You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@knox.apache.org by GitBox <gi...@apache.org> on 2021/07/20 08:25:29 UTC
[GitHub] [knox] smolnar82 opened a new pull request #471: KNOX-2637 - Added a new Knox CLI command to generate JWK secrets
smolnar82 opened a new pull request #471:
URL: https://github.com/apache/knox/pull/471
## What changes were proposed in this pull request?
A new Knox CLI command is developed to generate a JWK and print it into the STDOUT.
Accepted JWK algorithms are HS256, HS384, and HS512.
## How was this patch tested?
Added new JUnit test cases and executed manual testing:
```
$ bin/knoxcli.sh generate-jwk --jwkAlg HS256
VhgTGC4iMO5zOObyh9BiAIDdtbgI-xICeXjZj_PTQlM
$ bin/knoxcli.sh generate-jwk --jwkAlg HS384
bDVioGVgpbjg9BtJ5_HUrXdjsgPfMY1WD_FqTR4jVmqu_Nu7kJoHNOQruovjRZUO
$ bin/knoxcli.sh generate-jwk --jwkAlg HS512
Gw8_mfmYMeQzlxdGdx8am9rL1BKxef8RcrpPicqI9v-cww84I7cFGrMyH1vmEy77JvScpsal41gOUY41zs8laQ
$ bin/knoxcli.sh generate-jwk --jwkAlg 1212
KnoxCLI {cmd} [options]
[--help]
[version]
[create-master [--force] [--master mastersecret] [--generate]]
[create-cert [--force] [--hostname h]]
[export-cert [--type PEM|JKS|JCEKS|PKCS12]]
[create-alias aliasname [--cluster clustername] [ (--value v) | (--generate) ]]
[delete-alias aliasname [--cluster clustername]]
[list-alias [--cluster clustername]]
[redeploy [--cluster clustername]]
[list-topologies]
[validate-topology [--cluster clustername] | [--path "path/to/file"]]
[user-auth-test [--cluster clustername] [--u username] [--p password] [--g]]
[system-user-auth-test [--cluster clustername] [--d]]
[service-test [--u username] [--p password] [--cluster clustername] [--hostname name] [--port port]]
[list-registry-clients]
[list-provider-configs --registry-client name]
[upload-provider-config providerConfigFile --registry-client name [--entry-name entryName]]
[list-descriptors --registry-client name]
[upload-descriptor descriptorFile --registry-client name [--entry-name entryName]]
[delete-provider-config providerConfig --registry-client name]
[delete-descriptor descriptor --registry-client name]
[get-registry-acl entry --registry-client name]
[convert-topology --path "path/to/topology.xml" --provider-name my-provider.json [--descriptor-name my-descriptor.json] [--topology-name topologyName] [--output-path "path/to/configs/"] [--force] [--cluster clusterName] [--discovery-url url] [--discovery-user discoveryUser] [--discovery-pwd-alias discoveryPasswordAlias] [--discovery-type discoveryType]]
[generate-jwk [--jwkAlg HS256|HS384|HS512]]
generate-jwk [--jwkAlg HS256|HS384|HS512]:
Generates a JSON Web Key using the supplied algorithm name and prints the generated key value on the screen.
Options are as follows:
--jwkAlg (optional) defines the name of the desired JSON Web Signature algorithm name; defaults to HS256. Other accepted values are HS384 and HS512
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [knox] smolnar82 merged pull request #471: KNOX-2637 - Added a new Knox CLI command to generate JWK secrets
Posted by GitBox <gi...@apache.org>.
smolnar82 merged pull request #471:
URL: https://github.com/apache/knox/pull/471
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [knox] smolnar82 commented on pull request #471: KNOX-2637 - Added a new Knox CLI command to generate JWK secrets
Posted by GitBox <gi...@apache.org>.
smolnar82 commented on pull request #471:
URL: https://github.com/apache/knox/pull/471#issuecomment-883202971
Cc. @zeroflag
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [knox] smolnar82 commented on pull request #471: KNOX-2637 - Added a new Knox CLI command to generate JWK secrets
Posted by GitBox <gi...@apache.org>.
smolnar82 commented on pull request #471:
URL: https://github.com/apache/knox/pull/471#issuecomment-883202971
Cc. @zeroflag
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [knox] smolnar82 commented on pull request #471: KNOX-2637 - Added a new Knox CLI command to generate JWK secrets
Posted by GitBox <gi...@apache.org>.
smolnar82 commented on pull request #471:
URL: https://github.com/apache/knox/pull/471#issuecomment-883202971
Cc. @zeroflag
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [knox] zeroflag commented on pull request #471: KNOX-2637 - Added a new Knox CLI command to generate JWK secrets
Posted by GitBox <gi...@apache.org>.
zeroflag commented on pull request #471:
URL: https://github.com/apache/knox/pull/471#issuecomment-883395769
LGTM
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [knox] moresandeep commented on a change in pull request #471: KNOX-2637 - Added a new Knox CLI command to generate JWK secrets
Posted by GitBox <gi...@apache.org>.
moresandeep commented on a change in pull request #471:
URL: https://github.com/apache/knox/pull/471#discussion_r673119360
##########
File path: gateway-server/src/main/java/org/apache/knox/gateway/util/KnoxCLI.java
##########
@@ -63,34 +93,15 @@
import org.jboss.shrinkwrap.api.exporter.ExplodedExporter;
import org.jboss.shrinkwrap.api.spec.EnterpriseArchive;
-import javax.net.ssl.SSLException;
-import java.io.BufferedReader;
-import java.io.Console;
-import java.io.File;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.InputStreamReader;
-import java.io.PrintStream;
-import java.net.InetAddress;
-import java.net.UnknownHostException;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Path;
-import java.nio.file.Paths;
-import java.security.KeyStoreException;
-import java.security.cert.Certificate;
-import java.security.cert.X509Certificate;
-import java.util.Arrays;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Locale;
-import java.util.Map;
-import java.util.Properties;
-import java.util.Set;
-import java.util.UUID;
+import com.nimbusds.jose.JOSEException;
+import com.nimbusds.jose.JWSAlgorithm;
+import com.nimbusds.jose.jwk.OctetSequenceKey;
+import com.nimbusds.jose.jwk.gen.OctetSequenceKeyGenerator;
public class KnoxCLI extends Configured implements Tool {
+ private static final Collection<String> SUPPORTED_JWK_ALGORITHMS = Stream
Review comment:
Wouldn't it be better to make it Set instead of Collection. It will be easier to follow the references later on in the code and if needed Iterable can be used.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org