September 2013 - jboss-jira - Jboss List Archives

[JBoss JIRA] (WFLY-1843) Invoking :read-resource operation on Security subsystem as a role with restricted privileges causes NPE

by Ladislav Thon (JIRA)

[ https://issues.jboss.org/browse/WFLY-1843?page=com.atlassian.jira.plugin.... ] Ladislav Thon updated WFLY-1843: -------------------------------- Labels: rbac-filed-by-qa (was: ) > Invoking :read-resource operation on Security subsystem as a role with restricted privileges causes NPE > ------------------------------------------------------------------------------------------------------- > > Key: WFLY-1843 > URL: https://issues.jboss.org/browse/WFLY-1843 > Project: WildFly > Issue Type: Sub-task > Components: Domain Management, Security > Reporter: Jakub Cechacek > Assignee: Brian Stansberry > Labels: rbac-filed-by-qa > Fix For: 8.0.0.Alpha4 > > > Invoking :read-resource operation on Security subsystem results in NPE > {code} > :whoami(verbose=true) > { > "outcome" => "success", > "result" => { > "identity" => { > "username" => "monitor", > "realm" => "ManagementRealm" > }, > "roles" => ["Monitor"] > } > } > {code} > {code} > /subsystem=security:read-resource > { > "outcome" => "failed", > "failure-description" => "JBAS014749: Operation handler failed: null", > "rolled-back" => true > } > {code} > As a result NPE can be found in server log [1] http://pastebin.test.redhat.com/157254 > Although I'm not sure whether this is relevant but SecuritySubsystemRootResourceDefinition doesn't have any Access Constraints set -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira

12 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFLY-1844) deep-copy-subject-mode attribute on Security Subsystem is Readable to all roles

by Ladislav Thon (JIRA)

[ https://issues.jboss.org/browse/WFLY-1844?page=com.atlassian.jira.plugin.... ] Ladislav Thon updated WFLY-1844: -------------------------------- Assignee: Brian Stansberry > deep-copy-subject-mode attribute on Security Subsystem is Readable to all roles > ------------------------------------------------------------------------------- > > Key: WFLY-1844 > URL: https://issues.jboss.org/browse/WFLY-1844 > Project: WildFly > Issue Type: Sub-task > Components: Domain Management, Security > Reporter: Jakub Cechacek > Assignee: Brian Stansberry > Labels: rbac-filed-by-qa > Fix For: 8.0.0.CR1 > > > According to this spreadsheet [1] deep-copy-subject-mode attribute should be available only to Administrator role, instead it is Readable for everyone > {code} > [standalone@localhost:9990 /] :whoami(verbose=true) > { > "outcome" => "success", > "result" => { > "identity" => { > "username" => "monitor", > "realm" => "ManagementRealm" > }, > "roles" => ["Monitor"] > } > } > [standalone@localhost:9990 /] /subsystem=security:read-attribute(name=deep-copy-subject-mode) > { > "outcome" => "success", > "result" => false > } > {code} > [1] https://docs.google.com/spreadsheet/ccc?key=0Au0knNJrYUJhdFlSSEVpdGJpQnlD... -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira

12 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFLY-1844) deep-copy-subject-mode attribute on Security Subsystem is Readable to all roles

by Ladislav Thon (JIRA)

[ https://issues.jboss.org/browse/WFLY-1844?page=com.atlassian.jira.plugin.... ] Ladislav Thon updated WFLY-1844: -------------------------------- Labels: rbac-filed-by-qa (was: ) > deep-copy-subject-mode attribute on Security Subsystem is Readable to all roles > ------------------------------------------------------------------------------- > > Key: WFLY-1844 > URL: https://issues.jboss.org/browse/WFLY-1844 > Project: WildFly > Issue Type: Sub-task > Components: Domain Management, Security > Reporter: Jakub Cechacek > Labels: rbac-filed-by-qa > Fix For: 8.0.0.CR1 > > > According to this spreadsheet [1] deep-copy-subject-mode attribute should be available only to Administrator role, instead it is Readable for everyone > {code} > [standalone@localhost:9990 /] :whoami(verbose=true) > { > "outcome" => "success", > "result" => { > "identity" => { > "username" => "monitor", > "realm" => "ManagementRealm" > }, > "roles" => ["Monitor"] > } > } > [standalone@localhost:9990 /] /subsystem=security:read-attribute(name=deep-copy-subject-mode) > { > "outcome" => "success", > "result" => false > } > {code} > [1] https://docs.google.com/spreadsheet/ccc?key=0Au0knNJrYUJhdFlSSEVpdGJpQnlD... -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira

12 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFLY-1788) RBAC: role combination doesn't work

by Ladislav Thon (JIRA)

[ https://issues.jboss.org/browse/WFLY-1788?page=com.atlassian.jira.plugin.... ] Ladislav Thon reopened WFLY-1788: --------------------------------- > RBAC: role combination doesn't work > ----------------------------------- > > Key: WFLY-1788 > URL: https://issues.jboss.org/browse/WFLY-1788 > Project: WildFly > Issue Type: Sub-task > Components: Domain Management > Reporter: Ladislav Thon > Assignee: Ladislav Thon > > [This issue was in fact found on 2013-07-02 and is being filled now only for tracking purposes.] > Combining multiple roles doesn't work, as {{ManagementPermissionCollection(CombinationManagementPermission)}} will never {{imply}} a {{ManagementPermissionCollection(SimpleManagementPermission)}}. See TODOs in {{DefaultPermissionFactory}} and {{ManagementPermissionCollection}}. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira

12 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFLY-1788) RBAC: role combination doesn't work

by Ladislav Thon (JIRA)

[ https://issues.jboss.org/browse/WFLY-1788?page=com.atlassian.jira.plugin.... ] Ladislav Thon updated WFLY-1788: -------------------------------- Labels: rbac-filed-by-qa (was: ) > RBAC: role combination doesn't work > ----------------------------------- > > Key: WFLY-1788 > URL: https://issues.jboss.org/browse/WFLY-1788 > Project: WildFly > Issue Type: Sub-task > Components: Domain Management > Reporter: Ladislav Thon > Assignee: Ladislav Thon > Labels: rbac-filed-by-qa > > [This issue was in fact found on 2013-07-02 and is being filled now only for tracking purposes.] > Combining multiple roles doesn't work, as {{ManagementPermissionCollection(CombinationManagementPermission)}} will never {{imply}} a {{ManagementPermissionCollection(SimpleManagementPermission)}}. See TODOs in {{DefaultPermissionFactory}} and {{ManagementPermissionCollection}}. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira

12 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFLY-1790) RBAC: HostScopedRole* operations are wrong (copy&paste from ServerGroupScopedRole*)

by Ladislav Thon (JIRA)

[ https://issues.jboss.org/browse/WFLY-1790?page=com.atlassian.jira.plugin.... ] Ladislav Thon updated WFLY-1790: -------------------------------- Labels: rbac-filed-by-qa (was: ) > RBAC: HostScopedRole* operations are wrong (copy&paste from ServerGroupScopedRole*) > ----------------------------------------------------------------------------------- > > Key: WFLY-1790 > URL: https://issues.jboss.org/browse/WFLY-1790 > Project: WildFly > Issue Type: Sub-task > Components: Domain Management > Reporter: Ladislav Thon > Assignee: Ladislav Thon > Labels: rbac-filed-by-qa > > This is the issue I was speaking about with Brian yesterday. > The {{HostScopedRole*}} operations are clearly a copy&paste from {{ServerGroupScopedRole*}} operations. Sadly, there are few artifacts of this: > - {{HostScopedRoleAdd.performRuntime}} refers to attribute definitions from {{ServerGroupScopedRoleResourceDefinition}}, while it should use the ones from {{HostScopedRolesResourceDefinition}} > - all the {{HostScopedRoleAdd}}, {{HostScopedRoleRemove}} and {{HostScopedRoleWriteAttributeHandler}} operations expect that the {{hosts}} attribute will always contain a valid list, while it can easily be undefined (see {{HostScopedRolesResourceDefinition.HOSTS}}) -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira

12 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFLY-1788) RBAC: role combination doesn't work

by Ladislav Thon (JIRA)

[ https://issues.jboss.org/browse/WFLY-1788?page=com.atlassian.jira.plugin.... ] Ladislav Thon resolved WFLY-1788. --------------------------------- Resolution: Done > RBAC: role combination doesn't work > ----------------------------------- > > Key: WFLY-1788 > URL: https://issues.jboss.org/browse/WFLY-1788 > Project: WildFly > Issue Type: Sub-task > Components: Domain Management > Reporter: Ladislav Thon > Assignee: Ladislav Thon > Labels: rbac-filed-by-qa > > [This issue was in fact found on 2013-07-02 and is being filled now only for tracking purposes.] > Combining multiple roles doesn't work, as {{ManagementPermissionCollection(CombinationManagementPermission)}} will never {{imply}} a {{ManagementPermissionCollection(SimpleManagementPermission)}}. See TODOs in {{DefaultPermissionFactory}} and {{ManagementPermissionCollection}}. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira

12 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFLY-1790) RBAC: HostScopedRole* operations are wrong (copy&paste from ServerGroupScopedRole*)

by Ladislav Thon (JIRA)

[ https://issues.jboss.org/browse/WFLY-1790?page=com.atlassian.jira.plugin.... ] Ladislav Thon reopened WFLY-1790: --------------------------------- > RBAC: HostScopedRole* operations are wrong (copy&paste from ServerGroupScopedRole*) > ----------------------------------------------------------------------------------- > > Key: WFLY-1790 > URL: https://issues.jboss.org/browse/WFLY-1790 > Project: WildFly > Issue Type: Sub-task > Components: Domain Management > Reporter: Ladislav Thon > Assignee: Ladislav Thon > > This is the issue I was speaking about with Brian yesterday. > The {{HostScopedRole*}} operations are clearly a copy&paste from {{ServerGroupScopedRole*}} operations. Sadly, there are few artifacts of this: > - {{HostScopedRoleAdd.performRuntime}} refers to attribute definitions from {{ServerGroupScopedRoleResourceDefinition}}, while it should use the ones from {{HostScopedRolesResourceDefinition}} > - all the {{HostScopedRoleAdd}}, {{HostScopedRoleRemove}} and {{HostScopedRoleWriteAttributeHandler}} operations expect that the {{hosts}} attribute will always contain a valid list, while it can easily be undefined (see {{HostScopedRolesResourceDefinition.HOSTS}}) -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira

12 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFLY-1790) RBAC: HostScopedRole* operations are wrong (copy&paste from ServerGroupScopedRole*)

by Ladislav Thon (JIRA)

[ https://issues.jboss.org/browse/WFLY-1790?page=com.atlassian.jira.plugin.... ] Ladislav Thon resolved WFLY-1790. --------------------------------- Resolution: Done > RBAC: HostScopedRole* operations are wrong (copy&paste from ServerGroupScopedRole*) > ----------------------------------------------------------------------------------- > > Key: WFLY-1790 > URL: https://issues.jboss.org/browse/WFLY-1790 > Project: WildFly > Issue Type: Sub-task > Components: Domain Management > Reporter: Ladislav Thon > Assignee: Ladislav Thon > Labels: rbac-filed-by-qa > > This is the issue I was speaking about with Brian yesterday. > The {{HostScopedRole*}} operations are clearly a copy&paste from {{ServerGroupScopedRole*}} operations. Sadly, there are few artifacts of this: > - {{HostScopedRoleAdd.performRuntime}} refers to attribute definitions from {{ServerGroupScopedRoleResourceDefinition}}, while it should use the ones from {{HostScopedRolesResourceDefinition}} > - all the {{HostScopedRoleAdd}}, {{HostScopedRoleRemove}} and {{HostScopedRoleWriteAttributeHandler}} operations expect that the {{hosts}} attribute will always contain a valid list, while it can easily be undefined (see {{HostScopedRolesResourceDefinition.HOSTS}}) -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira

12 years, 10 months

1
0
0 / 0

[JBoss JIRA] (WFLY-1789) RBAC: OperationContextImpl.readResourceForUpdate is missing an authorize call

by Ladislav Thon (JIRA)

[ https://issues.jboss.org/browse/WFLY-1789?page=com.atlassian.jira.plugin.... ] Ladislav Thon updated WFLY-1789: -------------------------------- Labels: rbac-filed-by-qa (was: ) > RBAC: OperationContextImpl.readResourceForUpdate is missing an authorize call > ----------------------------------------------------------------------------- > > Key: WFLY-1789 > URL: https://issues.jboss.org/browse/WFLY-1789 > Project: WildFly > Issue Type: Sub-task > Components: Domain Management > Reporter: Ladislav Thon > Assignee: Brian Stansberry > Labels: rbac-filed-by-qa > Fix For: 8.0.0.Alpha4 > > > [This issue was in fact found on 2013-07-09 and is being filled now only for tracking purposes.] > During code inspection, I found one method in the {{OperationContextImpl}} class that is IMHO missing an {{authorize}} call: {{readResourceForUpdate}}. Compare with {{readModelForUpdate}}. See TODO in the code. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira

12 years, 10 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-jira September 2013