apache / apache/cloudstack

The documented RabbitMQ credential encryption feature using Jasypt is non-functional on CloudStack 4.22.x

Ouverte
#13,352 3 commentaires 0 réactions 0 personnes assignées Réclamée par @DaanHoogland Voir sur GitHub
component:management-server type:bug
Langage dominant
Java
Étoiles
3.1k
Forks
1.4k
Merge moyen
6 j 19 h
PR mergées (30 j)
32

Description

### problem

If we follow the documented RabbitMQ credential encryption feature, literally copy paste the configuration from https://docs.cloudstack.apache.org/en/4.22.0.0/adminguide/events.html , the encrypted credentials are not being decrypted and RabbitMQ connection is not established. Instead the error messages are thrown to the management server log about missing classes.

Upon further analysis it seems the jasypt library is incompatible with Spring 5+. There is a https://github.com/jasypt/jasypt/issues/25 and/or https://github.com/jasypt/jasypt/issues/35 . And so this is most probably the root cause as the class fails to load on Spring 5 which CloudStack is using.

### versions

CloudStack 4.22.1.0 and also 4.22.0.1, Standard management server install, Ubuntu

### The steps to reproduce the bug

STEPS TO REPRODUCE
1. Follow the AMQP configuration documentation at https://docs.cloudstack.apache.org/en/4.22.0.0/adminguide/events.html
2. Add the documented Jasypt bean configuration to spring-event-bus-context.xml
3. Restart cloudstack-management

EXPECTED BEHAVIOUR:
Encrypted credentials are decrypted and RabbitMQ connection is established.

ACTUAL BEHAVIOUR:
```
Error creating bean with name 'org.apache.cloudstack.spring.lifecycle.ConfigDepotLifeCycle#0': Unsatisfied dependency expressed through field 'configDepotAdmin'; nested exception is org.springframework.beans.factory.CannotLoadBeanClassException: Cannot find class [org.jasypt.spring3.properties.EncryptablePropertyPlaceholderConfigurer] for bean with name 'propertyConfigurer' defined in file [/etc/cloudstack/management/META-INF/cloudstack/event/spring-event-bus-context.xml]; nested exception is java.lang.ClassNotFoundException: org.jasypt.spring3.properties.EncryptablePropertyPlaceholderConfigurer
/var/log/cloudstack/management/management-server.log.2026-06-03.gz:Caused by: org.springframework.beans.factory.CannotLoadBeanClassException: Cannot find class [org.jasypt.spring3.properties.EncryptablePropertyPlaceholderConfigurer] for bean with name 'propertyConfigurer' defined in file [/etc/cloudstack/management/META-INF/cloudstack/event/spring-event-bus-context.xml]; nested exception is java.lang.ClassNotFoundException: org.jasypt.spring3.properties.EncryptablePropertyPlaceholderConfigurer
/var/log/cloudstack/management/management-server.log.2026-06-03.gz:Caused by: java.lang.ClassNotFoundException: org.jasypt.spring3.properties.EncryptablePropertyPlaceholderConfigurer
```

### What to do about it?

Replace the implementation with a Spring 5-compatible alternative
and/or document a supported workaround. Also, there is second issue with the PBEWithMD5AndDES is no longer considered secure, so the solution shall be future proof.

Guide de contribution

Ouvrir le guide de contribution

Piste de recherche

Commencez par examiner la pull request ouverte #13676 et la configuration AMQP documentée dans events.html. Inspectez spring-event-bus-context.xml et l’exception de management-server.log afin de retracer la classe Jasypt manquante. Le travail est considéré comme terminé lorsque les identifiants RabbitMQ chiffrés documentés fonctionnent avec une configuration compatible avec Spring 5 et qu’un remplacement sécurisé ou une solution de contournement prise en charge est documenté.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Évaluation

Stack technique
java, rabbitmq, spring
Domaine
backend, security
Type d'issue
Bug
Difficulté
4/5
Temps estimé
3-5 jours
Activité
À l'abandon
Clarté
Plutôt claire
Accessibilité débutants
35/100

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.