[JBoss JIRA] (WFLY-1523) Addition of caching for security realms backed by ldap.
by Darran Lofthouse (JIRA)
[ https://issues.jboss.org/browse/WFLY-1523?page=com.atlassian.jira.plugin.... ]
Darran Lofthouse updated WFLY-1523:
-----------------------------------
Summary: Addition of caching for security realms backed by ldap. (was: Addition of caching for backing store access used by realms.)
> Addition of caching for security realms backed by ldap.
> -------------------------------------------------------
>
> Key: WFLY-1523
> URL: https://issues.jboss.org/browse/WFLY-1523
> Project: WildFly
> Issue Type: Sub-task
> Security Level: Public(Everyone can see)
> Components: Domain Management, Security
> Reporter: Darran Lofthouse
> Assignee: Darran Lofthouse
> Priority: Critical
> Fix For: 8.0.0.Final
>
>
> For JAAS this is achieved by caching keyed on the combination of the username and the password, once we switch to the CallbackHandler approach this is no longer applicable as there is often not a single username/credential combination - instead a protocol specific exchange is used to establish the identity of the remote user.
> Any cache would also potentially require: -
> - Predicable eviction.
> - Management Operations e.g. clear entire cache, remove single entries etc...
> - Separation of caches for authenticiation data and additional data loaded for authorization purposes.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 3 months
[JBoss JIRA] (WFLY-2841) Datasource mapped in jboss-web.xml not available to persistence unit
by Scott Marlow (JIRA)
[ https://issues.jboss.org/browse/WFLY-2841?page=com.atlassian.jira.plugin.... ]
Scott Marlow commented on WFLY-2841:
------------------------------------
It sounds like an internal ordering problem during deployment of your app.
What happens if you set wildfly.jpa.twophasebootstrap to false in the persistence.xml? The persistence unit should deploy later as a result.
{quote}
<property name="wildfly.jpa.twophasebootstrap" value="false"/>
{quote}
Should look like:
{quote}
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<persistence xmlns="http://xmlns.jcp.org/xml/ns/persistence" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" version="2.1" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/persistence http://www.oracle.com/webfolder/technetwork/jsc/xml/ns/persistence/persis...">
<persistence-unit name="wfdsPU" transaction-type="JTA">
<jta-data-source>java:comp/env/MyDS</jta-data-source>
<properties>
<property name="wildfly.jpa.twophasebootstrap" value="false"/>
<property name="javax.persistence.schema-generation.database.action" value="drop-and-create"/>
<property name="hibernate.dialect" value="org.hibernate.dialect.H2Dialect"/>
</properties>
</persistence-unit>
</persistence>
{quote}
> Datasource mapped in jboss-web.xml not available to persistence unit
> --------------------------------------------------------------------
>
> Key: WFLY-2841
> URL: https://issues.jboss.org/browse/WFLY-2841
> Project: WildFly
> Issue Type: Bug
> Security Level: Public(Everyone can see)
> Affects Versions: 8.0.0.CR1
> Reporter: Martin Andersson
>
> I have mapped the datasource java:jboss/datasources/ExampleDS to jdbc/MyDS in jboss-web.xml for my application.
> In a stateless bean i can do a jndi lookup and find the datasource in both java:comp/env/jdbc/MyDS and java:module/env/jdbc/MyDS as expected. But if I try to use it in my persistence.xml I get an error:
> 13:18:28,129 ERROR [org.jboss.as.controller.management-operation] (DeploymentScanner-threads - 1) JBAS014613: Operation ("full-replace-deployment") failed - address: ([]) - failure description: {"JBAS014771: Services with missing/unavailable dependencies" => ["jboss.persistenceunit.\"wfds-1.0-SNAPSHOT.war#wfdsPU\".__FIRST_PHASE__ is missing [jboss.naming.context.java.module.\"wfds-1.0-SNAPSHOT\".\"wfds-1.0-SNAPSHOT\".env.MyDS]"]}
> A minimal example application that demonstrates the problem is available at: https://github.com/umartin/wfds/
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 3 months
[JBoss JIRA] (WFLY-2848) Pull the username from LDAP in security realms
by Darran Lofthouse (JIRA)
Darran Lofthouse created WFLY-2848:
--------------------------------------
Summary: Pull the username from LDAP in security realms
Key: WFLY-2848
URL: https://issues.jboss.org/browse/WFLY-2848
Project: WildFly
Issue Type: Task
Security Level: Public (Everyone can see)
Components: Domain Management, Security
Reporter: Darran Lofthouse
Assignee: Darran Lofthouse
Fix For: 8.0.0.Final
The user could have entered the username in a different case to what is stored in LDAP, a simple reload of their username using the attribute will correct this.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 3 months
[JBoss JIRA] (DROOLS-402) Programmatic rule update fails
by Mario Fusco (JIRA)
[ https://issues.jboss.org/browse/DROOLS-402?page=com.atlassian.jira.plugin... ]
Mario Fusco resolved DROOLS-402.
--------------------------------
Fix Version/s: 6.1.0.Beta1
Resolution: Done
There was a small bug when using the default releaseId. Fixed.
> Programmatic rule update fails
> ------------------------------
>
> Key: DROOLS-402
> URL: https://issues.jboss.org/browse/DROOLS-402
> Project: Drools
> Issue Type: Bug
> Security Level: Public(Everyone can see)
> Affects Versions: 6.0.1.Final
> Environment: Windows 7
> Reporter: Markus Tippmann
> Assignee: Mario Fusco
> Fix For: 6.1.0.Beta1
>
> Attachments: drools.test.zip
>
>
> Programmatic construction of a kmodule and updating its rules fails with different problems.
> I attach a small Maven project which runs 3 tests (one succeeds just for demonstration). I hope I'm doing correctly here on kmodule construction.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 3 months
[JBoss JIRA] (WFLY-2847) Caller's security identity doesn't get propagated by default
by Matus Abaffy (JIRA)
Matus Abaffy created WFLY-2847:
----------------------------------
Summary: Caller's security identity doesn't get propagated by default
Key: WFLY-2847
URL: https://issues.jboss.org/browse/WFLY-2847
Project: WildFly
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: EJB, Security
Affects Versions: 8.0.0.CR1
Reporter: Matus Abaffy
Assignee: David Lloyd
3 session beans: @RunAs("printer") Printer, which calls HelperBean (no security annotations), which calls @RolesAllowed("printer") Toner. The last invocation results in
{{javax.ejb.EJBAccessException: JBAS014502: Invocation on method: public void org.jboss.as.test.integration.ejb.security.runas.propagation.Toner.spill() of bean: Toner is not allowed}}
Printer calling Toner (directly) works just fine. And if the HelperBean is a CDI managed bean, it works just fine too.
According to EJB spec, 12 Security management, 12.1 Overview:
bq. "By default, the caller principal will be propagated as the caller identity. The Bean Provider can use the RunAs annotation to specify that a security principal that has been assigned to a specified security role be used instead. See Section 12.3.4."
12.3.4 Specification of Security Identities in the Deployment Descriptor:
bq. "The Bean Provider or Application Assembler typically specifies whether the caller’s security identity should be used for the execution of the methods of an enterprise bean or whether a specific run-as identity should be used. By default the caller’s security identity is used."
etc.
{code}
@RunAs("printer")
@PermitAll
public class Printer {
@EJB
HelperBean hb;
public void invokeHelperBean() {
hb.invokeToner();
}
}
{code}
{code}
@Stateful
public class HelperBean {
@EJB
Toner toner;
public void invokeToner() {
toner.spill();
}
}
{code}
{code}
@Stateless
@RolesAllowed("printer")
public class Toner {
public void spill() {}
}
{code}
A bit sophisticated test available at: https://github.com/bafco/wildfly/commits/securityContext
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 3 months
[JBoss JIRA] (DROOLS-364) ClasspathKieProject fails vfs: path for jar deployments and exploded ear
by Mario Fusco (JIRA)
[ https://issues.jboss.org/browse/DROOLS-364?page=com.atlassian.jira.plugin... ]
Mario Fusco reassigned DROOLS-364:
----------------------------------
Assignee: Mario Fusco (was: Mark Proctor)
> ClasspathKieProject fails vfs: path for jar deployments and exploded ear
> ------------------------------------------------------------------------
>
> Key: DROOLS-364
> URL: https://issues.jboss.org/browse/DROOLS-364
> Project: Drools
> Issue Type: Bug
> Security Level: Public(Everyone can see)
> Affects Versions: 6.0.0.Final
> Environment: JBoss AS 7.1.1
> Reporter: Nicolas-Xavier Vanderlinden
> Assignee: Mario Fusco
> Attachments: jbossas-deploy-reproducer.zip, windows-jboss-as-deploy-server.log
>
>
> Drools is not able to load kmodule.xml from an exploded ear.
> 17:24:45,116 WARN Unable to load pom.properties tried recursing down from\Project\Geline\jboss-as-7.1.1.Final\standalone\deployments\geline.ear\service-impl-1.4.0-SNAPcontent
> null
> 17:24:45,116 ERROR Unable to build index of kmodule.xml url=vfs:/E:/Project/Geline/jboss-as-7.1.1.Final/standalone/deployments/geline.ear/service-impl-1.4.0-SNAPSHOT.jar/META-INF/kmodule.xml
> null
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 3 months