This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 55f2405e20 Fixed: AdminServer no longer starts without a configured
admin key
55f2405e20 is described below
commit 55f2405e20b9bf7ced317b3ab0fe80e4bf4b59eb
Author: Mridul Pathak <[email protected]>
AuthorDate: Mon Sep 21 18:29:11 2026 +0530
Fixed: AdminServer no longer starts without a configured admin key
The AdminServer socket container previously used a fixed default value for
ofbiz.admin.key shipped in start.properties. It now stays disabled (the
existing no-op path already used when the port is unset) until an operator
configures a real key. The generateSecretKeys Gradle task now also provisions a
random ofbiz.admin.key alongside the existing JWT and password secret keys, so
./gradlew loadAll and the Docker image build continue to get a working, unique
key with no extra steps.
---
build.gradle | 15 ++++++-----
.../ofbiz/base/container/AdminServerContainer.java | 29 +++++++++++++++-------
.../org/apache/ofbiz/base/start/start.properties | 4 ++-
3 files changed, 32 insertions(+), 16 deletions(-)
diff --git a/build.gradle b/build.gradle
index ba847603e9..95f7a522da 100644
--- a/build.gradle
+++ b/build.gradle
@@ -1166,11 +1166,10 @@ task reEncryptAllSecrets(group: sysadminGroup,
}
task generateSecretKeys(group: sysadminGroup,
- description: 'Generate cryptographically secure 512-bit (64-char)
secret keys for JWT token signing and password encryption, and write them to
security.properties') {
+ description: 'Generate cryptographically secure secret keys for JWT
token signing, password encryption, '
+ + 'and AdminServer authentication, and write them to their
properties files') {
doLast {
- def propertiesFile =
file('framework/security/config/security.properties')
-
- def generateAndWriteKey = { String propertyName ->
+ def generateAndWriteKey = { File propertiesFile, String propertyName ->
def content = propertiesFile.text
def escapedName = propertyName.replace('.', '\\.')
// Only generate a key if the property is missing or commented out
@@ -1189,8 +1188,12 @@ task generateSecretKeys(group: sysadminGroup,
propertiesFile.text = content
}
- generateAndWriteKey('login.secret_key_string')
- generateAndWriteKey('security.token.key')
+ def securityPropertiesFile =
file('framework/security/config/security.properties')
+ generateAndWriteKey(securityPropertiesFile, 'login.secret_key_string')
+ generateAndWriteKey(securityPropertiesFile, 'security.token.key')
+
+ def startPropertiesFile =
file('framework/start/src/main/resources/org/apache/ofbiz/base/start/start.properties')
+ generateAndWriteKey(startPropertiesFile, 'ofbiz.admin.key')
println "Secret key generation complete. Keep any new keys secret and
do not commit them to version control."
}
diff --git
a/framework/base/src/main/java/org/apache/ofbiz/base/container/AdminServerContainer.java
b/framework/base/src/main/java/org/apache/ofbiz/base/container/AdminServerContainer.java
index 3e1bf0c24d..f775a9bfed 100644
---
a/framework/base/src/main/java/org/apache/ofbiz/base/container/AdminServerContainer.java
+++
b/framework/base/src/main/java/org/apache/ofbiz/base/container/AdminServerContainer.java
@@ -55,22 +55,33 @@ public final class AdminServerContainer implements
Container {
@Override
public void init(List<StartupCommand> ofbizCommands, String name, String
configFile) throws ContainerException {
this.name = name;
- try {
- serverSocket = new ServerSocket(cfg.getAdminPort(), 1,
cfg.getAdminAddress());
- } catch (IOException e) {
- String msg = "Couldn't create server socket(" +
cfg.getAdminAddress() + ":" + cfg.getAdminPort() + ")";
- throw new ContainerException(msg, e);
- }
-
- if (cfg.getAdminPort() > 0) {
+ if (cfg.getAdminPort() > 0 && isAdminKeyConfigured()) {
+ try {
+ serverSocket = new ServerSocket(cfg.getAdminPort(), 1,
cfg.getAdminAddress());
+ } catch (IOException e) {
+ String msg = "Couldn't create server socket(" +
cfg.getAdminAddress() + ":" + cfg.getAdminPort() + ")";
+ throw new ContainerException(msg, e);
+ }
serverThread = new Thread(this::run, "OFBiz-AdminServer");
} else {
serverThread = new Thread("OFBiz-AdminServer"); // Dummy thread
- System.out.println("Admin socket not configured; set to port 0");
+ if (cfg.getAdminPort() > 0) {
+ System.out.println("Admin socket disabled; ofbiz.admin.key is
not configured. Run "
+ + "'./gradlew generateSecretKeys' or set
ofbiz.admin.key to a unique secret to enable it.");
+ } else {
+ System.out.println("Admin socket not configured; set to port
0");
+ }
}
serverThread.setDaemon(false);
}
+ // The AdminServer must never come up authenticated by a value shipped in
public source code:
+ // treat a missing/blank key, or the Config default sentinel, as "not
configured".
+ private boolean isAdminKeyConfigured() {
+ String adminKey = cfg.getAdminKey();
+ return UtilValidate.isNotEmpty(adminKey) && !"NA".equals(adminKey);
+ }
+
// Listens for administration commands.
private void run() {
System.out.println("Admin socket configured on - " +
cfg.getAdminAddress() + ":" + cfg.getAdminPort());
diff --git
a/framework/start/src/main/resources/org/apache/ofbiz/base/start/start.properties
b/framework/start/src/main/resources/org/apache/ofbiz/base/start/start.properties
index 7cc6194809..47ba3c06ee 100644
---
a/framework/start/src/main/resources/org/apache/ofbiz/base/start/start.properties
+++
b/framework/start/src/main/resources/org/apache/ofbiz/base/start/start.properties
@@ -39,9 +39,11 @@ ofbiz.start.loaders=main
# Default ofbiz.admin.host 127.0.0.1
# Default ofbiz.admin.port 0
# Default ofbiz.admin.key NA
+# The admin socket stays disabled until ofbiz.admin.key is set to a unique
secret.
+# Run './gradlew generateSecretKeys' to generate one, or set it manually.
#ofbiz.admin.host=
ofbiz.admin.port=10523
-ofbiz.admin.key=so3du5kasd5dn
+ofbiz.admin.key=
# -- Enable the JVM shutdown hook. Default is true
#ofbiz.enable.hook=false
