Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ELY-2704] Missing keystore password does not throw a meaningful exception #2175

Merged
merged 1 commit into from
Sep 19, 2024

Conversation

lvydra
Copy link
Contributor

@lvydra lvydra commented Aug 13, 2024

@ivassile ivassile added the +1 IV label Aug 22, 2024
@darranl
Copy link
Contributor

darranl commented Aug 22, 2024

I have mixed throughts on this one - I have also been caught with this cryptic error message when using a PKCS12 KeyStore for trust information.

Some keystore types in this situation can be used without a password just fine (PKCS12 not being one of them). The problem is the loading of the PKCS12 KeyStore quietly succeeded I think it just ends up being empty.

On one hand the WARN feels safe to me as it just informs the user of something and may still work.

But some users have a policy of requiring 0 WARN messages output, I wonder if this will risk catching some of those.

@@ -129,6 +129,10 @@ ConfigXMLParseException xmlDuplicateAuthenticationConfigurationName(String name,
ConfigXMLParseException xmlInvalidKeyStoreEntryType(@Param Location location, String alias, Class<?> expectedClass,
Class<?> actualClass);

@LogMessage(level = WARN)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In our Elytron team call yesterday, we discussed that it might be better to use INFO here instead of WARN.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @fjuma, updated.

@darranl darranl added the +1 DAL label Sep 19, 2024
@fjuma fjuma merged commit 3217ffb into wildfly-security:2.x Sep 19, 2024
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants