Description:
When using custom key stores (not with the default wso2carbon.jks file name) for the secret encryption process (using -Dconfigure option), the Cipher tool overrides the key store configurations set in the <PRODUCT_HOME>/repository/conf/security/secret-conf.properties file using the configurations set in the <PRODUCT_HOME>/repository/conf/carbon.xml at the given time.
Thus, any custom key store location path set in the <PRODUCT_HOME>/repository/conf/security/secret-conf.properties in a fresh pack which has not been used before fails, as the initial application of customized key store configurations set in the <PRODUCT_HOME>/repository/conf/deployment.toml to the <PRODUCT_HOME>/repository/conf/carbon.xml happens during the initial execution of the server startup script for the product.
Current workaround:
- Set the custom key store configurations in the product's main configuration file
<PRODUCT_HOME>/repository/conf/deployment.toml
- Add the custom key stores to the
<PRODUCT_HOME>/repository/resources/security directory
- Execute the product server startup script
- Set the secrets in the
<PRODUCT_HOME>/repository/conf/deployment.toml file
- Encrypt the secrets using the Cipher tool
Used Product and Version:
WSO2 Identity Server version 5.11.0 Release Candidate 1
Description:
When using custom key stores (not with the default
wso2carbon.jksfile name) for the secret encryption process (using-Dconfigureoption), the Cipher tool overrides the key store configurations set in the<PRODUCT_HOME>/repository/conf/security/secret-conf.propertiesfile using the configurations set in the<PRODUCT_HOME>/repository/conf/carbon.xmlat the given time.Thus, any custom key store location path set in the
<PRODUCT_HOME>/repository/conf/security/secret-conf.propertiesin a fresh pack which has not been used before fails, as the initial application of customized key store configurations set in the<PRODUCT_HOME>/repository/conf/deployment.tomlto the<PRODUCT_HOME>/repository/conf/carbon.xmlhappens during the initial execution of the server startup script for the product.Current workaround:
<PRODUCT_HOME>/repository/conf/deployment.toml<PRODUCT_HOME>/repository/resources/securitydirectory<PRODUCT_HOME>/repository/conf/deployment.tomlfileUsed Product and Version:
WSO2 Identity Server version
5.11.0Release Candidate 1