[JBoss JIRA] (WFLY-4289) Authentication bug on one-way JAX-WS methods
by Sven V (JIRA)
[ https://issues.jboss.org/browse/WFLY-4289?page=com.atlassian.jira.plugin.... ]
Sven V commented on WFLY-4289:
------------------------------
Yes, that's exactly the behaviour I have experienced.
> Authentication bug on one-way JAX-WS methods
> --------------------------------------------
>
> Key: WFLY-4289
> URL: https://issues.jboss.org/browse/WFLY-4289
> Project: WildFly
> Issue Type: Bug
> Components: Security, Web Services
> Affects Versions: 8.2.0.Final
> Reporter: Jakub Grabowski
> Assignee: Darran Lofthouse
>
> 1. For two-way methods basic authentication and autorization works fine. User is authenticated with LDAP module and gets proper role that autorizes invocation. It works just fine. By two-way method I mean method with input and output message defined in WSDL.
> 2. For one-way methods (return type void) user is not authenticated properly. It results in denial of method invocation.
> 3. When I remove @RolesAllowed declaration I can see that for two-way methods authentication is correct (pricipal is set to logged user), but for one-way it's not - I get "anonymous" as principal.
> 4. When I change one-way method to have input and output messages defined in WSDL and update implementation accordingly it suprisingly starts to work as expected.
> It's quite serious issue, because currently there's no way to have authorized access to oneway webservice methods.
--
This message was sent by Atlassian JIRA
(v6.3.11#6341)
9 years, 3 months
[JBoss JIRA] (WFLY-4289) Authentication bug on one-way JAX-WS methods
by Jakub Grabowski (JIRA)
[ https://issues.jboss.org/browse/WFLY-4289?page=com.atlassian.jira.plugin.... ]
Jakub Grabowski edited comment on WFLY-4289 at 1/27/15 6:21 AM:
----------------------------------------------------------------
And the code that demonstrates issue:
{code}
@Stateless
@WebService
@DeclareRoles("user")
@Local(IMessageSender.class)
@WebContext(authMethod = "BASIC")
public class MessageSender implements IMessageSender {
@RolesAllowed("user")
@Oneway
public void fails(long l) {
System.out.println(">>>>>: " + l);
}
@RolesAllowed("user")
public void works(long l) {
System.out.println(">>>>>: " + l);
}
}
{code}
was (Author: jakub_grabowski):
And the code that demonstrates issue:
@Stateless
@WebService
@DeclareRoles("user")
@Local(IMessageSender.class)
@WebContext(authMethod = "BASIC")
public class MessageSender implements IMessageSender {
@RolesAllowed("user")
@Oneway
public void fails(long l) {
System.out.println(">>>>>: " + l);
}
@RolesAllowed("user")
public void works(long l) {
System.out.println(">>>>>: " + l);
}
}
> Authentication bug on one-way JAX-WS methods
> --------------------------------------------
>
> Key: WFLY-4289
> URL: https://issues.jboss.org/browse/WFLY-4289
> Project: WildFly
> Issue Type: Bug
> Components: Security, Web Services
> Affects Versions: 8.2.0.Final
> Reporter: Jakub Grabowski
> Assignee: Darran Lofthouse
>
> 1. For two-way methods basic authentication and autorization works fine. User is authenticated with LDAP module and gets proper role that autorizes invocation. It works just fine. By two-way method I mean method with input and output message defined in WSDL.
> 2. For one-way methods (return type void) user is not authenticated properly. It results in denial of method invocation.
> 3. When I remove @RolesAllowed declaration I can see that for two-way methods authentication is correct (pricipal is set to logged user), but for one-way it's not - I get "anonymous" as principal.
> 4. When I change one-way method to have input and output messages defined in WSDL and update implementation accordingly it suprisingly starts to work as expected.
> It's quite serious issue, because currently there's no way to have authorized access to oneway webservice methods.
--
This message was sent by Atlassian JIRA
(v6.3.11#6341)
9 years, 3 months
[JBoss JIRA] (WFLY-4289) Authentication bug on one-way JAX-WS methods
by Jakub Grabowski (JIRA)
[ https://issues.jboss.org/browse/WFLY-4289?page=com.atlassian.jira.plugin.... ]
Jakub Grabowski commented on WFLY-4289:
---------------------------------------
And the code that demonstrates issue:
@Stateless
@WebService
@DeclareRoles("user")
@Local(IMessageSender.class)
@WebContext(authMethod = "BASIC")
public class MessageSender implements IMessageSender {
@RolesAllowed("user")
@Oneway
public void fails(long l) {
System.out.println(">>>>>: " + l);
}
@RolesAllowed("user")
public void works(long l) {
System.out.println(">>>>>: " + l);
}
}
> Authentication bug on one-way JAX-WS methods
> --------------------------------------------
>
> Key: WFLY-4289
> URL: https://issues.jboss.org/browse/WFLY-4289
> Project: WildFly
> Issue Type: Bug
> Components: Security, Web Services
> Affects Versions: 8.2.0.Final
> Reporter: Jakub Grabowski
> Assignee: Darran Lofthouse
>
> 1. For two-way methods basic authentication and autorization works fine. User is authenticated with LDAP module and gets proper role that autorizes invocation. It works just fine. By two-way method I mean method with input and output message defined in WSDL.
> 2. For one-way methods (return type void) user is not authenticated properly. It results in denial of method invocation.
> 3. When I remove @RolesAllowed declaration I can see that for two-way methods authentication is correct (pricipal is set to logged user), but for one-way it's not - I get "anonymous" as principal.
> 4. When I change one-way method to have input and output messages defined in WSDL and update implementation accordingly it suprisingly starts to work as expected.
> It's quite serious issue, because currently there's no way to have authorized access to oneway webservice methods.
--
This message was sent by Atlassian JIRA
(v6.3.11#6341)
9 years, 3 months
[JBoss JIRA] (WFLY-4289) Authentication bug on one-way JAX-WS methods
by Jakub Grabowski (JIRA)
Jakub Grabowski created WFLY-4289:
-------------------------------------
Summary: Authentication bug on one-way JAX-WS methods
Key: WFLY-4289
URL: https://issues.jboss.org/browse/WFLY-4289
Project: WildFly
Issue Type: Bug
Components: Security, Web Services
Affects Versions: 8.2.0.Final
Reporter: Jakub Grabowski
Assignee: Darran Lofthouse
1. For two-way methods basic authentication and autorization works fine. User is authenticated with LDAP module and gets proper role that autorizes invocation. It works just fine. By two-way method I mean method with input and output message defined in WSDL.
2. For one-way methods (return type void) user is not authenticated properly. It results in denial of method invocation.
3. When I remove @RolesAllowed declaration I can see that for two-way methods authentication is correct (pricipal is set to logged user), but for one-way it's not - I get "anonymous" as principal.
4. When I change one-way method to have input and output messages defined in WSDL and update implementation accordingly it suprisingly starts to work as expected.
It's quite serious issue, because currently there's no way to have authorized access to oneway webservice methods.
--
This message was sent by Atlassian JIRA
(v6.3.11#6341)
9 years, 3 months
[JBoss JIRA] (SECURITY-868) Multithread issue when validate with cached hased password + nonce credential info from JBossCachedAuthenticationManager
by RH Bugzilla Integration (JIRA)
[ https://issues.jboss.org/browse/SECURITY-868?page=com.atlassian.jira.plug... ]
RH Bugzilla Integration commented on SECURITY-868:
--------------------------------------------------
Kabir Khan <kkhan(a)redhat.com> changed the Status of [bug 1181084|https://bugzilla.redhat.com/show_bug.cgi?id=1181084] from NEW to ON_QA
> Multithread issue when validate with cached hased password + nonce credential info from JBossCachedAuthenticationManager
> --------------------------------------------------------------------------------------------------------------------------
>
> Key: SECURITY-868
> URL: https://issues.jboss.org/browse/SECURITY-868
> Project: PicketBox
> Issue Type: Task
> Components: PicketBox
> Reporter: Jim Ma
> Assignee: Stefan Guilhen
> Fix For: PicketBox_4_9_0.Beta3
>
>
> When the new security domain is configured with catch-type=default in standalone.xml, the validated credential will be put in the JBossCachedAuthenticationManager with principal and domaininfo value pair. In multithread environment, a new validated credential can overwrite the previous thread cached domain info. This will cause even in the same thread , the cached authentication info could not work. For example if one user login with username , password and nonce in two threads : thread A and thread B ;thread A caches the validated credential(hased password +nonce) in JBossCachedAuthenticationMessager, thread B does the authentication, then caches the validated credential (hashed password + nonce) , even it's the same user and passoword, the credential is different because the nonce is diffrent. So the new credential created in thread B will overwrite the previous value created by thread A . So in thread A, the cached validation info won't work and following validation with cached credential will all fail.
--
This message was sent by Atlassian JIRA
(v6.3.11#6341)
9 years, 3 months