Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix a typo in the BC CredentialsProvider test #29561

Merged

Conversation

sberyozkin
Copy link
Member

@rsvoboda Spotted a typo in the test - the reason it works without a typo is because currently the default keystore password is password which matches the server-keystore.jks password.
I've confirmed that changing either keystore-password or truststore-password keys in SecretProvider fails the tests.
For whatever reasons, if I try to change the server-keystore.jks password (just to ensure that no default keystore value is picked up), it messes up the server-keystore.jks and Vertx can't read it, with or without CredentialsProvider.
Rostislav, if you'd like, please confirm independently that changing the passwords in SecretProvider causes a failure

@sberyozkin sberyozkin force-pushed the fix_vertx_http_cred_provider_test branch from dca6019 to 81fdcd1 Compare November 29, 2022 17:37
@sberyozkin
Copy link
Member Author

@rsvoboda I copied the existing keystore from one of the vertx-http tests where the secret is secret so it makes sure the default password is not used and therefore SecretProvider is effective

@rsvoboda
Copy link
Member

Good, just was about to ask why not generate new keystore and truststore with different password.

@rsvoboda
Copy link
Member

rsvoboda commented Nov 29, 2022

the default keystore password is password

@sberyozkin, why do we have the default password at all?

@rsvoboda
Copy link
Member

I was able to set new password for existing server-keystore.jks this way:

keytool -list -v -keystore server-keystore.jks -storepass password

keytool -storepasswd -new my-new-password -keystore server-keystore.jks -storepass password
keytool -keypasswd -alias server -keypass password -new my-new-password -keystore server-keystore.jks -storepass my-new-password

Changes to the code:

diff --git a/integration-tests/bouncycastle-jsse/src/main/java/io/quarkus/it/bouncycastle/SecretProvider.java b/integration-tests/bouncycastle-jsse/src/main/java/io/quarkus/it/bouncycastle/SecretProvider.java
index 9eed67c402..ddd70260fe 100644
--- a/integration-tests/bouncycastle-jsse/src/main/java/io/quarkus/it/bouncycastle/SecretProvider.java
+++ b/integration-tests/bouncycastle-jsse/src/main/java/io/quarkus/it/bouncycastle/SecretProvider.java
@@ -15,7 +15,7 @@ public class SecretProvider implements CredentialsProvider {
     @Override
     public Map<String, String> getCredentials(String credentialsProviderName) {
         Map<String, String> creds = new HashMap<>();
-        creds.put("keystore-password", "password");
+        creds.put("keystore-password", "my-new-password");
         creds.put("truststore-password", "password");
         return creds;
     }
diff --git a/integration-tests/bouncycastle-jsse/src/main/resources/application.properties b/integration-tests/bouncycastle-jsse/src/main/resources/application.properties
index 40f0793cd8..3a28e5d458 100644
--- a/integration-tests/bouncycastle-jsse/src/main/resources/application.properties
+++ b/integration-tests/bouncycastle-jsse/src/main/resources/application.properties
@@ -1,7 +1,7 @@
 quarkus.security.security-providers=BCJSSE

 quarkus.http.ssl.certificate.key-store-file=server-keystore.jks
-quarkus.http.ssl.certificate.key-store-password-key=key-store-password
+quarkus.http.ssl.certificate.key-store-password-key=keystore-password
 quarkus.http.ssl.certificate.trust-store-file=server-truststore.jks
 quarkus.http.ssl.certificate.trust-store-password-key=truststore-password
 quarkus.http.ssl.certificate.credentials-provider=custom

@rsvoboda rsvoboda merged commit 581507d into quarkusio:main Nov 30, 2022
@quarkus-bot quarkus-bot bot added this to the 2.16 - main milestone Nov 30, 2022
@sberyozkin sberyozkin deleted the fix_vertx_http_cred_provider_test branch November 30, 2022 11:25
@sberyozkin
Copy link
Member Author

@rsvoboda Thanks, yeah I think I did it the same way except that I let the tool ask for the current password. I could then confirm with keytool the new password was in place, but Vert.x would just fail. Strange, may be I missed something

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants