[JBoss JIRA] (WFLY-9557) Webservice subsystem requires an undertow dependency to get the Elytron security domain.
by Darran Lofthouse (Jira)
[ https://issues.jboss.org/browse/WFLY-9557?page=com.atlassian.jira.plugin.... ]
Darran Lofthouse commented on WFLY-9557:
----------------------------------------
[~dvilkola] This is a different issue to the client side integration you have been looking into but could be worthwhile you looking into this as well as you are already working closely with the WS subsystem and team.
> Webservice subsystem requires an undertow dependency to get the Elytron security domain.
> ----------------------------------------------------------------------------------------
>
> Key: WFLY-9557
> URL: https://issues.jboss.org/browse/WFLY-9557
> Project: WildFly
> Issue Type: Task
> Components: Security, Web (Undertow)
> Affects Versions: 11.0.0.Final
> Reporter: Jim Ma
> Priority: Major
>
> Webservice subsystem requires an undertow's dependency(ApplicationSecurityDomainService or some Service) to get Elytron security domain to do webservice layer authentication.
> From Darren, elytron security resource will be added in deploymentUnit after WF 11.
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 4 months
[JBoss JIRA] (WFCORE-3120) Tests broken as part of WildFly Core 3.0.0.Beta16
by Darran Lofthouse (Jira)
[ https://issues.jboss.org/browse/WFCORE-3120?page=com.atlassian.jira.plugi... ]
Darran Lofthouse reassigned WFCORE-3120:
----------------------------------------
Assignee: (was: Ken Wills)
> Tests broken as part of WildFly Core 3.0.0.Beta16
> -------------------------------------------------
>
> Key: WFCORE-3120
> URL: https://issues.jboss.org/browse/WFCORE-3120
> Project: WildFly Core
> Issue Type: Bug
> Components: Security
> Reporter: Ken Wills
> Priority: Major
>
> These tests were moved to wildfly-core previously.
> Tests shown here are going to be ignored or otherwise modified in order to get the core 3.0.0.Beta16 release integrated.
> org.jboss.as.test.integration.domain.elytron.SlaveHostControllerElytronAuthenticationTestCase.testSlaveRegistration
> org.jboss.as.test.integration.security.perimeter.CLISecurityTestCase.testConnect
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 4 months
[JBoss JIRA] (WFLY-10042) Elytron tests fail intermittently
by Farah Juma (Jira)
[ https://issues.jboss.org/browse/WFLY-10042?page=com.atlassian.jira.plugin... ]
Farah Juma commented on WFLY-10042:
-----------------------------------
[~dlofthouse] Yes, the stack trace here is actually the same as the one in WFCORE-4500 so we should be able to close this issue once a WildFly Core component upgrade with the fix for WFCORE-4500 has been merged to WildFly.
> Elytron tests fail intermittently
> ---------------------------------
>
> Key: WFLY-10042
> URL: https://issues.jboss.org/browse/WFLY-10042
> Project: WildFly
> Issue Type: Bug
> Components: JMX, Security
> Reporter: Stuart Douglas
> Priority: Major
>
> The JMX MBean server service does not have correct dependencies set on the security domain, and as a result unregistering the Arquillian MBean can fail on reload.
> If this happen all subsequent tests will fail as the Arquillian service will not start correctly.
> An example run is at: https://ci.wildfly.org/viewLog.html?buildId=89151&buildTypeId=WFPR&tab=bu...
> {code}
> 2018-02-12 09:31:55,112 INFO [org.wildfly.extension.undertow] (ServerService Thread Pool -- 31) WFLYUT0022: Unregistered web context: '/chained-principal-transformer-transform-transformed' from server 'default-server'
> 2018-02-12 09:31:55,118 INFO [org.jboss.as.server.deployment] (MSC service thread 1-1) WFLYSRV0028: Stopped deployment chained-principal-transformer-transform-transformed.war (runtime-name: chained-principal-transformer-transform-transformed.war) in 6ms
> 2018-02-12 09:31:55,129 INFO [org.jboss.as.repository] (management-handler-thread - 1) WFLYDR0002: Content removed from location /store/work/tc-work/9ccd5e119c4a65d0/testsuite/integration/elytron/target/wildfly/standalone/data/content/7b/30341090e956f73f2066f8e357380151a337e8/content
> 2018-02-12 09:31:55,129 INFO [org.jboss.as.server] (management-handler-thread - 1) WFLYSRV0009: Undeployed "chained-principal-transformer-transform-transformed.war" (runtime-name: "chained-principal-transformer-transform-transformed.war")
> 2018-02-12 09:31:55,563 ERROR [org.jboss.as.arquillian] (MSC service thread 1-8) Cannot stop Arquillian Test Runner: java.lang.IllegalStateException
> at org.jboss.msc.value.InjectedValue.getValue(InjectedValue.java:47)
> at org.jboss.as.controller.access.management.ManagementSecurityIdentitySupplier.get(ManagementSecurityIdentitySupplier.java:60)
> at org.jboss.as.controller.access.management.ManagementSecurityIdentitySupplier.get(ManagementSecurityIdentitySupplier.java:39)
> at org.jboss.as.jmx.PluggableMBeanServerImpl.log(PluggableMBeanServerImpl.java:1180)
> at org.jboss.as.jmx.MBeanServerAuditLogRecordFormatter.log(MBeanServerAuditLogRecordFormatter.java:331)
> at org.jboss.as.jmx.MBeanServerAuditLogRecordFormatter.isRegistered(MBeanServerAuditLogRecordFormatter.java:176)
> at org.jboss.as.jmx.PluggableMBeanServerImpl.isRegistered(PluggableMBeanServerImpl.java:784)
> at org.jboss.arquillian.protocol.jmx.JMXTestRunner.unregisterMBean(JMXTestRunner.java:109)
> at org.jboss.as.arquillian.service.ArquillianService.stop(ArquillianService.java:96)
> at org.jboss.msc.service.ServiceControllerImpl$StopTask.stopService(ServiceControllerImpl.java:1767)
> at org.jboss.msc.service.ServiceControllerImpl$StopTask.execute(ServiceControllerImpl.java:1740)
> at org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1527)
> at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1979)
> at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1481)
> at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1360)
> at java.lang.Thread.run(Thread.java:748)
> {code}
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 4 months
[JBoss JIRA] (WFCORE-3750) Revisit default DSA algorithm for generate-key-pair operation
by Darran Lofthouse (Jira)
[ https://issues.jboss.org/browse/WFCORE-3750?page=com.atlassian.jira.plugi... ]
Darran Lofthouse reassigned WFCORE-3750:
----------------------------------------
Assignee: (was: Farah Juma)
> Revisit default DSA algorithm for generate-key-pair operation
> -------------------------------------------------------------
>
> Key: WFCORE-3750
> URL: https://issues.jboss.org/browse/WFCORE-3750
> Project: WildFly Core
> Issue Type: Bug
> Components: Security
> Affects Versions: 5.0.0.Alpha2
> Reporter: Martin Choma
> Priority: Major
>
> Generate-key-pair operation use default DSA algorithm. I am unable to connect to such SSL with Firefox or Chrome ("no cipher suite in common"). With RSA private key it works. Can we revisit the default?
> Can we add default information into the model description (algorithm)? In such case it would be best if defaults were specified on subsystem level and not rely on Elytron library defaults.
> Was thinking also about key-size and signature-algorithm, but realized these parameters are computed dynamically based on chosen algorithm.
> {code:title=TLS.handshake}
> 08:19:21,479 INFO [stdout] (management task-1) *** ClientHello, TLSv1.2
> 08:19:21,480 INFO [stdout] (management task-1) RandomCookie: GMT: -151315060 bytes = { 149, 83, 32, 135, 156, 106, 80, 46, 117, 158, 131, 177, 174, 235, 90, 7, 124, 236, 42, 183, 158, 180, 151, 31, 121, 146, 31, 146 }
> 08:19:21,480 INFO [stdout] (management task-1) Session ID: {}
> 08:19:21,480 INFO [stdout] (management task-1) Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, Unknown 0xcc:0xa9, Unknown 0xcc:0xa8, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA]
> 08:19:21,480 INFO [stdout] (management task-1) Compression Methods: { 0 }
> 08:19:21,480 INFO [stdout] (management task-1) Extension server_name, server_name: [type=host_name (0), value=localhost]
> 08:19:21,480 INFO [stdout] (management task-1) Extension extended_master_secret
> 08:19:21,480 INFO [stdout] (management task-1) Extension renegotiation_info, renegotiated_connection: <empty>
> 08:19:21,480 INFO [stdout] (management task-1) Extension elliptic_curves, curve names: {unknown curve 29, secp256r1, secp384r1, secp521r1}
> 08:19:21,480 INFO [stdout] (management task-1) Extension ec_point_formats, formats: [uncompressed]
> 08:19:21,480 INFO [stdout] (management task-1) Unsupported extension type_35, data:
> 08:19:21,480 INFO [stdout] (management task-1) Unsupported extension type_16, data: 00:0c:02:68:32:08:68:74:74:70:2f:31:2e:31
> 08:19:21,480 INFO [stdout] (management task-1) Unsupported extension status_request, data: 01:00:00:00:00
> 08:19:21,480 INFO [stdout] (management task-1) Extension signature_algorithms, signature_algorithms: SHA256withECDSA, SHA384withECDSA, SHA512withECDSA, Unknown (hash:0x8, signature:0x4), Unknown (hash:0x8, signature:0x5), Unknown (hash:0x8, signature:0x6), SHA256withRSA, SHA384withRSA, SHA512withRSA, SHA1withECDSA, SHA1withRSA
> 08:19:21,480 INFO [stdout] (management task-1) ***
> 08:19:21,480 INFO [stdout] (management task-1) [read] MD5 and SHA1 hashes: len = 181
> 08:19:21,481 INFO [stdout] (management task-1) 0000: 01 00 00 B1 03 03 F7 FB 1E 8C 95 53 20 87 9C 6A ...........S ..j
> 08:19:21,481 INFO [stdout] (management task-1) 0010: 50 2E 75 9E 83 B1 AE EB 5A 07 7C EC 2A B7 9E B4 P.u.....Z...*...
> 08:19:21,482 INFO [stdout] (management task-1) 0020: 97 1F 79 92 1F 92 00 00 1E C0 2B C0 2F CC A9 CC ..y.......+./...
> 08:19:21,482 INFO [stdout] (management task-1) 0030: A8 C0 2C C0 30 C0 0A C0 09 C0 13 C0 14 00 33 00 ..,.0.........3.
> 08:19:21,483 INFO [stdout] (management task-1) 0040: 39 00 2F 00 35 00 0A 01 00 00 6A 00 00 00 0E 00 9./.5.....j.....
> 08:19:21,483 INFO [stdout] (management task-1) 0050: 0C 00 00 09 6C 6F 63 61 6C 68 6F 73 74 00 17 00 ....localhost...
> 08:19:21,483 INFO [stdout] (management task-1) 0060: 00 FF 01 00 01 00 00 0A 00 0A 00 08 00 1D 00 17 ................
> 08:19:21,484 INFO [stdout] (management task-1) 0070: 00 18 00 19 00 0B 00 02 01 00 00 23 00 00 00 10 ...........#....
> 08:19:21,484 INFO [stdout] (management task-1) 0080: 00 0E 00 0C 02 68 32 08 68 74 74 70 2F 31 2E 31 .....h2.http/1.1
> 08:19:21,484 INFO [stdout] (management task-1) 0090: 00 05 00 05 01 00 00 00 00 00 0D 00 18 00 16 04 ................
> 08:19:21,485 INFO [stdout] (management task-1) 00A0: 03 05 03 06 03 08 04 08 05 08 06 04 01 05 01 06 ................
> 08:19:21,485 INFO [stdout] (management task-1) 00B0: 01 02 03 02 01 .....
> 08:19:21,486 INFO [stdout] (management task-1) %% Initialized: [Session-5, SSL_NULL_WITH_NULL_NULL]
> 08:19:21,486 INFO [stdout] (management task-1) management task-1, fatal error: 40: no cipher suites in common
> 08:19:21,486 INFO [stdout] (management task-1) javax.net.ssl.SSLHandshakeException: no cipher suites in common
> 08:19:21,486 INFO [stdout] (management task-1) %% Invalidated: [Session-5, SSL_NULL_WITH_NULL_NULL]
> 08:19:21,486 INFO [stdout] (management task-1) management task-1, SEND TLSv1.2 ALERT: fatal, description = handshake_failure
> 08:19:21,486 INFO [stdout] (management task-1) management task-1, WRITE: TLSv1.2 Alert, length = 2
> 08:19:21,487 INFO [stdout] (management I/O-2) management I/O-2, fatal: engine already closed. Rethrowing javax.net.ssl.SSLHandshakeException: no cipher suites in common
> {code}
> {code:java|title=SelfSignedX509CertificateAndSigningKey.java}
> /**
> * The default key algorithm name.
> */
> public static final String DEFAULT_KEY_ALGORITHM_NAME = "DSA";
> {code}
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 4 months
[JBoss JIRA] (WFCORE-2732) Elytron - it should also be possible to store OTP algorithm on security realm level
by Darran Lofthouse (Jira)
[ https://issues.jboss.org/browse/WFCORE-2732?page=com.atlassian.jira.plugi... ]
Darran Lofthouse updated WFCORE-2732:
-------------------------------------
Issue Type: Feature Request (was: Bug)
> Elytron - it should also be possible to store OTP algorithm on security realm level
> -----------------------------------------------------------------------------------
>
> Key: WFCORE-2732
> URL: https://issues.jboss.org/browse/WFCORE-2732
> Project: WildFly Core
> Issue Type: Feature Request
> Components: Security
> Reporter: Josef Cacek
> Priority: Major
>
> It should be possible to store OTP algorithm name on security realm level too.
> Using of the OTP SASL mechanism requires modifiable realm and currently only ldap-realm integration is finished.
> The ldap-realm now requires to store the algorithm name into an LDAP attribute together with the rest of OTP configuration (seed, hash, sequence), but this can be limiting (or space vasting) when the algorithm is the same for all users in the realm. There should be a possibility to configure the OTP algorithm name also on the realm level and share it for users. Make it an alternative for {{ldap-realm.identity-mapping.otp-credential-mapper.algorithm-from}} configuration.
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 4 months
[JBoss JIRA] (WFLY-9855) [JDK9+] org.jboss.security.negotiation.spnego package is exported by two jars
by Darran Lofthouse (Jira)
[ https://issues.jboss.org/browse/WFLY-9855?page=com.atlassian.jira.plugin.... ]
Darran Lofthouse reassigned WFLY-9855:
--------------------------------------
Assignee: (was: Tomas Hofman)
> [JDK9+] org.jboss.security.negotiation.spnego package is exported by two jars
> -----------------------------------------------------------------------------
>
> Key: WFLY-9855
> URL: https://issues.jboss.org/browse/WFLY-9855
> Project: WildFly
> Issue Type: Bug
> Components: Security
> Reporter: Tomaž Cerar
> Priority: Major
>
> Currently if you have
> jboss-negotiation-spnego-3.0.4.Final and jboss-negotiation-extras-3.0.4.Final.jar
> on your module path, jvm complains as both jars export package org.jboss.security.negotiation.spnego
> which violates the modules contract where only one module (jar) can provide single package.
> example error that jvm prints
> {noformat}
> Error: Modules jboss.negotiation.extras and jboss.negotiation.spnego export package org.jboss.security.negotiation.spnego to module wildfly.clustering.common
> {noformat}
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 4 months
[JBoss JIRA] (WFLY-10042) Elytron tests fail intermittently
by Darran Lofthouse (Jira)
[ https://issues.jboss.org/browse/WFLY-10042?page=com.atlassian.jira.plugin... ]
Darran Lofthouse commented on WFLY-10042:
-----------------------------------------
[~fjuma] Does this relate to the issue you just looked into for [~brian.stansberry]?
> Elytron tests fail intermittently
> ---------------------------------
>
> Key: WFLY-10042
> URL: https://issues.jboss.org/browse/WFLY-10042
> Project: WildFly
> Issue Type: Bug
> Components: JMX, Security
> Reporter: Stuart Douglas
> Priority: Major
>
> The JMX MBean server service does not have correct dependencies set on the security domain, and as a result unregistering the Arquillian MBean can fail on reload.
> If this happen all subsequent tests will fail as the Arquillian service will not start correctly.
> An example run is at: https://ci.wildfly.org/viewLog.html?buildId=89151&buildTypeId=WFPR&tab=bu...
> {code}
> 2018-02-12 09:31:55,112 INFO [org.wildfly.extension.undertow] (ServerService Thread Pool -- 31) WFLYUT0022: Unregistered web context: '/chained-principal-transformer-transform-transformed' from server 'default-server'
> 2018-02-12 09:31:55,118 INFO [org.jboss.as.server.deployment] (MSC service thread 1-1) WFLYSRV0028: Stopped deployment chained-principal-transformer-transform-transformed.war (runtime-name: chained-principal-transformer-transform-transformed.war) in 6ms
> 2018-02-12 09:31:55,129 INFO [org.jboss.as.repository] (management-handler-thread - 1) WFLYDR0002: Content removed from location /store/work/tc-work/9ccd5e119c4a65d0/testsuite/integration/elytron/target/wildfly/standalone/data/content/7b/30341090e956f73f2066f8e357380151a337e8/content
> 2018-02-12 09:31:55,129 INFO [org.jboss.as.server] (management-handler-thread - 1) WFLYSRV0009: Undeployed "chained-principal-transformer-transform-transformed.war" (runtime-name: "chained-principal-transformer-transform-transformed.war")
> 2018-02-12 09:31:55,563 ERROR [org.jboss.as.arquillian] (MSC service thread 1-8) Cannot stop Arquillian Test Runner: java.lang.IllegalStateException
> at org.jboss.msc.value.InjectedValue.getValue(InjectedValue.java:47)
> at org.jboss.as.controller.access.management.ManagementSecurityIdentitySupplier.get(ManagementSecurityIdentitySupplier.java:60)
> at org.jboss.as.controller.access.management.ManagementSecurityIdentitySupplier.get(ManagementSecurityIdentitySupplier.java:39)
> at org.jboss.as.jmx.PluggableMBeanServerImpl.log(PluggableMBeanServerImpl.java:1180)
> at org.jboss.as.jmx.MBeanServerAuditLogRecordFormatter.log(MBeanServerAuditLogRecordFormatter.java:331)
> at org.jboss.as.jmx.MBeanServerAuditLogRecordFormatter.isRegistered(MBeanServerAuditLogRecordFormatter.java:176)
> at org.jboss.as.jmx.PluggableMBeanServerImpl.isRegistered(PluggableMBeanServerImpl.java:784)
> at org.jboss.arquillian.protocol.jmx.JMXTestRunner.unregisterMBean(JMXTestRunner.java:109)
> at org.jboss.as.arquillian.service.ArquillianService.stop(ArquillianService.java:96)
> at org.jboss.msc.service.ServiceControllerImpl$StopTask.stopService(ServiceControllerImpl.java:1767)
> at org.jboss.msc.service.ServiceControllerImpl$StopTask.execute(ServiceControllerImpl.java:1740)
> at org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1527)
> at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1979)
> at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1481)
> at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1360)
> at java.lang.Thread.run(Thread.java:748)
> {code}
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 4 months
[JBoss JIRA] (WFCORE-3747) Enhance credential-store description related to location and type attributes
by Darran Lofthouse (Jira)
[ https://issues.jboss.org/browse/WFCORE-3747?page=com.atlassian.jira.plugi... ]
Darran Lofthouse updated WFCORE-3747:
-------------------------------------
Fix Version/s: 10.0.0.Beta1
> Enhance credential-store description related to location and type attributes
> ----------------------------------------------------------------------------
>
> Key: WFCORE-3747
> URL: https://issues.jboss.org/browse/WFCORE-3747
> Project: WildFly Core
> Issue Type: Enhancement
> Components: Security
> Reporter: Claudio Miranda
> Assignee: Darran Lofthouse
> Priority: Major
> Fix For: 10.0.0.Beta1
>
>
> The description for "location" and "type" for credential-store resource is displayed below.
> Following discussion of WFCORE-3458, the "location" attribute is required only when the "type" is file based, but the description doesn't says that, the description may be improved to reflect this behavior and list the possible file based types.
> When the user doesn't set the "type" attribute it defaults to "JCEKS", but there is no "default" value on resource description for "type" attribute.
> {code}
> "location" => {
> "type" => STRING,
> "description" => "File name of credential store storage.",
> "attribute-group" => "implementation",
> "expressions-allowed" => true,
> "required" => false,
> "nillable" => true,
> "min-length" => 1L,
> "max-length" => 2147483647L,
> "access-type" => "read-write",
> "storage" => "configuration",
> "restart-required" => "all-services"
> },
> "type" => {
> "type" => STRING,
> "description" => "The credential store type, e.g. KeyStoreCredentialStore.",
> "attribute-group" => "implementation",
> "expressions-allowed" => true,
> "required" => false,
> "nillable" => true,
> "min-length" => 1L,
> "max-length" => 2147483647L,
> "access-type" => "read-write",
> "storage" => "configuration",
> "restart-required" => "all-services"
> }
> {code}
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
6 years, 4 months