ampassword is unusable

[anja98]

Describe the bug
Unable to execute ampassword from ssoadmintools. As a result, its not possible to perform the following:

• generate new certificate
• change default keystore password

To Reproduce
Steps to reproduce the behavior:

$ ./ampassword
./ampassword: 36: ./ampassword: Bad substitution

$ echo "${unix.setup.classpath}"
bash: ${unix.setup.classpath}: bad substitution

Expected behavior
ampassword should execute as usual

Screenshots
If applicable, add screenshots to help explain your problem.

Server :

• Host OS: Ubuntu 18.04.4 LTS
• OpenAM: 14.5.1 docker image from docker hub

[anja98]

Workaround:
Manually enter the required JARs.

#CLASSPATH="$CLASSPATH:${unix.setup.classpath}"
CLASSPATH="$CLASSPATH:$TOOLS_HOME/resources"
CLASSPATH="$CLASSPATH:$TOOLS_HOME/lib/org.openidentityplatform.openam.openam-core-14.5.1.jar"
CLASSPATH="$CLASSPATH:$TOOLS_HOME/lib/org.openidentityplatform.openam.openam-shared-14.5.1.jar"
CLASSPATH="$CLASSPATH:$TOOLS_HOME/lib/org.openidentityplatform.commons.util-2.0.7-SNAPSHOT.jar"
CLASSPATH="$CLASSPATH:$TOOLS_HOME/lib/com.fasterxml.jackson.core.jackson-databind-2.10.3.jar"
CLASSPATH="$CLASSPATH:$TOOLS_HOME/lib/com.fasterxml.jackson.core.jackson-core-2.10.3.jar"
CLASSPATH="$CLASSPATH:$TOOLS_HOME/lib/com.fasterxml.jackson.core.jackson-annotations-2.10.3.jar"
CLASSPATH="$CLASSPATH:$TOOLS_HOME/lib/commons-lang.commons-lang-2.6.jar"
CLASSPATH="$CLASSPATH:$TOOLS_HOME/lib/com.google.guava.guava-28.1-android.jar"
CLASSPATH="$CLASSPATH:$TOOLS_HOME/lib/joda-time.joda-time-2.10.5.jar"
CLASSPATH="$CLASSPATH:$TOOLS_HOME/lib/org.openidentityplatform.opendj.opendj-core-4.4.6-SNAPSHOT.jar"
CLASSPATH="$CLASSPATH:$TOOLS_HOME/lib/org.openidentityplatform.commons.i18n-framework.core-2.0.7-SNAPSHOT.jar"
CLASSPATH="$CLASSPATH:$TOOLS_HOME/lib/org.openidentityplatform.commons.i18n-framework.slf4j-2.0.7-SNAPSHOT.jar"
CLASSPATH="$CLASSPATH:$TOOLS_HOME/lib/org.slf4j.slf4j-api-1.7.30.jar"
CLASSPATH="$CLASSPATH:$TOOLS_HOME/lib/org.slf4j.slf4j-nop-1.7.30.jar"
CLASSPATH="$CLASSPATH:$TOOLS_HOME/lib/org.openidentityplatform.opendj.opendj-server-legacy-4.4.6-SNAPSHOT.jar"
CLASSPATH="$CLASSPATH:$TOOLS_HOME/lib/org.openidentityplatform.opendj.opendj-config-4.4.6-SNAPSHOT.jar"
CLASSPATH="$CLASSPATH:$TOOLS_HOME/lib/org.openidentityplatform.opendj.opendj-cli-4.4.6-SNAPSHOT.jar"
CLASSPATH="$CLASSPATH:$TOOLS_HOME/lib/org.openidentityplatform.openam.openam-ldap-utils-14.5.1.jar"
CLASSPATH="$CLASSPATH:$TOOLS_HOME/lib/org.openidentityplatform.openam.openam-audit-context-14.5.1.jar"
CLASSPATH="$CLASSPATH:$TOOLS_HOME/lib/org.openidentityplatform.openam.openam-audit-configuration-14.5.1.jar"
CLASSPATH="$CLASSPATH:$TOOLS_HOME/lib/org.openidentityplatform.commons.http-framework.core-2.0.7-SNAPSHOT.jar"
CLASSPATH="$CLASSPATH:$TOOLS_HOME/lib/org.openidentityplatform.opendj.opendj-core-4.4.6-SNAPSHOT.jar"
CLASSPATH="$CLASSPATH:$TOOLS_HOME/lib/org.openidentityplatform.opendj.opendj-grizzly-4.4.6-SNAPSHOT.jar"
CLASSPATH="$CLASSPATH:$TOOLS_HOME/lib/org.glassfish.grizzly.grizzly-framework-2.4.4.jar"

[LoganBarnett]

Related to #245. The build-classpath goal was providing unix.setup.classpath.

@anja98 thanks for posting a workaround!

[bagnos]

I get this error when I execute this command:

./ampassword --encrypt keypass.cleartext

ERROR: created internalAppSSOToken:UERlb0NMQ3dkTU5mSVNzY0N2TFMxQT09MTYxMjc4MTYyOTU3Mw==, authInitialized: false, SystemProperties.isServerMode(): false, SystemProperties.get(AMADMIN_MODE): true

Did you have this issue?

[michewl]

I came across the same bad substitution error and had to fix it in my project.

I opened a pull request with the changes

[michewl]

On a side note:
Encrypting .storepass does not seem to work. This will result in the following exception:

com.sun.identity.common.configuration.ConfigurationException: Configuration store is not available.
	com.sun.identity.setup.AMSetupFilter.doFilter(AMSetupFilter.java:119)
	org.forgerock.openam.audit.context.AuditContextFilter.doFilter(AuditContextFilter.java:51)

Reason being probably that the configuration store password is saved inside the keystore since the switch to JCEKS.

With encrypted .keypass OpenAM starts just fine but I belive it may cause some errors later as it is also saved in clear text during migration as seen in the references.

References:

• // the .storepass is not encrypted anymore
• // Save the keystore passwords unencrypted