Обсуждение: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256)
Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256)
We have a requirement to run all of our applications on FIPS enabled hosts.
We currently run postgres in a container that is executing on a FIPS enabled host with the setting: password_encryption = scram-sha-256
I am able to connect from one container to the postgres container/service using psql commands. However, none of our Java clients can connect to the postgresql database. If we run postgresql on a non-FIPS enabled host, everything works fine.
Our postgres/jdbc versions are 12.7/42.2.5
The java stack trace is:
Notice that the last "Caused by" is showing the "Unsupported PBKDF2 for SCRAM-SHA-256". We are also using Hibernate so perhaps the underlying problem is there?
java.sql.SQLException: Connections could not be acquired from the underlying database!
at com.mchange.v2.sql.SqlUtils.toSQLException(SqlUtils.java:118) ~[mchange-commons-java-0.2.19.jar:0.2.19]
at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool.checkoutPooledConnection(C3P0PooledConnectionPool.java:692) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.c3p0.impl.AbstractPoolBackedDataSource.getConnection(AbstractPoolBackedDataSource.java:140) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at org.hibernate.c3p0.internal.C3P0ConnectionProvider.getConnection(C3P0ConnectionProvider.java:72) ~[hibernate-c3p0-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.engine.jdbc.env.internal.JdbcEnvironmentInitiator$ConnectionProviderJdbcConnectionAccess.obtainConnection(JdbcEnvironmentInitiator.java:180) ~[hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.engine.jdbc.env.internal.JdbcEnvironmentInitiator.initiateService(JdbcEnvironmentInitiator.java:68) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.engine.jdbc.env.internal.JdbcEnvironmentInitiator.initiateService(JdbcEnvironmentInitiator.java:35) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.boot.registry.internal.StandardServiceRegistryImpl.initiateService(StandardServiceRegistryImpl.java:101) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.service.internal.AbstractServiceRegistryImpl.createService(AbstractServiceRegistryImpl.java:263) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.service.internal.AbstractServiceRegistryImpl.initializeService(AbstractServiceRegistryImpl.java:237) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.service.internal.AbstractServiceRegistryImpl.getService(AbstractServiceRegistryImpl.java:214) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.id.factory.internal.DefaultIdentifierGeneratorFactory.injectServices(DefaultIdentifierGeneratorFactory.java:152) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.service.internal.AbstractServiceRegistryImpl.injectDependencies(AbstractServiceRegistryImpl.java:286) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.service.internal.AbstractServiceRegistryImpl.initializeService(AbstractServiceRegistryImpl.java:243) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.service.internal.AbstractServiceRegistryImpl.getService(AbstractServiceRegistryImpl.java:214) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.boot.internal.InFlightMetadataCollectorImpl.<init>(InFlightMetadataCollectorImpl.java:176) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.boot.model.process.spi.MetadataBuildingProcess.complete(MetadataBuildingProcess.java:127) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.jpa.boot.internal.EntityManagerFactoryBuilderImpl.metadata(EntityManagerFactoryBuilderImpl.java:1224) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.jpa.boot.internal.EntityManagerFactoryBuilderImpl.build(EntityManagerFactoryBuilderImpl.java:1255) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.jpa.HibernatePersistenceProvider.createEntityManagerFactory(HibernatePersistenceProvider.java:56) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at javax.persistence.Persistence.createEntityManagerFactory(Persistence.java:79) [javax.persistence-api-2.2.jar:2.2]
at gms.shared.frameworks.osd.dao.util.CoiEntityManagerFactory.create(CoiEntityManagerFactory.java:73) [frameworks-osd-daos-LATEST.jar:?]
at gms.shared.frameworks.osd.dao.util.CoiEntityManagerFactory.create(CoiEntityManagerFactory.java:52) [frameworks-osd-daos-LATEST.jar:?]
at gms.shared.frameworks.osd.repository.OsdRepositoryFactory.createOsdRepository(OsdRepositoryFactory.java:30) [frameworks-osd-repository-LATEST.jar:?]
at gms.shared.frameworks.osd.service.OsdServiceApplication.main(OsdServiceApplication.java:12) [frameworks-osd-service-LATEST.jar:?]
Caused by: com.mchange.v2.resourcepool.CannotAcquireResourceException: A ResourcePool could not acquire a resource from its primary factory or source.
at com.mchange.v2.resourcepool.BasicResourcePool.awaitAvailable(BasicResourcePool.java:1507) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.resourcepool.BasicResourcePool.prelimCheckoutResource(BasicResourcePool.java:644) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.resourcepool.BasicResourcePool.checkoutResource(BasicResourcePool.java:554) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool.checkoutAndMarkConnectionInUse(C3P0PooledConnectionPool.java:758) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool.checkoutPooledConnection(C3P0PooledConnectionPool.java:685) ~[c3p0-0.9.5.5.jar:0.9.5.5]
... 23 more
Caused by: org.postgresql.util.PSQLException: Something unusual has occurred to cause the driver to fail. Please report this exception.
at org.postgresql.Driver.connect(Driver.java:277) ~[postgresql-42.2.5.jar:42.2.5]
at com.mchange.v2.c3p0.DriverManagerDataSource.getConnection(DriverManagerDataSource.java:175) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection(WrapperConnectionPoolDataSource.java:220) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection(WrapperConnectionPoolDataSource.java:206) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool$1PooledConnectionResourcePoolManager.acquireResource(C3P0PooledConnectionPool.java:203) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.resourcepool.BasicResourcePool.doAcquire(BasicResourcePool.java:1176) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.resourcepool.BasicResourcePool.doAcquireAndDecrementPendingAcquiresWithinLockOnSuccess(BasicResourcePool.java:1163) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.async.ThreadPoolAsynchronousRunner$PoolThread.run(ThreadPoolAsynchronousRunner.java:696) ~[mchange-commons-java-0.2.19.jar:0.2.19]
Caused by: java.lang.RuntimeException: Unsupported PBKDF2 for SCRAM-SHA-256
at org.postgresql.shaded.com.ongres.scram.common.ScramMechanisms.secretKeyFactory(ScramMechanisms.java:151) ~[postgresql-42.2.5.jar:42.2.5]
at org.postgresql.shaded.com.ongres.scram.common.ScramFunctions.saltedPassword(ScramFunctions.java:61) ~[postgresql-42.2.5.jar:42.2.5]
at org.postgresql.shaded.com.ongres.scram.client.ScramSession$ClientFinalProcessor.<init>(ScramSession.java:198) ~[postgresql-42.2.5.jar:42.2.5]
at org.postgresql.shaded.com.ongres.scram.client.ScramSession$ClientFinalProcessor.<init>(ScramSession.java:165) ~[postgresql-42.2.5.jar:42.2.5]
at org.postgresql.shaded.com.ongres.scram.client.ScramSession$ServerFirstProcessor.clientFinalProcessor(ScramSession.java:132) ~[postgresql-42.2.5.jar:42.2.5]
at org.postgresql.jre8.sasl.ScramAuthenticator.processServerFirstMessage(ScramAuthenticator.java:131) ~[postgresql-42.2.5.jar:42.2.5]
at org.postgresql.core.v3.ConnectionFactoryImpl.doAuthentication(ConnectionFactoryImpl.java:678) ~[postgresql-42.2.5.jar:42.2.5]
at org.postgresql.core.v3.ConnectionFactoryImpl.tryConnect(ConnectionFactoryImpl.java:141) ~[postgresql-42.2.5.jar:42.2.5]
at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:192) ~[postgresql-42.2.5.jar:42.2.5]
at org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:49) ~[postgresql-42.2.5.jar:42.2.5]
at org.postgresql.jdbc.PgConnection.<init>(PgConnection.java:195) ~[postgresql-42.2.5.jar:42.2.5]
at org.postgresql.Driver.makeConnection(Driver.java:454) ~[postgresql-42.2.5.jar:42.2.5]
at org.postgresql.Driver.connect(Driver.java:256) ~[postgresql-42.2.5.jar:42.2.5]
at com.mchange.v2.c3p0.DriverManagerDataSource.getConnection(DriverManagerDataSource.java:175) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection(WrapperConnectionPoolDataSource.java:220) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection(WrapperConnectionPoolDataSource.java:206) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool$1PooledConnectionResourcePoolManager.acquireResource(C3P0PooledConnectionPool.java:203) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.resourcepool.BasicResourcePool.doAcquire(BasicResourcePool.java:1176) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.resourcepool.BasicResourcePool.doAcquireAndDecrementPendingAcquiresWithinLockOnSuccess(BasicResourcePool.java:1163) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.resourcepool.BasicResourcePool.access$700(BasicResourcePool.java:44) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.resourcepool.BasicResourcePool$ScatteredAcquireTask.run(BasicResourcePool.java:1908) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.async.ThreadPoolAsynchronousRunner$PoolThread.run(ThreadPoolAsynchronousRunner.java:696) ~[mchange-commons-java-0.2.19.jar:0.2.19]
2022-03-21 22:40:22,878 INFO org.hibernate.dialect.Dialect [main] HHH000400: Using dialect: org.hibernate.dialect.PostgreSQL95Dialect
I tried upgrading the jdbc driver to 42.2.24 and I’m getting a different error:
Notice the last Caused by: java.lang.RuntimeException: Platform error: unsupported key for HMAC algorithm
2022-03-22 15:40:10,660 ERROR org.hibernate.engine.jdbc.spi.SqlExceptionHelper [main] Connections could not be acquired from the underlying database!
Exception in thread "main" java.lang.IllegalArgumentException: Could not create persistence unit gms
at gms.shared.frameworks.osd.dao.util.CoiEntityManagerFactory.create(CoiEntityManagerFactory.java:75)
at gms.shared.frameworks.osd.dao.util.CoiEntityManagerFactory.create(CoiEntityManagerFactory.java:52)
at gms.shared.frameworks.osd.repository.OsdRepositoryFactory.createOsdRepository(OsdRepositoryFactory.java:30)
at gms.shared.frameworks.osd.service.OsdServiceApplication.main(OsdServiceApplication.java:12)
Caused by: javax.persistence.PersistenceException: [PersistenceUnit: gms] Unable to build Hibernate SessionFactory
at org.hibernate.jpa.boot.internal.EntityManagerFactoryBuilderImpl.persistenceException(EntityManagerFactoryBuilderImpl.java:1336)
at org.hibernate.jpa.boot.internal.EntityManagerFactoryBuilderImpl.build(EntityManagerFactoryBuilderImpl.java:1262)
at org.hibernate.jpa.HibernatePersistenceProvider.createEntityManagerFactory(HibernatePersistenceProvider.java:56)
at javax.persistence.Persistence.createEntityManagerFactory(Persistence.java:79)
at gms.shared.frameworks.osd.dao.util.CoiEntityManagerFactory.create(CoiEntityManagerFactory.java:73)
... 3 more
Caused by: org.hibernate.exception.GenericJDBCException: Unable to open JDBC Connection for DDL execution
at org.hibernate.exception.internal.StandardSQLExceptionConverter.convert(StandardSQLExceptionConverter.java:47)
at org.hibernate.engine.jdbc.spi.SqlExceptionHelper.convert(SqlExceptionHelper.java:113)
at org.hibernate.engine.jdbc.spi.SqlExceptionHelper.convert(SqlExceptionHelper.java:99)
at org.hibernate.resource.transaction.backend.jdbc.internal.DdlTransactionIsolatorNonJtaImpl.getIsolatedConnection(DdlTransactionIsolatorNonJtaImpl.java:69)
at org.hibernate.tool.schema.internal.exec.ImprovedExtractionContextImpl.getJdbcConnection(ImprovedExtractionContextImpl.java:60)
at org.hibernate.tool.schema.extract.internal.SequenceInformationExtractorLegacyImpl.extractMetadata(SequenceInformationExtractorLegacyImpl.java:40)
at org.hibernate.tool.schema.extract.internal.DatabaseInformationImpl.initializeSequences(DatabaseInformationImpl.java:65)
at org.hibernate.tool.schema.extract.internal.DatabaseInformationImpl.<init>(DatabaseInformationImpl.java:59)
at org.hibernate.tool.schema.internal.Helper.buildDatabaseInformation(Helper.java:155)
at org.hibernate.tool.schema.internal.AbstractSchemaValidator.doValidation(AbstractSchemaValidator.java:61)
at org.hibernate.tool.schema.spi.SchemaManagementToolCoordinator.performDatabaseAction(SchemaManagementToolCoordinator.java:192)
at org.hibernate.tool.schema.spi.SchemaManagementToolCoordinator.process(SchemaManagementToolCoordinator.java:73)
at org.hibernate.internal.SessionFactoryImpl.<init>(SessionFactoryImpl.java:318)
at org.hibernate.boot.internal.SessionFactoryBuilderImpl.build(SessionFactoryBuilderImpl.java:468)
at org.hibernate.jpa.boot.internal.EntityManagerFactoryBuilderImpl.build(EntityManagerFactoryBuilderImpl.java:1259)
... 6 more
Caused by: java.sql.SQLException: Connections could not be acquired from the underlying database!
at com.mchange.v2.sql.SqlUtils.toSQLException(SqlUtils.java:118)
at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool.checkoutPooledConnection(C3P0PooledConnectionPool.java:692)
at com.mchange.v2.c3p0.impl.AbstractPoolBackedDataSource.getConnection(AbstractPoolBackedDataSource.java:140)
at org.hibernate.c3p0.internal.C3P0ConnectionProvider.getConnection(C3P0ConnectionProvider.java:72)
at org.hibernate.engine.jdbc.env.internal.JdbcEnvironmentInitiator$ConnectionProviderJdbcConnectionAccess.obtainConnection(JdbcEnvironmentInitiator.java:180)
at org.hibernate.resource.transaction.backend.jdbc.internal.DdlTransactionIsolatorNonJtaImpl.getIsolatedConnection(DdlTransactionIsolatorNonJtaImpl.java:43)
... 17 more
Caused by: com.mchange.v2.resourcepool.CannotAcquireResourceException: A ResourcePool could not acquire a resource from its primary factory or source.
at com.mchange.v2.resourcepool.BasicResourcePool.awaitAvailable(BasicResourcePool.java:1507)
at com.mchange.v2.resourcepool.BasicResourcePool.prelimCheckoutResource(BasicResourcePool.java:644)
at com.mchange.v2.resourcepool.BasicResourcePool.checkoutResource(BasicResourcePool.java:554)
at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool.checkoutAndMarkConnectionInUse(C3P0PooledConnectionPool.java:758)
at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool.checkoutPooledConnection(C3P0PooledConnectionPool.java:685)
... 21 more
Caused by: org.postgresql.util.PSQLException: Something unusual has occurred to cause the driver to fail. Please report this exception.
at org.postgresql.Driver.connect(Driver.java:285)
at com.mchange.v2.c3p0.DriverManagerDataSource.getConnection(DriverManagerDataSource.java:175)
at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection(WrapperConnectionPoolDataSource.java:220)
at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection(WrapperConnectionPoolDataSource.java:206)
at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool$1PooledConnectionResourcePoolManager.acquireResource(C3P0PooledConnectionPool.java:203)
at com.mchange.v2.resourcepool.BasicResourcePool.doAcquire(BasicResourcePool.java:1176)
at com.mchange.v2.resourcepool.BasicResourcePool.doAcquireAndDecrementPendingAcquiresWithinLockOnSuccess(BasicResourcePool.java:1163)
at com.mchange.v2.resourcepool.BasicResourcePool.access$700(BasicResourcePool.java:44)
at com.mchange.v2.resourcepool.BasicResourcePool$ScatteredAcquireTask.run(BasicResourcePool.java:1908)
at com.mchange.v2.async.ThreadPoolAsynchronousRunner$PoolThread.run(ThreadPoolAsynchronousRunner.java:696)
Caused by: java.lang.RuntimeException: Platform error: unsupported key for HMAC algorithm
at org.postgresql.shaded.com.ongres.scram.common.util.CryptoUtil.hmac(CryptoUtil.java:147)
at org.postgresql.shaded.com.ongres.scram.common.ScramFunctions.hmac(ScramFunctions.java:70)
at org.postgresql.shaded.com.ongres.scram.common.ScramFunctions.clientKey(ScramFunctions.java:85)
at org.postgresql.shaded.com.ongres.scram.client.ScramSession$ClientFinalProcessor.<init>(ScramSession.java:188)
at org.postgresql.shaded.com.ongres.scram.client.ScramSession$ClientFinalProcessor.<init>(ScramSession.java:194)
at org.postgresql.shaded.com.ongres.scram.client.ScramSession$ClientFinalProcessor.<init>(ScramSession.java:163)
at org.postgresql.shaded.com.ongres.scram.client.ScramSession$ServerFirstProcessor.clientFinalProcessor(ScramSession.java:130)
at org.postgresql.jre7.sasl.ScramAuthenticator.processServerFirstMessage(ScramAuthenticator.java:147)
at org.postgresql.core.v3.ConnectionFactoryImpl.doAuthentication(ConnectionFactoryImpl.java:778)
at org.postgresql.core.v3.ConnectionFactoryImpl.tryConnect(ConnectionFactoryImpl.java:161)
at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:213)
at org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:51)
at org.postgresql.jdbc.PgConnection.<init>(PgConnection.java:225)
at org.postgresql.Driver.makeConnection(Driver.java:465)
at org.postgresql.Driver.connect(Driver.java:264)
... 9 more
We definitely don’t have something correct on the Java side. Are there any experienced java users out there who can recommend the correct jdbc version and what we need to do on the Java side to support “password_encryption = scram-sha-256” for Postgres?
I am not a java develop but am responsible for the platform we run our application on so I can forward any java specifics to our development team(s).
Thank you,
Becky McDermott
Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256)
Re-sending – not sure I was subscribed to the list the first time.
We have a requirement to run all of our applications on FIPS enabled hosts.
We currently run postgres in a container that is executing on a FIPS enabled host with the setting: password_encryption = scram-sha-256
I am able to connect from one container to the postgres container/service using psql commands. However, none of our Java clients can connect to the postgresql database. If we run postgresql on a non-FIPS enabled host, everything works fine.
Our postgres/jdbc versions are 12.7/42.2.5
The java stack trace is:
Notice that the last "Caused by" is showing the "Unsupported PBKDF2 for SCRAM-SHA-256". We are also using Hibernate so perhaps the underlying problem is there?
java.sql.SQLException: Connections could not be acquired from the underlying database!
at com.mchange.v2.sql.SqlUtils.toSQLException(SqlUtils.java:118) ~[mchange-commons-java-0.2.19.jar:0.2.19]
at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool.checkoutPooledConnection(C3P0PooledConnectionPool.java:692) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.c3p0.impl.AbstractPoolBackedDataSource.getConnection(AbstractPoolBackedDataSource.java:140) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at org.hibernate.c3p0.internal.C3P0ConnectionProvider.getConnection(C3P0ConnectionProvider.java:72) ~[hibernate-c3p0-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.engine.jdbc.env.internal.JdbcEnvironmentInitiator$ConnectionProviderJdbcConnectionAccess.obtainConnection(JdbcEnvironmentInitiator.java:180) ~[hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.engine.jdbc.env.internal.JdbcEnvironmentInitiator.initiateService(JdbcEnvironmentInitiator.java:68) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.engine.jdbc.env.internal.JdbcEnvironmentInitiator.initiateService(JdbcEnvironmentInitiator.java:35) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.boot.registry.internal.StandardServiceRegistryImpl.initiateService(StandardServiceRegistryImpl.java:101) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.service.internal.AbstractServiceRegistryImpl.createService(AbstractServiceRegistryImpl.java:263) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.service.internal.AbstractServiceRegistryImpl.initializeService(AbstractServiceRegistryImpl.java:237) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.service.internal.AbstractServiceRegistryImpl.getService(AbstractServiceRegistryImpl.java:214) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.id.factory.internal.DefaultIdentifierGeneratorFactory.injectServices(DefaultIdentifierGeneratorFactory.java:152) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.service.internal.AbstractServiceRegistryImpl.injectDependencies(AbstractServiceRegistryImpl.java:286) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.service.internal.AbstractServiceRegistryImpl.initializeService(AbstractServiceRegistryImpl.java:243) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.service.internal.AbstractServiceRegistryImpl.getService(AbstractServiceRegistryImpl.java:214) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.boot.internal.InFlightMetadataCollectorImpl.<init>(InFlightMetadataCollectorImpl.java:176) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.boot.model.process.spi.MetadataBuildingProcess.complete(MetadataBuildingProcess.java:127) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.jpa.boot.internal.EntityManagerFactoryBuilderImpl.metadata(EntityManagerFactoryBuilderImpl.java:1224) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.jpa.boot.internal.EntityManagerFactoryBuilderImpl.build(EntityManagerFactoryBuilderImpl.java:1255) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at org.hibernate.jpa.HibernatePersistenceProvider.createEntityManagerFactory(HibernatePersistenceProvider.java:56) [hibernate-core-5.4.30.Final.jar:5.4.30.Final]
at javax.persistence.Persistence.createEntityManagerFactory(Persistence.java:79) [javax.persistence-api-2.2.jar:2.2]
at gms.shared.frameworks.osd.dao.util.CoiEntityManagerFactory.create(CoiEntityManagerFactory.java:73) [frameworks-osd-daos-LATEST.jar:?]
at gms.shared.frameworks.osd.dao.util.CoiEntityManagerFactory.create(CoiEntityManagerFactory.java:52) [frameworks-osd-daos-LATEST.jar:?]
at gms.shared.frameworks.osd.repository.OsdRepositoryFactory.createOsdRepository(OsdRepositoryFactory.java:30) [frameworks-osd-repository-LATEST.jar:?]
at gms.shared.frameworks.osd.service.OsdServiceApplication.main(OsdServiceApplication.java:12) [frameworks-osd-service-LATEST.jar:?]
Caused by: com.mchange.v2.resourcepool.CannotAcquireResourceException: A ResourcePool could not acquire a resource from its primary factory or source.
at com.mchange.v2.resourcepool.BasicResourcePool.awaitAvailable(BasicResourcePool.java:1507) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.resourcepool.BasicResourcePool.prelimCheckoutResource(BasicResourcePool.java:644) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.resourcepool.BasicResourcePool.checkoutResource(BasicResourcePool.java:554) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool.checkoutAndMarkConnectionInUse(C3P0PooledConnectionPool.java:758) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool.checkoutPooledConnection(C3P0PooledConnectionPool.java:685) ~[c3p0-0.9.5.5.jar:0.9.5.5]
... 23 more
Caused by: org.postgresql.util.PSQLException: Something unusual has occurred to cause the driver to fail. Please report this exception.
at org.postgresql.Driver.connect(Driver.java:277) ~[postgresql-42.2.5.jar:42.2.5]
at com.mchange.v2.c3p0.DriverManagerDataSource.getConnection(DriverManagerDataSource.java:175) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection(WrapperConnectionPoolDataSource.java:220) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection(WrapperConnectionPoolDataSource.java:206) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool$1PooledConnectionResourcePoolManager.acquireResource(C3P0PooledConnectionPool.java:203) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.resourcepool.BasicResourcePool.doAcquire(BasicResourcePool.java:1176) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.resourcepool.BasicResourcePool.doAcquireAndDecrementPendingAcquiresWithinLockOnSuccess(BasicResourcePool.java:1163) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.async.ThreadPoolAsynchronousRunner$PoolThread.run(ThreadPoolAsynchronousRunner.java:696) ~[mchange-commons-java-0.2.19.jar:0.2.19]
Caused by: java.lang.RuntimeException: Unsupported PBKDF2 for SCRAM-SHA-256
at org.postgresql.shaded.com.ongres.scram.common.ScramMechanisms.secretKeyFactory(ScramMechanisms.java:151) ~[postgresql-42.2.5.jar:42.2.5]
at org.postgresql.shaded.com.ongres.scram.common.ScramFunctions.saltedPassword(ScramFunctions.java:61) ~[postgresql-42.2.5.jar:42.2.5]
at org.postgresql.shaded.com.ongres.scram.client.ScramSession$ClientFinalProcessor.<init>(ScramSession.java:198) ~[postgresql-42.2.5.jar:42.2.5]
at org.postgresql.shaded.com.ongres.scram.client.ScramSession$ClientFinalProcessor.<init>(ScramSession.java:165) ~[postgresql-42.2.5.jar:42.2.5]
at org.postgresql.shaded.com.ongres.scram.client.ScramSession$ServerFirstProcessor.clientFinalProcessor(ScramSession.java:132) ~[postgresql-42.2.5.jar:42.2.5]
at org.postgresql.jre8.sasl.ScramAuthenticator.processServerFirstMessage(ScramAuthenticator.java:131) ~[postgresql-42.2.5.jar:42.2.5]
at org.postgresql.core.v3.ConnectionFactoryImpl.doAuthentication(ConnectionFactoryImpl.java:678) ~[postgresql-42.2.5.jar:42.2.5]
at org.postgresql.core.v3.ConnectionFactoryImpl.tryConnect(ConnectionFactoryImpl.java:141) ~[postgresql-42.2.5.jar:42.2.5]
at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:192) ~[postgresql-42.2.5.jar:42.2.5]
at org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:49) ~[postgresql-42.2.5.jar:42.2.5]
at org.postgresql.jdbc.PgConnection.<init>(PgConnection.java:195) ~[postgresql-42.2.5.jar:42.2.5]
at org.postgresql.Driver.makeConnection(Driver.java:454) ~[postgresql-42.2.5.jar:42.2.5]
at org.postgresql.Driver.connect(Driver.java:256) ~[postgresql-42.2.5.jar:42.2.5]
at com.mchange.v2.c3p0.DriverManagerDataSource.getConnection(DriverManagerDataSource.java:175) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection(WrapperConnectionPoolDataSource.java:220) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection(WrapperConnectionPoolDataSource.java:206) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool$1PooledConnectionResourcePoolManager.acquireResource(C3P0PooledConnectionPool.java:203) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.resourcepool.BasicResourcePool.doAcquire(BasicResourcePool.java:1176) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.resourcepool.BasicResourcePool.doAcquireAndDecrementPendingAcquiresWithinLockOnSuccess(BasicResourcePool.java:1163) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.resourcepool.BasicResourcePool.access$700(BasicResourcePool.java:44) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.resourcepool.BasicResourcePool$ScatteredAcquireTask.run(BasicResourcePool.java:1908) ~[c3p0-0.9.5.5.jar:0.9.5.5]
at com.mchange.v2.async.ThreadPoolAsynchronousRunner$PoolThread.run(ThreadPoolAsynchronousRunner.java:696) ~[mchange-commons-java-0.2.19.jar:0.2.19]
2022-03-21 22:40:22,878 INFO org.hibernate.dialect.Dialect [main] HHH000400: Using dialect: org.hibernate.dialect.PostgreSQL95Dialect
I tried upgrading the jdbc driver to 42.2.24 and I’m getting a different error:
Notice the last Caused by: java.lang.RuntimeException: Platform error: unsupported key for HMAC algorithm
2022-03-22 15:40:10,660 ERROR org.hibernate.engine.jdbc.spi.SqlExceptionHelper [main] Connections could not be acquired from the underlying database!
Exception in thread "main" java.lang.IllegalArgumentException: Could not create persistence unit gms
at gms.shared.frameworks.osd.dao.util.CoiEntityManagerFactory.create(CoiEntityManagerFactory.java:75)
at gms.shared.frameworks.osd.dao.util.CoiEntityManagerFactory.create(CoiEntityManagerFactory.java:52)
at gms.shared.frameworks.osd.repository.OsdRepositoryFactory.createOsdRepository(OsdRepositoryFactory.java:30)
at gms.shared.frameworks.osd.service.OsdServiceApplication.main(OsdServiceApplication.java:12)
Caused by: javax.persistence.PersistenceException: [PersistenceUnit: gms] Unable to build Hibernate SessionFactory
at org.hibernate.jpa.boot.internal.EntityManagerFactoryBuilderImpl.persistenceException(EntityManagerFactoryBuilderImpl.java:1336)
at org.hibernate.jpa.boot.internal.EntityManagerFactoryBuilderImpl.build(EntityManagerFactoryBuilderImpl.java:1262)
at org.hibernate.jpa.HibernatePersistenceProvider.createEntityManagerFactory(HibernatePersistenceProvider.java:56)
at javax.persistence.Persistence.createEntityManagerFactory(Persistence.java:79)
at gms.shared.frameworks.osd.dao.util.CoiEntityManagerFactory.create(CoiEntityManagerFactory.java:73)
... 3 more
Caused by: org.hibernate.exception.GenericJDBCException: Unable to open JDBC Connection for DDL execution
at org.hibernate.exception.internal.StandardSQLExceptionConverter.convert(StandardSQLExceptionConverter.java:47)
at org.hibernate.engine.jdbc.spi.SqlExceptionHelper.convert(SqlExceptionHelper.java:113)
at org.hibernate.engine.jdbc.spi.SqlExceptionHelper.convert(SqlExceptionHelper.java:99)
at org.hibernate.resource.transaction.backend.jdbc.internal.DdlTransactionIsolatorNonJtaImpl.getIsolatedConnection(DdlTransactionIsolatorNonJtaImpl.java:69)
at org.hibernate.tool.schema.internal.exec.ImprovedExtractionContextImpl.getJdbcConnection(ImprovedExtractionContextImpl.java:60)
at org.hibernate.tool.schema.extract.internal.SequenceInformationExtractorLegacyImpl.extractMetadata(SequenceInformationExtractorLegacyImpl.java:40)
at org.hibernate.tool.schema.extract.internal.DatabaseInformationImpl.initializeSequences(DatabaseInformationImpl.java:65)
at org.hibernate.tool.schema.extract.internal.DatabaseInformationImpl.<init>(DatabaseInformationImpl.java:59)
at org.hibernate.tool.schema.internal.Helper.buildDatabaseInformation(Helper.java:155)
at org.hibernate.tool.schema.internal.AbstractSchemaValidator.doValidation(AbstractSchemaValidator.java:61)
at org.hibernate.tool.schema.spi.SchemaManagementToolCoordinator.performDatabaseAction(SchemaManagementToolCoordinator.java:192)
at org.hibernate.tool.schema.spi.SchemaManagementToolCoordinator.process(SchemaManagementToolCoordinator.java:73)
at org.hibernate.internal.SessionFactoryImpl.<init>(SessionFactoryImpl.java:318)
at org.hibernate.boot.internal.SessionFactoryBuilderImpl.build(SessionFactoryBuilderImpl.java:468)
at org.hibernate.jpa.boot.internal.EntityManagerFactoryBuilderImpl.build(EntityManagerFactoryBuilderImpl.java:1259)
... 6 more
Caused by: java.sql.SQLException: Connections could not be acquired from the underlying database!
at com.mchange.v2.sql.SqlUtils.toSQLException(SqlUtils.java:118)
at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool.checkoutPooledConnection(C3P0PooledConnectionPool.java:692)
at com.mchange.v2.c3p0.impl.AbstractPoolBackedDataSource.getConnection(AbstractPoolBackedDataSource.java:140)
at org.hibernate.c3p0.internal.C3P0ConnectionProvider.getConnection(C3P0ConnectionProvider.java:72)
at org.hibernate.engine.jdbc.env.internal.JdbcEnvironmentInitiator$ConnectionProviderJdbcConnectionAccess.obtainConnection(JdbcEnvironmentInitiator.java:180)
at org.hibernate.resource.transaction.backend.jdbc.internal.DdlTransactionIsolatorNonJtaImpl.getIsolatedConnection(DdlTransactionIsolatorNonJtaImpl.java:43)
... 17 more
Caused by: com.mchange.v2.resourcepool.CannotAcquireResourceException: A ResourcePool could not acquire a resource from its primary factory or source.
at com.mchange.v2.resourcepool.BasicResourcePool.awaitAvailable(BasicResourcePool.java:1507)
at com.mchange.v2.resourcepool.BasicResourcePool.prelimCheckoutResource(BasicResourcePool.java:644)
at com.mchange.v2.resourcepool.BasicResourcePool.checkoutResource(BasicResourcePool.java:554)
at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool.checkoutAndMarkConnectionInUse(C3P0PooledConnectionPool.java:758)
at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool.checkoutPooledConnection(C3P0PooledConnectionPool.java:685)
... 21 more
Caused by: org.postgresql.util.PSQLException: Something unusual has occurred to cause the driver to fail. Please report this exception.
at org.postgresql.Driver.connect(Driver.java:285)
at com.mchange.v2.c3p0.DriverManagerDataSource.getConnection(DriverManagerDataSource.java:175)
at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection(WrapperConnectionPoolDataSource.java:220)
at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection(WrapperConnectionPoolDataSource.java:206)
at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool$1PooledConnectionResourcePoolManager.acquireResource(C3P0PooledConnectionPool.java:203)
at com.mchange.v2.resourcepool.BasicResourcePool.doAcquire(BasicResourcePool.java:1176)
at com.mchange.v2.resourcepool.BasicResourcePool.doAcquireAndDecrementPendingAcquiresWithinLockOnSuccess(BasicResourcePool.java:1163)
at com.mchange.v2.resourcepool.BasicResourcePool.access$700(BasicResourcePool.java:44)
at com.mchange.v2.resourcepool.BasicResourcePool$ScatteredAcquireTask.run(BasicResourcePool.java:1908)
at com.mchange.v2.async.ThreadPoolAsynchronousRunner$PoolThread.run(ThreadPoolAsynchronousRunner.java:696)
Caused by: java.lang.RuntimeException: Platform error: unsupported key for HMAC algorithm
at org.postgresql.shaded.com.ongres.scram.common.util.CryptoUtil.hmac(CryptoUtil.java:147)
at org.postgresql.shaded.com.ongres.scram.common.ScramFunctions.hmac(ScramFunctions.java:70)
at org.postgresql.shaded.com.ongres.scram.common.ScramFunctions.clientKey(ScramFunctions.java:85)
at org.postgresql.shaded.com.ongres.scram.client.ScramSession$ClientFinalProcessor.<init>(ScramSession.java:188)
at org.postgresql.shaded.com.ongres.scram.client.ScramSession$ClientFinalProcessor.<init>(ScramSession.java:194)
at org.postgresql.shaded.com.ongres.scram.client.ScramSession$ClientFinalProcessor.<init>(ScramSession.java:163)
at org.postgresql.shaded.com.ongres.scram.client.ScramSession$ServerFirstProcessor.clientFinalProcessor(ScramSession.java:130)
at org.postgresql.jre7.sasl.ScramAuthenticator.processServerFirstMessage(ScramAuthenticator.java:147)
at org.postgresql.core.v3.ConnectionFactoryImpl.doAuthentication(ConnectionFactoryImpl.java:778)
at org.postgresql.core.v3.ConnectionFactoryImpl.tryConnect(ConnectionFactoryImpl.java:161)
at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:213)
at org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:51)
at org.postgresql.jdbc.PgConnection.<init>(PgConnection.java:225)
at org.postgresql.Driver.makeConnection(Driver.java:465)
at org.postgresql.Driver.connect(Driver.java:264)
... 9 more
We definitely don’t have something correct on the Java side. Are there any experienced java users out there who can recommend the correct jdbc version and what we need to do on the Java side to support “password_encryption = scram-sha-256” for Postgres?
I am not a java develop but am responsible for the platform we run our application on so I can forward any java specifics to our development team(s).
Thank you,
Becky McDermott
Can you get the dev team to share their set-up?We definitely don’t have something correct on the Java side. Are there any experienced java users out there who can recommend the correct jdbc version and what we need to do on the Java side to support “password_encryption = scram-sha-256” for Postgres?
I am not a java develop but am responsible for the platform we run our application on so I can forward any java specifics to our development team(s).
Thank you,
Becky McDermott
Probably not right away. Getting this fixed/working will not get prioritized on the development side for a few weeks. I was tasked with confirming that we don’t have a platform side problem which I did by confirming I can connect to postgresql using psql on a FIPS enabled host.
I was hoping that maybe there was something simple like the version of postgres or the jdbc driver but it sounds like it may be more than that.
Once our developers are tasked with actively looking into this, I will re-post. I do know that we were using MD5 and switched to scram-sha-256 fairly recently (maybe 6 months ago). But, up until really recently, we were not running on a FIPS enabled host. Since FIPS is now enabled, the cryptography enforcement is actually occurring and we are seeing this problem.
Thank you,
Becky
From: Rob Sargent <robjsargent@gmail.com>
Sent: Tuesday, March 22, 2022 10:25 AM
To: pgsql-jdbc@lists.postgresql.org
Subject: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256)
We definitely don’t have something correct on the Java side. Are there any experienced java users out there who can recommend the correct jdbc version and what we need to do on the Java side to support “password_encryption = scram-sha-256” for Postgres?
I am not a java develop but am responsible for the platform we run our application on so I can forward any java specifics to our development team(s).
Thank you,
Becky McDermott
Can you get the dev team to share their set-up?
Well there's still a chance someone on the list may have useful input. If/when you return, please keep in mind that this list prefers "bottom-posting", i.e. (trimming and) adding your comments at the bottom, or where more appropriate adding comments in-line.@font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;}p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; font-size:11.0pt; font-family:"Calibri",sans-serif;}span.EmailStyle18 {mso-style-type:personal-reply; font-family:"Calibri",sans-serif; color:windowtext;}.MsoChpDefault {mso-style-type:export-only; font-size:10.0pt;}div.WordSection1 {page:WordSection1;} Probably not right away. Getting this fixed/working will not get prioritized on the development side for a few weeks. I was tasked with confirming that we don’t have a platform side problem which I did by confirming I can connect to postgresql using psql on a FIPS enabled host.
I was hoping that maybe there was something simple like the version of postgres or the jdbc driver but it sounds like it may be more than that.
Once our developers are tasked with actively looking into this, I will re-post. I do know that we were using MD5 and switched to scram-sha-256 fairly recently (maybe 6 months ago). But, up until really recently, we were not running on a FIPS enabled host. Since FIPS is now enabled, the cryptography enforcement is actually occurring and we are seeing this problem.
Thank you,
Becky
Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256)
On Tue, Mar 22, 2022 at 03:58:49PM +0000, McDermott, Becky wrote: > We have a requirement to run all of our applications on FIPS enabled hosts. > > We currently run postgres in a container that is executing on a FIPS enabled host with the setting: password_encryption= scram-sha-256 > > I am able to connect from one container to the postgres container/service using psql commands. However, none of our Javaclients can connect to the postgresql database. If we run postgresql on a non-FIPS enabled host, everything works fine. > > Our postgres/jdbc versions are 12.7/42.2.5 Is FIPS enabled on the host holding the PostgreSQL instance? I am afraid that you may run to run into problems in this case, in the shape of a crash in the backend. Internally, when compiled with OpenSSL, Postgres computes its set of SHA-256 hashes with the low-level cryptohashes APIs called SHA256_Init/Update/Final(), and these are known to blow up for most versions of OpenSSL (1.0.2 with unpatched upstream, but some Linux distributions patch 1.1.0, and it may still blow up with an exit() in the middle of its stack in one of the OpenSSL .so libs). Postgres 14 is able to work by going through the EVP layer for its SHA-2 computations, instead. -- Michael
Вложения
Michael Paquier <michael@paquier.xyz> writes:
> On Tue, Mar 22, 2022 at 03:58:49PM +0000, McDermott, Becky wrote:
>> We have a requirement to run all of our applications on FIPS enabled hosts.
> Is FIPS enabled on the host holding the PostgreSQL instance? I am
> afraid that you may run to run into problems in this case, in the
> shape of a crash in the backend.
I worried about that too in the earlier pgsql-general thread. But the
Java exception trace looks like the error is being thrown client-side.
Also Becky says she can connect successfully with psql, which indicates
that the server-side stack is not subject to those problems you mentioned.
regards, tom lane
> Is FIPS enabled on the host holding the PostgreSQL instance? I am afraid that you may run to run into problems in thiscase, in the shape of a crash in > > the backend. FIPS is enabled on each of our Kubernetes cluster nodes. We are running our application as Kubernetes deployments. I haveobserved the following: 1) The Postgres pod itself reaches a "Running" state 2) I have another pod in the same namespace with psql installed and I can exec into this pod and successfully connect topostgres and run SQL select statements 3) All other application pods (java services) that connect to postgres do NOT reach a "Running" state and their logs arefull of messages stating a connection cannot be established with a cause indicating " Unsupported PBKDF2 for SCRAM-SHA-256" I am not a Java developer so I'm not sure how the postgres encryption method (SCRAM_SHA-256) was setup other than what Ican see in the files: - postgresql.conf - pg_hba.conf Our developers are going to transition to working on this in a few weeks. I don't know enough about password encryptionbut it looks like we are using an unsupported algorithm on the java client side. > Postgres 14 is able to work by going through the EVP layer for its > SHA-2 computations, instead. Should we be looking at upgrading Postgres to version 14?
Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256)
On Tue, Mar 22, 2022 at 06:54:29PM -0400, Tom Lane wrote: > I worried about that too in the earlier pgsql-general thread. But the > Java exception trace looks like the error is being thrown client-side. > Also Becky says she can connect successfully with psql, which indicates > that the server-side stack is not subject to those problems you mentioned. I don't know enough about the JDBC driver to be sure, but that would mean that the code path related to processServerFirstMessage in the JDBC driver is taken after the backend has computed the SHA-256 hash for the mock authentication (first SHA-2 computed in the exchange so the backend would crash first with a libpq exchange). Anyway, I also got the impression that this was an initialization stack. -- Michael
Вложения
On Tue, Mar 22, 2022 at 11:00:04PM +0000, McDermott, Becky wrote: > Should we be looking at upgrading Postgres to version 14? If FIPS is enabled on the host running Postgres, you'd better do so. Now, that would also depend on the version of OpenSSL your builds of Postgres are linking to (aka pure upstream, patched version, etc.). -- Michael
Вложения
On Tue, Mar 22, 2022 at 11:00:04PM +0000, McDermott, Becky wrote:
> Should we be looking at upgrading Postgres to version 14?
If FIPS is enabled on the host running Postgres, you'd better do so.
Now, that would also depend on the version of OpenSSL your builds of
Postgres are linking to (aka pure upstream, patched version, etc.).
--
Michael
>> From: Dave Cramer <davecramer@postgres.rocks>
>> Sent: Thursday, March 24, 2022 8:31 AM
>> It would be useful to know the version of java you are using.
Our java client services are compiled with openjdk 11.0.14.0.9-2
Our java client services are compiled with openjdk 11.0.14.0.9-2
On Thu, Mar 24, 2022 at 11:52 AM McDermott, Becky <bmcderm@sandia.gov> wrote:Our java client services are compiled with openjdk 11.0.14.0.9-2
What's the runtime JDK build and version? e.g. AdoptOpenJDK, Zulu, Amazon Corretto, Oracle OpenJDK...
>> From: Sehrope Sarkuni sehrope@jackdb.com
>> Sent: Thursday, March 24, 2022 11:46 AM
>> What's the runtime JDK build and version? e.g. AdoptOpenJDK, Zulu, Amazon Corretto, Oracle OpenJDK...
When I exec inside one of the java services pod (that connects to postgres):
$ java --version
openjdk 11.0.14 2022-01-18 LTS
OpenJDK Runtime Environment 18.9 (build 11.0.14+9-LTS)
OpenJDK 64-Bit Server VM 18.9 (build 11.0.14+9-LTS, mixed mode, sharing)
>> From: Dave Cramer <davecramer@postgres.rocks>
>> Sent: Thursday, March 24, 2022 12:34 PM
>> Ah, a much better question. The reason we are asking is that it appears the the cryptographic algorithm required is not available in the JVM
This would make sense. Our application is so complex that it is difficult to troubleshoot problems. I created a very simple Java command line application:
- Few lines of code to connect to our postgresql database running inside the Kubernetes cluster
- Created a Dockerfile to containerize the app (copied the jar file into the docker file, etc.)
- Deployed the container to Kubernetes in the same namespace as the postgresql database
- Gathered the logs
- I exec’d into the postgres pod and connected as an admin user to run:
select rolname, rolpassword from pg_authid;
and I can see that all the database users have the prefix: “SCRAM-SHA-256$4096:”
The logs are showing:
Caused by: java.lang.RuntimeException: Platform error: unsupported key for HMAC algorithm
When I built my jar file in IntelliJ, I used the driver: postgresql-42.3.3.jar
In my java src, I am connecting with the same username and clear text password that I use for psql:
psql -h postgresql-gms -p 5432 -d $POSTGRES_DB -U xxx_xxx_application
and then I use the clear text password to successfully connect.
I am using these same credentials to connect in my simple java command line application.
The “Caused by” maybe does suggest that the JRE is missing something or the jdbc driver isn’t doing something correctly.
I am logging off for this week (long weekend) but maybe someone will have some good suggestions that I will see on Monday.
I am pasting my java source here at the end in case someone wants to try reproducing the problem. After the connection attempt, I just go into an infinite loop so that when the app is running in Kubernetes, it remains “Running”. I’ve also obfuscated the connection string and user name.
Java Source
package com.example.postgresqljdbc;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.SQLException;
import java.util.concurrent.TimeUnit;
public class PostgreSQLJDBC {
private final String url = "jdbc:postgresql://postgresql-xxx:5432/my-app-db";
private final String user = "xxx_xxx_application";
private final String password = "eb993cac-ee92-4df1-8429-a7a168a0ed21";
public Connection connect() {
Connection conn = null;
try {
conn = DriverManager.getConnection(url, user, password);
System.out.println("Connected to the PostgreSQL server successfully");
}
catch (SQLException e) {
System.out.println(e.getMessage());
e.printStackTrace(System.out);
}
return conn;
}
public static void main(String[] args) {
PostgreSQLJDBC app = new PostgreSQLJDBC();
int idx = 1;
System.out.println("About to try connecting to postreSQL database ...");
Connection db_con = app.connect();
if (db_con == null) {
System.out.println("Unable to connect to the database ... check the logs for the exception message");
}
else {
System.out.println("Successfully connected to the database!! Try running a query");
}
System.out.println("Inside main - about to enter a long loop");
while (true) {
System.out.printf("Looping a set number of times ... Loop Iteration: %d%n", idx);
idx++;
try {
TimeUnit.SECONDS.sleep(5);
}
catch (Exception e) {
System.out.println(e.getMessage());
}
}
}
}
>> From: Dave Cramer <davecramer@postgres.rocks>
>> Sent: Thursday, March 24, 2022 12:34 PM
>>
>> Ah, a much better question. The reason we are asking is that it appears the the cryptographic algorithm required is not available in the JVM
Is there a different Java run time I could try my simple example with? We build our own Java container that I’m running in but I could build a different java container and try that.
>> From: Dave Cramer <davecramer@postgres.rocks>
>> Sent: Thursday, March 24, 2022 12:34 PM
>>>> Ah, a much better question. The reason we are asking is that it appears the the cryptographic algorithm required is not available in the JVM
Is there a different Java run time I could try my simple example with? We build our own Java container that I’m running in but I could build a different java container and try that.
>> From: Dave Cramer <davecramer@postgres.rocks>
>> Sent: Thursday, March 24, 2022 3:05 PM
>>
>> I would try an Oracle JVM.
Thanks, I will try that I Monday and let you know how it goes.
I think this while loop is not going to exit.public static void main(String[] args) {
PostgreSQLJDBC app = new PostgreSQLJDBC();
int idx = 1;
System.out.println("About to try connecting to postreSQL database ...");
Connection db_con = app.connect();
if (db_con == null) {
System.out.println("Unable to connect to the database ... check the logs for the exception message");
}
else {
System.out.println("Successfully connected to the database!! Try running a query");
}
System.out.println("Inside main - about to enter a long loop");
while (true) {
System.out.printf("Looping a set number of times ... Loop Iteration: %d%n", idx);
idx++;
try {
TimeUnit.SECONDS.sleep(5);
}
catch (Exception e) {
System.out.println(e.getMessage());
}
}
}
}
Maybe while (idx < 1000)
>> From: Dave Cramer <davecramer@postgres.rocks>
>> Sent: Thursday, March 24, 2022 3:05 PM
>>>> I would try an Oracle JVM.
Thanks, I will try that I Monday and let you know how it goes.
>> From: Rob Sargent <robjsargent@gmail.com>
>> Sent: Thursday, March 24, 2022 3:37 PM
>>
>> I think this while loop is not going to exit.
>> Maybe while (idx < 1000)
Yeah, I purposely didn’t want it to exit since I was trying to simply/easily simulate a Java service that is waiting to handle requests (running as a Kubernetes pod). If the database connection had worked, I wanted to be able to exec into the running Kubernetes pod. I just kill the pod when I want it to stop.
Thanks,
Becky
>> From: Dave Cramer <davecramer@postgres.rocks>
>> Sent: Friday, March 25, 2022 7:17 AM
>>
>> I just tried this on openjdk 11.0.1 on macos and it works fine. It may be a specific problem with the openjdk built by the vendor you are using (I presume redhat?)
Thank you so much for letting me know that openjdk worked for you. We are building our base Java Docker image (that our Java services and my simple example runs in) from Iron Bank Redhat Universal Base Image (UBI) 8 and then installing Java into the image:
# javaARG JAVA_MAJOR_VERSION=11
ARG JAVA_VERSION=1:11.0.14.0.9-2.el8*
ENV JAVA_HOME /usr/lib/jvm/java-${JAVA_MAJOR_VERSION}-openjdk
dnf install java-${JAVA_MAJOR_VERSION}-openjdk-devel-${JAVA_VERSION}
I will work with someone on my team that understands the base images better. It is my understanding that we are building our own base Java image from Redhat UBI 8. Maybe there is something more we need to do to make sure the crypto libraries get installed?
Thanks,
Becky
From: McDermott, Becky <bmcderm@sandia.gov>
Date: Mon, 28 Mar 2022 at 10:07
Subject: RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256)
To: Dave Cramer <davecramer@postgres.rocks>
Cc: Sehrope Sarkuni <sehrope@jackdb.com>, Michael Paquier <michael@paquier.xyz>, pgsql-jdbc@lists.postgresql.org <pgsql-jdbc@lists.postgresql.org>
>> From: Dave Cramer <davecramer@postgres.rocks>
>> Sent: Friday, March 25, 2022 7:17 AM
>>
>> I just tried this on openjdk 11.0.1 on macos and it works fine. It may be a specific problem with the openjdk built by the vendor you are using (I presume redhat?)
Thank you so much for letting me know that openjdk worked for you. We are building our base Java Docker image (that our Java services and my simple example runs in) from Iron Bank Redhat Universal Base Image (UBI) 8 and then installing Java into the image:
# javaARG JAVA_MAJOR_VERSION=11
ARG JAVA_VERSION=1:11.0.14.0.9-2.el8*
ENV JAVA_HOME /usr/lib/jvm/java-${JAVA_MAJOR_VERSION}-openjdk
dnf install java-${JAVA_MAJOR_VERSION}-openjdk-devel-${JAVA_VERSION}
I will work with someone on my team that understands the base images better. It is my understanding that we are building our own base Java image from Redhat UBI 8. Maybe there is something more we need to do to make sure the crypto libraries get installed?
Honestly I don't know. What I would do is try this on a redhat machine (not in a docker container) to start with. If that fails then you have somewhere to start.
Dave
>> From: Dave Cramer <davecramer@postgres.rocks>
>> Sent: Monday, March 28, 2022 9:04 AM
>> Honestly I don't know. What I would do is try this on a redhat machine (not in a docker container) to start with. If that fails then you have somewhere to start.
I rebuilt my container using “FROM openjdk:11” and deployed my test application to our Kubernetes cluster. Now when I look at the pod logs, I can see that it is successfully connecting:
About to try connecting to postreSQL database ...
Connected to the PostgreSQL server successfully
Successfully connected to the database!! Try running a query
Inside main - about to enter a long loop
Looping a set number of times ... Loop Iteration: 1
Looping a set number of times ... Loop Iteration: 2
Looping a set number of times ... Loop Iteration: 3
Looping a set number of times ... Loop Iteration: 4
So openjdk:11 appears to have the cryptography libraries in the JVM. Now we can figure out what is missing from our Iron Bank base image.
Thank you so much everyone for your help. I believe we are on the right track to getting our application running on FIPS enabled hosts.
I really appreciate everyone’s input.
>> From: Dave Cramer <davecramer@postgres.rocks>
>> Sent: Monday, March 28, 2022 9:04 AM
>> Honestly I don't know. What I would do is try this on a redhat machine (not in a docker container) to start with. If that fails then you have somewhere to start.I rebuilt my container using “FROM openjdk:11” and deployed my test application to our Kubernetes cluster. Now when I look at the pod logs, I can see that it is successfully connecting:
About to try connecting to postreSQL database ...
Connected to the PostgreSQL server successfully
Successfully connected to the database!! Try running a query
Inside main - about to enter a long loop
Looping a set number of times ... Loop Iteration: 1
Looping a set number of times ... Loop Iteration: 2
Looping a set number of times ... Loop Iteration: 3
Looping a set number of times ... Loop Iteration: 4So openjdk:11 appears to have the cryptography libraries in the JVM. Now we can figure out what is missing from our Iron Bank base image.
Thank you so much everyone for your help. I believe we are on the right track to getting our application running on FIPS enabled hosts.
I really appreciate everyone’s input.
>> From: Dave Cramer <davecramer@postgres.rocks>
>> Sent: Wednesday, March 30, 2022 7:19 AM
>> Please post your findings here. We really appreciate it when people find a solution and post the solution so that others can benefit.
Here is what I did to get things working:
- Used the same source code that I posted before and compiled it into a “runnable jar” (pg.jar)
- Created a Dockerfile that looks like:
FROM openjdk:11
USER 0
WORKDIR /opt/gms
COPY out/artifacts/pg_jar/pg.jar .
RUN set -ex && \
umask 027 && \
groupadd --gid 1001 gms && \
useradd --gid 1001 --uid 1001 -d /opt/gms gms && \
chown -R gms:gms /opt/gms
# gms uid
USER 1001
CMD ["java", "-jar", "pg.jar"]
- Built the Dockerfile to generate a local image by running:
docker build --pull --tag my-docker-registry.sandia.gov/pg-test/pg-test:test . - Pushed the image into our Docker registry (Artifactory) by running:
docker push gms-docker-registry.sandia.gov/pg-test/pg-test:test - Created Kubernetes yaml files to deploy the example program to an existing namespace called “jasontest” where we have a Postgres database running (used the Kubernetes service name in the JDBC connection string and the postgres pod’s expected username/password)
- Yaml file that describes a Kubernetes Service Account, Role, Role Binding (for pod permissions)
- Yaml file that describes how to deploy my app as a Kubernetes “Deployment” object
- Deployed the java application by running:
kubectl apply -f rbac.yaml
kubectl apply -f pgtest_pod.yaml - Ran a command to make sure the new pod reached a running state:
watch kubectl get pod -n jasontest
and observed that a pod was created and placed in the “Running” state: pg-test-6b94476c95-8kvgh - Ran a command to display the pod logs for the test program
kubectl logs -n jasontest pg-test-6b94476c95-8kvgh
Observed the pod output:
About to try connecting to postreSQL database ...
Connected to the PostgreSQL server successfully
Successfully connected to the database!! Try running a query
Inside main - about to enter a long loop
Looping a set number of times ... Loop Iteration: 1
Looping a set number of times ... Loop Iteration: 2
Looping a set number of times ... Loop Iteration: 3
Previously running this command showed logs with Java exceptions
As an aside, we need to get the Red Hat UBI 8 based image (distributed by Iron Bank – hardened container images) with openjdk working as well (it still has a problem). We believe that FIPS may not be turned on in that image but now that we know it “can work”, we can figure out how to make it work in the Iron Bank image.
>> From: McDermott, Becky <bmcderm@sandia.gov>
>> Sent: Wednesday, March 30, 2022 7:49 AM
I forgot to add that I built my sample program (that does the connection to the postgresql database) with the JDBC driver: postgresql-42.3.3.jar
--Becky
>> From: McDermott, Becky <bmcderm@sandia.gov>
>> Sent: Wednesday, March 30, 2022 7:49 AMI forgot to add that I built my sample program (that does the connection to the postgresql database) with the JDBC driver: postgresql-42.3.3.jar
>> From: Dave Cramer <davecramer@postgres.rocks>
>> Sent: Wednesday, March 30, 2022 8:26 AM
>>
>> Thanks, although the driver doesn't have much to do with the problem here. As others have mentioned I suspect this is a JVM implementation issue.
I think it is probably related to the underlying container OS (Red Hat UBI 8). We looked at the Dockerfile for building the openjdk11 image and it’s really not doing anything special or different than what we are doing to install openjdk into our container. But, the base image may need to explicitly enable FIPS. There is a Red Hat article that indicates that but waiting for the guy who has a Red Hat login to come in and download it for me.
Once we get the UBI 8 issue figured out, I will re-post.