[JBoss JIRA] Created: (SECURITY-591) Single security domain with DatabaseSourceLoginModule and DatabaseCertLoginModule only works if allowUnsafeLegacyRenegotiation="true"
by Justin Cranford (JIRA)
Single security domain with DatabaseSourceLoginModule and DatabaseCertLoginModule only works if allowUnsafeLegacyRenegotiation="true"
-------------------------------------------------------------------------------------------------------------------------------------
Key: SECURITY-591
URL: https://issues.jboss.org/browse/SECURITY-591
Project: PicketBox (JBoss Security and Identity Management)
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: JBossSX
Affects Versions: PicketBox_v3_0_CR2
Environment: Windows 7 Enterprise x64
Eclipse EE 3.6.2
Oracle JDK 6u24
JBoss 6.0 AS Final (PicketBox 3.0.0CR2)
SQL Server Express 2008 R2 x64
Reporter: Justin Cranford
Assignee: Anil Saldhana
I am blocked by broken functionality in JBossSX login modules. The functionality is broken because SSL renegotiation is disabled. Disabling SSL renegotiation is valid, but is it possible to fix or workaround the login module issue without enabling SSL renegotiation?
- I posed this question on the PicketBox forum, but perhaps it belongs here instead.
http://community.jboss.org/message/604544#604544
- I get similar exceptions in Resteasy as what this person reported in SOAP.
https://issues.jboss.org/browse/JBPAPP-3889
- The original issue to disable SSl renegotiation by default is tracked by this issue, and it mentions how functionality might break. However, there is no mention of potential workarounds or fixes.
https://issues.jboss.org/browse/JBPAPP-3845
My requirements are to support Resteasy web access over HTTPS using one of 2 authentication methods. For localhost access, user/pass authentication is sufficient. For remote access, X.509 client cert authentication is required.
To implement these requirements, I deployed two nearly identical Resteasy web apps. The only differences are the context path in jboss-web.xml, and <auth-constraint> and <auth-method> in web.xml.
1) localhost HTTPS web app => username/password (LocalAdmin role only)
<login-config><auth-method>BASIC</auth-method><realm-name>JustinCranfordSecurityDomain</realm-name></login-config>
<security-role><role-name>LocalAdmin</role-name></security-role>
2) remote HTTPS => x.509 client cert (RemoteAdmin role only)
<login-config><auth-method>CLIENT-CERT</auth-method><realm-name>JustinCranfordSecurityDomain</realm-name></login-config>
<security-role><role-name>RemoteAdmin</role-name></security-role>
Both web apps are wrappers for the same EJB3 code, so I am forced to combine DatabaseServerLoginModule and DatabaseCertLoginModule into the same <application-policy> in login-config.xml.
<application-policy name="JustinCranfordSecurityDomain">
<authentication>
<login-module code="org.jboss.security.auth.spi.DatabaseServerLoginModule" flag="sufficient">
<module-option name="dsJndiName">java:/JustinCranfordDataSource</module-option>
<module-option name="principalsQuery">SELECT password FROM actor WHERE name=?</module-option>
<module-option name="rolesQuery">SELECT r.name,'Roles' FROM actor a,role r WHERE r.id=a.roleid AND a.name=?</module-option>
<module-option name="hashAlgorithm">MD5</module-option>
<module-option name="hashEncoding">base64</module-option>
<module-option name="unauthenticatedIdentity">unauthenticated</module-option>
</login-module>
<login-module code="org.jboss.security.auth.spi.DatabaseCertLoginModule" flag="required">
<module-option name="securityDomain">java:/jaas/JustinCranfordSecurityDomain</module-option>
<module-option name="dsJndiName">java:/JustinCranfordDataSource</module-option>
<module-option name="principalsQuery">SELECT password FROM actor WHERE dname=?</module-option>
<module-option name="rolesQuery">SELECT r.name,'Roles' FROM actor a,role r WHERE r.id=a.roleid AND a.dname=?</module-option>
<module-option name="hashAlgorithm">MD5</module-option>
<module-option name="hashEncoding">base64</module-option>
<module-option name="unauthenticatedIdentity">unauthenticated</module-option>
</login-module>
<login-module code="org.jboss.security.ClientLoginModule" flag="required"></login-module>
</authentication>
</application-policy>
DatabaseCertLoginModule only works if my web app turns on SSL renegotiation in server.xml via the allowUnsafeLegacyRenegotiation="true" attribute.
If turned off, I get SSL renegotiation disabled messages in JBossSX login modules. However, DatabaseCertLoginModule says the user is authenticated, and I see "Successfully passed all security constraints". Unfortunately JBossWebRealm then throws an exception "Security Context has not been set", control passes to Resteasy, and then "jboss.web" container throws an exception "Exception getting SSL attributes: java.net.SocketException: Socket Closed" and "No certificates included with this request".
At the very least, JBossSX should handle these problems more gracefully. SSL renegotiation is disabled by default after all.
Is is possible to fix these issues in JBossSX? Are there any workarounds in the meantime?
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
13 years, 7 months
[JBoss JIRA] Created: (AS7-745) Upgrade to JBossWS-CXF 4.0.0.Beta1
by Alessio Soldano (JIRA)
Upgrade to JBossWS-CXF 4.0.0.Beta1
----------------------------------
Key: AS7-745
URL: https://issues.jboss.org/browse/AS7-745
Project: Application Server 7
Issue Type: Component Upgrade
Components: Web Services
Reporter: Alessio Soldano
Assignee: Alessio Soldano
Fix For: 7.0.0.CR1
Move to jbossws cxf 4.0.0.Beta1 including its dependencies. Also move from jaxws-httpserver-httpspi to jaxws-jboss-httpserver-httpspi as a consequence of recent move from com.sun.net.httpserver to org.jboss.com.sun.httpserver.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
13 years, 7 months
[JBoss JIRA] Created: (JBRULES-3023) The Audit view in Drools Eclipse plugin does not work
by Jervis Liu (JIRA)
The Audit view in Drools Eclipse plugin does not work
-----------------------------------------------------
Key: JBRULES-3023
URL: https://issues.jboss.org/browse/JBRULES-3023
Project: Drools
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: drools-core, drools-eclipse
Affects Versions: 5.2.0.M2
Reporter: Jervis Liu
Assignee: Mark Proctor
Fix For: 5.2.0.CR1
The Audit view in Drools Eclipse plugin does not work. Or maybe it is sth wrong with the logger.
How to reproduce:
1. download drools distribution from https://hudson.qa.jboss.com/hudson/view/Drools%20jBPM/job/drools-5.2.x/3/
2. Build example using pom provided: mvn clean install
3. Generate Eclipse project: mvn eclipse:eclipse
4. Import example project into Eclipse.
5. Set a break point in Helloworld.drl. Uncomment the logger in HelloWorldExample.java
6. Debug HelloWorldExample as Drools
7. There is nothing showed up in Audit view. And there is an exception in console:
Exception in thread "main" java.lang.RuntimeException: Could not create the log file. Please make sure that directory that the log file should be placed in does exist.
at org.drools.audit.WorkingMemoryFileLogger.initializeLog(WorkingMemoryFileLogger.java:148)
at org.drools.audit.WorkingMemoryFileLogger.writeToDisk(WorkingMemoryFileLogger.java:113)
at org.drools.audit.KnowledgeRuntimeLoggerProviderImpl$KnowledgeRuntimeFileLoggerWrapper.close(KnowledgeRuntimeLoggerProviderImpl.java:56)
at org.drools.examples.helloworld.HelloWorldExample.main(HelloWorldExample.java:81)
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
13 years, 7 months