[JBoss JIRA] (ISPN-7811) Improve out-of-the-box server security in cloud
by Ryan Emerson (JIRA)
[ https://issues.jboss.org/browse/ISPN-7811?page=com.atlassian.jira.plugin.... ]
Ryan Emerson updated ISPN-7811:
-------------------------------
Fix Version/s: (was: 9.0.1.Final)
> Improve out-of-the-box server security in cloud
> -----------------------------------------------
>
> Key: ISPN-7811
> URL: https://issues.jboss.org/browse/ISPN-7811
> Project: Infinispan
> Issue Type: Enhancement
> Components: Security, Server
> Affects Versions: 9.0.0.Final
> Reporter: Galder Zamarreño
> Assignee: Galder Zamarreño
> Fix For: 9.1.0.Final
>
>
> When running Infinispan 9.0.0.Final in a cloud env, the default security code enforcements are causing issues when trying to register a proto file.
> The "___protobuf_metadata" cache cannot be written remotely any more. Accessing this cache to add protofile descriptors to server. The default configuration throws this error:
> {code}
> [datagrid-1-akxoi]
> [datagrid-1-akxoi] 12:15:56,602 ERROR [org.infinispan.server.hotrod.CacheDecodeContext] (HotRod-ServerWorker-4-2) ISPN005003: Exception reported: org.infinispan.server.hotrod.RequestParsingException: Remote requests are allowed to protected caches only over loopback or if authorization is enabled. Do no send remote requests to cache '___protobuf_metadata'
> [datagrid-1-akxoi] at org.infinispan.server.hotrod.CacheDecodeContext.obtainCache(CacheDecodeContext.java:116)
> [datagrid-1-akxoi] at org.infinispan.server.hotrod.HotRodDecoder.decodeHeader(HotRodDecoder.java:162)
> [datagrid-1-akxoi] at org.infinispan.server.hotrod.HotRodDecoder.decode(HotRodDecoder.java:93)
> {code}
> The code in CacheDecodeContext that enables this check does the following:
> {code}
> if (!cacheManager.getCacheManagerConfiguration().security().authorization().enabled()...
> {code}
> In order to have better out-of-the-box experience in cloud but still be secured, the following should be done:
> * Remove the code check for authorization in CacheDecodeContext.
> * Server's default configuration should require authentication.
> * Docker image allows passing in APP_USER and APP_PASS as env variables easily, but it provides default usernames and passwords for both APP and MGMT. These defaults should be removed since they're a security risk.
> * Docker image should have the possibility to set APP_GROUPS so that we can pass in optionally the role groups associated with a user. This is handy for making it easier in the future for users to add authorization on top of authentication.
> I will create JIRA subtasks for these so that the work can be divided.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 10 months
[JBoss JIRA] (ISPN-7856) Do not re-distribute the org.hibernate.search.orm module
by Sanne Grinovero (JIRA)
[ https://issues.jboss.org/browse/ISPN-7856?page=com.atlassian.jira.plugin.... ]
Sanne Grinovero updated ISPN-7856:
----------------------------------
Priority: Minor (was: Major)
> Do not re-distribute the org.hibernate.search.orm module
> --------------------------------------------------------
>
> Key: ISPN-7856
> URL: https://issues.jboss.org/browse/ISPN-7856
> Project: Infinispan
> Issue Type: Bug
> Components: Build process
> Reporter: Sanne Grinovero
> Assignee: Gustavo Fernandes
> Priority: Minor
> Fix For: 9.1.0.Alpha1
>
>
> Infinispan's build process is currently re-publishing the Hibernate Search modules as it needs to make some changes in their structure.
> However it only needs the {{hibernate-search-engine}} component and some other extensions, it should not re-publish the {{org.hibernate.search.orm}} WildFly module as this is unnecessary and can confuse people about the intended purpose of these modules.
> Side note: do we still need to re-distributed these modules at all? We did some improvements in the build, I wonder if we could avoid this dodgy process.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 10 months
[JBoss JIRA] (ISPN-7856) Do not re-distribute the org.hibernate.search.orm module
by Sanne Grinovero (JIRA)
Sanne Grinovero created ISPN-7856:
-------------------------------------
Summary: Do not re-distribute the org.hibernate.search.orm module
Key: ISPN-7856
URL: https://issues.jboss.org/browse/ISPN-7856
Project: Infinispan
Issue Type: Bug
Components: Build process
Reporter: Sanne Grinovero
Assignee: Gustavo Fernandes
Fix For: 9.1.0.Alpha1
Infinispan's build process is currently re-publishing the Hibernate Search modules as it needs to make some changes in their structure.
However it only needs the {{hibernate-search-engine}} component and some other extensions, it should not re-publish the {{org.hibernate.search.orm}} WildFly module as this is unnecessary and can confuse people about the intended purpose of these modules.
Side note: do we still need to re-distributed these modules at all? We did some improvements in the build, I wonder if we could avoid this dodgy process.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 10 months
[JBoss JIRA] (ISPN-7853) EntryWrappingInterceptor should delay extracting command metadata until it's needed
by Galder Zamarreño (JIRA)
[ https://issues.jboss.org/browse/ISPN-7853?page=com.atlassian.jira.plugin.... ]
Galder Zamarreño updated ISPN-7853:
-----------------------------------
Description: Delay EntryWrappingInterceptor extracting metadata from the command until it really needs it. It currently extracts it on the way down but it's not used until it handles replies. Hence, any updates done to a command's metadata by an interceptor deeper down than EntryWrappingInterceptor are currently ignored. (was: Delay EntryWrappingInterceptor extracting metadata from the command until it really needs it. It currently extracts it on the way down but it's not used until it handles replies. Hence, any updates done to a command's metadata by an interceptor deeper down than EntryWrappingInterceptor is currently ignored.)
> EntryWrappingInterceptor should delay extracting command metadata until it's needed
> -----------------------------------------------------------------------------------
>
> Key: ISPN-7853
> URL: https://issues.jboss.org/browse/ISPN-7853
> Project: Infinispan
> Issue Type: Enhancement
> Affects Versions: 9.0.0.Final
> Reporter: Galder Zamarreño
> Assignee: Galder Zamarreño
> Fix For: 9.0.1.Final, 9.1.0.Alpha1
>
>
> Delay EntryWrappingInterceptor extracting metadata from the command until it really needs it. It currently extracts it on the way down but it's not used until it handles replies. Hence, any updates done to a command's metadata by an interceptor deeper down than EntryWrappingInterceptor are currently ignored.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 10 months
[JBoss JIRA] (ISPN-7631) Cache.entrySet() entries don't implement Map.Entry.equals() correctly
by Ryan Emerson (JIRA)
[ https://issues.jboss.org/browse/ISPN-7631?page=com.atlassian.jira.plugin.... ]
Ryan Emerson resolved ISPN-7631.
--------------------------------
Resolution: Done
> Cache.entrySet() entries don't implement Map.Entry.equals() correctly
> ---------------------------------------------------------------------
>
> Key: ISPN-7631
> URL: https://issues.jboss.org/browse/ISPN-7631
> Project: Infinispan
> Issue Type: Bug
> Components: Core
> Affects Versions: 9.0.0.CR2
> Reporter: Dan Berindei
> Assignee: Pedro Ruivo
> Fix For: 9.0.1.Final
>
>
> The {{Map.Entry.equals()}} javadoc says "Returns true if the given object is also a map entry and the two entries represent the same mapping.", meaning any other metadata stored in cache entries (e.g. lifespan) must be ignored for the purpose of checking equality. In other words, this code should work regardless of what entries are stored in the cache or in the invocation context:
> {code:java}
> cache.entrySet().contains(new AbstractMap.SimpleEntry("k", "v"))
> {code}
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 10 months