apache / apache/cloudstack

The documented RabbitMQ credential encryption feature using Jasypt is non-functional on CloudStack 4.22.x

未关闭
#13,352 3 条评论 0 个 reaction 已指派 0 人 已被 @DaanHoogland 认领 在 GitHub 查看
component:management-server type:bug
主要语言
Java
星标
3.1k
派生
1.4k
平均合并
6 天 19 小时
30 天内合并 PR
32

描述

### problem

If we follow the documented RabbitMQ credential encryption feature, literally copy paste the configuration from https://docs.cloudstack.apache.org/en/4.22.0.0/adminguide/events.html , the encrypted credentials are not being decrypted and RabbitMQ connection is not established. Instead the error messages are thrown to the management server log about missing classes.

Upon further analysis it seems the jasypt library is incompatible with Spring 5+. There is a https://github.com/jasypt/jasypt/issues/25 and/or https://github.com/jasypt/jasypt/issues/35 . And so this is most probably the root cause as the class fails to load on Spring 5 which CloudStack is using.

### versions

CloudStack 4.22.1.0 and also 4.22.0.1, Standard management server install, Ubuntu

### The steps to reproduce the bug

STEPS TO REPRODUCE
1. Follow the AMQP configuration documentation at https://docs.cloudstack.apache.org/en/4.22.0.0/adminguide/events.html
2. Add the documented Jasypt bean configuration to spring-event-bus-context.xml
3. Restart cloudstack-management

EXPECTED BEHAVIOUR:
Encrypted credentials are decrypted and RabbitMQ connection is established.

ACTUAL BEHAVIOUR:
```
Error creating bean with name 'org.apache.cloudstack.spring.lifecycle.ConfigDepotLifeCycle#0': Unsatisfied dependency expressed through field 'configDepotAdmin'; nested exception is org.springframework.beans.factory.CannotLoadBeanClassException: Cannot find class [org.jasypt.spring3.properties.EncryptablePropertyPlaceholderConfigurer] for bean with name 'propertyConfigurer' defined in file [/etc/cloudstack/management/META-INF/cloudstack/event/spring-event-bus-context.xml]; nested exception is java.lang.ClassNotFoundException: org.jasypt.spring3.properties.EncryptablePropertyPlaceholderConfigurer
/var/log/cloudstack/management/management-server.log.2026-06-03.gz:Caused by: org.springframework.beans.factory.CannotLoadBeanClassException: Cannot find class [org.jasypt.spring3.properties.EncryptablePropertyPlaceholderConfigurer] for bean with name 'propertyConfigurer' defined in file [/etc/cloudstack/management/META-INF/cloudstack/event/spring-event-bus-context.xml]; nested exception is java.lang.ClassNotFoundException: org.jasypt.spring3.properties.EncryptablePropertyPlaceholderConfigurer
/var/log/cloudstack/management/management-server.log.2026-06-03.gz:Caused by: java.lang.ClassNotFoundException: org.jasypt.spring3.properties.EncryptablePropertyPlaceholderConfigurer
```

### What to do about it?

Replace the implementation with a Spring 5-compatible alternative
and/or document a supported workaround. Also, there is second issue with the PBEWithMD5AndDES is no longer considered secure, so the solution shall be future proof.

贡献指南

打开贡献指南

调研方向

首先检查开放的 pull request #13676 以及 events.html 中记录的 AMQP 配置。检查 spring-event-bus-context.xml 和 management-server.log 中的异常,以追踪缺失的 Jasypt 类。当文档中记录的加密 RabbitMQ 凭据能够在与 Spring 5 兼容的配置下工作,并且记录了安全的替代方案或受支持的 workaround 时,即视为完成。

由索引模型根据 Issue 内容生成。

评估

技术栈
java, rabbitmq, spring
领域
backend, security
Issue 类型
缺陷
难度
4/5
预计耗时
3-5 天
活跃度
停滞
描述清晰度
基本清楚
新手友好度
35/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。