[midPoint] config.xml during installation

Wed Oct 17 17:24:14 CEST 2018

>> - when midPoint starts for the very first time and there is no keystore.jceks, it will be created with a random key
>> So the issue should be caused by the password in the database encrypted by a different key.

Thanks Ivan. This clearly is the issue I was encountering. There’s a dependency between the keystore, the database (after first run) and config.xml. I did at one point try creating my docker image by copying in both the config.xml and keystore, but they must have already been versions (of the keystore at least) that were out of sync with the database. I need to move on to other things now, but I’ll probably work this out later so that I can easily redploy instancesl, and have them properly connected to the database.

I do recommend describing the process below and the dependency in the documentation. Thanks!

From: midPoint <midpoint-bounces at lists.evolveum.com> on behalf of Ivan Noris <ivan.noris at evolveum.com>
Organization: Evolveum, s.r.o.
Reply-To: midPoint General Discussion <midpoint at lists.evolveum.com>
Date: Tuesday, October 16, 2018 at 11:42 PM
To: <midpoint at lists.evolveum.com>
Subject: Re: [midPoint] config.xml during installation

Hi Eric,

just to explain as I have not much midPoint+docker experience (nor using MySQL that often):

- when midPoint starts for the very first time and there is no keystore.jceks, it will be created with a random key

- when midPoint starts, it will populate the repository with the initial objects (such as administrator) if such objects don't already exist (it will NOT overwrite). Any password (such as administrator) will be encrypted using the keystore key that is set as default

- by default there is only one key entry in the keystore.jceks and the key is referenced in the config.xml ("default)"

So the issue should be caused by the password in the database encrypted by a different key. Or using different midpoint.home directory. I've had similar error only when I installed midPoint correctly and then removed the keystore...

Sorry but I don't have time to replicate the process via docker.

Best regards,

Ivan

On 16. 10. 2018 22:28, Solberg, Eric wrote:

Thanks Colin. It looks like the keystore that was created when the midpoint started has only one entry:

Your keystore contains 1 entry

default, Oct 16, 2018, SecretKeyEntry,

So if I’m understanding correctly, I’m missing the administrator here. Perhaps the administrator account/password is only created automatically in demo mode? I imagine it’s a simple process to add it. The instructions in the config.xml show how to create a new keystore, but I’m not sure what it should be populated with, or how. 

I suspect I can copy the keystore from the demo system to get the admin password in here. I’ll try that next but if I’m going about it wrong let me know. Thanks again.

Eric

From: midPoint <midpoint-bounces at lists.evolveum.com> on behalf of Colin Thompson <cthompson31 at ucmerced.edu>
Reply-To: midPoint General Discussion <midpoint at lists.evolveum.com>
Date: Tuesday, October 16, 2018 at 12:54 PM
To: midPoint General Discussion <midpoint at lists.evolveum.com>
Subject: Re: [midPoint] config.xml during installation

Sounds like a missing/incorrect keystore.jceks issue. I believe the administrator password, among other things, is stored encrypted in the database, and the key by which it is encrypted is stored in the keystore.jceks file in /opt/midpoint/var/.  Ive found that when the administrator password doesn't match (assuming you're typing it correctly), it's usually because you're not using the key/keystore it was created with.

There are instructions in the default config.xml file for how to create the keystore if you want to customize things.

Get Outlook for Android

From: midPoint <midpoint-bounces at lists.evolveum.com> on behalf of Solberg, Eric <eric at solberg.com>
Sent: Tuesday, October 16, 2018 1:11:16 PM
To: midPoint General Discussion
Subject: [midPoint] config.xml during installation 

I'm installing MySQL drivers for my Midpoint setup, and have updated config.xml. I've got connectivity to the database, but am encountering a problem logging in as administrator. I'm just starting to evaluate this, but I'm not 100% confident I followed the right process for setting up config.xml.

Here's what I did:
- Installed the midpoint demo with embedded database. Made a copy of the generated config.xml.
- Deleted this demo instance
- Setup a MySQL instance, created midpoint user & database, imported mysql-3.8-all.sql
- Modified the config.xml to include <repository> settings for mysql
- Modified the Dockerfile to copy config.xml to ${MP_DIR}/var/
- Also modified the Dockerfile to install the SQL driver
- Built the Docker image and deployed to my VM

This is working and I have connectivity to the database. This setup is pretty slow, but I'm not tuning yet... The problem I'm having is I can't log in as administrator (5ecr3t password).

Here's what I got in midpoint.log:
018-10-16 16:44:02,824 [] [http-nio-8080-exec-4] ERROR (com.evolveum.midpoint.model.impl.sec
urity.AuthenticationEvaluatorImpl): Error dealing with credentials of user "administrator" cr
edentials: No key mapped to key digest FbJhcZYWk/Q3KnAucPQgRSxD/QM= could be found in the key
store. Keys digests must be recomputed during initialization

I'm guessing it's one of 3 things:
- Was I supposed to copy config.xml from the demo? Or should I create a new config.xml with only the repository settings and let midpoint recreate everything else?
- Or should I also copy the other files from the demo /opt/midpoint/var directory?
- Or is there some other step to recompute key digests?

Any suggestions?

Thanks,
Eric

_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint

_______________________________________________ midPoint mailing list midPoint at lists.evolveum.com http://lists.evolveum.com/mailman/listinfo/midpoint 

_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint
-- 
Ivan Noris
Senior Identity Engineer
evolveum.com
_______________________________________________ midPoint mailing list midPoint at lists.evolveum.com http://lists.evolveum.com/mailman/listinfo/midpoint 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20181017/d48ce65a/attachment.htm>