cloudfoundry/credhub

CredHub centralizes and secures credential generation, storage, lifecycle management, and access

CredHub manages credentials like passwords, certificates, certificate authorities, ssh keys, rsa keys and arbitrary values (strings and JSON blobs). CredHub provides a CLI and API to get, set, generate and securely store such credentials.

• Documentation
• CredHub API Docs
• CredHub Tracker

CredHub is intended to be deployed by BOSH using the credhub-release BOSH release. This repository is for development and is not intended to be directly deployable.

Additional repos:

• credhub-cli: command line interface for credhub
• credhub-release: BOSH release of CredHub server
• credhub-acceptance-tests: integration tests written in Go.

Contributing to CredHub

The Cloud Foundry team uses GitHub and accepts contributions via pull request.

Contributor License Agreement

Follow these steps to make a contribution to any of our open source repositories:

1. Ensure that you have completed our CLA Agreement for individuals or corporations.

2. Set your name and email (these should match the information on your submitted CLA)

    git config --global user.name "Firstname Lastname"
    git config --global user.email "[email protected]"
   

Reporting a Vulnerability

We strongly encourage people to report security vulnerabilities privately to our security team before disclosing them in a public forum.

Please note that the e-mail address below should only be used for reporting undisclosed security vulnerabilities in open source Cloud Foundry codebases and managing the process of fixing such vulnerabilities. We cannot accept regular bug reports or other security-related queries at this address.

The e-mail address to use to contact the CFF Security Team is [email protected].

Our public PGP key can be obtained from a public key server such as pgp.mit.edu. Its fingerprint is: 3FC8 9AF3 940B E270 CF25 E122 9965 0006 EF9D C642. More information can be found at cloudfoundry.org/security.

General Workflow

1. Fork the repository
2. Create a feature branch (git checkout -b <my_new_branch>)
3. Make changes on your branch
4. Test your changes locally (see next section) and in a bosh-lite or other test environment.
5. Push to your fork (git push origin <my_new_branch>) and submit a pull request

We favor pull requests with very small, single commits with a single purpose. Your pull request is much more likely to be accepted if it is small and focused with a clear message that conveys the intent of your change.

Generating API Documentation

The CredHub API can generate API documentation by running its test suite (via Spring Rest Docs). CredHub API Documentation can be generated as follows:

./scripts/generate_documentation_snippets.sh

CredHub API documentation will be built as an html file in the CredHub backend gradle subproject build directory: backends/credhub/build/asciidoc/html5.

Development Configuration

Launching in production directly using the bootRun target is unsafe, as you will launch with a dev profile, which has checked-in secret keys in application-dev.yml.

Dependency Graph

A dependency graph of project components (gradle subprojects) can be generated to better understand project organization. You will need graphviz installed on your system in order to generate the graph.

./gradlew dependenciesGraph

Generally

Configuration for the server is spread across the application*.yml files.

• Configuration shared by all environments (dev, test, or BOSH-deployed) is in application.yml.
• Development-specific configuration is in application-dev.yml. This includes:
  • A UAA URL intended for development use only,
  • A JWT public verification key for use with that UAA, and
  • two dev-keys intended for development use only.
• Per-database configuration is placed in application-dev-h2.yml,application-dev-mysql.yml, and application-dev-postgres.yml. For convenience, these per-database profiles include the dev profile.

By default, CredHub launches with the dev-h2 and dev profiles enabled.

UAA and the JWT public signing key

CredHub requires a UAA server to manage authentication.

In application-dev.yml there are two relevant settings:

1. auth-server.url. This needs to point to a running UAA server (remote or BOSH-lite, it's up to you).
2. security.oauth2.resource.jwt.key-value. This is the public verification key, corresponding to a private JWT signing key held by your UAA server.

For convenience, the CredHub team runs a public UAA whose IP is in the default application-dev.yml manifest. The password grant values are credhub/password and the client credentials grant value are credhub_client/secret. This public UAA is for local development usage only! You will need to skip SSL validation in order to use it.

Running CredHub with local UAA

In order to run CredHub against a UAA running on your local machine, do the following:

1. Start a UAA with Docker: docker run -d --mount type=bind,source=$PWD/config/uaa.yml,target=/uaa/uaa.yml -p 127.0.0.1:8080:8080 pcfseceng/uaa:latest
2. Start CredHub server pointing at the local UAA: ./scripts/start_server.sh -Dspring.profiles.active=dev,dev-h2,dev-local-uaa

For testing purposes, the local UAA bootstraps a user (username: credhub/ password: password) and a client (client ID:credhub_client / client secret:secret), with which you can access the local CredHub. For example:

# log into CredHub CLI using a UAA client; this client comes with permissions to access all CredHub credential paths (see `application-dev.yml` manifest)
credhub login -s https://localhost:9000 --client-name=credhub_client --client-secret=secret --skip-tls-validation
# log into CredHub CLI using a UAA user; this user does not come with permissions to CredHub credential paths (see `application-dev.yml` manifest)
credhub login -s https://localhost:9000 -u credhub -p password --skip-tls-validation

Starting the server with different databases

H2 (the default)

H2 datasource configuration is in application-dev-h2.yml.

./scripts/start_server.sh

PostgreSQL

Postgres datasource configuration is in application-dev-postgres.yml.

Before development, you'll need to create the target database.

A local Postgres server with docker can be started as follows:

docker run --name postgres-server \
   --env POSTGRES_USER=pivotal \
   --env POSTGRES_HOST_AUTH_METHOD=trust \
   --detach \
   --publish 5432:5432 \
   postgres:15

createdb credhub_dev

Then to run in development mode with Postgres

./scripts/start_server.sh -Dspring.profiles.active=dev,dev-postgres

MySQL

MySQL datasource configuration is in application-dev-mysql.yml.

Log into your MySQL server and create databases credhub_dev and credhub_test with privileges granted to root.

mysql -u root
create database credhub_test;
create database credhub_dev;

If you're on a Mac using Homebrew and you run into a problem where you install MySQL and it isn't running (i.e., mysql -u root errors with a socket error), you may need to uninstall mysql, delete the /usr/local/var/mysql directory (Warning: this will delete all local MySQL data!), and then reinstall MySQL.

Alternatively, you can also start a local MySQL server with docker:

docker run \
  --name mysql-server \
  --env MYSQL_ALLOW_EMPTY_PASSWORD='yes' \
  --env MYSQL_ROOT_HOST='%' \
  --publish 3306:3306 \
  --detach \
  "mysql:8.0"

Then to run in development mode with MySQL:

./scripts/start_server.sh -Dspring.profiles.active=dev,dev-mysql

Debugging the server

To load JDWP agent for credhub jvm debugging, start the server as follows:

./scripts/start_server.sh -Pdebug=true

You can then attach your debugger to port 5005 of the jvm process.

To suspend the server start-up until the debugger is attached (useful for debugging start-up code), start the server as follows:

./scripts/start_server.sh -Pdebugs=true

Running tests with different databases

Testing with different databases requires you to set a system property with the profile corresponding to your desired database. For example, to test with H2, you'll need to run the tests with the -Dspring.profiles.active=unit-test-h2 profile.

During development, it is helpful to set up different IntelliJ testing profiles that use the following VM Options:

• -ea -Dspring.profiles.active=unit-test-h2 for testing with H2
• -ea -Dspring.profiles.active=unit-test-mysql for testing with MySQL
• -ea -Dspring.profiles.active=unit-test-postgres for testing with Postgres

Testing with the CLI and Acceptance Tests

Using the CLI locally

After having pulled the credhub-cli repo, run make, and then run the following command to target your locally running CredHub instance:

build/credhub login -s https://localhost:9000 --client-name=credhub_client --client-secret=secret --skip-tls-validation

Running the Acceptance Tests

First, be sure to pull and compile the credhub-cli, as described above.

Make sure your development server is running. When it starts up for the first time, it will create a server CA and server certificate for SSL, as well as a trusted client CA for testing mutual TLS authentication. These will be located in src/test/resources relative to the credhub repository.

Pull credhub-acceptance-tests and run:

CREDENTIAL_ROOT=/path/to/credhub/repo/plus/src/test/resources ./scripts/run_tests.sh

Assuming it works, that will generate some test client certificates for testing mutual TLS (in certs/ in the acceptance test directory) and run the acceptance test suite against your locally running credhub server.

Cleaning up orphaned encrypted_value records

To clean up orphaned encrypted_value records from CredHub version 2.12.70 and earlier (#231), follow the steps decribed in Cleaning up orphaned encrypted_value records.

credhub's Issues

Feature Request: return principal that created a credentials in get-credentials endpoint

As a credhub user, in order to clean up credhub entries following a bosh deployment deletion, I need to distinguish credhub entries that I (or my bosh-director) created from credhub entries other users created.

Currently the get-credentials endpoint only returns

{
  "id": "2993f622-cb1e-4e00-a267-4b23c273bf3d",
  "name": "/example-password",
  "type": "password",
  "value": "6mRPZB3bAfb8lRpacnXsHfDhlPqFcjH2h9YDvLpL",
  "version_created_at": "2017-01-05T01:01:01Z"
}

Additionally, the audit traces seem hard to access to credhub users (accessible in audit logs or credhub db) and targetted towards credhub admins or SIEM tools.

It would be useful to have get-credentials endpoint return additional field(s) describing the user/principal that generated the secret, inspired by the identity scheme

{
  "id": "2993f622-cb1e-4e00-a267-4b23c273bf3d",
  "name": "/example-password",
  "type": "password",
  "value": "6mRPZB3bAfb8lRpacnXsHfDhlPqFcjH2h9YDvLpL",
  "version_created_at": "2017-01-05T01:01:01Z",
  "created_by": {
      "auth_type": "uaa-user",
      "scope":"zone1",
      "primary_identifier": "1234" 
   }
}

Possibly additional fields available in the AuditRecord might be useful to include, such as username
https://github.com/cloudfoundry-incubator/credhub/blob/fc8bd65383e985bf1bdd271b4964a1449db58078/src/main/java/org/cloudfoundry/credhub/audit/CEFAuditRecord.java#L44

---

What version of the credhub server you are using?

2.0.2

Access control to restrict groups of users to specified paths

From @gdenn on October 13, 2017 7:25

Feature Request

Problem

We access the same credhub with multiple users through the credhub cli. But i don't want everyone to see all the variables in the credhub. E.g. we have credentials only relevant for specific Concourse Pipelines, credentials needed by an Administrator for our bosh deployment or simple credentials that help apps to access their dashboard.

As we are redeploying our bosh from time to time to include new features, it is important to us that the different people can access their passwords without conducting a system administrator.
But on the other hand we don't want to expose all credentials to everyone.

Solution

credhub cli could support different user groups. Each group gets e.g. access to a certain set of credentials that match a prefix. For our Concourse users this prefix would be /concourse.

With the different user groups i could create user accounts with only the access permissions i am comfortable to give.

best

Copied from original issue: cloudfoundry/credhub-cli#19

Credhub Server URL 404

Please update this dead links

When I tell credhub to include Special characters, it contains non-safe special Characters

Hi,
we tried to generate passwords with special characters in credhub. Unfortunately, credhub then includes characters like " in the created password. Due to us needing to follow guidelines that require special characters, we cannot use Credhub to create those Passwords for us. Therefore we would like to see the special characters feature improved, that all passwords generated can be safely used in bosh jobs. As an example you can use the Cloud Controller, which for example escapes passwords using double quotes.

CredHub CLI "find" command should behave like the unix find command for filesystems

I have no way of discovering credentials saved under the root path /. For example if I create an entry with no slashes in its name, I have to remember the name to get it back, since find -a and find -p / don't show them. Or I think someone else on my team mucked around with my CredHub and I want to see if they left anything around, and it's hard to figure out.

In general, it appears that find shows "directories", not credentials, contrary to what a lot of the help text for the find command says. Also, it refers to "directories" as "paths", which is confusing -- "paths" should refer to "directories" or entries. In general I'd expect to be able to navigate the CredHub KV store similar to how I'd navigate a file system with the find utility, with recursive listing, options for showing only directories or only "end-values", limiting the depth to show, etc.

Additional information:

$ ./credhub --version
CLI Version: 0.3.0
CM Version: 0.3.0 build DEV

NullPointerException when invocing api/v1/key-usage

What version of the credhub server you are using?
Server Version: 2.1.4

What version of the credhub cli you are using?
CLI Version: 2.3.0

If you were attempting to accomplish a task, what was it you were attempting to do?
Check status of key rotation process

curl -k 'https://xxxxxxxxxx:8844/info' -i -X GET     -H 'Content-Type: application/json'     -H "Authorization: $(credhub --token) "
HTTP/1.1 200 
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Frame-Options: DENY
Content-Type: application/json;charset=UTF-8
Transfer-Encoding: chunked
Date: Fri, 10 May 2019 12:25:31 GMT

{"auth-server":{"url":"https://xxxxx:8443"},"app":{"name":"CredHub"}}[yyyyyy rotate-credhub-enckey]$ 

What did you expect to happen?
Get response similar to { "active_key": 141240, "inactive_keys": 0, "unknown_keys": 0 }

What was the actual behavior?
Logs show a java null pointer exception, see below

Please confirm where necessary:

• [*] I have included a log output
• [*] My log includes an error message
• [* ] I have included steps for reproduction

If you are a PCF customer with an Operation Manager (PCF Ops Manager) please direct your questions to support (https://support.pivotal.io/)

java.lang.NullPointerException: null
        at java.util.UUID.fromString(UUID.java:192) ~[?:1.8.0_192]
        at org.cloudfoundry.credhub.data.CredentialVersionDataService.lambda$countByEncryptionKey$0(CredentialVersionDataService.java:182) ~[classes!/:?]
        at org.springframework.jdbc.core.RowMapperResultSetExtractor.extractData(RowMapperResultSetExtractor.java:94) ~[spring-jdbc-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.jdbc.core.RowMapperResultSetExtractor.extractData(RowMapperResultSetExtractor.java:61) ~[spring-jdbc-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.jdbc.core.JdbcTemplate$1QueryStatementCallback.doInStatement(JdbcTemplate.java:440) ~[spring-jdbc-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.jdbc.core.JdbcTemplate.execute(JdbcTemplate.java:376) ~[spring-jdbc-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.jdbc.core.JdbcTemplate.query(JdbcTemplate.java:452) ~[spring-jdbc-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.jdbc.core.JdbcTemplate.query(JdbcTemplate.java:462) ~[spring-jdbc-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.cloudfoundry.credhub.data.CredentialVersionDataService.countByEncryptionKey(CredentialVersionDataService.java:178) ~[classes!/:?]
        at org.cloudfoundry.credhub.controller.v1.KeyUsageController.getKeyUsages(KeyUsageController.java:42) ~[classes!/:?]
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_192]
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_192]
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_192]
        at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_192]
        at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:189) ~[spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:138) ~[spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:102) ~[spring-webmvc-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:895) ~[spring-webmvc-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:800) ~[spring-webmvc-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87) ~[spring-webmvc-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1038) [spring-webmvc-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:942) [spring-webmvc-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1005) [spring-webmvc-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:897) [spring-webmvc-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:634) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:882) [spring-webmvc-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:741) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53) [tomcat-embed-websocket-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:101) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:101) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.springframework.boot.actuate.web.trace.servlet.HttpTraceFilter.doFilterInternal(HttpTraceFilter.java:90) [spring-boot-actuator-2.1.3.RELEASE.jar!/:2.1.3.RELEASE]
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
[...]
        at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:270) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:92) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:93) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.filterAndRecordMetrics(WebMvcMetricsFilter.java:117) [spring-boot-actuator-2.1.3.RELEASE.jar!/:2.1.3.RELEASE]
        at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.doFilterInternal(WebMvcMetricsFilter.java:106) [spring-boot-actuator-2.1.3.RELEASE.jar!/:2.1.3.RELEASE]
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:200) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:200) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:490) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:834) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1415) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_192]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_192]
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at java.lang.Thread.run(Thread.java:748) [?:1.8.0_192]

Feature request: bulk delete in a directory

The Release Integration team is adding credhub support in cf-deployment-concourse-tasks.

For fresh deploys we would like to ensure that there are no credentials stored in CredHub prior to deploy. For vars store, it was pretty simple: we just threw away the vars store file.

To enable credhub, we have to do something like this:

for cred in `credhub f -j | jq -r .credentials[].name`; do credhub d -n $cred; done

Given 80+ credentials needed for cf-deployment, this is pretty slow and inconvenient. SOCKS5 proxy slows down connections even more.

We would love to have something like

credhub delete -p /my-bosh-director/cf

which will delete all credentials in a certain directory.

What version of the credhub server you are using?
v1.6.5

What version of the credhub cli you are using?
v1.7.0

CredHub CLI "find -n ''" should find all credentials, not none

./credhub find -n 'ab' only finds creds where "ab" is a substring of the cred name. So ./credhub find -n '' should find creds that have the empty string as a substring of the name, which should be every single string. Instead, this command returns nothing.

Assuming every credential has an alphabetical character in it, I can find all creds like this:

$ for x in {a..z}; do ./credhub find -n $x 2>/dev/null; done | grep 2016  | cut -f1 -d' ' | sort | uniq
DELETE_ME_AMIT
shell/pivotal/ssh_key

but that's not a desirable way to do it.

Additional info:

$ ./credhub --version
CLI Version: 0.3.0
CM Version: 0.3.0 build DEV

Document and improve policy on incompatible API updates

After a recent credhub update, we noted today that part of our infrastructure began receiving the error:

{"error":"The request includes an unrecognized parameter 'overwrite'. Please update or remove this parameter and retry your request."}

from PUT requests to /api/v1/data that contained "overwrite":true.

The fix (for us) was to convert to "mode":"overwrite".

Can someone please explain why the API is versioned, yet an incompatible change like this did not result in a bump to v2? (and, for trivial cases like this, the previous version signature still supported under the old path?) I would have thought that was the point of having a version as part of the API endpoint path?

Google seem to do a reasonably good job at this, it might be worth reading Dan Ciruli's blog post about it: https://cloud.google.com/blog/products/gcp/versioning-apis-at-google

See also related cloudfoundry/credhub-cli#50 - and thank you for fixing that.

Internal Exception not bubbled up to client

What version of the credhub server you are using?

$ credhub --version
CLI Version: 2.5.2
Server Version: 2.5.7

What version of the credhub cli you are using?

$ credhub --version
CLI Version: 2.5.2
Server Version: 2.5.7

If you were attempting to accomplish a task, what was it you were attempting to do?

credhub import -f <f>

What did you expect to happen?

The error to have been bubbled up to the client.

What was the actual behavior?

CLI output:

credhub import -f <f>
Credential '/bosh/x/x' at index 1 could not be set: An application error occurred. Please contact your CredHub administrator.

Log output (credhub.log):

2020-02-06T21:20:44.284Z [https-jsse-nio-8844-exec-8] .... ERROR --- DefaultExceptionHandler: An application error occurred. Please contact your CredHub administrator.
java.io.IOException: -----END RSA PRIVATE KEY not found
        at org.bouncycastle.util.io.pem.PemReader.loadObject(Unknown Source) ~[bc-fips-1.0.1.jar!/:?]
        at org.bouncycastle.util.io.pem.PemReader.readPemObject(Unknown Source) ~[bc-fips-1.0.1.jar!/:?]
        at org.bouncycastle.openssl.PEMParser.readObject(Unknown Source) ~[bcpkix-fips-1.0.2.jar!/:?]
        at org.cloudfoundry.credhub.utils.PrivateKeyReader$Companion.getPrivateKey(PrivateKeyReader.kt:25) ~[credentials.jar!/:?]
        at org.cloudfoundry.credhub.utils.PrivateKeyReader$Companion.getPublicKey(PrivateKeyReader.kt:42) ~[credentials.jar!/:?]
        at org.cloudfoundry.credhub.validators.CertificateMatchesPrivateKeyValidator.isValid(CertificateMatchesPrivateKeyValidator.kt:29) ~[credentials.jar!/:?]
        at org.hibernate.validator.internal.engine.constraintvalidation.ConstraintTree.validateSingleConstraint(ConstraintTree.java:171) ~[hibernate-validator-6.0.14.Fin
al.jar!/:6.0.14.Final]
        at org.hibernate.validator.internal.engine.constraintvalidation.SimpleConstraintTree.validateConstraints(SimpleConstraintTree.java:68) ~[hibernate-validator-6.0.
14.Final.jar!/:6.0.14.Final]
        at org.hibernate.validator.internal.engine.constraintvalidation.ConstraintTree.validateConstraints(ConstraintTree.java:73) ~[hibernate-validator-6.0.14.Final.jar
!/:6.0.14.Final]
        at org.hibernate.validator.internal.metadata.core.MetaConstraint.doValidateConstraint(MetaConstraint.java:127) ~[hibernate-validator-6.0.14.Final.jar!/:6.0.14.Fi
nal]
        at org.hibernate.validator.internal.metadata.core.MetaConstraint.validateConstraint(MetaConstraint.java:120) ~[hibernate-validator-6.0.14.Final.jar!/:6.0.14.Fina
l]
        at org.hibernate.validator.internal.engine.ValidatorImpl.validateMetaConstraint(ValidatorImpl.java:533) ~[hibernate-validator-6.0.14.Final.jar!/:6.0.14.Final]
        at org.hibernate.validator.internal.engine.ValidatorImpl.validateConstraintsForSingleDefaultGroupElement(ValidatorImpl.java:496) ~[hibernate-validator-6.0.14.Fin
al.jar!/:6.0.14.Final]
        at org.hibernate.validator.internal.engine.ValidatorImpl.validateConstraintsForDefaultGroup(ValidatorImpl.java:465) ~[hibernate-validator-6.0.14.Final.jar!/:6.0.
14.Final]
        at org.hibernate.validator.internal.engine.ValidatorImpl.validateConstraintsForCurrentGroup(ValidatorImpl.java:430) ~[hibernate-validator-6.0.14.Final.jar!/:6.0.
14.Final]
        at org.hibernate.validator.internal.engine.ValidatorImpl.validateInContext(ValidatorImpl.java:380) ~[hibernate-validator-6.0.14.Final.jar!/:6.0.14.Final]
        at org.hibernate.validator.internal.engine.ValidatorImpl.validateCascadedAnnotatedObjectForCurrentGroup(ValidatorImpl.java:605) ~[hibernate-validator-6.0.14.Fina
l.jar!/:6.0.14.Final]
        at org.hibernate.validator.internal.engine.ValidatorImpl.validateCascadedConstraints(ValidatorImpl.java:568) ~[hibernate-validator-6.0.14.Final.jar!/:6.0.14.Fina
l]
        at org.hibernate.validator.internal.engine.ValidatorImpl.validateInContext(ValidatorImpl.java:389) ~[hibernate-validator-6.0.14.Final.jar!/:6.0.14.Final]
        at org.hibernate.validator.internal.engine.ValidatorImpl.validate(ValidatorImpl.java:169) ~[hibernate-validator-6.0.14.Final.jar!/:6.0.14.Final]
        at org.cloudfoundry.credhub.requests.BaseCredentialRequest.enforceJsr303AnnotationValidations(BaseCredentialRequest.java:52) ~[credentials.jar!/:?]
        at org.cloudfoundry.credhub.requests.BaseCredentialRequest.validate(BaseCredentialRequest.java:47) ~[credentials.jar!/:?]
        at org.cloudfoundry.credhub.requests.BaseCredentialSetRequest.validate(BaseCredentialSetRequest.java:36) ~[credentials.jar!/:?]
        at org.cloudfoundry.credhub.credentials.CredentialsController.set(CredentialsController.kt:146) ~[credhub.jar!/:?]
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_192]
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_192]
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_192]
        at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_192]
        at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:189) ~[spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:138) ~[spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:102) ~[spring-webmvc-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:895) ~[spring-webmvc-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:800) ~[spring-webmvc-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87) ~[spring-webmvc-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1038) [spring-webmvc-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:942) [spring-webmvc-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1005) [spring-webmvc-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.servlet.FrameworkServlet.doPut(FrameworkServlet.java:919) [spring-webmvc-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:663) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:882) [spring-webmvc-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:741) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53) [tomcat-embed-websocket-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:101) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:101) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.springframework.boot.actuate.web.trace.servlet.HttpTraceFilter.doFilterInternal(HttpTraceFilter.java:90) [spring-boot-actuator-2.1.3.RELEASE.jar!/:2.1.3.RELEASE]
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:320) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:127) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:119) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:170) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter.doFilter(OAuth2AuthenticationProcessingFilter.java:176) [spring-security-oauth2-2.3.6.RELEASE.jar!/:?]
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter.doFilter(AbstractPreAuthenticatedProcessingFilter.java:121) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.cloudfoundry.credhub.config.OAuth2ExtraValidationFilter.doFilterInternal(OAuth2ExtraValidationFilter.java:82) [auth.jar!/:?]
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.cloudfoundry.credhub.auth.PreAuthenticationFailureFilter.doFilterInternal(PreAuthenticationFailureFilter.java:30) [auth.jar!/:?]
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:74) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178) [spring-security-web-5.1.4.RELEASE.jar!/:5.1.4.RELEASE]
        at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:357) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:270) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:92) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:93) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.filterAndRecordMetrics(WebMvcMetricsFilter.java:117) [spring-boot-actuator-2.1.3.RELEASE.jar!/:2.1.3.RELEASE]
        at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.doFilterInternal(WebMvcMetricsFilter.java:106) [spring-boot-actuator-2.1.3.RELEASE.jar!/:2.1.3.RELEASE]
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:200) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.1.5.RELEASE.jar!/:5.1.5.RELEASE]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:200) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:490) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:834) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1415) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_192]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_192]
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-9.0.16.jar!/:9.0.16]
        at java.lang.Thread.run(Thread.java:748) [?:1.8.0_192]

Please confirm where necessary:

• I have included a log output
• My log includes an error message

Clarify behavior when setting credentials without overwrite flag

When trying to set a credential in the API with a previous value without the overwrite flag, we were surprised that we got a 200 Success but the value didn't change

We would have expected to get a 403 Forbidden or maybe a 409 Conflict when the variable already has a value, and the overwrite key is not provided, so the value can't (and won't) be persisted. It would be great to either return a clearer error code, or if it's not a bug, document the behavior in the case explicitly.

Generating credentials through bosh appears to ignore parameters

We tried the following:

1. credhub ca-generate --name test_root_ca --common-name test_root_ca
2. Created a job spec with a property:

redis.cert:
  description: test cert
  type: certificate
  parameters:
    ca: test_root_ca

1. Referenced the property in the manifest:

properties:
  ...
  cert: ((redis-server-cert))

1. The deploy fails and we get the following error message in credhub.log

2016-10-31T12:32:28.032Z [https-jsse-nio-8844-exec-8] ....  INFO --- CREDHUB_SECURITY_EVENTS: CEF:0|pivotal|credhub|0.3.0 build DEV|POST /api/v1/data/credhub-lite/redis-service-dev1/redis-server-cert|POST /api/v1/data/credhub-lite/redis-service-dev1/redis-server-cert|0|rt=1477917148028 suser=null suid=null cs1Label=userAuthenticationMechanism cs1=oauth-access-token request=/api/v1/data/credhub-lite/redis-service-dev1/redis-server-cert requestMethod=POST cs3Label=result cs3=clientError cs4Label=httpStatusCode cs4=400 src=104.199.48.137 dst=104.199.48.137
2016-10-31T12:32:28.033Z [https-jsse-nio-8844-exec-8] .... DEBUG --- HttpEntityMethodProcessor: Written [{error=The request could not be completed because a default CA has not been defined. Please set a default CA or provide a named CA and retry your request.}] as "application/json;charset=UTF-8" using [org.springframework.http.converter.json.MappingJackson2HttpMessageConverter@299266e2]

We are using director v259 and credhub v0.3.0.

We'd appreciate your help figuring this out!

Cheers,
Craig & @Samze

cc : @avade

unsupported protocol scheme \"\"

Hi, guys, recently I tried to deploy cfcr env on mac, but met lots problems. Such as, when executed "credhub api --server=https://192.168.50.6:8443 --ca-cert=./cert" command would throw an error message "Get /info: unsupported protocol scheme """. Very weird. Please help me double check why? Thank you very much.

Don't see PivotalTracker links when opening up issues

When I open this issue, I'd expect an automatic link to a Pivotal Tracker story copying this issue to a story in the CredHub icebox. Makes it harder to know if issues opened here will be tracked by anyone. Looks like that's not setup.

/cc @pivotal-danjahner @ishustava

Document and refine the /health endpoint

I see that credhub is exposing a /health endpoint (which I could not yet find in the API documentation). This endpoint does not seem to check dependent resources health https://github.com/cloudfoundry-incubator/credhub/blob/c7aa6f0a51dbdc0ac48a5442b889adc9edb51db1/src/main/java/org/cloudfoundry/credhub/controller/v1/HealthController.java#L19

It seems the history of spring actuator code-like reuse indeed included related datasource health check 4702ca1

While external systems such as https://github.com/orange-cloudfoundry/credhub_exporter can monitor credhub health using find-credentials or get-credentials endpoint, the /health endpoint seems appealing (for performance and dependency coverage reasons).

I wonder whether direct usage of spring actuator was recently considered (as I could not find mention of it in the credhub pivotal tracker), and may address potential (performance?) issues that occured in the past.

/CC @psycofdj psycofdj

---

What version of the credhub server you are using?

2.0.2

read access to /api/v1/data requires credhub.write permissions

What version of the credhub server you are using?
https://github.com/pivotal/credhub-release/releases/tag/2.5.6

What version of the credhub cli you are using?
CLI Version: 2.6.1

If you were attempting to accomplish a task, what was it you were attempting to do?

we have credhub clients that should only be able to read credentials, not write them. we want to restrict the permissions of those clients to credhub.read.

What did you expect to happen?

a call to REST endpoint https://credhub-api.cfapps.io/version/2.5/#_get_a_credential_by_name using a bearer token with only credhub.read permissions should succeed

What was the actual behavior?

HTTP 403 error: Bearer error="insufficient_scope", error_description="Insufficient scope for this resource", scope="credhub.write"

curl example log:

curl -kv -H "Authorization: Bearer ${TOKEN}" 'https://10.250.2.9:8844/api/v1/data?current=true&name=%2Fexample-password'
*   Trying 10.250.2.9...
* Connected to 10.250.2.9 (10.250.2.9) port 8844 (#0)
* found 166 certificates in /etc/ssl/certs/ca-certificates.crt
* found 610 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* SSL connection using TLS1.2 / DHE_RSA_AES_128_GCM_SHA256
*        server certificate verification SKIPPED
*        server certificate status verification SKIPPED
*        common name: 10.250.2.9 (matched)
*        server certificate expiration date OK
*        server certificate activation date OK
*        certificate public key: RSA
*        certificate version: #3
*        subject: C=USA,O=Cloud Foundry,CN=10.250.2.9
*        start date: Wed, 11 Dec 2019 13:29:06 GMT
*        expire date: Thu, 10 Dec 2020 13:29:06 GMT
*        issuer: C=USA,O=Cloud Foundry,CN=CredHub CA
*        compression: NULL
* ALPN, server did not agree to a protocol
> GET /api/v1/data?current=true&name=%2example-password HTTP/1.1
> Host: 10.250.2.9:8844
> User-Agent: curl/7.47.0
> Accept: */*
> Authorization: Bearer <REDACTED>
< HTTP/1.1 403
< Pragma: no-cache
< WWW-Authenticate: Bearer error="insufficient_scope", error_description="Insufficient scope for this resource", scope="credhub.write"
< Cache-Control: no-store
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block
< Strict-Transport-Security: max-age=31536000 ; includeSubDomains
< X-Frame-Options: DENY
< Content-Type: application/json;charset=UTF-8
< Transfer-Encoding: chunked
< Date: Tue, 07 Jan 2020 16:22:28 GMT
<
* Connection #0 to host 10.250.2.9 left intact

Please confirm where necessary:

• I have included a log output
• My log includes an error message
• I have included steps for reproduction

Need to replace compiled release tarball package from ubuntu to Centos.

Hi All,

Good Day :)

Need to replace compiled release tarball package from ubuntu to Centos.

url: https://s3.amazonaws.com/bosh-compiled-release-tarballs/credhub-1.6.5-ubuntu-trusty-3541.10-20180329-193725-445975294-20180329193729.tgz?versionId=scvcFwaTcvkrpBoriVwjpomlFufz34Zh
sha1: f56ec2497e39ea00acb0cd0bbe818ae285b9b44

Following error occurred during the compilation

Deploying:
Running the pre-start script:
Sending 'get_task' to the agent:
Agent responded with error: Action Failed get_task: Task 626f2acc-1cd9-4095-7998-4c24b18a960c result: 1 of 5 pre-start scripts failed. Failed Jobs: uaa. Successful Jobs: postgres-9.4, director, user_add, credhub.

Exit code 1

Please let me know if there is any concerns.

Feature request: support meta-data associated to credhub objects

As usage of credhub expands and becomes a source of truth for operators configuration, it becomes useful to be able to attach additional meta-data to credhub entries in the set-credentials endpoint similar to the bosh job specs (metadata), e.g.

• a description field
• an example field
• a JSON schema field that would apply to the Valueor Json types (similarly as how json schemas are used by the OpenServiceBroker api by service authors to hint users about expected parameters format)

The meta-datas would help operators that might need to rotate or update credhub entries about the possible side effects of such updates, additional constraints/requirements expected on the values.

The meta-datas might not necessary be considered as sensitive data, and might be subject to cost optimization related to which storage to use (e.g. avoid storing them in HSM if this can be expensive)

This would also enable to tooling authors to provide credhub UIs.

---

What version of the credhub server you are using?
2.0.2

Deploy credhub inside a kubernetes cluster

Hi,

I am looking for some documentation about installing/deploying a CredHub instance inside a kubernetes/openshift cluster. Is it possible? Or is only available in cloud foundry platforms?

Thanks and regards.

How to add certificates to credhub use its rest api.

For password or string value, I can use the curl cmd below to add them into credhub. But if I want to add some certificate files, how to do it?

add a password:
curl -X PUT https://host:8844/api/v1/data -H 'Authorization: bearer token' -H 'cache-control: no-cache' -H 'content-type: application/json' -d '{"name": "/projectname/dbpassword","type": "password","overwrite": true,"value": "dbpassword"}' -k

Actor must not be null when using authorization_code grant type

What version of the credhub server you are using?
2.5.7

What version of the credhub cli you are using?
2.5.3

If you were attempting to accomplish a task, what was it you were attempting to do?
Credhub integrated into UAA (w/SAML) using a web app to read/write to credhub with ACLs set on various paths. The web app is using a UAA client with authorization_code grant type.

What did you expect to happen?
Data to be returned

What was the actual behavior?
No data. "IllegalStateException: actor must not be null" in the credhub log

Please confirm where necessary:

• I have included a log output
• My log includes an error message
• I have included steps for reproduction

If you are a PCF customer with an Operation Manager (PCF Ops Manager) please direct your questions to support (https://support.pivotal.io/)

This method is returning null, because it looks like it doesn't support the authorization_code grant type:
https://github.com/cloudfoundry-incubator/credhub/blob/87befb1dc9f6b7ddffa7ce6568ef04e21de3466d/components/auth/src/main/java/org/cloudfoundry/credhub/auth/UserContext.java#L107

Mutual TLS: permit empty organization unit in client cert

As mentioned in the mutual TLS docs, client certificates must contain an organization unit field in the form of app:some-guid.

The docs already make it sound like this'll be fixed at some point, I just wanted to +1 that from a user's perspective. :) This bit us when testing Concourse's CredHub integration, and we ended up having to generate our own certs in code rather than just use BOSH's variables feature. (See vmware-archive/topgun@b5300a1.) I would like to just not have to fill in anything for that field.

Do we have any web UI for credhub?

Do we have any web UI for credhub?

If not, do we have any plans in near future?

JVM error in Credhub logs

What version of the credhub server you are using?
Bosh director for vsphere v2.7.11-build.251

What version of the credhub cli you are using?
Bosh director for vsphere v2.7.11-build.251

If you were attempting to accomplish a task, what was it you were attempting to do?
Deploy PKS and create a cluster.

What did you expect to happen?
To successfully deploy PKS, connect to UAA.

What was the actual behavior?
[2020-02-24 20:56:56+0000] Could not reach the UAA server
[2020-02-25 00:35:16+0000] Successfully connected to UAA, continuing startup
[2020-02-25 00:35:16+0000] #
[2020-02-25 00:35:16+0000] # A fatal error has been detected by the Java Runtime Environment:
[2020-02-25 00:35:16+0000] #
[2020-02-25 00:35:16+0000] # SIGILL (0x4) at pc=0x00007f6d3114c1c2, pid=9607, tid=0x00007f6ced1e7700
[2020-02-25 00:35:16+0000] #
[2020-02-25 00:35:16+0000] # JRE version: OpenJDK Runtime Environment (8.0_192-b12) (build 1.8.0_192-b12)
[2020-02-25 00:35:16+0000] # Java VM: OpenJDK 64-Bit Server VM (25.192-b12 mixed mode linux-amd64 compressed oops)
[2020-02-25 00:35:16+0000] # Problematic frame:
[2020-02-25 00:35:16+0000] # J 15310 C1 com.fasterxml.jackson.core.base.ParserBase.(Lcom/fasterxml/jackson/core/io/IOContext;I)V (61 bytes) @ 0x00007f6d3114c1c2 [0x00007f6d3114c1a0+0x22]
[2020-02-25 00:35:16+0000] #
[2020-02-25 00:35:16+0000] # Failed to write core dump. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
[2020-02-25 00:35:16+0000] #
[2020-02-25 00:35:16+0000] # An error report file with more information is saved as:
[2020-02-25 00:35:16+0000] # /tmp/hs_err_pid9607.log
[2020-02-25 00:35:16+0000] #
[2020-02-25 00:35:16+0000] # If you would like to submit a bug report, please visit:
[2020-02-25 00:35:16+0000] # http://bugreport.java.com/bugreport/crash.jsp
[2020-02-25 00:35:16+0000] #

Please confirm where necessary:

• [X ] I have included a log output
• My log includes an error message
• I have included steps for reproduction

If you are a PCF customer with an Operation Manager (PCF Ops Manager) please direct your questions to support (https://support.pivotal.io/)

Will credhub be integrated into service brokers and build packs?

Is it a design goal of credhub to improve the security of credentials published and shared with application instances?

Using CredHub CLI to set a credential with special characters in its name causes segfault

$ ./credhub --version
CLI Version: 0.3.0
CM Version: 0.3.0 build DEV

$ ./credhub set -n '%.)' -v 123
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x38 pc=0x4f814b]
goroutine 1 [running]:
panic(0x698000, 0xc42000e090)
        /usr/local/Cellar/go/1.7.1/libexec/src/runtime/panic.go:500 +0x1a1
github.com/pivotal-cf/credhub-cli/client.newRequest(0x6e2a18, 0x3, 0xc4200aabe0, 0x16, 0xc4200aac00, 0x1c, 0xc420079680, 0x411, 0xc4200ca420, 0x22, ...)
        /Users/pivotal/go/src/github.com/pivotal-cf/credhub-cli/client/requests.go:207 +0x10b
github.com/pivotal-cf/credhub-cli/client.newSecretRequest(0x6e2a18, 0x3, 0xc4200aabe0, 0x16, 0xc4200aac00, 0x1c, 0xc420079680, 0x411, 0xc4200ca420, 0x22, ...)
        /Users/pivotal/go/src/github.com/pivotal-cf/credhub-cli/client/requests.go:191 +0xfe
github.com/pivotal-cf/credhub-cli/client.NewPutPasswordRequest(0xc4200aabe0, 0x16, 0xc4200aac00, 0x1c, 0xc420079680, 0x411, 0xc4200ca420, 0x22, 0x1, 0x7ffebeb9b995, ...)
        /Users/pivotal/go/src/github.com/pivotal-cf/credhub-cli/client/requests.go:34 +0x197
github.com/pivotal-cf/credhub-cli/commands.getRequest(0x7ffebeb9b995, 0x3, 0x6e3dc0, 0x8, 0x7ffebeb9b99c, 0x3, 0x0, 0x0, 0x0, 0x0, ...)
        /Users/pivotal/go/src/github.com/pivotal-cf/credhub-cli/commands/set.go:67 +0x513
github.com/pivotal-cf/credhub-cli/commands.SetCommand.Execute(0x7ffebeb9b995, 0x3, 0x6e3dc0, 0x8, 0x7ffebeb9b99c, 0x3, 0x0, 0x0, 0x0, 0x0, ...)
        /Users/pivotal/go/src/github.com/pivotal-cf/credhub-cli/commands/set.go:48 +0x238
github.com/pivotal-cf/credhub-cli/commands.(*SetCommand).Execute(0x837ce0, 0xc4200445f0, 0x0, 0x5, 0x1, 0x0)
        <autogenerated>:11 +0xb9
github.com/pivotal-cf/credhub-cli/vendor/github.com/jessevdk/go-flags.(*Parser).ParseArgs(0xc42000a2a0, 0xc42000a130, 0x5, 0x5, 0xc42006c090, 0xc42000a2a0, 0x7ffebeb9b986, 0x0, 0x0)
        /Users/pivotal/go/src/github.com/pivotal-cf/credhub-cli/vendor/github.com/jessevdk/go-flags/parser.go:314 +0x8e6
github.com/pivotal-cf/credhub-cli/vendor/github.com/jessevdk/go-flags.(*Parser).Parse(0xc42000a2a0, 0x837ca0, 0x2, 0xc42000a2a0, 0x0, 0x0)
        /Users/pivotal/go/src/github.com/pivotal-cf/credhub-cli/vendor/github.com/jessevdk/go-flags/parser.go:185 +0x74
main.main()
        /Users/pivotal/go/src/github.com/pivotal-cf/credhub-cli/main.go:16 +0x6d

Feature Request: DER certificates.

What version of the credhub server you are using?

$ credhub --version
CLI Version: 2.5.2
Server Version: 2.5.7

What version of the credhub cli you are using?

$ credhub --version
CLI Version: 2.5.2
Server Version: 2.5.7

If you were attempting to accomplish a task, what was it you were attempting to do?

Create a new DER-formatted certificate. It would be nice if there was an option for using DER-formatted certificates as part of the certificate generation process. SAML 2.0 requires DER-formatted certificates, so these certificates cannot be generated or managed by Credhub as Credhub only supports PEM-formatted certificates.

Failed to run `credhub api`, NPE reported on the credhub server side

CredHub server (together with postgres and uaa) was setup up using sample yml https://github.com/pivotal-cf/credhub-release/blob/master/sample-manifests/credhub-postgres-uaa.yml

Releases used:

- name: credhub
  url: https://bosh.io/d/github.com/pivotal-cf/credhub-release?v=1.3.0
  version: 1.3.0
  sha1: 2b13fa390bd1b0ec7ca69537d1ac67b101cf0f7d
- name: postgres
  url: https://bosh.io/d/github.com/cloudfoundry/postgres-release?v=20
  version: 20
  sha1: 3f378bcab294e20316171d4e656636df88763664
- name: uaa
  url: https://bosh.io/d/github.com/cloudfoundry/uaa-release?v=45
  version: 45
  sha1: 4d4fba13b724b75206f5eb3abae8efa94dcf7db8

Credhub Cli (version 1.4.1) was downloaded to another VM.

Failed to run credhub api command:

# credhub api https://<CredHub_server_ip>:8844/api/ --ca-cert credhub-ca.pem
The targeted API does not appear to be valid. Please validate the API address and retry your request.

On the CredHub server side, /var/vcap/sys/log/credhub/credhub.log reported error:

java.lang.NullPointerException: null
	at io.pivotal.security.auth.UserContextFactory.createUserContext(UserContextFactory.java:35) ~[classes!/:?]
	at io.pivotal.security.auth.UserContextFactory.createUserContext(UserContextFactory.java:30) ~[classes!/:?]
	at io.pivotal.security.audit.AuditInterceptor.afterCompletion(AuditInterceptor.java:56) ~[classes!/:?]
	at org.springframework.web.servlet.HandlerExecutionChain.triggerAfterCompletion(HandlerExecutionChain.java:169) [spring-webmvc-4.3.10.RELEASE.jar!/:4.3.10.RELEASE]
	at org.springframework.web.servlet.DispatcherServlet.processDispatchResult(DispatcherServlet.java:1059) [spring-webmvc-4.3.10.RELEASE.jar!/:4.3.10.RELEASE]
	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:984) [spring-webmvc-4.3.10.RELEASE.jar!/:4.3.10.RELEASE]
	at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:901) [spring-webmvc-4.3.10.RELEASE.jar!/:4.3.10.RELEASE]
	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:970) [spring-webmvc-4.3.10.RELEASE.jar!/:4.3.10.RELEASE]
	at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:861) [spring-webmvc-4.3.10.RELEASE.jar!/:4.3.10.RELEASE]
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:635) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846) [spring-webmvc-4.3.10.RELEASE.jar!/:4.3.10.RELEASE]
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:742) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:728) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:469) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:392) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:311) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.catalina.core.StandardHostValve.custom(StandardHostValve.java:395) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.catalina.core.StandardHostValve.status(StandardHostValve.java:254) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:177) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:80) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:799) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1455) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_141]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_141]
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_141]

Is there any problem? Anyway, NPE should not be reported.

Don't print out credentials on `credhub import`

What version of the credhub server you are using?
Server Version: 0.0.0

What version of the credhub cli you are using?
CLI Version: 1.7.5

If you were attempting to accomplish a task, what was it you were attempting to do?
credhub import --file <some-file>

What did you expect to happen?
Credhub to say successfully import credentials without printing the credentials to stdout. That is, I expect just the following output.

Import complete.
Successfully set: 3
Failed to set: 0

We are running this command in CI and I didn't expect the CLI to print out all our credentials to concourse web output.

What was the actual behavior?
The current behavior prints out all the credentials to stdout.
http://credhub-api.cfapps.io/version/2.1/#bulk-import

id: 67fc3def-bbfb-4953-83f8-4ab0682ad675
name: /example-ssh
type: ssh
value:
  public_key: ssh-rsa AAAAB3NzaC1y...W9RWFM1
  private_key: |
    -----BEGIN RSA PRIVATE KEY-----
    ...
    -----END RSA PRIVATE KEY-----
version_created_at: 2017-01-01T04:07:18Z

id: 2ba73fbd-439e-40ef-b005-0e1db8815063
name: /example-password
type: password
value: SqFcE2c0AuRvet2YhrxdFbPtkBmjiq
version_created_at: 2017-01-01T04:07:28Z

id: 22a1e87b-ba0b-4bc9-bb26-4e5fc5fb1b2f
name: /example-value
type: value
value: sample
version_created_at: 2017-01-01T04:07:38Z

Import complete.
Successfully set: 3
Failed to set: 0

Please confirm where necessary:

• I have included a log output
• My log includes an error message
• I have included steps for reproduction

If you are a PCF customer with an Operation Manager (PCF Ops Manager) please direct your questions to support (https://support.pivotal.io/)

Director <> Credhub workflow doc is out of date

This doc https://github.com/cloudfoundry-incubator/credhub/blob/master/docs/bosh-config-server.md#interpolation shows an outdated workflow for Director <> Credhub.

The workflow now is:

1. Send POST /api/v1/data for each variable the director is responsible for generating. [0]
2. Issue a GET /api/v1/data?name= for every variable that is being interpolated by the director during a deploy.
3. Issue a GET /api/v1/data/:id during a render of templates for a non-deploy action. e.g. comparing the current deployment's templates with the new deployment's manifest to detect change.

[0] We send a POST for every variable now since https://www.pivotaltracker.com/story/show/158947047. Since the director doesn't keep track of the update mode (overwrite, no-overwrite, converge) or options hash, we rely on credhub + the mode to conditionally generate the variable again or not. See the logs in the issue below.

Related: cloudfoundry/bosh#2126.

Error while importing credentials coming from an export

What version of the credhub server you are using?
Version 2.0.2

What version of the credhub cli you are using?
Version 2.0.0

If you were attempting to accomplish a task, what was it you were attempting to do?
I want to import credentials coming from a credhub export command

What did you expect to happen?
I expected my crendentials to be imported without error.

What was the actual behavior?
Some credentials could not be imported

Please confirm where necessary:

• I have included a log output
• My log includes an error message
• I have included steps for reproduction

If you try to export / import datas (even from / to the same credhub) you will have an error for all ssh and user type credentials.
You can reproduce theussue with these commands:

$ credhub set -t user -n john_user -z john -w john-secret
id: 484e340d-fe04-4541-a398-89ef2eeb0236
name: /john_user
type: user
value: <redacted>
version_created_at: "2018-09-21T13:52:20Z"

$ credhub export -f /tmp/credhub-export.yml
$ credhub import -f /tmp/credhub-export.yml
Credential '/john_user' at index 0 could not be set: The request includes an unrecognized parameter 'password_hash'. Please update or remove this parameter and retry your request.

Import complete.
Successfully set: 0
Failed to set: 1
 - Credential '/john_user' at index 0 could not be set: The request includes an unrecognized parameter 'password_hash'. Please update or remove this parameter and retry your request.

The error concerns fields that can be automaticaly retrieved.

• public_key_fingerprint for ssh type
• password_hash for user type

CLI login timeout breaks security

What version of the credhub server you are using?

1.7.2

What version of the credhub cli you are using?

1.6.0

If you were attempting to accomplish a task, what was it you were attempting to do?

credhub login --client-name foo --client-secret bar -s --ca-cert

What did you expect to happen?

Login succeeds, and I would be logged in for a decent amount of time ( > 30 minutes )

What was the actual behavior?

Login succeeds, but I am forced to login over and over again (after every 30 seconds it seems).

Problem

This behaviour encourages all developers to set the password in their bashrc/zshrc files, meaning security is flawed as the password is suddenly exposed in files on every users computer.
This behaviour is now being observed after upgrading to 1.7.2

More obvious logging expected

I understand that it's cosmetic change, but probably worth mentioning, to make product better.

What version of the credhub server you are using?
Server Version: 2.5.4

What version of the credhub cli you are using?
CLI Version: 2.5.3

If you were attempting to accomplish a task, what was it you were attempting to do?
Set CA certificate with empty Certificate and Private Key fields with the command like this
credhub set -n /my_credential_name -t rsa -r /ca.crt

What did you expect to happen?
The log output with smth similar to certificate and private key are mandatory for rsa type

What was the actual behavior?
At least one key value must be set. Please validate your input and retry your request.
The log output is a bit confusing and can lead to wrong debug direction

Please confirm where necessary:

• I have included a log output
• My log includes an error message
• I have included steps for reproduction

If you are a PCF customer with an Operation Manager (PCF Ops Manager) please direct your questions to support (https://support.pivotal.io/)

Failed to run `credhub api`, NPE reported on the credhub server side

The issue #16 is not resolved but closed which I can't reopen. So create a new one.

CredHub server (together with postgres and uaa) was setup up using sample yml https://github.com/pivotal-cf/credhub-release/blob/master/sample-manifests/credhub-postgres-uaa.yml

Releases used:

- name: credhub
  url: https://bosh.io/d/github.com/pivotal-cf/credhub-release?v=1.3.0
  version: 1.3.0
  sha1: 2b13fa390bd1b0ec7ca69537d1ac67b101cf0f7d
- name: postgres
  url: https://bosh.io/d/github.com/cloudfoundry/postgres-release?v=20
  version: 20
  sha1: 3f378bcab294e20316171d4e656636df88763664
- name: uaa
  url: https://bosh.io/d/github.com/cloudfoundry/uaa-release?v=45
  version: 45
  sha1: 4d4fba13b724b75206f5eb3abae8efa94dcf7db8

Credhub Cli (version 1.4.1) was downloaded to another VM.

Failed to run credhub api command:

# credhub api https://<CredHub_server_ip>:8844/api/ --ca-cert credhub-ca.pem
The targeted API does not appear to be valid. Please validate the API address and retry your request.

On the CredHub server side, /var/vcap/sys/log/credhub/credhub.log reported error:

java.lang.NullPointerException: null
	at io.pivotal.security.auth.UserContextFactory.createUserContext(UserContextFactory.java:35) ~[classes!/:?]
	at io.pivotal.security.auth.UserContextFactory.createUserContext(UserContextFactory.java:30) ~[classes!/:?]
	at io.pivotal.security.audit.AuditInterceptor.afterCompletion(AuditInterceptor.java:56) ~[classes!/:?]
	at org.springframework.web.servlet.HandlerExecutionChain.triggerAfterCompletion(HandlerExecutionChain.java:169) [spring-webmvc-4.3.10.RELEASE.jar!/:4.3.10.RELEASE]
	at org.springframework.web.servlet.DispatcherServlet.processDispatchResult(DispatcherServlet.java:1059) [spring-webmvc-4.3.10.RELEASE.jar!/:4.3.10.RELEASE]
	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:984) [spring-webmvc-4.3.10.RELEASE.jar!/:4.3.10.RELEASE]
	at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:901) [spring-webmvc-4.3.10.RELEASE.jar!/:4.3.10.RELEASE]
	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:970) [spring-webmvc-4.3.10.RELEASE.jar!/:4.3.10.RELEASE]
	at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:861) [spring-webmvc-4.3.10.RELEASE.jar!/:4.3.10.RELEASE]
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:635) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846) [spring-webmvc-4.3.10.RELEASE.jar!/:4.3.10.RELEASE]
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:742) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:728) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:469) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:392) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:311) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.catalina.core.StandardHostValve.custom(StandardHostValve.java:395) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.catalina.core.StandardHostValve.status(StandardHostValve.java:254) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:177) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:80) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:799) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1455) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_141]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_141]
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_141]

When I changed to credhub api https://<CredHub_server_ip>:8844 --ca-cert credhub-ca.pem, I got this error:
Get https://127.0.0.1:8443/info: dial tcp 127.0.0.1:8443: getsockopt: connection refused

Discussion: Support for additional credential types

Related to the Credhub vs Vault discussion, one Vault feature I wish was in Credhub is support for more varied secret generators. Specially an AWS IAM generator or similar for GCP would be a big help in moving our CI towards more limited and ephemeral credentials. For example:

credhub generate -t gcp-service-account -n blobstore-reader --roles StorageObjectView
# outputs a GCP JSON key

I'm imagining a workflow where rather than specifying static IaaS credentials in our pipeline, our CI jobs can ask Credhub for a Service Account scoped to exactly the set of permissions that CI job requires at runtime. The CI pipeline could then tell Credhub to revoke the credential at the end of a successful run (or maybe Credhub supports an expires_at).

Would the Credhub team have any interest is supporting something like this long-term?

"/lol" path should not result in 500 server error

README request: CredHub vs Vault

It would be awesome to summarize "CredHub vs Vault" in the readme. This will help explain to everyone why we are going down a path that's independent of the Vault ecosystem of existing tooling; and for non-CF/BOSH users it would explain why they'd deploy CredHub rather than Vault.

Add .cf-extensions to your repo to be listed in cloudfoundry-incubator.cf-extensions

Add .cf-extensions file to your repo so that it shows correctly in the CF-Extensions hub and catalog.

{
  "lead_company": "ADD LEAD COMPANY HERE",
  "contact_email": "[email protected]",
  "description": "ADD DESCRIPTION HERE",
  "tracker_url": "https://www.pivotaltracker.com",
  "proposal_url": "https://docs.google.com/document/d/1cpyBmds7WYNLKO1qkjhCdS8bNSJjWH5MqTE-h1UCQkQ/edit?usp=sharing",
  "proposed_date": "2017-08-29 10:31:52.56862848 -0700 PDT"
}

or

lead_company: ADD LEAD COMPANY HERE
contact_email: [email protected]
description: ADD DESCRIPTION HERE
tracker_url: https://www.pivotaltracker.com
proposal_url: https://docs.google.com/document/d/1cpyBmds7WYNLKO1qkjhCdS8bNSJjWH5MqTE-h1UCQkQ/edit?usp=sharing
proposed_date: 2017-08-29 10:31:52.56862848 -0700 PDT

This is a JSON or YAML formatted file. The default values in the file are for you to get started. You should edit to match your project's data.

For example, the field tracker_url should contain your project's tracker URL, and so on.

FINAL NOTES

You may also add two more optional fields: logo_url and icon_url pointing to images for your logo and icon respectively.

For best results your images should be in JPG or PNG file formats and their sizes around 200x300 pixels for logo and 32x32 pixels for icon.

Delete method in CredentialDataService not transactional. Possible StaleStateException

Hello CredHub team, I had look at the delete implementation of the CredentialDataService.java
What drew my attention here is the fact that there is a find, and a delete method that do not happen inside a transaction. I would expect to have the delete method transactional and not only the deleteByNameIgnoreCase as transactional.
Could not this cause problems during the deletion of the credentials? The find method could retrieve a cached version of the credential that is not actual anymore. And then the deleteByNameIgnoreCase method would fail, since it might happen that this credential is not there anymore. This seems a strange behaviour that could lead to a StaleStateException https://docs.jboss.org/hibernate/orm/3.5/api/org/hibernate/StaleStateException.html

Unable to gain valid mTLS client certs

What version of the credhub server you are using?
Master, at commit 6eb9d8c

What version of the credhub cli you are using?
2.2.0

If you were attempting to accomplish a task, what was it you were attempting to do?
I was attempting to test the new mTLS client in the go-credhub repo by running CredHub locally and using its test certificates.

What did you expect to happen?
I was expecting to be able to test CredHub's mTLS auth with client certs.

What was the actual behavior?

I may be going about this test incorrectly. Here's what I was doing. I started CredHub locally using:

$ ./scripts/start_server.sh -Dspring.profiles.active=dev,dev-h2,dev-local-uaa

I attempted to use the linked client using various combinations of the certs generated in src/test/resources, such as client_ca_cert.pem and client_ca_private.pem, and server_ca_cert.pem and server_ca_private.pem. None worked. I noticed that perhaps I needed separate client certs that would be generated by running acceptance tests, as per the README:

Assuming it works, that will generate some test client certificates for testing mutual TLS (in certs/ in the acceptance test directory) and run the acceptance test suite against your locally running credhub server.

However, after attempting to run those tests using:

$ CREDENTIAL_ROOT=/home/tbex/go/src/github.com/cloudfoundry-incubator/credhub/src/test/resources UAA_CA=/home/tbex/go/src/github.com/cloudfoundry-incubator/credhub/src/test/resources/ca/dev_uaa.pem ./scripts/run_tests.sh

... the mTLS tests succeed, but the smoke tests fail with:

• Failure in Spec Teardown (AfterEach) [0.075 seconds]
UAA Lifecycle [AfterEach] lifecycle 
/home/tbex/go/src/github.com/cloudfoundry-incubator/credhub-acceptance-tests/vendor/github.com/onsi/ginkgo/ginkgo_dsl.go:365

  Expected error:
      <*errors.errorString | 0xc0005b4590>: {
          s: "Received HTTP 403 error while revoking token from auth server: \"{\\\"error\\\":\\\"insufficient_scope\\\",\\\"error_description\\\":\\\"Insufficient scope for this resource\\\",\\\"scope\\\":\\\"uaa.admin tokens.revoke\\\"}\"",
      }
      Received HTTP 403 error while revoking token from auth server: "{\"error\":\"insufficient_scope\",\"error_description\":\"Insufficient scope for this resource\",\"scope\":\"uaa.admin tokens.revoke\"}"
  not to have occurred

  /home/tbex/go/src/github.com/cloudfoundry-incubator/credhub-acceptance-tests/api_client_test/uaa_lifecycle_test.go:15
------------------------------
•••••••••

Summarizing 1 Failure:

[Fail] UAA Lifecycle [AfterEach] lifecycle 
/home/tbex/go/src/github.com/cloudfoundry-incubator/credhub-acceptance-tests/api_client_test/uaa_lifecycle_test.go:15

Ran 18 of 18 Specs in 1.497 seconds
FAIL! -- 17 Passed | 1 Failed | 0 Pending | 0 Skipped

And there is no resulting certs/ directory yielding test certs.

Using Credhub behind Concourse, database growing?

What version of the credhub server you are using?

1.6.5 via https://github.com/starkandwayne/bucc/releases/tag/v0.4.1

What version of the credhub cli you are using?

1.6.0

If you were attempting to accomplish a task, what was it you were attempting to do?

Backup my BOSH + Credhub

bucc bbr backup

What did you expect to happen?

• I expected it to happen relatively quickly. I'm only use the credhub for < 100 items across my BOSH + Concourse.

What was the actual behavior?

It took 4 mins to backup credhub database:

[bbr] 2018/03/16 22:38:21 INFO - Backing up credhub on bosh/0...
[bbr] 2018/03/16 22:42:56 INFO - Finished backing up credhub on bosh/0.

The credhub backup is over 2G

-rw-rw-r-- 1 jumpbox jumpbox 2.3G Mar 16 22:46 bosh-0-credhub.tar

Is there an audit log or similar inside my database that's growing regularly because Concourse is polling it? Suggestions for operators to cleanup their DB to constrain its size?

Question: Pushing credhub to CF as an app?

Hi all

I'm thinking about pushing credhub to CF as an app. It looks like a regular spring boot application with a RDBMS backend, so it should run happily in CF...

Am I wrong? I noticed that there is no doc how to push it to CF (as opposed to UAA, where it's advertised very prominently) and Pivotal also only seems to ship it as a bosh release.
The README also explicitly states This repository is for development and is not intended to be directly deployable.

It looks like somehow it's not really supported to run it as an app. Is this true? Should credhub only be deployed as a bosh release?

Please create github releases with release notes?

I saw in #bosh channel that 1.8.0 was released. I came to this repo and find there are 0 github releases. Can we please start publishing github releases & release notes? This is how other CFF projects are communicating (and the releases go out to Watters via email notifications)

@chipchilders has the foundation or PMC ever discussed a consistent way for all repos to communicate new releases?

NullPointerException when setting certificate

We're trying to set a certificate value:

./credhub set -n /bosh-bbl-env-saimaa-2017-10-23t12-59z/concourse/atc_tls -t certificate -r concourse_ssl/ca -c concourse_ssl/certificate -p concourse_ssl/private_key

The CLI output is:

An application error occurred. Please contact your CredHub administrator.

In the credhub server logs we see the following:

==> credhub.log <==
2018-02-08T10:19:45.716Z [https-jsse-nio-8844-exec-8] .... ERROR --- DefaultExceptionHandler: An application error occurred. Please contact your CredHub administrator.
javax.validation.ValidationException: HV000028: Unexpected exception during isValid call.
	at org.hibernate.validator.internal.engine.constraintvalidation.ConstraintTree.validateSingleConstraint(ConstraintTree.java:451) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.engine.constraintvalidation.ConstraintTree.validateConstraints(ConstraintTree.java:127) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.engine.constraintvalidation.ConstraintTree.validateConstraints(ConstraintTree.java:87) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.metadata.core.MetaConstraint.validateConstraint(MetaConstraint.java:73) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.engine.ValidatorImpl.validateMetaConstraint(ValidatorImpl.java:620) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.engine.ValidatorImpl.validateConstraint(ValidatorImpl.java:583) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.engine.ValidatorImpl.validateConstraintsForSingleDefaultGroupElement(ValidatorImpl.java:527) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.engine.ValidatorImpl.validateConstraintsForDefaultGroup(ValidatorImpl.java:495) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.engine.ValidatorImpl.validateConstraintsForCurrentGroup(ValidatorImpl.java:460) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.engine.ValidatorImpl.validateInContext(ValidatorImpl.java:410) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.engine.ValidatorImpl.validateCascadedConstraint(ValidatorImpl.java:761) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.engine.ValidatorImpl.validateCascadedConstraints(ValidatorImpl.java:684) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.engine.ValidatorImpl.validateInContext(ValidatorImpl.java:419) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.engine.ValidatorImpl.validate(ValidatorImpl.java:207) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at io.pivotal.security.request.BaseCredentialRequest.enforceJsr303AnnotationValidations(BaseCredentialRequest.java:93) ~[classes!/:?]
	at io.pivotal.security.request.BaseCredentialRequest.validate(BaseCredentialRequest.java:88) ~[classes!/:?]
	at io.pivotal.security.request.BaseCredentialSetRequest.validate(BaseCredentialSetRequest.java:34) ~[classes!/:?]
	at io.pivotal.security.controller.v1.CredentialsController.set(CredentialsController.java:97) ~[classes!/:?]
	at sun.reflect.GeneratedMethodAccessor144.invoke(Unknown Source) ~[?:?]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_152]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_152]
	at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:205) ~[spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:133) ~[spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:97) ~[spring-webmvc-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:827) ~[spring-webmvc-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:738) ~[spring-webmvc-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:85) ~[spring-webmvc-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:967) [spring-webmvc-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:901) [spring-webmvc-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:970) [spring-webmvc-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.servlet.FrameworkServlet.doPut(FrameworkServlet.java:883) [spring-webmvc-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:664) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846) [spring-webmvc-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:742) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) [tomcat-embed-websocket-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:101) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:101) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:317) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:127) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:114) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:170) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter.doFilter(OAuth2AuthenticationProcessingFilter.java:176) [spring-security-oauth2-2.0.14.RELEASE.jar!/:?]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter.doFilter(AbstractPreAuthenticatedProcessingFilter.java:121) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at io.pivotal.security.config.OAuth2ExtraValidationFilter.doFilterInternal(OAuth2ExtraValidationFilter.java:78) [classes!/:?]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at io.pivotal.security.auth.PreAuthenticationFailureFilter.doFilterInternal(PreAuthenticationFailureFilter.java:28) [classes!/:?]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:64) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:214) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:347) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:263) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.java:108) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:81) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:197) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:199) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:478) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:803) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1459) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_152]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_152]
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_152]
Caused by: java.lang.RuntimeException: java.lang.RuntimeException: java.lang.NullPointerException
	at io.pivotal.security.validator.CertificateSignedByCAValidator.isValid(CertificateSignedByCAValidator.java:38) ~[classes!/:?]
	at org.hibernate.validator.internal.engine.constraintvalidation.ConstraintTree.validateSingleConstraint(ConstraintTree.java:448) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	... 116 more
Caused by: java.lang.RuntimeException: java.lang.NullPointerException
	at io.pivotal.security.util.CertificateReader.isSignedByCa(CertificateReader.java:91) ~[classes!/:?]
	at io.pivotal.security.validator.CertificateSignedByCAValidator.isValid(CertificateSignedByCAValidator.java:35) ~[classes!/:?]
	at org.hibernate.validator.internal.engine.constraintvalidation.ConstraintTree.validateSingleConstraint(ConstraintTree.java:448) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	... 116 more
Caused by: java.lang.NullPointerException
	at io.pivotal.security.util.CertificateReader.isSignedByCa(CertificateReader.java:84) ~[classes!/:?]
	at io.pivotal.security.validator.CertificateSignedByCAValidator.isValid(CertificateSignedByCAValidator.java:35) ~[classes!/:?]
	at org.hibernate.validator.internal.engine.constraintvalidation.ConstraintTree.validateSingleConstraint(ConstraintTree.java:448) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	... 116 more

We're using:
CLI Version: 1.5.3
Server Version: 1.6.5

This error only occurs when we try to upload the certificate in combination with the private key. Uploading the values {root ca, certificate, private key} individually or in the combinations (root ca, certificate) or (root ca, private key) works fine.

Credhub Deployment Failure - Encryption Provider

I'm getting an error trying to deploy Credhub alongside the Director:
From: /var/vcap/sys/log/credhub/credhub.log

Error starting ApplicationContext. To display the auto-configuration report re-run your application with 'debug' enabled.
2018-10-10T20:56:29.797Z [main] .... ERROR --- SpringApplication: Application startup failed
org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'encryptedValueDataService' defined in URL [jar:file:/var/vcap/data/packages/credhub/13a554b2cb4fbf2bfd25326f7dbb11da156a2e50/credhub.jar!/BOOT-INF/classes!/io/pivotal/security/data/EncryptedValueDataService.class]: Unsatisfied dependency expressed through constructor parameter 0; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'encryptionKeyCanaryMapper' defined in URL [jar:file:/var/vcap/data/packages/credhub/13a554b2cb4fbf2bfd25326f7dbb11da156a2e50/credhub.jar!/BOOT-INF/classes!/io/pivotal/security/service/EncryptionKeyCanaryMapper.class]: Bean instantiation via constructor failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [io.pivotal.security.service.EncryptionKeyCanaryMapper]: Constructor threw exception; nested exception is java.lang.RuntimeException: java.lang.NullPointerException

Checked the docs: https://github.com/pivotal-cf/credhub-release/blob/master/docs/troubleshooting-guide.md

[Post-start error] org.cloudfoundry.credhub.service.EncryptionKeyCanaryMapper required a bean of type 'org.cloudfoundry.credhub.service.EncryptionService' that could not be found
This failure indicates that the active encryption provider type has not be defined or is an invalid value. Check the encryption.providers.type value in your manifest.

Here's my manifest (snippet) - taken from the credhub.yml ops file:

    encryption:
     providers:
     - name: internal
      type: internal
     keys:
     - provider_name: internal
      key_properties:
       encryption_password: ((credhub_encryption_password))
      active: true

I'v checked creds.yml and there is a value present for credhub_encryption_password.

I have another Director+USA+Credhub working fine using the same release versions and manifests, the only difference being the working deployment is done from an Ubuntu 16 vm, and the failing from a RHEL7 vm.

Any ideas?

Symlink style credentials

As a credhub user, I would like to be able to have the same credential be available in different paths.
To be able use bosh generated variables (/{director_name}/{deployment_name}/{variable_name}) in concourse (/concourse/{team_name}/{variable_name}).

Related issues:

• concourse/concourse#291 (comment)
• hashicorp/vault#1284

Changing the private key and certificate for an existing certificate variable causes exception

What version of the credhub server you are using?

1.6.5

What version of the credhub cli you are using?

1.6.0

If you were attempting to accomplish a task, what was it you were attempting to do?

credhub set -n /bosh-bbl-env-great-bear-2018-04-06t21-46z/cf/router_ssl -t certificate -c ./cert_chain -p ./private-key

The cert_chain file has content in this format:

<cert for *.panda.cf-app.com>

<intermediate CA cert 2>

<intermediate CA cert 1>

<root CA cert>

What did you expect to happen?

We expected the values to be updated in credhub

What was the actual behavior?

The CLI showed this error:

An application error occurred. Please contact your CredHub administrator.

When we looked at the logs on the credhub server, we saw this:

==> /var/vcap/sys/log/credhub/credhub.log <==
2018-05-04T19:21:13.975Z [https-jsse-nio-8844-exec-17] .... ERROR --- DefaultExceptionHandler: An application error occurred. Please contact your CredHub administrator.
javax.validation.ValidationException: HV000028: Unexpected exception during isValid call.
	at org.hibernate.validator.internal.engine.constraintvalidation.ConstraintTree.validateSingleConstraint(ConstraintTree.java:451) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.engine.constraintvalidation.ConstraintTree.validateConstraints(ConstraintTree.java:127) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.engine.constraintvalidation.ConstraintTree.validateConstraints(ConstraintTree.java:87) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.metadata.core.MetaConstraint.validateConstraint(MetaConstraint.java:73) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.engine.ValidatorImpl.validateMetaConstraint(ValidatorImpl.java:620) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.engine.ValidatorImpl.validateConstraint(ValidatorImpl.java:583) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.engine.ValidatorImpl.validateConstraintsForSingleDefaultGroupElement(ValidatorImpl.java:527) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.engine.ValidatorImpl.validateConstraintsForDefaultGroup(ValidatorImpl.java:495) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.engine.ValidatorImpl.validateConstraintsForCurrentGroup(ValidatorImpl.java:460) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.engine.ValidatorImpl.validateInContext(ValidatorImpl.java:410) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.engine.ValidatorImpl.validateCascadedConstraint(ValidatorImpl.java:761) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.engine.ValidatorImpl.validateCascadedConstraints(ValidatorImpl.java:684) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.engine.ValidatorImpl.validateInContext(ValidatorImpl.java:419) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at org.hibernate.validator.internal.engine.ValidatorImpl.validate(ValidatorImpl.java:207) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	at io.pivotal.security.request.BaseCredentialRequest.enforceJsr303AnnotationValidations(BaseCredentialRequest.java:93) ~[classes!/:?]
	at io.pivotal.security.request.BaseCredentialRequest.validate(BaseCredentialRequest.java:88) ~[classes!/:?]
	at io.pivotal.security.request.BaseCredentialSetRequest.validate(BaseCredentialSetRequest.java:34) ~[classes!/:?]
	at io.pivotal.security.controller.v1.CredentialsController.set(CredentialsController.java:97) ~[classes!/:?]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_152]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_152]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_152]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_152]
	at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:205) ~[spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:133) ~[spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:97) ~[spring-webmvc-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:827) ~[spring-webmvc-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:738) ~[spring-webmvc-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:85) ~[spring-webmvc-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:967) [spring-webmvc-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:901) [spring-webmvc-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:970) [spring-webmvc-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.servlet.FrameworkServlet.doPut(FrameworkServlet.java:883) [spring-webmvc-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:664) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846) [spring-webmvc-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:742) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) [tomcat-embed-websocket-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:101) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:101) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:317) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:127) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:114) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:170) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter.doFilter(OAuth2AuthenticationProcessingFilter.java:176) [spring-security-oauth2-2.0.14.RELEASE.jar!/:?]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter.doFilter(AbstractPreAuthenticatedProcessingFilter.java:121) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at io.pivotal.security.config.OAuth2ExtraValidationFilter.doFilterInternal(OAuth2ExtraValidationFilter.java:78) [classes!/:?]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at io.pivotal.security.auth.PreAuthenticationFailureFilter.doFilterInternal(PreAuthenticationFailureFilter.java:28) [classes!/:?]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:64) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:214) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177) [spring-security-web-4.2.3.RELEASE.jar!/:4.2.3.RELEASE]
	at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:347) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:263) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.java:108) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:81) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:197) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.3.12.RELEASE.jar!/:4.3.12.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:199) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:478) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:803) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1459) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_152]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_152]
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-8.5.23.jar!/:8.5.23]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_152]
Caused by: java.lang.RuntimeException: java.lang.ClassCastException: org.bouncycastle.asn1.pkcs.PrivateKeyInfo cannot be cast to org.bouncycastle.openssl.PEMKeyPair
	at io.pivotal.security.validator.CertificateMatchesPrivateKeyValidator.isValid(CertificateMatchesPrivateKeyValidator.java:48) ~[classes!/:?]
	at org.hibernate.validator.internal.engine.constraintvalidation.ConstraintTree.validateSingleConstraint(ConstraintTree.java:448) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	... 117 more
Caused by: java.lang.ClassCastException: org.bouncycastle.asn1.pkcs.PrivateKeyInfo cannot be cast to org.bouncycastle.openssl.PEMKeyPair
	at io.pivotal.security.util.PrivateKeyReader.getPublicKey(PrivateKeyReader.java:25) ~[classes!/:?]
	at io.pivotal.security.validator.CertificateMatchesPrivateKeyValidator.isValid(CertificateMatchesPrivateKeyValidator.java:44) ~[classes!/:?]
	at org.hibernate.validator.internal.engine.constraintvalidation.ConstraintTree.validateSingleConstraint(ConstraintTree.java:448) ~[hibernate-validator-5.3.5.Final.jar!/:5.3.5.Final]
	... 117 more

Additional details

We also tried putting the certificate in its own file (cert) and the CA chain in another file (ca_chain) and running the following command:

ch set -n /bosh-bbl-env-great-bear-2018-04-06t21-46z/cf/router_ssl -t certificate -c ./cert -p ./key -r ./ca_chain

This also didn't work. We were able to update either the cert or the private key separately, but this cleared the other fields.

We are happy to provide the ca certs and private key on request, though obviously we won't post them here.

Please confirm where necessary:

• I have included a log output
• My log includes an error message
• I have included steps for reproduction

Thanks!
Matt + Brendan of the BAM team
Pivotal R&D

"credhub generate --no-overwrite" overwrites passwords set with "credhub set"

What version of the credhub server / cli are you using?

bash-4.4# credhub --version
CLI Version: 2.5.3
Server Version: 2.5.6

If you were attempting to accomplish a task, what was it you were attempting to do?

Using credhub generate with the --no-overwrite flag to generate a new value for a password if and only if it does not already have a value.

Consider:

bash-4.4# credhub set -n "/path" -t password -w "test-test-test"
id: dbaee067-812a-446c-81a8-cc86cd447d46
name: /path
type: password
value: <redacted>
version_created_at: "2019-10-28T14:04:59Z"

bash-4.4# credhub get -n "/path"
id: dbaee067-812a-446c-81a8-cc86cd447d46
name: /path
type: password
value: test-test-test
version_created_at: "2019-10-28T14:04:59Z"

bash-4.4# credhub generate -n "/path" -t password --no-overwrite
id: af96f43d-625b-4ef8-acc8-467c917b55ab
name: /path
type: password
value: <redacted>
version_created_at: "2019-10-28T14:06:19Z"

bash-4.4# credhub get -n "/path"
id: af96f43d-625b-4ef8-acc8-467c917b55ab
name: /path
type: password
value: PWlybYx60cSMD3kTHFYTnHClAymcJD
version_created_at: "2019-10-28T14:06:19Z"

What did you expect to happen?

The password should be left with its value from the original credhub set and not overwritten.

What was the actual behavior?

The password was overwritten

Please confirm where necessary:

• I have included a log output
• My log includes an error message
• I have included steps for reproduction

Component metrics for credhub

Most CF components expose component metrics that are useful to operators as service level indicators (e.g. through prometheus exporters such as https://github.com/orange-cloudfoundry/credhub_exporter).

For credhub, the following metrics could be useful:

• built-in spring metrics including
  • SpringMVC metrics such as metrics per api endpoint
  • HTTP container,
  • JVM metrics,
• credhub specific metrics (if not yet covered by SpringMVC metrics)
  • number of credentials fetched
  • number of credentials written
  • number of API authentication failures

I wonder whether sharing with the UAA team and their metrics emitter mechanism happened yet or would make sense.

/CC @psycofdj

---

What version of the credhub server you are using?

2.0.2

What version of the credhub cli you are using?

2.0.0

Limit for encrypted values in credhub?

We need to save string and json values securely in credhub (bosh release 1.6.5) for a special bosh deployment use case.
For that we tested with different sizes of values and there was no problem to store strings/json with 233k bytes and more.

But in the credhub source code on the persistence layer there is a limit of 7000 + 12 bytes set for all types of encrypted values.

in the class EncryptedValue

 @Column(length = ENCRYPTED_BYTES + NONCE_SIZE, name = "encrypted_value", nullable = false)
 private byte[] encryptedValue;

with defined ENCRYPTED_BYTES = 7000 and NONCE_SIZE = 12 parameters.

Fortunately it seems that this limit is ignored, because the column length parameter applies only on string values and not byte arrays.
From the javax.persistence.Column documentation (https://javaee.github.io/javaee-spec/javadocs/javax/persistence/Column.html):

(Optional) The column length. (Applies only if a string-valued column is used.)

Before we can implement our special bosh deployment, we must ensure from credhub, that we are able to save values larger than the (for json and some other use cases too low) 7012 bytes limit. Therefor we have some questions:

• What was the origin reason for implementing such a 7012 size limit?
• Do you plan to fix this “bug”, so the limit will be enforced or will you just remove that limit ?
• If you plan a limit, which size will it be ?