[JBoss JIRA] (SECURITY-978) Remove DEBUG message in server logs while calling isCallerInRole(String roleName) method
by Ilia Vassilev (JIRA)
[ https://issues.jboss.org/browse/SECURITY-978?page=com.atlassian.jira.plug... ]
Ilia Vassilev moved JBEAP-13291 to SECURITY-978:
------------------------------------------------
Project: PicketBox (was: JBoss Enterprise Application Platform)
Key: SECURITY-978 (was: JBEAP-13291)
Workflow: classic default workflow (was: CDW with loose statuses v1)
> Remove DEBUG message in server logs while calling isCallerInRole(String roleName) method
> ----------------------------------------------------------------------------------------
>
> Key: SECURITY-978
> URL: https://issues.jboss.org/browse/SECURITY-978
> Project: PicketBox
> Issue Type: Bug
> Environment: Red Hat JBoss Enterprise Application Platform 7.0.x
> Reporter: Ilia Vassilev
> Assignee: Ilia Vassilev
>
> While explicitly checking the user roles in the ejb code using context.isCallerInRole(String roleName) and when it return false below exception message got printed at the DEBUG level in server.log file.
> {code:java}
> 2017-09-13 21:10:24,549 DEBUG [org.jboss.security] sessionhash="b34cb4c5c50e3eefbe4f924ee42fa658" requestid="33015X1505317224509" username="adm2.lg" src_ip="127.0.0.1" PBOX00326: isCallerInRole processing failed: org.jboss.security.authorization.AuthorizationException: PBOX00017: Acces denied: authorization failed
> at org.jboss.security.plugins.authorization.JBossAuthorizationContext.invokeAuthorize(JBossAuthorizationContext.java:274)
> at org.jboss.security.plugins.authorization.JBossAuthorizationContext.access$000(JBossAuthorizationContext.java:71)
> at org.jboss.security.plugins.authorization.JBossAuthorizationContext$1.run(JBossAuthorizationContext.java:147)
> at java.security.AccessController.doPrivileged(Native Method)
> at org.jboss.security.plugins.authorization.JBossAuthorizationContext.authorize(JBossAuthorizationContext.java:143)
> at org.jboss.security.plugins.JBossAuthorizationManager.internalAuthorization(JBossAuthorizationManager.java:438)
> at org.jboss.security.plugins.JBossAuthorizationManager.authorize(JBossAuthorizationManager.java:115)
> at org.jboss.security.plugins.javaee.EJBAuthorizationHelper.isCallerInRole(EJBAuthorizationHelper.java:187)
> at org.jboss.as.security.service.SimpleSecurityManager.isCallerInRole(SimpleSecurityManager.java:229)
> at org.jboss.as.ejb3.component.EJBComponent.isCallerInRole(EJBComponent.java:400)
> at org.jboss.as.ejb3.context.EJBContextImpl.isCallerInRole(EJBContextImpl.java:115)
> {code}
> The exception seems to be printed in DEBUG in the below line
> {code:java}
> https://github.com/picketbox/picketbox/blob/master/security-jboss-sx/jbos...
> {code}
> This should not be logged as an exception message may be just a line in DEBUG logs should be enough.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 1 month
[JBoss JIRA] (WFLY-8817) The jboss.dist system property is not used in testsuite/integration/elytron module
by Yeray Borges (JIRA)
[ https://issues.jboss.org/browse/WFLY-8817?page=com.atlassian.jira.plugin.... ]
Yeray Borges reassigned WFLY-8817:
----------------------------------
Assignee: Yeray Borges
> The jboss.dist system property is not used in testsuite/integration/elytron module
> ----------------------------------------------------------------------------------
>
> Key: WFLY-8817
> URL: https://issues.jboss.org/browse/WFLY-8817
> Project: WildFly
> Issue Type: Bug
> Components: Test Suite
> Reporter: Josef Cacek
> Assignee: Yeray Borges
> Priority: Critical
>
> Elytron testsuite module doesn't work correctly with the {{jboss.dist}} system property.
> The {{jboss.dist}} system property is used by QE to run the AS testsuite against the correct bits (e.g. comming from PROD team). The {{testsuite/integration/elytron}} module seems not to be taking this property into account. It seems it always uses output of {{wildfly-server-provisioning-maven-plugin}} to test against.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 1 month
[JBoss JIRA] (WFLY-9401) Remove remaining direct uses of SimpleAttributeDefinition constructors
by Brian Stansberry (JIRA)
Brian Stansberry created WFLY-9401:
--------------------------------------
Summary: Remove remaining direct uses of SimpleAttributeDefinition constructors
Key: WFLY-9401
URL: https://issues.jboss.org/browse/WFLY-9401
Project: WildFly
Issue Type: Task
Components: REST, Security
Reporter: Brian Stansberry
Assignee: Brian Stansberry
Priority: Minor
Fix For: 12.0.0.Alpha1
There are a couple remaining uses of new SimpleAttributeDefiniton(String, ModelType, boolean) that should be replaced by using the builder. See WFCORE-2634.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 1 month