0

I'm trying to implement a custom credential-store (with custom CredentialStoreSpi implementation) to integrate with data-sources through credential-reference.

The idea is to use a vault service with rotating passwords, and, for now, when I start WildFly, it calls CredentialStoreSpi.retrieve() and initializes data-source with current password, but if I flush data-source and request a new connection there are no calls to .retrieve(). And if I rotate password, then, it fails to create connection with username/password error, and still do not call for a new password.

There is any way to change this behavior and force that any new connection should require password directly from credential-store?

Looking in specs I see that data-source connection security has a config to some "Reauth Plugin Class Name", but I can't find any clues on what is that.

Found this spec: https://docs.wildfly.org/20/wildscribe/subsystem/datasources/data-source/ExampleDS/index.html#attr-reauth-plugin-class-name

  • reauth-plugin-class-name The fully qualified class name of the reauthentication plugin implementation

Looking at web but find no documentation on this.

Anyone knows what is that? Could it help in this use case?

Edit 2023-04-03

I found this implementation: https://github.com/ironjacamar/ironjacamar/blob/263826e4fc49bb6f51257fbbeb227d0480a05a7c/adapters/src/main/java/org/jboss/jca/adapters/jdbc/BaseWrapperManagedConnectionFactory.java#L1232

This method is called always when a connection is obtained from pool. In my tests it always enter on WrappedConnectionRequestInfo test (line 1253).

From what I understand, I could try to override ManagedConnectionFactory or ConnectionRequestInfo:

  • ConnectionRequestInfo: can't find any way to override this;
  • ManagedConnectionFactory: apparently I can override it, but found only old docs and it appears to be discouraged.
Claudio Weiler
  • 589
  • 2
  • 15

1 Answers1

0

if the credential store is updated externally you have to do a reload of that credential store. Maybe calling the retrieve method or reloading the credential store in the server at a certain intervals might make sense

diavil
  • 81
  • 4
  • Can you elaborate more on "reload credential store"? Current credential store implementation always get a fresh password. – Claudio Weiler Aug 11 '22 at 17:04
  • @ClaudioWeiler Currently the credential store is caching the credential and then using it every time. You have to do a reload of the server to associate a different credential. That is why you only see call to the `retrieve()` method at startup. You can create new issue for this use case in WildFly issue tracker if you want https://issues.redhat.com/projects/WFLY . – diavil Aug 24 '22 at 10:42
  • Hi @diavil. Sorry for late reply, but I returned to this issue again. I'm trying to understand how credentials are cached on datasources but I just can't find the point where it is done on source codes. If you know this, can you share a link? – Claudio Weiler Apr 03 '23 at 20:06