For Symmetric Key Authentication as per documentation KeyStore password is optional, but JDK 11 requires it

[dishabehrani7]

Hi ,

I am using OrientDB 3.2.21 with JDK 11 and configuring Symmetric Key Authentication using a JCEKS keystore containing an AES secret key.

I created the keystore using:

keytool -genseckey   -alias keyAlias   -keyalg AES   -keysize 128   -storetype JCEKS   -keystore D:/database/new/orientdb-community-3.2.21/orientdb-community-3.2.21/config/AESKey.jks   -storepass password   -keypass password

According to the documentation, both keyStore.password and keyStore.keyPassword are marked as optional.
https://orientdb.dev/docs/3.0.x/security/Security-Symmetric-Key-Authentication.html#keystore

However, when I omit the password property from the configuration, OrientDB fails with:

com.orientechnologies.orient.core.exception.OSecurityException: OSymmetricKey.fromKeystore() Exception: password can't be null
	at com.orientechnologies.orient.core.security.symmetrickey.OSymmetricKey.fromKeystore(OSymmetricKey.java:335)
	at com.orientechnologies.orient.core.security.symmetrickey.OSymmetricKey.fromKeystore(OSymmetricKey.java:284)
	at com.orientechnologies.orient.core.security.symmetrickey.OSymmetricKey.fromConfig(OSymmetricKey.java:215)
	at symmetric.OrientSymmetricKeyExampleKeystore.main(OrientSymmetricKeyExampleKeystore.java:39)
Caused by: java.lang.IllegalArgumentException: password can't be null
	at java.base/com.sun.crypto.provider.KeyProtector.<init>(KeyProtector.java:114)
	at java.base/com.sun.crypto.provider.JceKeyStore.engineGetKey(JceKeyStore.java:129)
	at java.base/java.security.KeyStoreSpi.engineGetEntry(KeyStoreSpi.java:494)
	at java.base/java.security.KeyStore.getEntry(KeyStore.java:1555)

I have the following questions -

1.) Does OrientDB actually support passwordless JCEKS keystores for symmetric key authentication as documnet mentions its optional ?
2.) If yes, what is the supported procedure for creating such a keystore?
3.) If no, should the documentation state that password is required when using keystore as authentication mode ?
4.) Was there a previous OrientDB version, JDK version, or keystore type where a null password was supported?

Thanks,
Disha

[tglman]

Hi,

Yes it should work, it looks like you are not passing the keystore password to it.

In any case I strongly suggest to plan a update to a most recent release.

Regards

[dishabehrani7]

As per the documentation, password and keyPassword are marked as optional. However, when these fields are not provided, authentication fails with a password-related error.

Could you please confirm whether these fields are actually mandatory in practice? If so, does that mean the documentation is incorrect or outdated?

[tglman]

hi,
you did this:

keytool -genseckey   -alias keyAlias   -keyalg AES   -keysize 128   -storetype JCEKS   -keystore D:/database/new/orientdb-community-3.2.21/orientdb-community-3.2.21/config/AESKey.jks   -storepass password   -keypass password

that have:

-storepass password   -keypass password