[JBoss JIRA] (ISPN-11126) Health check fails when authz is enabled and cache is not yet started
by Tristan Tarrant (Jira)
[ https://issues.redhat.com/browse/ISPN-11126?page=com.atlassian.jira.plugi... ]
Tristan Tarrant updated ISPN-11126:
-----------------------------------
Fix Version/s: 10.1.6.Final
(was: 10.1.5.Final)
> Health check fails when authz is enabled and cache is not yet started
> ---------------------------------------------------------------------
>
> Key: ISPN-11126
> URL: https://issues.redhat.com/browse/ISPN-11126
> Project: Infinispan
> Issue Type: Bug
> Components: JMX, reporting and management, REST
> Affects Versions: 10.1.0.Final
> Reporter: Tristan Tarrant
> Assignee: Tristan Tarrant
> Priority: Major
> Fix For: 11.0.0.Dev03, 10.1.6.Final
>
>
> When using predefined caches on a container with authorization, and the caches have not been started, the health handler for the cachemanager resource fails with an authorization error.
> The call should be wrapped in a SecurityAction.
--
This message was sent by Atlassian Jira
(v7.13.8#713008)
6 years
[JBoss JIRA] (ISPN-11113) ScatteredDelayedAvailabilityUpdateTest takes too long
by Tristan Tarrant (Jira)
[ https://issues.redhat.com/browse/ISPN-11113?page=com.atlassian.jira.plugi... ]
Tristan Tarrant updated ISPN-11113:
-----------------------------------
Fix Version/s: 10.1.6.Final
(was: 10.1.5.Final)
> ScatteredDelayedAvailabilityUpdateTest takes too long
> -----------------------------------------------------
>
> Key: ISPN-11113
> URL: https://issues.redhat.com/browse/ISPN-11113
> Project: Infinispan
> Issue Type: Bug
> Components: Core, Test Suite
> Affects Versions: 10.1.0.Final
> Reporter: Dan Berindei
> Assignee: Dan Berindei
> Priority: Minor
> Fix For: 11.0.0.Final, 10.1.6.Final
>
>
> Partition handling tests use {{LOCAL_PING.setClusterName()}} with a unique name to disable discovery, otherwise partitions would try to merge while they are supposed to stay separate.
> But {{LOCAL_PING}} uses the cluster name on stop to remove the node from the static discovery map. If the test doesn't change the cluster name back, {{LOCAL_PING}} doesn't remove the node, the next test method sees an existing coordinator, and tries to connect to it. When a test has lots of test methods, like {{ScatteredDelayedAvailabilityUpdateTest}}, each test method leaves one more coordinator in the discovery map, and each test method takes longer to start the first method.
> {noformat}
> 09:08:52,758 DEBUG (testng:[]) [GMS] address=NodeA-30899, cluster=org.infinispan.partitionhandling.ScatteredDelayedAvailabilityUpdateTest[SCATTERED_SYNC, bias=NEVER, DENY_READ_WRITES], physical address=127.0.0.1:51941
> 09:08:52,774 TRACE (testng:[]) [GMS] NodeA-30899: discovery took 0 ms, members: 21 rsps (5 coords) [done]
> 09:08:52,774 DEBUG (testng:[]) [GMS] NodeA-30899: found multiple coords: [NodeA-2608, NodeA-5606, NodeA-17288, NodeA-64297, NodeA-48475]
> 09:08:52,774 DEBUG (testng:[]) [GMS] NodeA-30899: sending JOIN(NodeA-30899) to NodeA-5606
> 09:08:54,774 WARN (testng:[]) [GMS] NodeA-30899: JOIN(NodeA-30899) sent to NodeA-5606 timed out (after 2000 ms), on try 0
> 09:08:54,774 DEBUG (testng:[]) [GMS] NodeA-30899: sending JOIN(NodeA-30899) to NodeA-64297
> 09:08:56,775 WARN (testng:[]) [GMS] NodeA-30899: JOIN(NodeA-30899) sent to NodeA-64297 timed out (after 2000 ms), on try 0
> 09:08:56,775 DEBUG (testng:[]) [GMS] NodeA-30899: sending JOIN(NodeA-30899) to NodeA-48475
> 09:08:58,775 WARN (testng:[]) [GMS] NodeA-30899: JOIN(NodeA-30899) sent to NodeA-48475 timed out (after 2000 ms), on try 0
> 09:08:58,775 DEBUG (testng:[]) [GMS] NodeA-30899: sending JOIN(NodeA-30899) to NodeA-17288
> 09:09:00,776 WARN (testng:[]) [GMS] NodeA-30899: JOIN(NodeA-30899) sent to NodeA-17288 timed out (after 2000 ms), on try 0
> 09:09:00,776 DEBUG (testng:[]) [GMS] NodeA-30899: sending JOIN(NodeA-30899) to NodeA-2608
> 09:09:02,776 WARN (testng:[]) [GMS] NodeA-30899: JOIN(NodeA-30899) sent to NodeA-2608 timed out (after 2000 ms), on try 0
> 09:09:02,776 TRACE (testng:[]) [GMS] NodeA-30899: discovery took 0 ms, members: 21 rsps (5 coords) [done]
> 09:09:02,776 DEBUG (testng:[]) [GMS] NodeA-30899: found multiple coords: [NodeA-2608, NodeA-5606, NodeA-17288, NodeA-64297, NodeA-48475]
> 09:09:02,776 DEBUG (testng:[]) [GMS] NodeA-30899: sending JOIN(NodeA-30899) to NodeA-5606
> 09:09:04,776 WARN (testng:[]) [GMS] NodeA-30899: JOIN(NodeA-30899) sent to NodeA-5606 timed out (after 2000 ms), on try 1
> ...
> 09:09:12,777 TRACE (testng:[]) [GMS] NodeA-30899: discovery took 0 ms, members: 21 rsps (5 coords) [done]
> 09:09:12,778 DEBUG (testng:[]) [GMS] NodeA-30899: found multiple coords: [NodeA-2608, NodeA-5606, NodeA-17288, NodeA-64297, NodeA-48475]
> 09:09:12,778 DEBUG (testng:[]) [GMS] NodeA-30899: sending JOIN(NodeA-30899) to NodeA-2608
> 09:09:14,778 WARN (testng:[]) [GMS] NodeA-30899: JOIN(NodeA-30899) sent to NodeA-2608 timed out (after 2000 ms), on try 2
> ...
> 09:09:22,780 WARN (testng:[]) [GMS] NodeA-30899: too many JOIN attempts (3): becoming singleton
> {noformat}
--
This message was sent by Atlassian Jira
(v7.13.8#713008)
6 years
[JBoss JIRA] (ISPN-11440) Allow use of config sub-elements in XIncluded fragments
by Tristan Tarrant (Jira)
[ https://issues.redhat.com/browse/ISPN-11440?page=com.atlassian.jira.plugi... ]
Tristan Tarrant updated ISPN-11440:
-----------------------------------
Fix Version/s: 10.1.6.Final
(was: 10.1.5.Final)
> Allow use of config sub-elements in XIncluded fragments
> -------------------------------------------------------
>
> Key: ISPN-11440
> URL: https://issues.redhat.com/browse/ISPN-11440
> Project: Infinispan
> Issue Type: Enhancement
> Components: Configuration
> Affects Versions: 11.0.0.Alpha2
> Reporter: Tristan Tarrant
> Assignee: Tristan Tarrant
> Priority: Major
> Fix For: 11.0.0.Dev03, 10.1.6.Final
>
>
> The infinispan-config XSD only allows the {{infinispan}} element as a top-level element. However, when using XInclude, it would be useful to be able to have other kinds of top-level elements:
> jgroups
> threads
> cache-container
> transport
> security
> *-cache-*
--
This message was sent by Atlassian Jira
(v7.13.8#713008)
6 years
[JBoss JIRA] (ISPN-11467) IteratorHandler cannot start in a secure cache
by Tristan Tarrant (Jira)
[ https://issues.redhat.com/browse/ISPN-11467?page=com.atlassian.jira.plugi... ]
Tristan Tarrant updated ISPN-11467:
-----------------------------------
Status: Resolved (was: Pull Request Sent)
Resolution: Done
> IteratorHandler cannot start in a secure cache
> ----------------------------------------------
>
> Key: ISPN-11467
> URL: https://issues.redhat.com/browse/ISPN-11467
> Project: Infinispan
> Issue Type: Bug
> Components: Core
> Affects Versions: 10.1.4.Final
> Reporter: Dan Berindei
> Assignee: Dan Berindei
> Priority: Major
> Labels: testsuite_stability
> Fix For: 10.1.5.Final
>
>
> {{IteratorHandler.start()}} tries to add a listener on the cache manager, which fails when the cache manager has security enabled:
> {noformat}
> java.lang.SecurityException: ISPN000287: Unauthorized access: subject 'null' lacks 'LISTEN' permission
> at org.infinispan.security.impl.AuthorizationHelper.checkPermission(AuthorizationHelper.java:100)
> at org.infinispan.security.impl.AuthorizationHelper.checkPermission(AuthorizationHelper.java:66)
> at org.infinispan.manager.DefaultCacheManager.addListenerAsync(DefaultCacheManager.java:846)
> at org.infinispan.notifications.Listenable.addListener(Listenable.java:27)
> at org.infinispan.stream.impl.IteratorHandler.start(IteratorHandler.java:82)
> at org.infinispan.stream.impl.CorePackageImpl$1.start(CorePackageImpl.java:33)
> at org.infinispan.stream.impl.CorePackageImpl$1.start(CorePackageImpl.java:27)
> at org.infinispan.factories.impl.BasicComponentRegistryImpl.invokeStart(BasicComponentRegistryImpl.java:587)
> at org.infinispan.factories.impl.BasicComponentRegistryImpl.doStartWrapper(BasicComponentRegistryImpl.java:578)
> at org.infinispan.factories.impl.BasicComponentRegistryImpl.startWrapper(BasicComponentRegistryImpl.java:547)
> at org.infinispan.factories.impl.BasicComponentRegistryImpl.access$700(BasicComponentRegistryImpl.java:30)
> at org.infinispan.factories.impl.BasicComponentRegistryImpl$ComponentWrapper.running(BasicComponentRegistryImpl.java:770)
> at org.infinispan.factories.impl.BasicComponentRegistryImpl.startDependencies(BasicComponentRegistryImpl.java:605)
> at org.infinispan.factories.impl.BasicComponentRegistryImpl.doStartWrapper(BasicComponentRegistryImpl.java:569)
> at org.infinispan.factories.impl.BasicComponentRegistryImpl.startWrapper(BasicComponentRegistryImpl.java:547)
> at org.infinispan.factories.impl.BasicComponentRegistryImpl.access$700(BasicComponentRegistryImpl.java:30)
> at org.infinispan.factories.impl.BasicComponentRegistryImpl$ComponentWrapper.running(BasicComponentRegistryImpl.java:770)
> at org.infinispan.factories.AbstractComponentRegistry.internalStart(AbstractComponentRegistry.java:341)
> at org.infinispan.factories.AbstractComponentRegistry.start(AbstractComponentRegistry.java:237)
> at org.infinispan.factories.ComponentRegistry.start(ComponentRegistry.java:209)
> at org.infinispan.cache.impl.CacheImpl.start(CacheImpl.java:1088)
> at org.infinispan.cache.impl.AbstractDelegatingCache.start(AbstractDelegatingCache.java:513)
> at org.infinispan.cache.impl.AbstractDelegatingCache.start(AbstractDelegatingCache.java:513)
> at org.infinispan.cache.impl.AbstractDelegatingCache.start(AbstractDelegatingCache.java:513)
> at org.infinispan.manager.DefaultCacheManager.wireAndStartCache(DefaultCacheManager.java:693)
> at org.infinispan.manager.DefaultCacheManager.createCache(DefaultCacheManager.java:632)
> at org.infinispan.manager.DefaultCacheManager.access$000(DefaultCacheManager.java:137)
> at org.infinispan.manager.DefaultCacheManager$1.run(DefaultCacheManager.java:554)
> {noformat}
> {{SecureRemoteCacheAdminTest}} is failing on branch 10.1.x because of this, after ISPN-11435 made {{DefaultCacheManager}} start all the caches automatically. The test uses {{Security.doPrivileged()}} to start the cache manager, but internally {{InfinispanDirectoryProvider.start()}} uses {{startCaches()}}, which spawns a new thread for each cache that needs to be started, without any privileges.
--
This message was sent by Atlassian Jira
(v7.13.8#713008)
6 years