如何为鞘翅生成屏蔽密码?

Question

我想用屏蔽密码替换我在wildfly-config中使用的明文密码.xml，这在WildFly 18中似乎得到了支持。 我尝试使用elytron工具生成屏蔽密码：

./elytron-tool.sh mask --salt 12345678 --iteration 12 --secret password
MASK-2FVkvIpoGRstP19QEZ76qE;12345678;12

然后我将哈希("2FVkvIpoGRstP19QEZ76qE"(转换为base64并添加到wildfly-config中.xml

<credentials>
<masked-password iteration-count="12" salt="12345678" masked-password="MkZWa3ZJcG9HUnN0UDE5UUVaNzZxRQ=="/>
</credentials>
<sasl-mechanism-selector selector="DIGEST-MD5"/>

但是，它失败并显示：

Caused by: java.security.spec.InvalidKeySpecException: javax.crypto.IllegalBlockSizeException: Input length must be multiple of 8 when decrypting with padded cipher
at org.wildfly.security.password.impl.MaskedPasswordImpl.unmask(MaskedPasswordImpl.java:182)
at org.wildfly.security.password.impl.MaskedPasswordImpl.<init>(MaskedPasswordImpl.java:76)
at org.wildfly.security.password.impl.MaskedPasswordImpl.<init>(MaskedPasswordImpl.java:96)
at org.wildfly.security.password.impl.PasswordFactorySpiImpl.engineGeneratePassword(PasswordFactorySpiImpl.java:476)
at org.wildfly.security.password.PasswordFactory.generatePassword(PasswordFactory.java:151)
at org.wildfly.security.auth.client.ElytronXmlParser.lambda$parseMaskedPassword$55(ElytronXmlParser.java:2748)
... 21 more
Caused by: javax.crypto.IllegalBlockSizeException: Input length must be multiple of 8 when decrypting with padded cipher
at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:936)
at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:847)
at com.sun.crypto.provider.PBES1Core.doFinal(PBES1Core.java:416)
at com.sun.crypto.provider.PBEWithMD5AndDESCipher.engineDoFinal(PBEWithMD5AndDESCipher.java:316)
at javax.crypto.Cipher.doFinal(Cipher.java:2164)
at org.wildfly.security.password.impl.MaskedPasswordImpl.unmask(MaskedPasswordImpl.java:180)

因此，我生成屏蔽密码的过程似乎是错误的。您能建议任何将生成有效屏蔽密码的工具/外壳命令吗？ 多谢

Answer 1

你可以在 Jboss 的开发者博客中找到生成屏蔽密码的示例代码：https://developer.jboss.org/people/aabdelsa/blog/2019/09/05/support-for-masked-passwords-in-the-client-xml-configuration 希望对你有帮助