	at org.wildfly.extension.elytron.ProviderDefinitions$1$1.get(ProviderDefinitions.java:190)
	... 7 more
Caused by: java.security.ProviderException: Secmod module already configured
	at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:276)
	at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:107)
	... 12 more
..
08:12:56,140 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address: ([
    ("subsystem" => "elytron"),
    ("provider-loader" => "nss")
]) - failure description: {"WFLYCTL0080: Failed services" => {"org.wildfly.security.providers.nss" => "java.lang.reflect.InvocationTargetException
    Caused by: java.lang.reflect.InvocationTargetException
    Caused by: java.security.ProviderException: Secmod module already configured"}}

      Attachments

        Issue Links

          clones

          Bug - A problem that impairs or prevents the functions of the product. JBEAP-12700 NSS tools based PKCS11 provider defined in Elytron doesn't survive server reload

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Resolved

          Activity

            People

              Unassigned Unassigned
              josef.cacek@gmail.com Josef Cacek (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated: