WSO2 Identity Server: How to enter the keystore and private key password in a Dockerized WSO2 identity server

After running the ciphertool.bat or ciphertool.sh script in the bin directory of WSO2 Identity server, the next time the server is started up, you are presented with a prompt that asks you for the keystore and private key password used to configure the WSO2 secure vault. Example:

C:Program FilesWSO2Identity Server5.7.0bin>wso2server.bat --start

JAVA_HOME environment variable is set to C:Program FilesJavajdk1.8.0_181

CARBON_HOME environment variable is set to C:PROGRA~1WSO2IDENTI~1570D0D~1.0bin..

Java HotSpot(TM) 64-Bit Server VM warning: ignoring option MaxPermSize=256m; support was removed in 8.0

[Enter KeyStore and Private Key Password :]

I have a WSO2 identity server instance that is running in a Docker container. My passwords are encrypted so I need to provide a keystore/private key password on startup.

This presents an issue though:

I have to run my docker container with the -it flag in order to create an active bash shell in the container that allows me to type in the keystore and private key password. My docker run command looks like this docker run -p 443:443 -it wso2-test .. If I don't include the -it flag, WSO2 IS will never ask for the password and the passwords won't get resolved, causing everything to fail.

I don't want to use the -it flag because it forces user input and I'd like the containers to run independently.

In order to keep things as automated as possible, I want to provide the keystore and private key password right away when I run the wso2server.sh script (which is the entrypoint of my Dockerfile), rather than when the prompt is presented. Is this possible?

Ideally, a solution would have a Dockerfile entrypoint that looks something like this:

ENTRYPOINT ["wso2server.sh", "run", "KEYSTORE_PASSWORD"]

edited Jan 2 at 21:40

asked Jan 2 at 18:54

stanaka

957

I tried this using two wso2is-5.7.0 packs. I ran ciphertool.sh -Dconfigure in one pack(say A) and copied secret-conf.properties to the other one(say B). Then tried to start B, it asked for the KeyStore and Private Key Password. Therefore please check again whether you have correctly copied secret-conf.properties to the Dockerized implementation from the other pack which you ran ciphertool.sh -Dconfigure.

– Sajith
Jan 2 at 21:38

Thanks Sajith. The actual issue was that the docker container wouldn't allow user input unless the -it flag was added. With the -it flag, it works as expected. However, I want to be able to provide the password when I run the docker run command rather than having to give user input after the docker run command is run. I have updated the question to reflect the new issue.

– stanaka
Jan 2 at 21:43

1

What about using password-persist.txt or password-tmp.txt as described in below doc? docs.wso2.com/display/Carbon440/Resolving+Encrypted+Passwords

– Sajith
Jan 2 at 21:49

I don't see a daemon.sh or daemon.bat in my WSO2 bin folder. I am running v5.7.0. Am I missing something? Also, the WSO2 documentation reads daemon. sh wso2server.sh -start I assume that is supposed to be daemon.sh wso2server.sh -start (no space) EDIT: I do see forgetme.sh and forgetme.bin. Is that what I am supposed to be using?

– stanaka
Jan 2 at 23:05

Nevermind, I see that the "forgetme" scripts are used for something else. I still can't find the daemon.sh script, however.

– stanaka
Jan 2 at 23:17

|
show 1 more comment

C:Program FilesWSO2Identity Server5.7.0bin>wso2server.bat --start

JAVA_HOME environment variable is set to C:Program FilesJavajdk1.8.0_181

CARBON_HOME environment variable is set to C:PROGRA~1WSO2IDENTI~1570D0D~1.0bin..

Java HotSpot(TM) 64-Bit Server VM warning: ignoring option MaxPermSize=256m; support was removed in 8.0

[Enter KeyStore and Private Key Password :]

I have a WSO2 identity server instance that is running in a Docker container. My passwords are encrypted so I need to provide a keystore/private key password on startup.

This presents an issue though:

I don't want to use the -it flag because it forces user input and I'd like the containers to run independently.

Ideally, a solution would have a Dockerfile entrypoint that looks something like this:

ENTRYPOINT ["wso2server.sh", "run", "KEYSTORE_PASSWORD"]

edited Jan 2 at 21:40

asked Jan 2 at 18:54

stanaka

957

I tried this using two wso2is-5.7.0 packs. I ran ciphertool.sh -Dconfigure in one pack(say A) and copied secret-conf.properties to the other one(say B). Then tried to start B, it asked for the KeyStore and Private Key Password. Therefore please check again whether you have correctly copied secret-conf.properties to the Dockerized implementation from the other pack which you ran ciphertool.sh -Dconfigure.

– Sajith
Jan 2 at 21:38

Thanks Sajith. The actual issue was that the docker container wouldn't allow user input unless the -it flag was added. With the -it flag, it works as expected. However, I want to be able to provide the password when I run the docker run command rather than having to give user input after the docker run command is run. I have updated the question to reflect the new issue.

– stanaka
Jan 2 at 21:43

1

What about using password-persist.txt or password-tmp.txt as described in below doc? docs.wso2.com/display/Carbon440/Resolving+Encrypted+Passwords

– Sajith
Jan 2 at 21:49

I don't see a daemon.sh or daemon.bat in my WSO2 bin folder. I am running v5.7.0. Am I missing something? Also, the WSO2 documentation reads daemon. sh wso2server.sh -start I assume that is supposed to be daemon.sh wso2server.sh -start (no space) EDIT: I do see forgetme.sh and forgetme.bin. Is that what I am supposed to be using?

– stanaka
Jan 2 at 23:05

Nevermind, I see that the "forgetme" scripts are used for something else. I still can't find the daemon.sh script, however.

– stanaka
Jan 2 at 23:17

|
show 1 more comment

C:Program FilesWSO2Identity Server5.7.0bin>wso2server.bat --start

JAVA_HOME environment variable is set to C:Program FilesJavajdk1.8.0_181

CARBON_HOME environment variable is set to C:PROGRA~1WSO2IDENTI~1570D0D~1.0bin..

Java HotSpot(TM) 64-Bit Server VM warning: ignoring option MaxPermSize=256m; support was removed in 8.0

[Enter KeyStore and Private Key Password :]

I have a WSO2 identity server instance that is running in a Docker container. My passwords are encrypted so I need to provide a keystore/private key password on startup.

This presents an issue though:

I don't want to use the -it flag because it forces user input and I'd like the containers to run independently.

Ideally, a solution would have a Dockerfile entrypoint that looks something like this:

ENTRYPOINT ["wso2server.sh", "run", "KEYSTORE_PASSWORD"]

edited Jan 2 at 21:40

asked Jan 2 at 18:54

stanaka

957

C:Program FilesWSO2Identity Server5.7.0bin>wso2server.bat --start

JAVA_HOME environment variable is set to C:Program FilesJavajdk1.8.0_181

CARBON_HOME environment variable is set to C:PROGRA~1WSO2IDENTI~1570D0D~1.0bin..

Java HotSpot(TM) 64-Bit Server VM warning: ignoring option MaxPermSize=256m; support was removed in 8.0

[Enter KeyStore and Private Key Password :]

I have a WSO2 identity server instance that is running in a Docker container. My passwords are encrypted so I need to provide a keystore/private key password on startup.

This presents an issue though:

I don't want to use the -it flag because it forces user input and I'd like the containers to run independently.

Ideally, a solution would have a Dockerfile entrypoint that looks something like this:

ENTRYPOINT ["wso2server.sh", "run", "KEYSTORE_PASSWORD"]

wso2 wso2is

edited Jan 2 at 21:40

asked Jan 2 at 18:54

stanaka

957

edited Jan 2 at 21:40

asked Jan 2 at 18:54

stanaka

957

edited Jan 2 at 21:40

asked Jan 2 at 18:54

stanaka

957

asked Jan 2 at 18:54

stanaka

957

asked Jan 2 at 18:54

stanaka

957

I tried this using two wso2is-5.7.0 packs. I ran ciphertool.sh -Dconfigure in one pack(say A) and copied secret-conf.properties to the other one(say B). Then tried to start B, it asked for the KeyStore and Private Key Password. Therefore please check again whether you have correctly copied secret-conf.properties to the Dockerized implementation from the other pack which you ran ciphertool.sh -Dconfigure.

– Sajith
Jan 2 at 21:38

Thanks Sajith. The actual issue was that the docker container wouldn't allow user input unless the -it flag was added. With the -it flag, it works as expected. However, I want to be able to provide the password when I run the docker run command rather than having to give user input after the docker run command is run. I have updated the question to reflect the new issue.

– stanaka
Jan 2 at 21:43

1

What about using password-persist.txt or password-tmp.txt as described in below doc? docs.wso2.com/display/Carbon440/Resolving+Encrypted+Passwords

– Sajith
Jan 2 at 21:49

I don't see a daemon.sh or daemon.bat in my WSO2 bin folder. I am running v5.7.0. Am I missing something? Also, the WSO2 documentation reads daemon. sh wso2server.sh -start I assume that is supposed to be daemon.sh wso2server.sh -start (no space) EDIT: I do see forgetme.sh and forgetme.bin. Is that what I am supposed to be using?

– stanaka
Jan 2 at 23:05

Nevermind, I see that the "forgetme" scripts are used for something else. I still can't find the daemon.sh script, however.

– stanaka
Jan 2 at 23:17

|
show 1 more comment

I tried this using two wso2is-5.7.0 packs. I ran ciphertool.sh -Dconfigure in one pack(say A) and copied secret-conf.properties to the other one(say B). Then tried to start B, it asked for the KeyStore and Private Key Password. Therefore please check again whether you have correctly copied secret-conf.properties to the Dockerized implementation from the other pack which you ran ciphertool.sh -Dconfigure.

– Sajith
Jan 2 at 21:38

Thanks Sajith. The actual issue was that the docker container wouldn't allow user input unless the -it flag was added. With the -it flag, it works as expected. However, I want to be able to provide the password when I run the docker run command rather than having to give user input after the docker run command is run. I have updated the question to reflect the new issue.

– stanaka
Jan 2 at 21:43

1

What about using password-persist.txt or password-tmp.txt as described in below doc? docs.wso2.com/display/Carbon440/Resolving+Encrypted+Passwords

– Sajith
Jan 2 at 21:49

I don't see a daemon.sh or daemon.bat in my WSO2 bin folder. I am running v5.7.0. Am I missing something? Also, the WSO2 documentation reads daemon. sh wso2server.sh -start I assume that is supposed to be daemon.sh wso2server.sh -start (no space) EDIT: I do see forgetme.sh and forgetme.bin. Is that what I am supposed to be using?

– stanaka
Jan 2 at 23:05

Nevermind, I see that the "forgetme" scripts are used for something else. I still can't find the daemon.sh script, however.

– stanaka
Jan 2 at 23:17

I tried this using two wso2is-5.7.0 packs. I ran ciphertool.sh -Dconfigure in one pack(say A) and copied secret-conf.properties to the other one(say B). Then tried to start B, it asked for the KeyStore and Private Key Password. Therefore please check again whether you have correctly copied secret-conf.properties to the Dockerized implementation from the other pack which you ran ciphertool.sh -Dconfigure.

– Sajith
Jan 2 at 21:38

Thanks Sajith. The actual issue was that the docker container wouldn't allow user input unless the -it flag was added. With the -it flag, it works as expected. However, I want to be able to provide the password when I run the docker run command rather than having to give user input after the docker run command is run. I have updated the question to reflect the new issue.

– stanaka
Jan 2 at 21:43

What about using password-persist.txt or password-tmp.txt as described in below doc? docs.wso2.com/display/Carbon440/Resolving+Encrypted+Passwords

– Sajith
Jan 2 at 21:49

I don't see a daemon.sh or daemon.bat in my WSO2 bin folder. I am running v5.7.0. Am I missing something? Also, the WSO2 documentation reads daemon. sh wso2server.sh -start I assume that is supposed to be daemon.sh wso2server.sh -start (no space) EDIT: I do see forgetme.sh and forgetme.bin. Is that what I am supposed to be using?

– stanaka
Jan 2 at 23:05

Nevermind, I see that the "forgetme" scripts are used for something else. I still can't find the daemon.sh script, however.

– stanaka
Jan 2 at 23:17

|
show 1 more comment

1 Answer
1

active

oldest

votes

You should pass the keystore password as an environment variable to the docker run command.

docker run -e KEY_STORE_PASSWORD=wso2carbon secvault-test:latest

This environment variable should be read by ENTRYPOINT command, and written into a file named password-tmp under the $PRODUCT_HOME directory. Here's a sample Dockerfile with ENTRYPOINT:

$> cat Dockerfile

FROM ubuntu:16.04



RUN mkdir /opt/wso2is

WORKDIR /opt/wso2is



ENTRYPOINT ["/bin/sh", "-c", "echo $KEY_STORE_PASSWORD > password-tmp && wso2server.sh run"]

Security check:

Since the password is not baked into the docker image, we can safely push the image to a registry. Further, you'll need to enter environment variable whenever you spin a new container. Note that the environment variables of the containers are visible via docker inspect command.

edited Jan 6 at 4:35

answered Jan 3 at 21:37

Kasun Gajasinghe

2,37111629

add a comment |

Your Answer

StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54011693%2fwso2-identity-server-how-to-enter-the-keystore-and-private-key-password-in-a-do%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

You should pass the keystore password as an environment variable to the docker run command.

docker run -e KEY_STORE_PASSWORD=wso2carbon secvault-test:latest

This environment variable should be read by ENTRYPOINT command, and written into a file named password-tmp under the $PRODUCT_HOME directory. Here's a sample Dockerfile with ENTRYPOINT:

$> cat Dockerfile

FROM ubuntu:16.04



RUN mkdir /opt/wso2is

WORKDIR /opt/wso2is



ENTRYPOINT ["/bin/sh", "-c", "echo $KEY_STORE_PASSWORD > password-tmp && wso2server.sh run"]

Security check:

edited Jan 6 at 4:35

answered Jan 3 at 21:37

Kasun Gajasinghe

2,37111629

add a comment |

You should pass the keystore password as an environment variable to the docker run command.

docker run -e KEY_STORE_PASSWORD=wso2carbon secvault-test:latest

This environment variable should be read by ENTRYPOINT command, and written into a file named password-tmp under the $PRODUCT_HOME directory. Here's a sample Dockerfile with ENTRYPOINT:

$> cat Dockerfile

FROM ubuntu:16.04



RUN mkdir /opt/wso2is

WORKDIR /opt/wso2is



ENTRYPOINT ["/bin/sh", "-c", "echo $KEY_STORE_PASSWORD > password-tmp && wso2server.sh run"]

Security check:

edited Jan 6 at 4:35

answered Jan 3 at 21:37

Kasun Gajasinghe

2,37111629

add a comment |

You should pass the keystore password as an environment variable to the docker run command.

docker run -e KEY_STORE_PASSWORD=wso2carbon secvault-test:latest

This environment variable should be read by ENTRYPOINT command, and written into a file named password-tmp under the $PRODUCT_HOME directory. Here's a sample Dockerfile with ENTRYPOINT:

$> cat Dockerfile

FROM ubuntu:16.04



RUN mkdir /opt/wso2is

WORKDIR /opt/wso2is



ENTRYPOINT ["/bin/sh", "-c", "echo $KEY_STORE_PASSWORD > password-tmp && wso2server.sh run"]

Security check:

edited Jan 6 at 4:35

answered Jan 3 at 21:37

Kasun Gajasinghe

2,37111629

You should pass the keystore password as an environment variable to the docker run command.

docker run -e KEY_STORE_PASSWORD=wso2carbon secvault-test:latest

This environment variable should be read by ENTRYPOINT command, and written into a file named password-tmp under the $PRODUCT_HOME directory. Here's a sample Dockerfile with ENTRYPOINT:

$> cat Dockerfile

FROM ubuntu:16.04



RUN mkdir /opt/wso2is

WORKDIR /opt/wso2is



ENTRYPOINT ["/bin/sh", "-c", "echo $KEY_STORE_PASSWORD > password-tmp && wso2server.sh run"]

Security check:

edited Jan 6 at 4:35

answered Jan 3 at 21:37

Kasun Gajasinghe

2,37111629

edited Jan 6 at 4:35

answered Jan 3 at 21:37

Kasun Gajasinghe

2,37111629

answered Jan 3 at 21:37

Kasun Gajasinghe

2,37111629

answered Jan 3 at 21:37

Kasun Gajasinghe

2,37111629

add a comment |

draft saved

draft discarded

Thanks for contributing an answer to Stack Overflow!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

Search This Blog

Ufyukyu