| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| WMB 7, WS-Security, cannot retrieve key |
« View previous topic :: View next topic » |
| Author |
Message
|
| jinie |
 Posted: Mon Sep 29, 2014 4:09 am Post subject: WMB 7, WS-Security, cannot retrieve key |
 |
|
Novice
Joined: 10 Jul 2013
Posts: 13
|
Hi.
I'm trying to setup WMB 7 as a WS Security provider, and have followed the tutorial on setting it up, with one exception - i would like it to run with EG level keystores/truststores instead of broker level.
I have my Policy Set binding set up to point to a key with the alias "selfsigned", and i've set the EG level keystore/truststore to the keystore, and set the password.
| Code: |
keystoreType='JKS'
keystoreFile='c:\work\selfsigned.jks'
keystorePass='default::keystorePass'
truststoreType='JKS'
truststoreFile='c:\work\selfsigned.jks'
truststorePass='default::truststorePass'
|
I've set the passwords with
| Code: |
C:\>mqsisetdbparms BROKER -n default::keystorePass -u na -p password
C:\>mqsisetdbparms BROKER -n default::truststorePass -u na -p password
|
And when i try testing with SoapUI, i get the following error :
| Code: |
<faultcode>axis2ns1:FailedAuthentication</faultcode>
<faultstring>CWWSS6521E: The Login failed because of an exception: javax.security.auth.login.LoginException: com.ibm.wsspi.wssecurity.core.SoapSecurityException: CWWSS5312E: The Application Server cannot retrieve the 'selfsigned' key from the 'c:\work\selfsigned.jks' keystore. The following exception occurred: java.lang.IllegalArgumentException: password can't be null</faultstring>
|
any hints ? ideas ?
Thanks.
/J |
|
| Back to top |
|
 |
| fjb_saper |
| Posted: Mon Sep 29, 2014 4:32 am Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
check the documentation again. I don't believe you can use default::keystorepass. The part before the :: might be mandatory as per description in the documentation... meaning you can't change it to what identifier you want... 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| zpat |
| Posted: Mon Sep 29, 2014 4:44 am Post subject: |
|
|
Jedi Council
Joined: 19 May 2001
Posts: 5866
Location: UK
|
Here's how to do it in one go - no security id needed.
mqsichangeproperties <brokername> -o "HTTPSConnector" -e <EGname> -n keystoreFile,keystorePass,keystoreType -v /path/keystore.jks,password,JKS
_________________
Well, I don't think there is any question about it. It can only be attributable to human error. This sort of thing has cropped up before, and it has always been due to human error. |
|
| Back to top |
|
|
| jinie |
| Posted: Mon Sep 29, 2014 9:18 am Post subject: |
|
|
Novice
Joined: 10 Jul 2013
Posts: 13
|
| fjb_saper wrote: |
| check the documentation again. I don't believe you can use default::keystorepass. The part before the :: might be mandatory as per description in the documentation... meaning you can't change it to what identifier you want... |
I checked again, according to this http://www-01.ibm.com/support/knowledgecenter/SSKM8N_7.0.0/com.ibm.etools.mft.doc/ap34020_.htm?lang=en
i should set the properties to "eg_nameKeyStore::password", in my case "defaultKeystore::password", and set the dbparms key as "defaultKeystore::password"
| Code: |
C:\>mqsichangeproperties BROKER -e default -o ComIbmJVMManager -n keystorePass -v defaultKeystore::password
|
still gives me the same error  |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Mon Sep 29, 2014 10:06 am Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
Is the keystore / truststore accessible to the broker's service id? (check file permissions)
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| jinie |
| Posted: Mon Sep 29, 2014 11:30 am Post subject: |
|
|
Novice
Joined: 10 Jul 2013
Posts: 13
|
| fjb_saper wrote: |
| Is the keystore / truststore accessible to the broker's service id? (check file permissions) |
Yeah, just to be sure i copied it to a temporary directory, and set full access to it. Still the same error. |
|
| Back to top |
|
|
| jinie |
| Posted: Wed Oct 01, 2014 11:58 pm Post subject: "solved" |
|
|
Novice
Joined: 10 Jul 2013
Posts: 13
|
I solved this, though I'm not sure what i did to solve it 
After many tries i finally deleted everything (Execution group, WMB workdir, db parms, policy set, etc) and started over, and following the tutorial once more it finally worked. |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
