[
https://issues.apache.org/jira/browse/KNOX-3401?focusedWorklogId=1039931&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1039931
]
ASF GitHub Bot logged work on KNOX-3401:
----------------------------------------
Author: ASF GitHub Bot
Created on: 07/Sep/26 10:31
Start Date: 07/Sep/26 10:31
Worklog Time Spent: 10m
Work Description: smolnar82 commented on code in PR #1380:
URL: https://github.com/apache/knox/pull/1380#discussion_r3948836053
##########
gateway-server/src/main/java/org/apache/knox/gateway/database/H2DataSourceFactory.java:
##########
@@ -0,0 +1,69 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.database;
+
+import org.apache.knox.gateway.config.GatewayConfig;
+import org.apache.knox.gateway.services.security.AliasService;
+import org.apache.knox.gateway.services.security.AliasServiceException;
+import org.h2.jdbcx.JdbcDataSource;
+
+import javax.sql.DataSource;
+import java.sql.SQLException;
+
+/**
+ * Builds a {@link DataSource} for the H2 database. In the self-provisioning
embedded case the
+ * connection URL points at a local file base ({@code
jdbc:h2:${securityDir}/h2db/knoxdb}) that
+ * {@link EmbeddedH2Database} has configured via {@code
gateway.database.name}; H2 creates the file
+ * on first connection, so no server or explicit database-creation step is
required. Within a single
+ * JVM all Knox services connecting to the same URL share one embedded
database instance.
+ * <p>
+ * When {@link GatewayConfig#isDatabaseH2EncryptionEnabled()} is {@code true},
at-rest encryption is
+ * enabled by appending {@code ;CIPHER=AES} to the URL and supplying the
connection password as
+ * {@code "<filePassword> <userPassword>"} (H2 splits the password on the
first space into the file
+ * password and the user password). The file password is the
operator-provisioned passphrase resolved
+ * from the credential-store alias named by {@link
GatewayConfig#getDatabaseH2EncryptionPassphraseAlias()};
+ * initialization fails fast if that alias is unset (no silent unencrypted
fallback).
+ */
+public class H2DataSourceFactory extends AbstractDataSourceFactory {
+
+ @Override
+ public DataSource createDataSource(GatewayConfig gatewayConfig,
AliasService aliasService) throws AliasServiceException, SQLException {
+ final JdbcDataSource dataSource = new JdbcDataSource();
+ String url = "jdbc:h2:" + gatewayConfig.getDatabaseName();
+ final String userPassword = getDatabasePassword(aliasService);
+
+ if (gatewayConfig.isDatabaseH2EncryptionEnabled()) {
+ final String aliasName =
gatewayConfig.getDatabaseH2EncryptionPassphraseAlias();
+ final String filePassword = getDatabaseAlias(aliasService,
aliasName);
+ if (filePassword == null || filePassword.isEmpty()) {
+ throw new SQLException("H2 at-rest encryption is enabled (" +
aliasName + ") but no passphrase is stored under credential-store alias '"
+ + aliasName + "'. Provision the alias or disable
gateway.database.h2.encryption.enabled.");
+ }
+ url += ";CIPHER=AES";
Review Comment:
Fixed.
##########
gateway-server/src/main/java/org/apache/knox/gateway/database/H2DataSourceFactory.java:
##########
@@ -0,0 +1,69 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.database;
+
+import org.apache.knox.gateway.config.GatewayConfig;
+import org.apache.knox.gateway.services.security.AliasService;
+import org.apache.knox.gateway.services.security.AliasServiceException;
+import org.h2.jdbcx.JdbcDataSource;
+
+import javax.sql.DataSource;
+import java.sql.SQLException;
+
+/**
+ * Builds a {@link DataSource} for the H2 database. In the self-provisioning
embedded case the
+ * connection URL points at a local file base ({@code
jdbc:h2:${securityDir}/h2db/knoxdb}) that
+ * {@link EmbeddedH2Database} has configured via {@code
gateway.database.name}; H2 creates the file
+ * on first connection, so no server or explicit database-creation step is
required. Within a single
+ * JVM all Knox services connecting to the same URL share one embedded
database instance.
+ * <p>
+ * When {@link GatewayConfig#isDatabaseH2EncryptionEnabled()} is {@code true},
at-rest encryption is
+ * enabled by appending {@code ;CIPHER=AES} to the URL and supplying the
connection password as
+ * {@code "<filePassword> <userPassword>"} (H2 splits the password on the
first space into the file
+ * password and the user password). The file password is the
operator-provisioned passphrase resolved
+ * from the credential-store alias named by {@link
GatewayConfig#getDatabaseH2EncryptionPassphraseAlias()};
+ * initialization fails fast if that alias is unset (no silent unencrypted
fallback).
+ */
+public class H2DataSourceFactory extends AbstractDataSourceFactory {
+
+ @Override
+ public DataSource createDataSource(GatewayConfig gatewayConfig,
AliasService aliasService) throws AliasServiceException, SQLException {
+ final JdbcDataSource dataSource = new JdbcDataSource();
+ String url = "jdbc:h2:" + gatewayConfig.getDatabaseName();
+ final String userPassword = getDatabasePassword(aliasService);
+
+ if (gatewayConfig.isDatabaseH2EncryptionEnabled()) {
+ final String aliasName =
gatewayConfig.getDatabaseH2EncryptionPassphraseAlias();
+ final String filePassword = getDatabaseAlias(aliasService,
aliasName);
+ if (filePassword == null || filePassword.isEmpty()) {
+ throw new SQLException("H2 at-rest encryption is enabled (" +
aliasName + ") but no passphrase is stored under credential-store alias '"
+ + aliasName + "'. Provision the alias or disable
gateway.database.h2.encryption.enabled.");
+ }
+ url += ";CIPHER=AES";
+ dataSource.setUser(getDatabaseUser(aliasService));
Review Comment:
Fixed.
Issue Time Tracking
-------------------
Worklog Id: (was: 1039931)
Time Spent: 1h (was: 50m)
> Switch OOTB JDBC-based token state service from Derby to something else
> -----------------------------------------------------------------------
>
> Key: KNOX-3401
> URL: https://issues.apache.org/jira/browse/KNOX-3401
> Project: Apache Knox
> Issue Type: Bug
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandeep More
> Priority: Major
> Attachments: image-2026-07-30-07-34-16-369.png, screenshot-1.png
>
> Time Spent: 1h
> Remaining Estimate: 0h
>
> The community agreed to switch from alias-based TSS to JDBC-based TSS as the
> default implementation due to several reasons, details are found in [this
> e-mail
> thread|https://lists.apache.org/thread/fs9nkl6l45o330ttvgvqxj3jnxt63bcs].
> At that time (late 2023), Derby DB seemed a good choice given its wide range
> of configs and community support. However, the project os now retired, this
> is what's listed on their Apache page:
> h2. Derby Retired
> *On 2025-10-10, the Derby developers voted to retire the project into a
> read-only state. Derby development and bug-fixing have ended. No further
> releases will be published. The Derby website and wiki are frozen in place.
> Derby JIRA issues are now read-only and new bugs cannot be logged. The user
> and developer lists are disabled and can be accessed only through their
> archives.*
>
> Therefore, we need to find another DB vendor that satisfies our needs and can
> be used as Knox's default token state backend.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
