AWS Secret Manager - Protect Your Secrets in Applications

Many applications use secrets for various use cases. Using an application ID and Secret key to generate a token or maybe the secret key itself to access APIs, a username and password to create a database connection string to retrieve data from RDS. Maybe there are various security measurements and standards you’ve been enforced by your organization. One thing for sure is not storing passwords in configuration files or hard code them in plain texts. Storing and retrieving those secrets/passwords in a secure manner can be a challenging task and in this post we are going to discuss a more robust solution using AWS services.

You’ll be need a AWS account setup to follow this tutorial. Then log into your AWS console and locate Secrets Manager service under the Security, Identity and Compliance category.  Click on the “Store a new Secret”. You’ll get three options,

 1. Credentials for RDS database
 2. Credentials for other database
 3. Other Type of Secrets.

Option 1 and 2 dedicate for database credentials, We’ll select the “Other type of secrets” option since this post we going to demonstrate a more generalized solution. Now add your secrets to store securely. Use the DefaultEncryptionKey option for the demo purpose.

Hit Next and add a meaningful name for “Secret Name”, we will be using this to retrieve secrets in the application. Other options are optional and you can proceed.

Hit Next and you’ll get an option to enable Automatic rotation of the keys via a lambda function, lets keep the automated key rotation disabled and proceed to next step. Finally you’ll be redirected to the review and create step. Important thing in this step is you’ll get sample code snippets for Java, JavaScript, C#, Python 3, Ruby and Go languages.

Following is a java code snippet generated for our newly created “blog-sample” secret.

// Use this code snippet in your app.
// If you need more information about configurations or implementing the sample code, visit the AWS docs:
// https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/java-dg-samples.html#prerequisites

public static void getSecret() {

    String secretName = "blog-sample";
    String region = "us-east-1";

    // Create a Secrets Manager client
    AWSSecretsManager client  = AWSSecretsManagerClientBuilder.standard()
                                    .withRegion(region)
                                    .build();
    
    // In this sample we only handle the specific exceptions for the 'GetSecretValue' API.
    // See https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html
    // We rethrow the exception by default.
    
    String secret, decodedBinarySecret;
    GetSecretValueRequest getSecretValueRequest = new GetSecretValueRequest()
                    .withSecretId(secretName);
    GetSecretValueResult getSecretValueResult = null;

    try {
        getSecretValueResult = client.getSecretValue(getSecretValueRequest);
    } catch (DecryptionFailureException e) {
        // Secrets Manager can't decrypt the protected secret text using the provided KMS key.
        // Deal with the exception here, and/or rethrow at your discretion.
        throw e;
    } catch (InternalServiceErrorException e) {
        // An error occurred on the server side.
        // Deal with the exception here, and/or rethrow at your discretion.
        throw e;
    } catch (InvalidParameterException e) {
        // You provided an invalid value for a parameter.
        // Deal with the exception here, and/or rethrow at your discretion.
        throw e;
    } catch (InvalidRequestException e) {
        // You provided a parameter value that is not valid for the current state of the resource.
        // Deal with the exception here, and/or rethrow at your discretion.
        throw e;
    } catch (ResourceNotFoundException e) {
        // We can't find the resource that you asked for.
        // Deal with the exception here, and/or rethrow at your discretion.
        throw e;
    }

    // Decrypts secret using the associated KMS CMK.
    // Depending on whether the secret is a string or binary, one of these fields will be populated.
    if (getSecretValueResult.getSecretString() != null) {
        secret = getSecretValueResult.getSecretString();
    }
    else {
        decodedBinarySecret = new String(Base64.getDecoder().decode(getSecretValueResult.getSecretBinary()).array());
    }

    // Your code goes here.
}

If you check the code you can see that, it is using the “secretName” and the stored “region” to fetch the secret data.

You can use either the secret name or secret ARN to retrieve the secrets. Now let’s try our sample code in our local environment to access secrets values.

1. To run the sample locally you need to configure the AWS CLI, using [a]

[a]. https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html

2. Add the following maven dependency.
      
            com.amazonaws
            aws-java-sdk-secretsmanager
            1.11.502
       
 3. Build the project using following command

mvn clean install

4. Run the assembly plugin

mvn assembly:single

5. Run the uber jar using following command
java -jar target/aws-secrets-manager-test-1.0-SNAPSHOT-jar-with-dependencies.jar

You’ll get the secret as following in decrypted manner.

Now you learned,how to store secrets using AWS Secrets Manager and retrieve them in your Applications. But there is a catch here, when configuring the AWS CLI tool you have to store the AWS Access Key ID and the AWS Secret Access Key, which is not the best practice to host them in the AWS EC2 servers. If  a server is compromised, the intruder can easily pick your AWS credentials stored in the ~/.aws/credentials file.

Overcome the storing of Secret Keys

In above use-case, we have to hard code AWS credentials, which is not recommended. Let’s spin up a  ec2 instance and copy our sample app and see whether we can access the secrets we stored in the AWS Secrets Manger.

1. Spin up a ec2 t2 micro instance.
2. Then copy the sample application to the new ec2 server.
scp -i ec2.pem ~/code-base/aws-secrets-manager-test/target/aws-secrets-manager-test-1.0-SNAPSHOT-jar-with-dependencies.jar ec2-user@ip-address:/home/ec2-user
3. Install java in your ec2 instance.
    sudo yum install java-1.8.0-openjdk
4. Run the application
java -jar aws-secrets-manager-test-1.0-SNAPSHOT-jar-with-dependencies.jar

You’ll be ended up with the following error.

It complains that you don’t have the AWS-ACCESS_KEY and AWS_SECRET_KEY unable to load AWS credentials.

Overcome the issue using IAM roles.

Now lets create an IAM role so that my ec2 instance can access the AWS Secrets Manager and retrieve the stored secret values.

1. Go to Services -> IAM -> Roles → Create Role.
2. Select type of trusted entity as AWS service
3. Select EC2
4. Hit Next- Permissions.

5. Search for the permission policy “SecretsManagerReadWrite” and select.

6. Hit Next-Tags.
7. Add tags if you need hit Next.
8. Give a role name and hit Create Role.

Note - It would be if you can create a more granualar role, which can only read the AWS Secrets Manager, since the “SecretsManagerReadWrite” policy has more permissions than we required.

Next Goto → Services → EC2 → Instances → Actions → Instance Settings → Attach/Repalce IAM Role

Select the newly created role and apply.

Now let’s try to run our sample application copied to the AWS EC2 instance. You should be able to read the secrets.

So in this post we have discussed an important aspect of storing and retrieving secrets required for you applications. Since as per my experience this has become a chicken and egg problem, when comes to security the secrets and securing the master key which secure those secrets. I think using the Role approach will help to overcome this problem.

Please add your comments/thoughts if you think there are better ways to overcome this :) Sample Code Link

Hashi Corp KV Secrets Manager integration with SpringBoot Application

Securing your secrets inside application is not an easy task. Typically applications deployed to multiple environments, and developers have to maintain separate credentials for each environment in configuration files, if there is no encryption mechanism (most of the time :( ) those username and passwords or secrets for token generation (API keys), database connections are stored as plain text. If there is a security breach, sensitive data can be compromised and lose millions of your business, because of not having encryption in place.

To address this there are various solutions available in the market. The most popular ones are the AWS Secret Manager, HashiCorp, Google Cloud KMS etc. Most of these services provide Authorization to secret vaults, Verification of Usage of Keys, Encryption data at rest, Automated Key Rotation etc. Selecting a suitable application is depend on your requirement of the organization or by the features of the service. If you are using AWS and deployed your application is cloud, AWS Secret Manager is one best possibility, since the management overhead is minimal. But for some companies which having serious security concerns, they tend to use on premise solution, and Hashi Corp can be a suitable choice. 

The scope of this post is to how to configure and use HashiCorp KV Secret Engine, and consume those secrets inside a SpringBoot application.

Image source - https://www.vaultproject.io/

Configuring the Hashi Corp Vault.
1. Download the community version from [1]. https://www.vaultproject.io/downloads.html
2. Extract and set the path to the vault bin

export PATH=$PATH:/home/aruna/vault/bin

3. Start the vault with dev configuration

vault server --dev --dev-root-token-id="12345678" // use secure token to seed

 4. Now open another terminal and put some secrets to the vault, In KV secrets engine version 2 write operation has changed to put.

export PATH=$PATH:/home/aruna/vault/bin
vault kv put secret/my-secret username=spring-user password=se3ret

5. You can test the values are saved to vault using following curl command.

 curl --header "X-Vault-Token: 12345678"        http://127.0.0.1:8200/v1/secret/data/my-secret

      If the request is a success should get the below response.

{  
   "request_id":"b0a0f055-3eed-b3c1-353f-427de8f61bcd",
   "lease_id":"",
   "renewable":false,
   "lease_duration":0,
   "data":{  
      "data":{  
         "password":"se3ret",
         "username":"spring-user"
      },
      "metadata":{  
         "created_time":"2018-11-14T09:21:46.812937558Z",
         "deletion_time":"",
         "destroyed":false,
         "version":2
      }
   },
   "wrap_info":null,
   "warnings":null,
   "auth":null
}

More about the rest API can be found here.
[2]. https://www.vaultproject.io/api/secret/kv/kv-v2.html

Setting up the SpringBoot project to consume the secret stored above.

Add the following properties to your bootstrap.properties file. Before starting the application, these values should be injected to the spring vault to work.

spring.application.name=my-secret // name of the KV secrets engine
spring.cloud.vault.token=12345678 //token value set for server
spring.cloud.vault.scheme=http
spring.cloud.vault.kv.enabled=true

Then load the properties as follows.

@ConfigurationProperties
public class SecretConfiguration {

    private String username;
    private String password;

    public String getUsername() {
        return username;
    }

    public void setUsername(String username) {
        this.username = username;
    }

    public String getPassword() 
        return password;
    }

    public void setPassword(String password) {
        this.password = password;
    }
}

Full sample can be found here. [3]. https://github.com/arunasujith/hashi-corp-vault-sample
That's it for this article, hope you to see you in another exciting post.

Functions as First Class Citizen Variables

Hello all, In this post we are going to talk about functions as first class citizens and it's usages.

taken from - https://www.linkedin.com/topic/functional-programming

The easiest way to understand is to analyze a demonstration. Package java.util.function  in java 8 contains all kinds of single method interfaces. In this samples we are going to use the java.util.function.Function and java.util.function.BiFunction interfaces.

1. Create  an inline lambda expression and store in a variable.

BiFunction<Integer, Integer, Integer> addFunction = (int1, int2) -> {
            return int1 + int2;
        };

to call the above method we can do as follows.

addFunction.apply(100, 200);

2. Create a static method that fits into the signature of the BiFunction interface, then assign it to the variable and invoke.

import java.util.function.BiFunction;

/**
 * Created by aruna on 2/7/17.
 */
public class Main {

    public static void main(String[] args) throws Exception {
        //create the variable
        BiFunction<Integer, Integer, Integer> addFunctionVariable;
        //assign the function to variable
        addFunctionVariable = Main::addStaticFunction;
        //invoke
        addFunctionVariable.apply(100, 200);
    }

    private static int addStaticFunction(int int1, int int2) {
        return int1 + int2;
    }
}

3. Create a instance method that fits to the signature of the BiFunction interface. In this approach, first we have to create the instance to acquire the function variable.

import java.util.function.BiFunction;

/**
 * Created by aruna on 2/7/17.
 */
public class Main {

    public static void main(String[] args) throws Exception {
        //create the variable
        BiFunction<Integer, Integer, Integer> addFunctionVariable;
        //create Main Object
        Main main = new Main();
        //assign the instance method to variable
        addFunctionVariable = main::addFunction;
        //invoke
        addFunctionVariable.apply(100, 200);
    }

    private int addFunction(int int1, int int2) {
        return int1 + int2;
    }
}

Now take an example, how to pass functions as variables and do some stuff.

import java.util.function.Function;

/**
 * Created by aruna on 2/7/17.
 */
public class Main {

    public static void main(String[] args) throws Exception {

        //define a function that multiply integer by 100
        Function<Integer, Integer> function = (intValue) -> { return intValue * 100;};
        //pass that function as a variable
        multiplyAndAdd(100 , 200, function);
    }
    private static int multiplyAndAdd(int int1, int int2, Function<Integer, Integer> function){

        if(function != null) {
            int1 = function.apply(int1);
            int2 = function.apply(int2);
        }

        return int1+ int2;
    }
}

Spring Boot Application Live Reload (Hot Swap) with Intellij IDEA

While developing Spring Boot Applications using Intellij IDEA, it was so annoying to restart the spring boot app after each and every change. Spring boot provides live reload (how swap) of application out of the box using the following dependency.
 

<dependency>
    <groupid>org.springframework.boot</groupid>
    <artifactid>spring-boot-devtools</artifactid> 

</dependency>

But it didn't live reload the application/container and the hot deployment, didn't work for changes. Further researching found that following changes needed to be done, in order the hot deployment to be worked correctly.

1. Open the Settings --> Build-Execution-Deployment --> Compiler
    and enable the Make Project Automatically.

2. Then press ctrl+shift+A and search for registry. In the registry make the following configuration enabled.

compiler.automake.allow.when.app.running

3. Restart the IDE.

That's it now the hot deployment works and you don't have to restart manually after each and every change. :)

WSO2 ESB : Consume JMS Messages From HornetQ embedded JBOSS EAP

In this post we are going to explore some JMS transport capabilities in WSO2 ESB. We are going to learn on how to create a message queues in JBOSS EAP, Publish sample messages to that queue. And finally using WSO2 ESB to listen to that queue and fetch the messages from the queue. Following are the per-requisites for this tutorial.

1. WSO2 ESB 4.9.0 Download From Here
2. JBOSS EAP Download From Here 
3. Maven to build and run the helloworld-jms sample client

Setting up JBOSS EAP

First lets install the JBOSS EAP to your local machine. Follow the below instructions to install.
1. Start the installer using the following command.

java -jar jboss-eap-6.2.0-installer.jar

2. Continue the installer with appropriate values (mostly default configurations). Select yes to install samples. Since we are using the helloworld-jms sample to publish messages to the queue. Otherwise you can write your own sample client to publish messages.

3. After that fill out the details with default values as it is, and finish the installation.
Now you have installed JBoss EAP successfully, Now lets create a new application user and a new message queue.

Adding a new application user. 

Move to the JBOSS-EAP installation folder and execute the following command.

EAP_HOME/bin/add-user.sh -a -u 'SampleUser' -p 'SamplePwd1!' -g 'guest'

Create a new message queue.

You can add a message queue directly editing the EAP_HOME/standalone/configuration/standalone-full.xml configuration file. Follow the below steps to add the new message queue.

Open up the the standalone-full.xml file and locate the <hornetq-server>
2. Add the following content inside the  <hornetq-server> element.

1 2 3 4 5 6

<jms-destinations> <jms-queue name="sampleQueue"> <entry name="queue/test"/> <entry name="java:jboss/exported/jms/queue/test"/> </jms-queue> </jms-destinations>

Now Start the JBoss server with following command and login to the management console.

EAP_HOME/bin/standalone.sh -c standalone-full.xml

Now after logging to the management console, we can see the newly added user and the message queue. Default admin console url is http://127.0.0.1:9990

After logging navigate to Profile -> Messaging -> Destinations. And you'll be able to see the added sampleQueue.

And if you move to Security Settings section in the same page, you'll able to see the Role with guest has the permission to consume and produce messages to the queue.

Now the configuration part of the JBOSS EAP is done. Lets configure the WSO2 ESB. In this sample we are going to consume messages from the queue. So we are going to configure only the JMS Transport Receiving part in the ESB side.

1. Open up the WSO2-ESB/repository/conf/axis2/axis2.xml file and add  the following configuration.

<transportReceiver name="jms" class="org.apache.axis2.transport.jms.JMSListener">
 <parameter name="sampleQueueConnectionFactory" locked="false">
  <parameter name="java.naming.factory.initial" locked="false">org.jboss.naming.remote.client.InitialContextFactory</parameter>
  <parameter name="java.naming.provider.url" locked="false">remote://localhost:4447</parameter>
  <parameter name="transport.jms.ConnectionFactoryJNDIName" locked="false">jms/RemoteConnectionFactory</parameter>
  <parameter name="transport.jms.UserName" locked="false">SampleUser</parameter>
  <parameter name="transport.jms.Password" locked="false">SamplePwd1!</parameter>
  <parameter name="java.naming.security.principal" locked="false">SampleUser</parameter> 
  <parameter name="java.naming.security.credentials" locked="false">SamplePwd1!</parameter>
  <parameter name="transport.jms.ConnectionFactoryType" locked="false">queue</parameter>
 </parameter>
    </transportReceiver>

For the username and password add the user details we have created in JBOSS side for both transport.jms and java.naming.security parameters.

2. Copy the jboss-client.jar to WSO2-ESB/repository/components/lib folder.
IMPORTANT After copying we have to remove the javax.jms package inside the javax.

Now Start the esb server by executing the ./ESB-HOME/bin/wso2server.sh command. Login to the ESB Management console and create the following sample Proxy. 

Note that in the below proxy transport.jms.destination value should be equal to the sampleQueue we have created earlier. transport.jms.ConnectionFactory value should be eqaul to the transportReceiver element calue we have added to the axis.xml

<?xml version="1.0" encoding="UTF-8"?>
<proxy xmlns="http://ws.apache.org/ns/synapse"
       name="JBossToESB"
       transports="jms"
       startOnLoad="true"
       trace="disable">
   <description/>
   <target>
      <inSequence>
         <log level="full">
            <property name="MESSAGE" value="New message from JBoss"/>
         </log>
      </inSequence>
   </target>
   <parameter name="transport.jms.Destination">sampleQueue</parameter>
   <parameter name="transport.jms.ContentType">
      <rules>
         <jmsProperty>contentType</jmsProperty>
         <default>text/plain</default>
      </rules>
   </parameter>
   <parameter name="transport.jms.ConnectionFactory">sampleQueueConnectionFactory</parameter>
</proxy>

If the deployment of the proxy is successful you'll see something similar to the following log.

[2016-01-13 12:47:33,623]  INFO - ProxyService Building Axis service for Proxy service : JBossToESB
[2016-01-13 12:47:33,625]  INFO - ProxyService Adding service JBossToESB to the Axis2 configuration
[2016-01-13 12:47:33,635]  INFO - DeploymentInterceptor Deploying Axis2 service: JBossToESB {super-tenant}
[2016-01-13 12:47:33,712]  INFO - JMSListener Connection attempt: 1 for JMS Provider for service: JBossToESB was successful!
[2016-01-13 12:47:33,713]  INFO - ServiceTaskManager Task manager for service : JBossToESB [re-]initialized
[2016-01-13 12:47:34,714]  INFO - JMSListener Started to listen on destination : sampleQueue of type queue for service JBossToESB
[2016-01-13 12:47:34,714]  INFO - ProxyService Successfully created the Axis2 service for Proxy service : JBossToESB
[2016-01-13 12:47:34,714]  INFO - ProxyServiceDeployer ProxyService named 'JBossToESB' has been deployed from file : /home/aruna/Desktop/doc/wso2esb-4.9.0/repository/deployment/server/synapse-configs/default/proxy-services/JBossToESB.xml

Test the Scenario

To test this JBOSS ESB integration is working we are going to use the helloworld-jms sample client which comes with the JBoss installation.

Navigate to the following folder EAP-Home/jboss-eap-6.2.0.GA-quickstarts/helloworld-jms. Then comment out the following code block from the src/main/java/org/jboss/as/quickstarts/jms/HelloWorldJMSClient.java file. Since we don't need the consume part of the sample. ESB will consume the message.

// Then receive the same number of messages that were sent
//            for (int i = 0; i < count; i++) { 
//              message = (TextMessage) consumer.receive(5000);
//              log.info("Received message with content " + message.getText());
//        }

Execute the following command to run the sample.

mvn clean compile exec:java -Dusername=SampleUser -Dpassword=SamplePwd1! -Dmessage.content="Hellow WSO2 ESB From JBoss EAP"

If the above command fails to execute due to dependency issue. You may have to add following profile to Maven-Home/conf/settings.xml.

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/xsd/settings-1.0.0.xsd">
    <localRepository/>
    <profiles>
        <profile>
            <id>redhat-techpreview-all-repository</id>
            <repositories>
                <repository>
                    <id>redhat-techpreview-all-repository</id>
                    <name>Red Hat Tech Preview repository (all)</name>
                    <url>http://maven.repository.redhat.com/techpreview/all/</url>
                    <layout>default</layout>
                    <releases>
                        <enabled>true</enabled>
                        <updatePolicy>never</updatePolicy>
                    </releases>
                    <snapshots>
                        <enabled>false</enabled>
                        <updatePolicy>never</updatePolicy>
                    </snapshots>
                </repository>
            </repositories>
            <pluginRepositories>
                <pluginRepository>
                    <id>redhat-techpreview-all-repository</id>
                    <name>Red Hat Tech Preview repository (all)</name>
                    <url>http://maven.repository.redhat.com/techpreview/all/</url>
                    <layout>default</layout>
                    <releases>
                        <enabled>true</enabled>
                        <updatePolicy>never</updatePolicy>
                    </releases>
                    <snapshots>
                        <enabled>false</enabled>
                        <updatePolicy>never</updatePolicy>
                    </snapshots>
                </pluginRepository>
            </pluginRepositories>
        </profile>
    </profiles>
    <activeProfiles>
        <activeProfile>redhat-techpreview-all-repository</activeProfile>
    </activeProfiles>
</settings>

Or else you can add the above repository to the sample's pom.xml.

Explanation

helloworld-jms sample client will add a sample message to the sampleQueue after running the above command. And now if you check the ESB Console, You'll see something similar to the following log, proving that the ESB has consumed the message from the JBoss JMS queue.

[2016-01-13 14:10:28,888]  INFO - LogMediator To: , WSAction: urn:mediate, SOAPAction: urn:mediate, MessageID: ID:4c942aa5-b9d1-11e5-b7c9-c18d59e6d603, Direction: request, MESSAGE = New message from JBoss, Envelope: 
<?xml version='1.0' encoding='utf-8'?><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Body>
<axis2ns3:text xmlns:axis2ns3="http://ws.apache.org/commons/ns/payload">Hellow WSO2 ESB From JBoss EAP</axis2ns3:text>
</soapenv:Body>
</soapenv:Envelope>

Possible Issues and How to troubleshoot them.

1. Address already in use when starting ESB Server.

[2016-01-13 11:56:43,966] ERROR - JMXServerManager Could not create the RMI local registry
java.rmi.server.ExportException: Port already in use: 9999; nested exception is: 
 java.net.BindException: Address already in use
 at sun.rmi.transport.tcp.TCPTransport.listen(TCPTransport.java:330)
 at sun.rmi.transport.tcp.TCPTransport.exportObject(TCPTransport.java:238)
 at sun.rmi.transport.tcp.TCPEndpoint.exportObject(TCPEndpoint.java:411)
 at sun.rmi.transport.LiveRef.exportObject(LiveRef.java:147)
 at sun.rmi.server.UnicastServerRef.exportObject(UnicastServerRef.java:208)

Start the ESB server with -DportOffset=1 flag

2. ListenerManager Couldn't initialize the jmstransport listener

[2016-01-13 15:07:52,246]  INFO - PassThroughHttpSSLSender Pass-through HTTPS Sender started...
[2016-01-13 15:07:53,176] ERROR - BaseUtils JNDI lookup of name jms/RemoteConnectionFactory returned a org.hornetq.jms.client.HornetQJMSConnectionFactory while a interface javax.jms.ConnectionFactory was expected
[2016-01-13 15:07:53,178] ERROR - ListenerManager Couldn't initialize the jmstransport listener
org.apache.axis2.transport.base.BaseTransportException: JNDI lookup of name jms/RemoteConnectionFactory returned a org.hornetq.jms.client.HornetQJMSConnectionFactory while a interface javax.jms.ConnectionFactory was expected
 at org.apache.axis2.transport.base.BaseUtils.handleException(BaseUtils.java:168)
 at org.apache.axis2.transport.jms.JMSUtils.lookup(JMSUtils.java:656)
 at org.apache.axis2.transport.jms.JMSConnectionFactory.<init>(JMSConnectionFactory.java:93)
 at org.apache.axis2.transport.jms.JMSConnectionFactoryManager.loadConnectionFactoryDefinitions(JMSConnectionFactoryManager.java:58)
 at org.apache.axis2.transport.jms.JMSConnectionFactoryManager.<init>(JMSConnectionFactoryManager.java:45)
 at org.apache.axis2.transport.jms.JMSListener.doInit(JMSListener.java:65)
 at org.apache.axis2.transport.base.AbstractTransportListenerEx.init(AbstractTransportListenerEx.java:62)
 at org.apache.axis2.engine.ListenerManager.init(ListenerManager.java:84)
 at org.wso2.carbon.core.init.CarbonServerManager.initializeCarbon(CarbonServerManager.java:411)
 at org.wso2.carbon.core.init.CarbonServerManager.start(CarbonServerManager.java:219)
 at org.wso2.carbon.core.internal.CarbonCoreServiceComponent.activate(CarbonCoreServiceComponent.java:91)
 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.lang.reflect.Method.invoke(Method.java:483)
 at org.eclipse.equinox.internal.ds.model.ServiceComponent.activate(ServiceComponent.java:260)
 at org.eclipse.equinox.internal.ds.model.ServiceComponentProp.activate(ServiceComponentProp.java:146)
 at org.eclipse.equinox.internal.ds.model.ServiceComponentProp.build(ServiceComponentProp.java:345)
 at org.eclipse.equinox.internal.ds.InstanceProcess.buildComponent(InstanceProcess.java:620)
 at org.eclipse.equinox.internal.ds.InstanceProcess.buildComponents(InstanceProcess.java:197)
 at org.eclipse.equinox.internal.ds.Resolver.getEligible(Resolver.java:343)
 at org.eclipse.equinox.internal.ds.SCRManager.serviceChanged(SCRManager.java:222)
 at org.eclipse.osgi.internal.serviceregistry.FilteredServiceListener.serviceChanged(FilteredServiceListener.java:107)
 at org.eclipse.osgi.framework.internal.core.BundleContextImpl.dispatchEvent(BundleContextImpl.java:861)
 at org.eclipse.osgi.framework.eventmgr.EventManager.dispatchEvent(EventManager.java:230)
 at org.eclipse.osgi.framework.eventmgr.ListenerQueue.dispatchEventSynchronous(ListenerQueue.java:148)
 at org.eclipse.osgi.internal.serviceregistry.ServiceRegistry.publishServiceEventPrivileged(ServiceRegistry.java:819)
 at org.eclipse.osgi.internal.serviceregistry.ServiceRegistry.publishServiceEvent(ServiceRegistry.java:771)
 at org.eclipse.osgi.internal.serviceregistry.ServiceRegistrationImpl.register(ServiceRegistrationImpl.java:130)
 at org.eclipse.osgi.internal.serviceregistry.ServiceRegistry.registerService(ServiceRegistry.java:214)
 at org.eclipse.osgi.framework.internal.core.BundleContextImpl.registerService(BundleContextImpl.java:433)
 at org.eclipse.equinox.http.servlet.internal.Activator.registerHttpService(Activator.java:81)
 at org.eclipse.equinox.http.servlet.internal.Activator.addProxyServlet(Activator.java:60)
 at org.eclipse.equinox.http.servlet.internal.ProxyServlet.init(ProxyServlet.java:40)
 at org.wso2.carbon.tomcat.ext.servlet.DelegationServlet.init(DelegationServlet.java:38)
 at org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1284)
 at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1197)
 at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1087)
 at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:5262)
 at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5550)
 at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
 at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1575)
 at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1565)
 at java.util.concurrent.FutureTask.run(FutureTask.java:266)
 at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
 at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
 at java.lang.Thread.run(Thread.java:745)

Remove the jms package from the jboss-client.jar

3. JMSConnectionFactoryManager Error setting up connection factory

[2016-01-13 15:14:57,357] ERROR - JMSConnectionFactoryManager Error setting up connection factory : sampleQueueConnectionFactory
org.apache.axis2.transport.jms.AxisJMSException: Cannot acquire JNDI context, JMS Connection factory : jms/RemoteConnectionFactory or default destination : null for JMS CF : sampleQueueConnectionFactory using : {transport.jms.Password=SamplePwd1!, java.naming.provider.url=remote://localhost:4447, java.naming.factory.initial=org.jboss.naming.remote.client.InitialContextFactory, transport.jms.ConnectionFactoryType=queue, transport.jms.UserName=SampleUser, java.naming.security.principal=SampleUser, transport.jms.ConnectionFactoryJNDIName=jms/RemoteConnectionFactory, java.naming.security.credentials=SamplePwd1!}
 at org.apache.axis2.transport.jms.JMSConnectionFactory.<init>(JMSConnectionFactory.java:102)
 at org.apache.axis2.transport.jms.JMSConnectionFactoryManager.loadConnectionFactoryDefinitions(JMSConnectionFactoryManager.java:58)
 at org.apache.axis2.transport.jms.JMSConnectionFactoryManager.<init>(JMSConnectionFactoryManager.java:45)
 at org.apache.axis2.transport.jms.JMSListener.doInit(JMSListener.java:65)
 at org.apache.axis2.transport.base.AbstractTransportListenerEx.init(AbstractTransportListenerEx.java:62)
 at org.apache.axis2.engine.ListenerManager.init(ListenerManager.java:84)
 at org.wso2.carbon.core.init.CarbonServerManager.initializeCarbon(CarbonServerManager.java:411)
 at org.wso2.carbon.core.init.CarbonServerManager.start(CarbonServerManager.java:219)
 at org.wso2.carbon.core.internal.CarbonCoreServiceComponent.activate(CarbonCoreServiceComponent.java:91)
 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.lang.reflect.Method.invoke(Method.java:483)
 at org.eclipse.equinox.internal.ds.model.ServiceComponent.activate(ServiceComponent.java:260)
 at org.eclipse.equinox.internal.ds.model.ServiceComponentProp.activate(ServiceComponentProp.java:146)
 at org.eclipse.equinox.internal.ds.model.ServiceComponentProp.build(ServiceComponentProp.java:345)
 at org.eclipse.equinox.internal.ds.InstanceProcess.buildComponent(InstanceProcess.java:620)
 at org.eclipse.equinox.internal.ds.InstanceProcess.buildComponents(InstanceProcess.java:197)
 at org.eclipse.equinox.internal.ds.Resolver.getEligible(Resolver.java:343)
 at org.eclipse.equinox.internal.ds.SCRManager.serviceChanged(SCRManager.java:222)
 at org.eclipse.osgi.internal.serviceregistry.FilteredServiceListener.serviceChanged(FilteredServiceListener.java:107)
 at org.eclipse.osgi.framework.internal.core.BundleContextImpl.dispatchEvent(BundleContextImpl.java:861)
 at org.eclipse.osgi.framework.eventmgr.EventManager.dispatchEvent(EventManager.java:230)
 at org.eclipse.osgi.framework.eventmgr.ListenerQueue.dispatchEventSynchronous(ListenerQueue.java:148)
 at org.eclipse.osgi.internal.serviceregistry.ServiceRegistry.publishServiceEventPrivileged(ServiceRegistry.java:819)
 at org.eclipse.osgi.internal.serviceregistry.ServiceRegistry.publishServiceEvent(ServiceRegistry.java:771)
 at org.eclipse.osgi.internal.serviceregistry.ServiceRegistrationImpl.register(ServiceRegistrationImpl.java:130)
 at org.eclipse.osgi.internal.serviceregistry.ServiceRegistry.registerService(ServiceRegistry.java:214)
 at org.eclipse.osgi.framework.internal.core.BundleContextImpl.registerService(BundleContextImpl.java:433)
 at org.eclipse.equinox.http.servlet.internal.Activator.registerHttpService(Activator.java:81)
 at org.eclipse.equinox.http.servlet.internal.Activator.addProxyServlet(Activator.java:60)
 at org.eclipse.equinox.http.servlet.internal.ProxyServlet.init(ProxyServlet.java:40)
 at org.wso2.carbon.tomcat.ext.servlet.DelegationServlet.init(DelegationServlet.java:38)
 at org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1284)
 at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1197)
 at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1087)
 at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:5262)
 at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5550)
 at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
 at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1575)
 at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1565)
 at java.util.concurrent.FutureTask.run(FutureTask.java:266)
 at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
 at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
 at java.lang.Thread.run(Thread.java:745)
Caused by: javax.naming.NamingException: Failed to connect to any server. Servers tried: [remote://localhost:4447]
 at org.jboss.naming.remote.client.HaRemoteNamingStore.failOverSequence(HaRemoteNamingStore.java:213)
 at org.jboss.naming.remote.client.HaRemoteNamingStore.namingStore(HaRemoteNamingStore.java:144)
 at org.jboss.naming.remote.client.HaRemoteNamingStore.namingOperation(HaRemoteNamingStore.java:125)
 at org.jboss.naming.remote.client.HaRemoteNamingStore.lookup(HaRemoteNamingStore.java:241)
 at org.jboss.naming.remote.client.RemoteContext.lookup(RemoteContext.java:79)
 at org.jboss.naming.remote.client.RemoteContext.lookup(RemoteContext.java:83)
 at javax.naming.InitialContext.lookup(InitialContext.java:417)
 at org.apache.axis2.transport.jms.JMSUtils.lookup(JMSUtils.java:643)
 at org.apache.axis2.transport.jms.JMSConnectionFactory.<init>(JMSConnectionFactory.java:93)
 ... 44 more

Check the java.naming.provider.url is correct in the axis2.xml transportReceiver Parameters.
Check the JBOSS EAP is up and running and reachable to WSO2 ESB.