RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256)

Поиск
Список
Период
Сортировка
От McDermott, Becky
Тема RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256)
Дата
Msg-id BY3PR09MB8627D40E10069992D4EE46E1C8199@BY3PR09MB8627.namprd09.prod.outlook.com
обсуждение исходный текст
Ответ на Re: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256)  (Dave Cramer <davecramer@postgres.rocks>)
Ответы Re: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256)  (Rob Sargent <robjsargent@gmail.com>)
Список pgsql-jdbc

>> From: Dave Cramer <davecramer@postgres.rocks>
>> Sent: Thursday, March 24, 2022 12:34 PM
>> Ah, a much better question. The reason we are asking is that it appears the the cryptographic algorithm required is not available in the JVM

 

This would make sense.  Our application is so complex that it is difficult to troubleshoot problems.  I created a very simple Java command line application:

 

  1. Few lines of code to connect to our postgresql database running inside the Kubernetes cluster
  2. Created a Dockerfile to containerize the app (copied the jar file into the docker file, etc.)
  3. Deployed the container to Kubernetes in the same namespace as the postgresql database
  4. Gathered the logs
  5. I exec’d into the postgres pod and connected as an admin user to run: 
        select rolname, rolpassword from pg_authid;

    and I can see that all the database users have the prefix:  “SCRAM-SHA-256$4096:”

 

The logs are showing: 

Caused by: java.lang.RuntimeException: Platform error: unsupported key for HMAC algorithm

 

When I built my jar file in IntelliJ, I used the driver:    postgresql-42.3.3.jar

 

In my java src, I am connecting with the same username and clear text password that I use for psql:

psql -h postgresql-gms -p 5432 -d $POSTGRES_DB -U xxx_xxx_application

and then I use the clear text password to successfully connect.

 

I am using these same credentials to connect in my simple java command line application.

 

The “Caused by” maybe does suggest that the JRE is missing something or the jdbc driver isn’t doing something correctly.

 

I am logging off for this week (long weekend) but maybe someone will have some good suggestions that I will see on Monday.

 

I am pasting my java source here at the end in case someone wants to try reproducing the problem.  After the connection attempt, I just go into an infinite loop so that when the app is running in Kubernetes, it remains “Running”.  I’ve also obfuscated the connection string and user name.

 

Java Source

package com.example.postgresqljdbc;

 

import java.sql.Connection;

import java.sql.DriverManager;

import java.sql.SQLException;

import java.util.concurrent.TimeUnit;

 

public class PostgreSQLJDBC {

private final String url = "jdbc:postgresql://postgresql-xxx:5432/my-app-db";

private final String user = "xxx_xxx_application";

private final String password = "eb993cac-ee92-4df1-8429-a7a168a0ed21";

 

public Connection connect()  {

Connection conn = null;

 

try {

conn = DriverManager.getConnection(url, user, password);

System.out.println("Connected to the PostgreSQL server successfully");

}

catch (SQLException e) {

System.out.println(e.getMessage());

e.printStackTrace(System.out);

}

 

return conn;

}

 

public static void main(String[] args)  {

PostgreSQLJDBC app = new PostgreSQLJDBC();

int idx = 1;

 

System.out.println("About to try connecting to postreSQL database ...");

 

Connection db_con = app.connect();

 

if (db_con == null) {

System.out.println("Unable to connect to the database ... check the logs for the exception message");

}

else {

System.out.println("Successfully connected to the database!!  Try running a query");

}

 

System.out.println("Inside main - about to enter a long loop");

 

while (true) {

System.out.printf("Looping a set number of times ... Loop Iteration:  %d%n", idx);

 

idx++;

 

try {

TimeUnit.SECONDS.sleep(5);

}

catch (Exception e) {

System.out.println(e.getMessage());

}

}

}

}

В списке pgsql-jdbc по дате отправления:

Предыдущее
От: "McDermott, Becky"
Дата:
Сообщение: RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256)
Следующее
От: "McDermott, Becky"
Дата:
Сообщение: RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256)