[JBoss JIRA] (SWSQE-194) ISTIOOC Client
by Matt Mahoney (JIRA)
Matt Mahoney created SWSQE-194:
----------------------------------
Summary: ISTIOOC Client
Key: SWSQE-194
URL: https://issues.jboss.org/browse/SWSQE-194
Project: Kiali QE
Issue Type: Story
Reporter: Matt Mahoney
Assignee: Michael Foley
[ISTIO Jenkins Install] script doesn't use the istiooc client that Kevin has been building.
Right now there are issues with the ansible-installer that cause few errors - I don't know what exactly the issues are, but Kevin is aware and has it in his to-do list to patch and send a PR very soon.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
7 years, 7 months
[JBoss JIRA] (JGRP-2253) FD_SOCK is not working in AWS environment
by Sibin Karnavar (JIRA)
[ https://issues.jboss.org/browse/JGRP-2253?page=com.atlassian.jira.plugin.... ]
Sibin Karnavar commented on JGRP-2253:
--------------------------------------
I am sorry I am late on this. I will provide the requested information before end of tomorrow.
> FD_SOCK is not working in AWS environment
> -----------------------------------------
>
> Key: JGRP-2253
> URL: https://issues.jboss.org/browse/JGRP-2253
> Project: JGroups
> Issue Type: Bug
> Affects Versions: 4.0.10
> Environment: AWS - EC2
> Reporter: Sibin Karnavar
> Assignee: Bela Ban
> Fix For: 4.0.12
>
>
> We have our failure detection defined like below.
> <FD_SOCK external_port="7804" />
> <FD timeout="3000" max_tries="3" />
> <VERIFY_SUSPECT timeout="3000" />
> Please note that we have used FD instead of FD_ALL in AWS. We will be changing it to FD_ALL later after detailed testing.
> In my local, this is working perfect. As soon as I kill my node, I was able to see that view change was happening immediately with FD_SOCK.
> We were not mentioning the external_port in the FD_SOCK but later I thought it may be an issue with the port and defined it as 7804 and added the same port to the security group that allows to access this port among all the nodes. So no issue with the port.
> Can you please let us know if we need any additional configurations to make FD_SOCK works well in AWS.
> Thanks,
> Sibin
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
7 years, 7 months
[JBoss JIRA] (ELY-1535) CipherSuiteSelector does not know about CHACHA20_POLY1305
by David Lloyd (JIRA)
[ https://issues.jboss.org/browse/ELY-1535?page=com.atlassian.jira.plugin.s... ]
David Lloyd commented on ELY-1535:
----------------------------------
http://cr.openjdk.java.net/~jnimeh/reviews/8153028/webrev.04/
> CipherSuiteSelector does not know about CHACHA20_POLY1305
> ---------------------------------------------------------
>
> Key: ELY-1535
> URL: https://issues.jboss.org/browse/ELY-1535
> Project: WildFly Elytron
> Issue Type: Bug
> Reporter: Mike Yoder
> Assignee: Darran Lofthouse
>
> I was trying to be a good person and implement the Mozilla "Modern" cipher suite described here:
> https://wiki.mozilla.org/Security/Server_Side_TLS
> I'm doing this in a keycloak server. The config line there looks like
> {noformat}
> <https-listener security-realm="ApplicationRealm"
> enabled-protocols="SSLv2Hello,TLSv1.2"
> enabled-cipher-suites="TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384:TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"
> name="default"
> socket-binding="httpish"
> enable-http2="true"
> proxy-address-forwarding="true"
> />
> {noformat}
> But I got this:
> {noformat}
> 13:20:46,574 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-1) MSC000001: Failed to start service org.wildfly.undertow.listener.default: org.jboss.msc.service.StartException in serv
> ice org.wildfly.undertow.listener.default: Failed to start service
> at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1978)
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
> at java.lang.Thread.run(Thread.java:748)
> Caused by: java.lang.IllegalArgumentException: ELY05016: Unrecognized token "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" in mechanism selection string "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384:TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"
> at org.wildfly.security.ssl.CipherSuiteSelector.fromString(CipherSuiteSelector.java:423)
> at org.wildfly.extension.undertow.HttpsListenerService.startListening(HttpsListenerService.java:120)
> at org.wildfly.extension.undertow.ListenerService.start(ListenerService.java:169)
> at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:2032)
> at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1955)
> {noformat}
> With a little digging it appears that CipherSuiteSelector doesn't know what CHACHA20 or POLY1305 are. See:
> https://github.com/wildfly-security/wildfly-elytron/blame/master/src/main...
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
7 years, 7 months
[JBoss JIRA] (WFCORE-3780) Provide Elytron alternative to RoleMappingLoginModule
by Derek Horton (JIRA)
Derek Horton created WFCORE-3780:
------------------------------------
Summary: Provide Elytron alternative to RoleMappingLoginModule
Key: WFCORE-3780
URL: https://issues.jboss.org/browse/WFCORE-3780
Project: WildFly Core
Issue Type: Feature Request
Components: Security
Affects Versions: 4.0.0.Final
Reporter: Derek Horton
In picketbox there is RoleMappingLoginModule [1], which takes role as returned from authorization process and maps to different role. I thought something similar should be configurable with some of Elytron role-mappers. But looking into model/code, it is not obvious to me which of them can be used. I know custom role mapper can be still used, but I wonder if we really do not provide this common funcionality out of the box with Elytron.
Another workaround is to use direct roles from realm (e.g. LDAP ) in target (e.g. web.xml). But seems users tend to map IDM Roles to applicaiton roles.
[1] https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_ap...
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
7 years, 7 months