[JBoss JIRA] (WFLY-8157) Synchronize XSD and DMR description of credential-store attributes
by Ilia Vassilev (JIRA)
[ https://issues.jboss.org/browse/WFLY-8157?page=com.atlassian.jira.plugin.... ]
Ilia Vassilev reassigned WFLY-8157:
-----------------------------------
Assignee: Ilia Vassilev (was: Darran Lofthouse)
> Synchronize XSD and DMR description of credential-store attributes
> ------------------------------------------------------------------
>
> Key: WFLY-8157
> URL: https://issues.jboss.org/browse/WFLY-8157
> Project: WildFly
> Issue Type: Bug
> Components: Security
> Reporter: Martin Choma
> Assignee: Ilia Vassilev
> Labels: credential-store
>
> Use XSD description in DMR description, because description in XSD is better for attributes
> * provider-name
> * providers
> * other-providers
> * relative-to
> * uri (DMR description contains wrong vault://)
> For {{type}} attribute use this description in both XSD and DMR: "The credential store type, e.g. KeyStoreCredentialStore" . Now there is mentioned wrongly KeyStorePasswordStore
> {code:xml|title=XSD}
> <xs:attribute name="type" type="xs:string" use="optional">
> <xs:annotation>
> <xs:documentation>
> The credential store type, e.g. KeyStorePasswordStore.
> </xs:documentation>
> </xs:annotation>
> </xs:attribute>
> {code}
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 8 months
[JBoss JIRA] (WFLY-8241) EJB deployments with Elytron SD collides in EJB3 SD service
by Farah Juma (JIRA)
[ https://issues.jboss.org/browse/WFLY-8241?page=com.atlassian.jira.plugin.... ]
Farah Juma commented on WFLY-8241:
----------------------------------
This was fixed in WFLY-8171:
https://github.com/wildfly/wildfly/pull/9681
> EJB deployments with Elytron SD collides in EJB3 SD service
> -----------------------------------------------------------
>
> Key: WFLY-8241
> URL: https://issues.jboss.org/browse/WFLY-8241
> Project: WildFly
> Issue Type: Bug
> Components: EJB, Security
> Reporter: Jan Kalina
> Assignee: Jan Kalina
> Priority: Critical
> Attachments: enable-elytron.cli, read-props-grant.ear, read-props-limited.ear
>
>
> Every EJB deployment associated with an Elytron security domain builds *jboss.ejb3.security-domain* service:
> https://github.com/wildfly/wildfly/blob/master/ejb3/src/main/java/org/jbo...
> But it fails if there are more such deployments, because it mean second service with the same name:
> {code}
> 00:02:12,118 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-8) MSC000001: Failed to start service jboss.deployment.subunit."read-props-limited.ear"."ejb-moduleread-props-limited.jar".POST_MODULE: org.jboss.msc.service.StartException in service jboss.deployment.subunit."read-props-limited.ear"."ejb-moduleread-props-limited.jar".POST_MODULE: WFLYSRV0153: Failed to process phase POST_MODULE of subdeployment "ejb-moduleread-props-limited.jar" of deployment "read-props-limited.ear"
> at org.jboss.as.server.deployment.DeploymentUnitPhaseService.start(DeploymentUnitPhaseService.java:172)
> at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:2032)
> at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1955)
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> at java.lang.Thread.run(Thread.java:745)
> Caused by: org.jboss.msc.service.DuplicateServiceException: Service jboss.ejb3.security-domain is already registered
> at org.jboss.msc.service.ServiceRegistrationImpl.setInstance(ServiceRegistrationImpl.java:158)
> at org.jboss.msc.service.ServiceControllerImpl.startInstallation(ServiceControllerImpl.java:235)
> at org.jboss.msc.service.ServiceContainerImpl.install(ServiceContainerImpl.java:768)
> at org.jboss.msc.service.ServiceTargetImpl.install(ServiceTargetImpl.java:223)
> at org.jboss.msc.service.ServiceControllerImpl$ChildServiceTarget.install(ServiceControllerImpl.java:2555)
> at org.jboss.msc.service.ServiceTargetImpl.install(ServiceTargetImpl.java:223)
> at org.jboss.msc.service.ServiceControllerImpl$ChildServiceTarget.install(ServiceControllerImpl.java:2555)
> at org.jboss.msc.service.ServiceBuilderImpl.install(ServiceBuilderImpl.java:317)
> at org.jboss.as.ejb3.deployment.processors.EJBDefaultSecurityDomainProcessor.deploy(EJBDefaultSecurityDomainProcessor.java:111)
> at org.jboss.as.server.deployment.DeploymentUnitPhaseService.start(DeploymentUnitPhaseService.java:165)
> ... 5 more
> {code}
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 8 months
[JBoss JIRA] (ELY-880) Unable to set IPv6 address in Elytron authentication context match-host rule
by Tomas Hofman (JIRA)
[ https://issues.jboss.org/browse/ELY-880?page=com.atlassian.jira.plugin.sy... ]
Tomas Hofman commented on ELY-880:
----------------------------------
PR is up. David Lloyd expressed an opinion that more advanced IP address matching should be performed by a separate AddressMatcher rather than the current HostMatcher, so I updated the PR to perform just equality check.
> Unable to set IPv6 address in Elytron authentication context match-host rule
> ----------------------------------------------------------------------------
>
> Key: ELY-880
> URL: https://issues.jboss.org/browse/ELY-880
> Project: WildFly Elytron
> Issue Type: Bug
> Components: Authentication Client
> Affects Versions: 1.1.0.Beta18
> Reporter: Martin Choma
> Assignee: Tomas Hofman
> Original Estimate: 3 days
> Remaining Estimate: 3 days
>
> Setting IPv6 address in wildfly-config.xml cause validation error.
> {code:xml|title=wildfly-config.xml}
> <?xml version="1.0" encoding="UTF-8"?>
> <authentication-client xmlns="urn:elytron:1.0">
> <authentication-configurations>
> <configuration name="set-host-to-localhost">
> <set-host name="localhost"/>
> </configuration>
> </authentication-configurations>
> <authentication-rules>
> <rule use-configuration="set-host-to-localhost">
> <match-host name="::1"/>
> </rule>
> </authentication-rules>
> </authentication-client>
> {code}
> {code:title=server.log}
> java.lang.IllegalArgumentException: ELY01029: Invalid host specification "::1"
> at org.wildfly.security.auth.client.MatchHostRule.<init>(MatchHostRule.java:39)
> at org.wildfly.security.auth.client.MatchRule.matchHost(MatchRule.java:411)
> at org.wildfly.security.auth.client.ElytronXmlParser.parseAbstractMatchRuleType(ElytronXmlParser.java:701)
> at org.wildfly.security.auth.client.ElytronXmlParser.parseAuthenticationRuleType(ElytronXmlParser.java:467)
> at org.wildfly.security.auth.client.ElytronXmlParser.parseRulesType(ElytronXmlParser.java:484)
> at org.wildfly.security.auth.client.ElytronXmlParser.parseAuthenticationClientType(ElytronXmlParser.java:241)
> at org.wildfly.security.auth.client.ElytronXmlParser.parseAuthenticationClientConfiguration(ElytronXmlParser.java:169)
> at org.wildfly.security.auth.client.XmlConfigurationTest.testMatcHostRuleConfiguration(XmlConfigurationTest.java:175)
> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
> at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> at java.lang.reflect.Method.invoke(Method.java:497)
> at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:47)
> at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
> at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:44)
> at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
> at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:271)
> at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:70)
> at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:50)
> at org.junit.runners.ParentRunner$3.run(ParentRunner.java:238)
> at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:63)
> at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:236)
> at org.junit.runners.ParentRunner.access$000(ParentRunner.java:53)
> at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:229)
> at org.junit.internal.runners.statements.RunBefores.evaluate(RunBefores.java:26)
> at org.junit.internal.runners.statements.RunAfters.evaluate(RunAfters.java:27)
> at org.junit.runners.ParentRunner.run(ParentRunner.java:309)
> at org.apache.maven.surefire.junit4.JUnit4Provider.execute(JUnit4Provider.java:367)
> at org.apache.maven.surefire.junit4.JUnit4Provider.executeWithRerun(JUnit4Provider.java:274)
> at org.apache.maven.surefire.junit4.JUnit4Provider.executeTestSet(JUnit4Provider.java:238)
> at org.apache.maven.surefire.junit4.JUnit4Provider.invoke(JUnit4Provider.java:161)
> at org.apache.maven.surefire.booter.ForkedBooter.invokeProviderInSameClassLoader(ForkedBooter.java:290)
> at org.apache.maven.surefire.booter.ForkedBooter.runSuitesInProcess(ForkedBooter.java:242)
> at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:121)
> {code}
> It is because of elytron validation [1]. However don't know if just allowing ":" in regexp is valid solution.
> [1] https://github.com/wildfly-security/wildfly-elytron/blob/7debbcabc7c20be5...
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 8 months
[JBoss JIRA] (WFLY-8238) Unable to undefine credential-reference
by Jeff Mesnil (JIRA)
[ https://issues.jboss.org/browse/WFLY-8238?page=com.atlassian.jira.plugin.... ]
Jeff Mesnil reassigned WFLY-8238:
---------------------------------
Assignee: Martin Choma (was: Jeff Mesnil)
> Unable to undefine credential-reference
> ---------------------------------------
>
> Key: WFLY-8238
> URL: https://issues.jboss.org/browse/WFLY-8238
> Project: WildFly
> Issue Type: Bug
> Components: JMS, Security
> Reporter: Claudio Miranda
> Assignee: Martin Choma
>
> A bridge is added and a credential-reference is set.
> However a "password" attribute cannot be set as the alternatives constraint validates the data, but the password attribute has a default value.
> Also neither credential-reference and password are required=true, so they may be undefined.
> {code}
> /profile=full/subsystem=messaging-activemq/server=default/bridge=test1:add(discovery-group=mane,queue-name=DLQ,forwarding-address=DLQ)
> /profile=full/subsystem=messaging-activemq/server=default/bridge=test1:write-attribute(name=credential-reference,value={clear-text=senha1})
> /profile=full/subsystem=messaging-activemq/server=default/bridge=test1:undefine-attribute(name=credential-reference)
> {
> "outcome" => "failed",
> "failure-description" => {"domain-failure-description" => "WFLYMSGAMQ0069: Attribute (credential-reference) can not been undefined as the resource does not define any alternative to this attribute."},
> "rolled-back" => true
> }
> {code}
> The same problem, when user adds a bridge with a password and later wants to undefine it to add a credential-reference
> {code}
> /profile=full/subsystem=messaging-activemq/server=default/bridge=test1:add(discovery-group=mane,queue-name=DLQ,forwarding-address=DLQ,password=senha1)
> /profile=full/subsystem=messaging-activemq/server=default/bridge=test1:undefine-attribute(name=password)
> {
> "outcome" => "failed",
> "failure-description" => {"domain-failure-description" => "WFLYMSGAMQ0069: Attribute (password) can not been undefined as the resource does not define any alternative to this attribute."},
> "rolled-back" => true
> }
> {code}
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 8 months