[JBoss JIRA] (WFLY-11131) @LoginToContinue.errorPage doesn't work for pages in WEB-INF (New Java EE 8 Security)
by Darran Lofthouse (Jira)
[ https://issues.jboss.org/browse/WFLY-11131?page=com.atlassian.jira.plugin... ]
Darran Lofthouse reassigned WFLY-11131:
---------------------------------------
Assignee: (was: Darran Lofthouse)
> @LoginToContinue.errorPage doesn't work for pages in WEB-INF (New Java EE 8 Security)
> -------------------------------------------------------------------------------------
>
> Key: WFLY-11131
> URL: https://issues.jboss.org/browse/WFLY-11131
> Project: WildFly
> Issue Type: Bug
> Components: Security
> Affects Versions: 14.0.1.Final
> Reporter: Instantiation Exception
> Priority: Major
>
> I have this configuration:
> {code:java}
> @FormAuthenticationMechanismDefinition(
> loginToContinue = @LoginToContinue(
> loginPage = "/WEB-INF/account/login.xhtml",
> errorPage = "/WEB-INF/account/login.xhtml?error=true"))
> @ApplicationScoped
> public class SecurityConfiguration {}
> {code}
> When I open browser and go to restricted page, I am forwarded to login page. Then I input invalid username and password and submit form (action="j_security_check"). My browser sends me redirect to http://localhost:8080/WEB-INF/account/login.xhtml?error=true. I believe it should forward request to /WEB-INF/account/login.xhtml?error=true because standard FORM login-config in web.xml worked this way.
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 7 months
[JBoss JIRA] (WFLY-3313) Websocket Auth - Container is not aware of the Principal
by Darran Lofthouse (Jira)
[ https://issues.jboss.org/browse/WFLY-3313?page=com.atlassian.jira.plugin.... ]
Darran Lofthouse reassigned WFLY-3313:
--------------------------------------
Assignee: (was: Darran Lofthouse)
> Websocket Auth - Container is not aware of the Principal
> --------------------------------------------------------
>
> Key: WFLY-3313
> URL: https://issues.jboss.org/browse/WFLY-3313
> Project: WildFly
> Issue Type: Bug
> Components: EJB, Security, Web (Undertow), Web Sockets
> Affects Versions: 8.1.0.CR1, 10.0.0.Final, 15.0.0.Final
> Reporter: Markus D
> Priority: Major
> Attachments: websocket-different-principals-ejb-vs-socket.png, websocket-endpoint-security.war
>
>
> The Websocket is protected by the web.xml. The session object of the callback object correctly returns the principal.
> When an EJB is called the callerPrincipal is always anonymous.
> @Resource
> private SessionContext ctx;
> Principal callerPrincipal = ctx.getCallerPrincipal();
> Running thread here:
> https://community.jboss.org/thread/240617
> Shouldn't the principal be propagated to the EJB container when a websocket callback method triggered?
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 7 months
[JBoss JIRA] (WFLY-9702) SSO Integration for Programmatic Authentication
by Darran Lofthouse (Jira)
[ https://issues.jboss.org/browse/WFLY-9702?page=com.atlassian.jira.plugin.... ]
Darran Lofthouse reassigned WFLY-9702:
--------------------------------------
Assignee: (was: Darran Lofthouse)
> SSO Integration for Programmatic Authentication
> -----------------------------------------------
>
> Key: WFLY-9702
> URL: https://issues.jboss.org/browse/WFLY-9702
> Project: WildFly
> Issue Type: Feature Request
> Components: Clustering, Security, Web (Undertow)
> Reporter: Darran Lofthouse
> Priority: Critical
>
> At the moment the SSO integration only fully covers authentication mechanisms as they can be wrapped, we need to revisit for programmatic authentication.
> In this scenario we don't have either a wrapped mechanism or a CallbackHandler.
> Couple of options:
> * Can we get away with pushing in some form of IdentityCache factory the mechs can obtain from the request? This may miss the additional notifications the SSO impl depends on.
> * Can we also better support listening for the notifications without the need for wrappers? This could cover both mechs and programmatic authentication?
> * Instead do we make the programmatic authenticator pluggable, i.e. push in an SSO aware impl, it can choose how to handle it's own caching and also doesn't need the notifications as it is in control of that stage of the process.
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 7 months
[JBoss JIRA] (WFCORE-4357) Support new MSC Service API for deployment dependency
by Jeff Mesnil (Jira)
[ https://issues.jboss.org/browse/WFCORE-4357?page=com.atlassian.jira.plugi... ]
Jeff Mesnil commented on WFCORE-4357:
-------------------------------------
[~ropalka][~jstourac] I've renamed the issue and move it to WFCORE as the change would have to be done in the codebase.
> Support new MSC Service API for deployment dependency
> -----------------------------------------------------
>
> Key: WFCORE-4357
> URL: https://issues.jboss.org/browse/WFCORE-4357
> Project: WildFly Core
> Issue Type: Bug
> Components: Management
> Reporter: Jan Stourac
> Assignee: Jeff Mesnil
> Priority: Major
>
> When org.jboss.as.server.deployment.DeploymentPhaseContextImpl#addDeploymentDependency is used, it is expecting the service to be old-API org.jboss.msc.service.Service and use its getValue() method.
> This needs to be fixed so that using new MSC Service API works too.
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 7 months
[JBoss JIRA] (DROOLS-3715) Zipkiemodule nullpointerexception
by Łukasz Szmolke (Jira)
[ https://issues.jboss.org/browse/DROOLS-3715?page=com.atlassian.jira.plugi... ]
Łukasz Szmolke commented on DROOLS-3715:
----------------------------------------
Sory, i can't share project code. But it's common multi maven module issue. Each nested maven project with multiple kmodule.xml should not working.
> Zipkiemodule nullpointerexception
> ---------------------------------
>
> Key: DROOLS-3715
> URL: https://issues.jboss.org/browse/DROOLS-3715
> Project: Drools
> Issue Type: Bug
> Affects Versions: 7.16.0.Final, 7.17.0.Final
> Reporter: Łukasz Szmolke
> Assignee: Tibor Zimányi
> Priority: Major
>
> o During ZipKieModule loading in “org.drools.compiler.kie.builder.impl.ZipKieModule:142” nullpointerexception is thrown:
>
> urlPath = urlPath.substring( urlPath.lastIndexOf( '!' ) + 1 );
> ArrayList<ZipEntry> entries = new ArrayList<>();
> // read jar file from uber-jar
> InputStream in = this.getClass().getResourceAsStream(urlPath); // nullpointerexception
>
> For example full UrlPath on windows to internal .jar is:
> C:\Users\xbbnv0c\IdeaProjects\ais-data-exchange\data-exchange-app\target\data-exchange-app-1.0.1-SNAPSHOT.jar!\BOOT-INF\lib\data-exchange-brms-1.0.1-SNAPSHOT.jar
> So the result of this first line will be:
> \BOOT-INF\lib\data-exchange-brms-1.0.1-SNAPSHOT.jar
> It will be perfect, but during accessing internal resource file separator should be “/” not “\”. So InputStream in = null.
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 7 months