ssl - 相互认证 PBOX00052 : Supplied credential did not match existing credential for alias

Question

我创建了一个 server.keystore，然后是一个 client.keyStore 和一个 client.crt，我用它来做 client.truststore

别名为 devmyserverkey 的 server.keystore

/myserver_opt/jdk1.8.0_latest/jre/bin/keytool -genkey -alias devmyserverkey -storetype pkcs12 -keyalg RSA -keysize 2048 -keystore myserver.keystore -validity 730 -storepass samepassword -dname "CN=dev.myserver.com, OU=CMJAVA, O=myserver, L=City, ST=State, C=Country" -keypass samepassword

别名为 devclientkey 的 client.keystore

/myserver_opt/jdk1.8.0_latest/jre/bin/keytool  -genkey -keystore client.keystore -storepass samepassword  -keyalg RSA -keysize 2048 -storetype pkcs12  -alias devclientkey -dname "CN=dev.myserver.com, OU=CMJAVA, O=myserver, L=City, ST=State, C=Country"

然后使用别名 devclientkey 的客户端 crt

/myserver_opt/jdk1.8.0_latest/jre/bin/keytool -exportcert -keystore client.keystore  -storetype pkcs12 -storepass samepassword  -keypass samepassword  -file client.crt -alias devclientkey

然后是客户端信任库

/myserver_opt/jdk1.8.0_latest/jre/bin/keytool -import -file client.crt -keystore client.truststore

然后是 pkc12 keystore

 /myserver_opt/jdk1.8.0_latest/jre/bin/keytool -importkeystore -srckeystore client.keystore -destkeystore clientCert.p12 -srcstoretype PKCS12 -deststoretype PKCS12 -deststorepass samepassword

client.truststore 和 server.keystore 位于我的 widlfly 实例的配置目录中，当我尝试访问我的应用程序时，我得到以下信息:

   2018-03-16 08:23:18,177 TRACE [org.jboss.security] (default task-28) PBOX00200: Begin isValid, principal: org.wildfly.extension.undertow.security.AccountImpl$AccountPrincipal@3e1567dc, cache entry: null 2018-03-16 08:23:18,177 TRACE [org.jboss.security] (default task-28) PBOX00209: defaultLogin, principal: org.wildfly.extension.undertow.security.AccountImpl$AccountPrincipal@3e1567dc 2018-03-16 08:23:18,178 TRACE [org.jboss.security] (default task-28) PBOX00221: Begin getAppConfigurationEntry(mygenwebservicessecurity), size: 6 2018-03-16 08:23:18,179 TRACE [org.jboss.security] (default task-28) PBOX00224: End getAppConfigurationEntry(mygenwebservicessecurity), AuthInfo: AppConfigurationEntry[]: [0] LoginModule Class: org.jboss.security.auth.spi.BaseCertLoginModule ControlFlag: LoginModuleControlFlag: required Options: name=securityDomain, value=mygenwebservicessecurity

2018-03-16 08:23:18,181 TRACE [org.jboss.security] (default task-28) PBOX00236: Begin initialize method 2018-03-16 08:23:18,192 TRACE [org.jboss.security] (default task-28) PBOX00245: Found security domain: org.jboss.security.JBossJSSESecurityDomain 2018-03-16 08:23:18,192 TRACE [org.jboss.security] (default task-28) PBOX00239: End initialize method 2018-03-16 08:23:18,192 TRACE [org.jboss.security] (default task-28) PBOX00240: Begin login method 2018-03-16 08:23:18,192 TRACE [org.jboss.security] (default task-28) PBOX00240: Begin login method 2018-03-16 08:23:18,192 TRACE [org.jboss.security] (default task-28) PBOX00252: Begin getAliasAndCert method 2018-03-16 08:23:18,193 TRACE [org.jboss.security] (default task-28) PBOX00253: Found certificate, serial number: 13e04227, subject DN: CN=dev.myserver.com, OU=CMJAVA, O=myserver, L=City, ST=State, C=Country 2018-03-16 08:23:18,193 TRACE [org.jboss.security] (default task-28) PBOX00255: End getAliasAndCert method 2018-03-16 08:23:18,193 TRACE [org.jboss.security] (default task-28) PBOX00256: Begin validateCredential method 2018-03-16 08:23:18,201 TRACE [org.jboss.security] (default task-28)
        PBOX00056: Supplied credential: 13e04227
                CN=dev.myserver.com, OU=CMJAVA, O=myserver, L=City, ST=State, C=Country

        PBOX00057: Existing credential: PBOX00058: No match for alias CN=dev.myserver.com, OU=CMJAVA, O=myserver, L=City, ST=State, C=Country, existing aliases: [mykey] 2018-03-16 08:23:18,201 TRACE [org.jboss.security] (default task-28) PBOX00260: End validateCredential method, result: false 2018-03-16 08:23:18,201 TRACE [org.jboss.security] (default task-28) PBOX00244: Begin abort method, overall result: false 2018-03-16 08:23:18,201 DEBUG [org.jboss.security] (default task-28) PBOX00206: Login failure: javax.security.auth.login.FailedLoginException: PBOX00052: Supplied credential did not match existing credential for alias CN=dev.myserver.com, OU=CMJAVA, O=myserver, L=City, ST=State, C=Country
        at org.jboss.security.auth.spi.BaseCertLoginModule.login(BaseCertLoginModule.java:231)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at javax.security.auth.login.LoginContext.invoke(LoginContext.java:755)

我看不出两者有什么区别。我看到的唯一区别是别名 mykey。那是一个默认别名。但是这是从哪里来的，因为我自己为两者提供了别名。

这是我在 standalone.xml 中添加的内容

 <security-realm name="SSLRealm">
                <server-identities>
                    <ssl>
                        <keystore path="myserver.keystore" relative-to="jboss.server.config.dir" keystore-password="samepassword" alias="devmyserverkey" key-password="samepassword"/>
                    </ssl>
                </server-identities>
                <authentication>
                    <truststore path="client.truststore" relative-to="jboss.server.config.dir" keystore-password="samepassword"/>
                    <local default-user="$local" skip-group-loading="true"/>
                    <properties path="mgmt-users.properties" relative-to="jboss.server.config.dir"/>
                </authentication>
            </security-realm>
        </security-realms>

  <subsystem xmlns="urn:jboss:domain:remoting:3.0">
            <endpoint/>
            <http-connector name="http-remoting-connector" connector-ref="default" security-realm="ApplicationRealm"/>
            <http-connector name="https-remoting-connector" connector-ref="default-https" security-realm="SSLRealm"/>
        </subsystem>

            <subsystem xmlns="urn:jboss:domain:security:1.2">
                <security-domains>

                   <security-domain name="mygenwebservicessecurity" cache-type="default">
                    <authentication>

                        <login-module code="Certificate" flag="required">
                            <module-option name="securityDomain" value="mygenwebservicessecurity"/>
                            <!--module-option name="rolesProperties" value="file:${jboss.server.config.dir}/user_roles.properties"/>
                            <module-option name="defaultRolesProperties" value="file:${jboss.server.config.dir}/default_roles.properties"/-->
                        </login-module>
                    </authentication>
                    <jsse keystore-password="samepassword" keystore-url="file:/myserver_opt/wildfly10_javatest/mlws/configuration/myserver.keystore" truststore-password="samepassword" truststore-url="file:/myserver_opt/wildfly10_javatest/mlws/configuration/client.truststore" client-auth="true"/>
                </security-domain>
            </security-domains>
        </subsystem>


        <subsystem xmlns="urn:jboss:domain:undertow:3.0">
            <buffer-cache name="default"/>
            <server name="default-server">
                <http-listener name="defaultHTTP" socket-binding="http" redirect-socket="https"/>
                <https-listener name="default" enabled-protocols="TLSv1.2" verify-client="REQUIRED" security-realm="SSLRealm" socket-binding="https"/>
                <host name="default-host" alias="localhost">
                    <location name="/" handler="welcome-content"/>
                    <access-log predicate="not equals[%a, %A]" suffix=".log" prefix="access" pattern="%h %l %u %t &quot;%r&quot; %s %b &quot;%{i,Referer}&quot; &quot;%{i,User-Agent}&quot; %D %T"/>
                    <filter-ref name="server-header"/>
                    <filter-ref name="x-powered-by-header"/>
                </host>
            </server>

在我的 standalone.xml 中添加以上内容后，当我尝试通过 http 访问我的应用程序时，它也被禁止访问。但是上面的异常是https自带的，没有意义。

编辑:

我删除了所有别名引用并再次制作了证书并检查了

keytool -list - v -keystore ( truststore/pC12Store/Server.keystore/client.keystore)  

他们都有相同的别名mykey

我什至查看了引发错误的类的代码，似乎归结到此类的别名不是“mykey”，而是 DN 定义/主题

Answer 1

我在我的安全域 mygenwebservicessecurity 中添加了以下验证器

<module-option name="verifier" value="org.jboss.security.auth.certs.AnyCertVerifier"/>

还有另一个名为 X509Verifier 的验证器，但它只是一个接口(interface)，因此您需要实现您的验证器并将其添加到 jar 中(如果需要)

AnyCertVerifier 使其通过验证。

现在，当我同时单击 http 和 https 链接时，同样的问题发生在仅日志和仅状态时:

2018-03-16 23:20:22,695 TRACE [org.jboss.security] (default task-11) PBOX00354: Setting security roles ThreadLocal: null
2018-03-16 23:20:28,584 TRACE [org.jboss.security] (default task-13) PBOX00354: Setting security roles ThreadLocal: null
2018-03-16 23:20:30,570 TRACE [org.jboss.security] (default task-15) PBOX00354: Setting security roles ThreadLocal: null

根据 picketbox 4.9 中的代码。 WF10 在其模块中具有此异常跟踪仅抛出

https://github.com/picketbox/picketbox/blob/master/security-jboss-sx/jbosssx/src/main/java/org/jboss/security/SecurityRolesAssociation.java

我对这个错误有点不知所措。它确实有意义，因为人们已经收到此错误，但他们通过数据库查询或其他方式添加了角色并解决了它。我已经添加了 roles.properties 和 users.properties，但它并没有占据我的角色。

此外，某些类(可能是 wildfly)调用此类的 setSecurityRoles 方法时没有安全角色( null )，这是跟踪语句中的 null 。 ？？但这也许是一个单独的问题。