[
https://issues.apache.org/jira/browse/ARTEMIS-5347?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Justin Bertram updated ARTEMIS-5347:
------------------------------------
Description:
{{bootstrap.xml}} supports TLS connections. For this option you should set
{{keyStorePath}} and {{keyStorePassword}}, e.g.:
{code:xml}
//Bootstrap.xml
<binding uri="https://0.0.0.0:8161";
keyStorePath="keystore.jks"
keyStorePassword="ENC("@#$%UIO")"
passwordCodec="org.apache.activemq.artemis.utils.DefaultSensitiveStringCodec">{code}
In this config you must set the encrypted password directly and placeholders
are not supported. Below code for reading password:
{code:java}
//BindingDTO
private String getPassword(String password) throws Exception {
return PasswordMaskingUtil.resolveMask(password, this.passwordCodec);
}
//PasswordMaskingUtil
public static String resolveMask(String password, String codecClass) throws
Exception {
return resolveMask(null, password, codecClass);
}
public static String resolveMask(Boolean maskPassword, String password, String
codecClass) throws Exception {
String plainText = password;
if (maskPassword == null) {
if (isEncMasked(password)) {
//masked
String bareMaskedPassword = unwrap(password);
plainText = getCodec(codecClass).decode(bareMaskedPassword);
}
} else if (maskPassword) {
plainText = getCodec(codecClass).decode(password);
}
return plainText;
}{code}
There is no way to get values from properties/envs, like it is done in
{{broker.xml}}.
In a cloud environment where credentials are passed by the pod environment this
is a problem. It's annoying that only this config does not support values from
env and requires additional actions to make it work.
Can you support this? I see two way for this:
# Add new sensitiveDataCode that will get vaule from env
# Read this config by XMLUtil as others, this reader support both props and
envs plaseholders
was:
Bootstrap.xml supports tls connections, for this option you should set keystore
path and keystore password, like:
{code:java}
//Bootstrap.xml
<binding uri="https://0.0.0.0:8161";
keyStorePath="keystore.jks"
keyStorePassword="ENC("@#$%UIO")"
passwordCodec="org.apache.activemq.artemis.utils.DefaultSensitiveStringCodec"
> {code}
In this config you must set the encrypted password directly and placeholders
are not supported. Below code for reading password:
{code:java}
//BindingDTO
private String getPassword(String password) throws Exception {
return PasswordMaskingUtil.resolveMask(password, this.passwordCodec);
}
//PasswordMaskingUtil
public static String resolveMask(String password, String codecClass) throws
Exception {
return resolveMask(null, password, codecClass);
}
public static String resolveMask(Boolean maskPassword, String password, String
codecClass) throws Exception {
String plainText = password;
if (maskPassword == null) {
if (isEncMasked(password)) {
//masked
String bareMaskedPassword = unwrap(password);
plainText = getCodec(codecClass).decode(bareMaskedPassword);
}
} else if (maskPassword) {
plainText = getCodec(codecClass).decode(password);
}
return plainText;
}{code}
There is no way to get values from properties/envs, like it is done in
broker.xml.
In a cloud environment where credentials are passed by the pod environment this
is a problem. It's annoying that only this config does not support values from
env and requires additional actions to make it work.
So can you realse this support? I see two way for this:
# Add new sensitiveDataCode that will get vaule from env
# Read this config by XMLUtil as others, this reader support both props and
envs plaseholders
> Add support env variable in bootstrap.xml config
> -------------------------------------------------
>
> Key: ARTEMIS-5347
> URL: https://issues.apache.org/jira/browse/ARTEMIS-5347
> Project: ActiveMQ Artemis
> Issue Type: New Feature
> Components: Configuration
> Affects Versions: 2.38.0
> Reporter: Valeriy Ak
> Priority: Major
> Labels: bootstrap
>
> {{bootstrap.xml}} supports TLS connections. For this option you should set
> {{keyStorePath}} and {{keyStorePassword}}, e.g.:
> {code:xml}
> //Bootstrap.xml
> <binding uri="https://0.0.0.0:8161";
> keyStorePath="keystore.jks"
> keyStorePassword="ENC("@#$%UIO")"
>
> passwordCodec="org.apache.activemq.artemis.utils.DefaultSensitiveStringCodec">{code}
> In this config you must set the encrypted password directly and placeholders
> are not supported. Below code for reading password:
> {code:java}
> //BindingDTO
> private String getPassword(String password) throws Exception {
> return PasswordMaskingUtil.resolveMask(password, this.passwordCodec);
> }
> //PasswordMaskingUtil
> public static String resolveMask(String password, String codecClass) throws
> Exception {
> return resolveMask(null, password, codecClass);
> }
> public static String resolveMask(Boolean maskPassword, String password,
> String codecClass) throws Exception {
> String plainText = password;
> if (maskPassword == null) {
> if (isEncMasked(password)) {
> //masked
> String bareMaskedPassword = unwrap(password);
> plainText = getCodec(codecClass).decode(bareMaskedPassword);
> }
> } else if (maskPassword) {
> plainText = getCodec(codecClass).decode(password);
> }
> return plainText;
> }{code}
> There is no way to get values from properties/envs, like it is done in
> {{broker.xml}}.
> In a cloud environment where credentials are passed by the pod environment
> this is a problem. It's annoying that only this config does not support
> values from env and requires additional actions to make it work.
> Can you support this? I see two way for this:
> # Add new sensitiveDataCode that will get vaule from env
> # Read this config by XMLUtil as others, this reader support both props and
> envs plaseholders
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
For further information, visit: https://activemq.apache.org/contact
