Basics of Credential Store in WildFly (11.0.0.Beta1 Nightly)

Introduction

Credential store came to life as follower of PicketBox Security Vault with some extended capabilities and better integration to the new WildFly security framework (WildFly Elytron).
More about Elytron could be found here.
The best way to test credential store functionality is to grab latest nightly build of WildFly 11 and take for a ride.

How to create credential store

One can manipulate credential store using CLI provided by WildFly or use Elytron Tool (part of WildFly) to manipulate credential store "offline" and then use it in your WildFly instance.

Create credential store in CLI

Start WildFly standalone server using ./bin/standalone.sh. Open command line interface using

./bin/jboss-cli.sh --connect

There should already be installed Elytron Subsystem which can be easily check using CLI command

ls /subsystem=elytron

Creating credential store is as easy as running this CLI command:

 /subsystem=elytron/credential-store=test:add(location=test.storage, relative-to=jboss.server.data.dir, credential-reference={clear-text="secret2"}, create=true)  

This command adds credential store named "test" with storage file named test.storage in data directory of your WildFly instance (ls ./standalone/data/). Default implementation of credential store will not create storage file until you add the first credential to the store.
Credentials are stored under alias which they can be later referred to in your configuration.
This command adds alias "my_db_password" with value "supersecret" as the password itself.

/subsystem=elytron/credential-store=test/alias=my_db_password:add(secret-value="supersecret")

The storage file "test.storage" is created right now.

Credential store manipulation

Note: manipulation style has changed, see more here.

There are several manipulation commands in CLI one can use to create credential store content.
Add new alias:

/subsystem=elytron/credential-store=test/alias=dept1db:add(secret-value="dbDept1Password", entry-type=org.wildfly.security.credential.PasswordCredential)

Remove from credential store alias:

/subsystem=elytron/credential-store=test/alias=dept1db:remove()

Show all aliases:

ls /subsystem=elytron/credential-store=test/alias=

Reference your credential alias

To use your credential alias from credential store we introduced credential-reference attribute. One can find credential references all over the model. We can demonstrate its usage at credential store itself. Let's create new credential store with guarded with password "supersecret" as created above.

/subsystem=elytron/credential-store=another-test:add(relative-to=jboss.server.data.dir, credential-reference={store=test, alias=my_db_password}, create=true)

Notice credential-reference attribute using store and alias to point to different credential store (test) to fetch real password value.
Let's test if it functions properly and store some alias in the new store.

/subsystem=elytron/credential-store=another-test/alias=remote-api:add(secret-value="crazysecret1")

We have two credential stores at the moment (test and another-test):

ls /subsystem=elytron/credential-store=

Credential reference supports also other types of references which I will cover in one of next posts.

Introduction to Credential Store SPI in WildFly Elytron

WildFly Elytron is also new home for Credential Store API/SPI originally introduced in PicketBox (known as Vault API) and has been part of JBoss AS7/WildFly for some time now.
Things are moving the way that PicketBox will not be used anymore in WildFly and Vault got some more requirements, so we are starting another life of Vault under WildfFly Elytron project with new name and API/SPI called Credentail Store.
Initial introduction blog post about WildFly Elytron could be found here.

Introduction to Credential Store

Elytron's approach to Credential Store is to enable users to create their own implementations of SPI and easily integrate them to WildFly and provide some out of the box implementations which will cover the most requirements from our users.

Elytron provides SPI called under package org.wildfly.security.credential.store.
One can find abstract CredentialStoreSpi class there which is intended to be used as base class for any Credentlial Store provider.
Check abstract methods in case you are looking for creating your own implementations.

Out of the box implementations are located in package org.wildfly.security.credential.store.impl. If one is familiar with options in PicketBox Vault there credential stores that can be used to supply the same features for the Elytron.

• CmdPasswordStore - credential store which is able to get credential from output of executed program. It uses comma as parameter delimiter to be able to handle more complicated use cases.
• ExecPasswordStore - credential store which is able to get credential from output of executed program.
• MaskedPasswordStore - credential store which is able to get credential from masked password string by PBE algorithm.
• KeystorePasswordStore - Keystore based ClearPassword password storage used in as default implementation of Credential Store SPI in Elytron security provider.

Basics of Credential Store SPI

The idea behind credential store is that it can be used for any kind of credential type implementing org.wildfly.security.credential.Credential under certain alias. Alias can mark more different credential types.
It has initialize method which can supply configuration parameters into the credential store. There is method to check if the initialize method has been already called (isInitialized). Credential  stores can be marked as modifiable which can will help when populating the credential store in WildFly subsystem (using CLI).
There is set of methods to work with credential/alias association (exists, store, retrieve, remove).
For better integration with tooling there is a method getAliases which returns all aliases stored in the credential store. This is not mandatory to implement but it can help tooling (and user) to work with such store.
If once decides to create his own credential store provider it will be useful to take a look at resolveMasterCredential method to add support to use master credential from the new credential store.   

Finally credential stores are going to be managed through WildFly CLI, so after Elytron subsystem become part of WildFly Core you can give it a try.