[JBoss JIRA] (ELY-698) Rework the constructor exclusion logic for authentication rules and configurations
by David Lloyd (JIRA)
David Lloyd created ELY-698:
-------------------------------
Summary: Rework the constructor exclusion logic for authentication rules and configurations
Key: ELY-698
URL: https://issues.jboss.org/browse/ELY-698
Project: WildFly Elytron
Issue Type: Task
Components: Authentication Client
Reporter: David Lloyd
Priority: Minor
The current authentication rule and configuration classes are designed to ensure that mutually incompatible rules and configurations cannot coexist. However the implementation is applied a bit erratically. There may be problems with commutatively applying checks. Some checks may be missing or extraneous.
We need a new approach where the mutual exclusion set is somehow enforced centrally. One option is to have literal sets, and each class that is a member of one or more sets must remove all other handlers that are also within the set(s). A predicate could be used to make this efficient by only sweeping the list one time, in contrast to the current mechanism which sweeps the list once per exclusive type.
Another option is to have a marker interface for each capability, and to remove all peers with the same capability. A predicate can also be used in this case.
--
This message was sent by Atlassian JIRA
(v7.2.2#72004)
9 years, 6 months
[JBoss JIRA] (ELY-369) SecurityIdentity-based self-service
by David Lloyd (JIRA)
[ https://issues.jboss.org/browse/ELY-369?page=com.atlassian.jira.plugin.sy... ]
David Lloyd commented on ELY-369:
---------------------------------
For this to work, realms (modifiable or non-modifiable) need to return a modifiable authorization identity which includes credential update methods - _or_ alternatively a modifiable realm needs to return an authorization identity which knows how to re-create the (necessarily modifiable) realm identity to perform the credential update.
The latter option is probably better because an AuthorizationIdentity deliberately releases all possible resources; there's no dispose() to call after the change is complete. Therefore if the AuthorizationIdentity gets back the ModifiableRealmIdentity, that realm identity can be used to perform the update and then be disposed (to release the database or LDAP connection for example).
Re-finding the RealmIdentity is a non-starter because only the realm can make the guarantee that you are either finding the original identity or that you cannot perform the update. If this guarantee isn't made, there is a risk of updating credentials that the caller does not actually own, which at worst could cause an access breach.
> SecurityIdentity-based self-service
> -----------------------------------
>
> Key: ELY-369
> URL: https://issues.jboss.org/browse/ELY-369
> Project: WildFly Elytron
> Issue Type: Feature Request
> Components: API / SPI
> Reporter: David Lloyd
>
> We may need to provide the ability to allow users to manage their accounts in various ways.
> * Password reset
--
This message was sent by Atlassian JIRA
(v7.2.2#72004)
9 years, 6 months
[JBoss JIRA] (WFLY-7409) BanTransitiveDependencies for Full Feature Pack module on IBM jdk
by Tomaz Cerar (JIRA)
[ https://issues.jboss.org/browse/WFLY-7409?page=com.atlassian.jira.plugin.... ]
Tomaz Cerar moved JBEAP-6706 to WFLY-7409:
------------------------------------------
Project: WildFly (was: JBoss Enterprise Application Platform)
Key: WFLY-7409 (was: JBEAP-6706)
Workflow: GIT Pull Request workflow (was: CDW with loose statuses v1)
Component/s: Build System
(was: Build System)
Fix Build: (was: DR7)
Affects Version/s: (was: 7.1.0.DR6)
> BanTransitiveDependencies for Full Feature Pack module on IBM jdk
> -----------------------------------------------------------------
>
> Key: WFLY-7409
> URL: https://issues.jboss.org/browse/WFLY-7409
> Project: WildFly
> Issue Type: Bug
> Components: Build System
> Environment: java version "1.8.0"
> Java(TM) SE Runtime Environment (build pxa6480sr3fp10-20160720_02(SR3fp10))
> IBM J9 VM (build 2.8, JRE 1.8.0 Linux amd64-64 Compressed References 20160719_312156 (JIT enabled, AOT enabled)
> J9VM - R28_Java8_SR3_20160719_1144_B312156
> JIT - tr.r14.java_20160629_120284.01
> GC - R28_Java8_SR3_20160719_1144_B312156_CMPRSS
> J9CL - 20160719_312156)
> JCL - 20160719_01 based on Oracle jdk8u101-b13
> Reporter: Tomaz Cerar
> Assignee: Tomaz Cerar
>
> Building wildfly-feature-pack:7.1.0.Alpha1-redhat-4 fails on IBM jdk.
> {noformat}
> [INFO] --- maven-enforcer-plugin:1.4:enforce (ban-transitive-deps) @ wildfly-feature-pack ---
> [WARNING] Rule 0: org.apache.maven.plugins.enforcer.BanTransitiveDependencies failed with message:
> org.jboss.eap:wildfly-feature-pack:pom:7.1.0.Alpha1-redhat-4
> org.apache.cxf:cxf-rt-features-clustering:jar:3.1.6.redhat-1:compile has transitive dependencies:
> xalan:xalan:jar:2.7.1.redhat-11:compile
> xalan:serializer:jar:2.7.1.redhat-11:compile
> {noformat}
> full log http://pastebin.test.redhat.com/406421
> Same worked with 7.1.0.DR2 bits (7.1.0.Alpha1-redhat-2). The issue is preventing us from running the EAP unit tests on IBM jdk - see https://jenkins.mw.lab.eng.bos.redhat.com/hudson/job/eap-7x-as-testsuite-....
--
This message was sent by Atlassian JIRA
(v7.2.2#72004)
9 years, 6 months
[JBoss JIRA] (WFLY-6966) FatalError on Transaction Expired Entry Monitor during server shutdown
by Tom Jenkinson (JIRA)
[ https://issues.jboss.org/browse/WFLY-6966?page=com.atlassian.jira.plugin.... ]
Tom Jenkinson commented on WFLY-6966:
-------------------------------------
I have a fixed merged upstream in Narayana now - will be available with the next release.
> FatalError on Transaction Expired Entry Monitor during server shutdown
> ----------------------------------------------------------------------
>
> Key: WFLY-6966
> URL: https://issues.jboss.org/browse/WFLY-6966
> Project: WildFly
> Issue Type: Enhancement
> Components: Transactions
> Affects Versions: 10.1.0.CR1
> Reporter: Ondra Chaloupka
> Assignee: Tom Jenkinson
> Priority: Minor
>
> I do experience intermittent errors being shown in server log during server shutdown. It happens time to time for server configured to use {{JTS}} transaction that {{Transaction Expired Entry Monitor}} shows {{FatalError}} during container shutdown.
> I do experience this failure when jdbc object store is used.
> The shutdown log looks
> {code}
> 2016-08-16 07:07:46,900 INFO [org.jboss.as.server.deployment] (MSC service thread 1-1) WFLYSRV0028: Stopped deployment wmq.jmsra.rar (runtime-name: wmq.jmsra.rar) in 132ms
> 2016-08-16 07:07:46,914 INFO [org.wildfly.extension.messaging-activemq] (MSC service thread 1-2) WFLYMSGAMQ0006: Unbound messaging object to jndi name java:jboss/DefaultJMSConnectionFactory
> 2016-08-16 07:07:46,914 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-2) WFLYJCA0010: Unbound data source [java:jboss/datasources/ExampleDS]
> 2016-08-16 07:07:46,915 INFO [org.jboss.as.connector.deployment] (MSC service thread 1-4) WFLYJCA0011: Unbound JCA ConnectionFactory [java:/JmsXA]
> 2016-08-16 07:07:46,921 INFO [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-2) WFLYJCA0019: Stopped Driver service with driver-name = h2
> 2016-08-16 07:07:46,924 INFO [org.jboss.as.server.deployment] (MSC service thread 1-4) WFLYSRV0028: Stopped deployment crashrecovery-jms-stateless-cmt.jar (runtime-name: crashrecovery-jms-stateless-cmt.jar) in 156ms
> 2016-08-16 07:07:46,947 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 16) WFLYCLINF0003: Stopped client-mappings cache from ejb container
> 2016-08-16 07:07:46,952 TRACE [com.arjuna.ats.arjuna] (Transaction Expired Entry Monitor) InputObjectState::InputObjectState(0:ffff7f000001:55f44a88:57b2ec0b:8, Recovery/FactoryContact)
> 2016-08-16 07:07:46,959 INFO [org.apache.activemq.artemis.ra] (ServerService Thread Pool -- 32) AMQ151003: resource adaptor stopped
> 2016-08-16 07:07:46,962 TRACE [com.arjuna.orbportability] (MSC service thread 1-4) ORB::shutdown ()
> 2016-08-16 07:07:46,962 TRACE [com.arjuna.orbportability] (MSC service thread 1-4) OA::destroyRootPOA ()
> 2016-08-16 07:07:46,962 TRACE [com.arjuna.orbportability] (MSC service thread 1-4) RootOA::shutdownObject (Servant)
> 2016-08-16 07:07:46,962 INFO [com.arjuna.ats.jbossatx] (MSC service thread 1-4) ARJUNA032018: Destroying TransactionManagerService
> 2016-08-16 07:07:46,963 INFO [com.arjuna.ats.jbossatx] (MSC service thread 1-4) ARJUNA032014: Stopping transaction recovery manager
> 2016-08-16 07:07:47,000 FATAL [com.arjuna.ats.jts] (Transaction Expired Entry Monitor) ARJUNA022006: The ORB has not been initialized yet
> 2016-08-16 07:07:47,001 ERROR [stderr] (Transaction Expired Entry Monitor) Exception in thread "Transaction Expired Entry Monitor" com.arjuna.ats.arjuna.exceptions.FatalError
> 2016-08-16 07:07:47,001 ERROR [stderr] (Transaction Expired Entry Monitor) at com.arjuna.ats.internal.jts.ORBManager.getORB(ORBManager.java:56)
> 2016-08-16 07:07:47,001 ERROR [stderr] (Transaction Expired Entry Monitor) at com.arjuna.ats.internal.jts.recovery.contact.FactoryContactItem.restore_state(FactoryContactItem.java:264)
> 2016-08-16 07:07:47,001 ERROR [stderr] (Transaction Expired Entry Monitor) at com.arjuna.ats.internal.jts.recovery.contact.FactoryContactItem.restoreMe(FactoryContactItem.java:320)
> 2016-08-16 07:07:47,001 ERROR [stderr] (Transaction Expired Entry Monitor) at com.arjuna.ats.internal.jts.recovery.contact.FactoryContactItem.recreate(FactoryContactItem.java:100)
> 2016-08-16 07:07:47,001 ERROR [stderr] (Transaction Expired Entry Monitor) at com.arjuna.ats.internal.jts.recovery.contact.ExpiredContactScanner.scan(ExpiredContactScanner.java:99)
> 2016-08-16 07:07:47,001 ERROR [stderr] (Transaction Expired Entry Monitor) at com.arjuna.ats.internal.arjuna.recovery.ExpiredEntryMonitor.run(ExpiredEntryMonitor.java:171)
> 2016-08-16 07:07:47,001 DEBUG [com.arjuna.ats.arjuna] (Listener:4712) Recovery listener existing com.arjuna.ats.internal.arjuna.recovery.WorkerService
> 2016-08-16 07:07:47,002 DEBUG [com.arjuna.ats.arjuna] (MSC service thread 1-4) PeriodicRecovery: Mode <== TERMINATED
> 2016-08-16 07:07:47,002 DEBUG [com.arjuna.ats.arjuna] (MSC service thread 1-4) PeriodicRecovery: shutdown waiting for scan to end
> 2016-08-16 07:07:47,002 DEBUG [com.arjuna.ats.arjuna] (Periodic Recovery) PeriodicRecovery: scan TERMINATED at phase 1
> 2016-08-16 07:07:47,002 DEBUG [com.arjuna.ats.arjuna] (Periodic Recovery) PeriodicRecovery: background thread Status <== INACTIVE
> 2016-08-16 07:07:47,002 DEBUG [com.arjuna.ats.arjuna] (Periodic Recovery) PeriodicRecovery: background thread exiting
> 2016-08-16 07:07:47,002 DEBUG [com.arjuna.ats.arjuna] (MSC service thread 1-4) PeriodicRecovery: shutdown scan wait complete
> 2016-08-16 07:07:47,003 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-4) WFLYJCA0010: Unbound data source [java:jboss/datasources/jdbc-store]
> 2016-08-16 07:07:47,006 INFO [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-4) WFLYJCA0019: Stopped Driver service with driver-name = module_postgresql-9.4.1207.jar
> 2016-08-16 07:07:47,012 INFO [org.apache.activemq.artemis.core.server] (ServerService Thread Pool -- 32) AMQ221002: Apache ActiveMQ Artemis Message Broker version 1.1.0.SP16-redhat-1 [023d1e88-638c-11e6-927a-a180c25082cf] stopped
> 2016-08-16 07:07:47,012 INFO [org.wildfly.extension.undertow] (MSC service thread 1-4) WFLYUT0008: Undertow HTTP listener default suspending
> 2016-08-16 07:07:47,013 INFO [org.wildfly.extension.undertow] (MSC service thread 1-4) WFLYUT0007: Undertow HTTP listener default stopped, was bound to 127.0.0.1:8080
> 2016-08-16 07:07:47,013 INFO [org.wildfly.extension.undertow] (MSC service thread 1-4) WFLYUT0004: Undertow 1.3.21.Final-redhat-1 stopping
> 2016-08-16 07:07:47,018 INFO [org.jboss.as] (MSC service thread 1-1) WFLYSRV0050: JBoss EAP 7.0.0.GA (WildFly Core 2.1.2.Final-redhat-1) stopped in 250ms
> {code}
--
This message was sent by Atlassian JIRA
(v7.2.2#72004)
9 years, 6 months
[JBoss JIRA] (DROOLS-1347) Explicit expiration of event not effective - regression from 6.4 to 6.5
by Matteo Mortari (JIRA)
[ https://issues.jboss.org/browse/DROOLS-1347?page=com.atlassian.jira.plugi... ]
Matteo Mortari edited comment on DROOLS-1347 at 10/28/16 11:19 AM:
-------------------------------------------------------------------
Rule definition advice.
In this case, the problem is the rule "Rexpected" is assuming the previous behavior of expiration (as behaving before 6.5.0.Final). In this case, the rule can be defined more correclty and aligned with the current behavior (from 6.5.0.Final) by rewriting it as:
{code:java}
rule "Rexpected"
when
$t : Character() over window:length(1)
not String(this coincides $t)
then
insert("good");
list.add("Rexpected");
end
{code}
with output:
{code}
2016-10-28 17:06:21,275 INFO [org.drools.compiler.kie.builder.impl.ClasspathKieProject] (main) Found kmodule: file:/home/mmortari/git/DROOLS-1347/target/classes/META-INF/kmodule.xml
2016-10-28 17:06:21,462 WARN [org.drools.compiler.kie.builder.impl.ClasspathKieProject] (main) Unable to find pom.properties in /home/mmortari/git/DROOLS-1347/target/classes
2016-10-28 17:06:21,472 INFO [org.drools.compiler.kie.builder.impl.ClasspathKieProject] (main) Recursed up folders, found and used pom.xml /home/mmortari/git/DROOLS-1347/pom.xml
2016-10-28 17:06:21,478 INFO [org.drools.compiler.kie.builder.impl.KieRepositoryImpl] (main) KieModule was added: FileKieModule[releaseId=org.drools:DROOLS-1347:0.0.1-SNAPSHOT,file=/home/mmortari/git/DROOLS-1347/target/classes]
2016-10-28 17:06:22,314 INFO [org.drools.DROOLS_1347.RuleTest] (main) Creating kieBase with STREAM option
2016-10-28 17:06:22,380 INFO [org.drools.DROOLS_1347.RuleTest] (main) There should be rules:
2016-10-28 17:06:22,381 INFO [org.drools.DROOLS_1347.RuleTest] (main) kp [Package name=org.drools.DROOLS_1347] rule Rexpected
2016-10-28 17:06:22,381 INFO [org.drools.DROOLS_1347.RuleTest] (main) kp [Package name=org.drools.DROOLS_1347] rule Ravoid
2016-10-28 17:06:22,381 INFO [org.drools.DROOLS_1347.RuleTest] (main) Creating kieSession
2016-10-28 17:06:22,427 INFO [org.drools.DROOLS_1347.RuleTest] (main) Populating globals
2016-10-28 17:06:22,427 INFO [org.drools.DROOLS_1347.RuleTest] (main) Now running data
---a---
x a
x good
fired: [Rule name=Rexpected, agendaGroup=MAIN, salience=0, no-loop=false]
Session facts:
> a [java.lang.Character] FH: 5:1:649329985:97:1:DEFAULT:NON_TRAIT:java.lang.Character
> good [java.lang.String] FH: 5:2:1146825051:3178685:2:DEFAULT:NON_TRAIT:java.lang.String
---b---
x b
x good
fired: [Rule name=Rexpected, agendaGroup=MAIN, salience=0, no-loop=false]
Session facts:
> b [java.lang.Character] FH: 5:3:1239807799:98:3:DEFAULT:NON_TRAIT:java.lang.Character
> good [java.lang.String] FH: 5:4:1146825051:3178685:4:DEFAULT:NON_TRAIT:java.lang.String
{code}
and all assertions passes (/)
was (Author: tari_manga):
Rule definition advice.
In this case, the problem is the rule "Rexpected" is assuming the previous behavior of expiration (as behaving before 6.5.0.Final). In this case, the rule can be defined more correclty and aligned with the current behavior (from 6.5.0.Final) by rewriting it as:
{code:java}
rule "Rexpected"
when
$t : Character() over window:length(1)
not String(this coincides $t)
then
insert("good");
list.add("Rexpected");
end
{code}
with output:
{code}
2016-10-28 17:06:21,275 INFO [org.drools.compiler.kie.builder.impl.ClasspathKieProject] (main) Found kmodule: file:/home/mmortari/git/DROOLS-1347/target/classes/META-INF/kmodule.xml
2016-10-28 17:06:21,462 WARN [org.drools.compiler.kie.builder.impl.ClasspathKieProject] (main) Unable to find pom.properties in /home/mmortari/git/DROOLS-1347/target/classes
2016-10-28 17:06:21,472 INFO [org.drools.compiler.kie.builder.impl.ClasspathKieProject] (main) Recursed up folders, found and used pom.xml /home/mmortari/git/DROOLS-1347/pom.xml
2016-10-28 17:06:21,478 INFO [org.drools.compiler.kie.builder.impl.KieRepositoryImpl] (main) KieModule was added: FileKieModule[releaseId=org.drools:DROOLS-1347:0.0.1-SNAPSHOT,file=/home/mmortari/git/DROOLS-1347/target/classes]
2016-10-28 17:06:22,314 INFO [org.drools.DROOLS_1347.RuleTest] (main) Creating kieBase with STREAM option
2016-10-28 17:06:22,380 INFO [org.drools.DROOLS_1347.RuleTest] (main) There should be rules:
2016-10-28 17:06:22,381 INFO [org.drools.DROOLS_1347.RuleTest] (main) kp [Package name=org.drools.DROOLS_1347] rule Rexpected
2016-10-28 17:06:22,381 INFO [org.drools.DROOLS_1347.RuleTest] (main) kp [Package name=org.drools.DROOLS_1347] rule Ravoid
2016-10-28 17:06:22,381 INFO [org.drools.DROOLS_1347.RuleTest] (main) Creating kieSession
2016-10-28 17:06:22,427 INFO [org.drools.DROOLS_1347.RuleTest] (main) Populating globals
2016-10-28 17:06:22,427 INFO [org.drools.DROOLS_1347.RuleTest] (main) Now running data
---a---
x a
x good
fired: [Rule name=Rexpected, agendaGroup=MAIN, salience=0, no-loop=false]
Session facts:
> a [java.lang.Character] FH: 5:1:649329985:97:1:DEFAULT:NON_TRAIT:java.lang.Character
> good [java.lang.String] FH: 5:2:1146825051:3178685:2:DEFAULT:NON_TRAIT:java.lang.String
---b---
x b
x good
fired: [Rule name=Rexpected, agendaGroup=MAIN, salience=0, no-loop=false]
Session facts:
> b [java.lang.Character] FH: 5:3:1239807799:98:3:DEFAULT:NON_TRAIT:java.lang.Character
> good [java.lang.String] FH: 5:4:1146825051:3178685:4:DEFAULT:NON_TRAIT:java.lang.String
{code}
and all assertions passes (/) (y)
> Explicit expiration of event not effective - regression from 6.4 to 6.5
> -----------------------------------------------------------------------
>
> Key: DROOLS-1347
> URL: https://issues.jboss.org/browse/DROOLS-1347
> Project: Drools
> Issue Type: Bug
> Components: core engine
> Affects Versions: 6.5.0.Final
> Reporter: Thibault Daoulas
> Assignee: Matteo Mortari
>
> I just ugraded my project from Drools 6.4.0.Final to 6.5.0.Final and have now quite a few tests on rules that fail, all have in common that they test the expiration of events, where an event that should have been removed from the working memory is still present.
--
This message was sent by Atlassian JIRA
(v7.2.2#72004)
9 years, 6 months
[JBoss JIRA] (DROOLS-1347) Explicit expiration of event not effective - regression from 6.4 to 6.5
by Matteo Mortari (JIRA)
[ https://issues.jboss.org/browse/DROOLS-1347?page=com.atlassian.jira.plugi... ]
Matteo Mortari resolved DROOLS-1347.
------------------------------------
Resolution: Rejected
I'm resolving this ticket as this is not a bug, and this is not a regression.
The system is behaving as expected, especially to what concerning the *expiration* behavior.
I have added some comments for further details in the ticket log.
Specifically to the rule base originally reported, in my perspective the culprit is the rule "Expiring event init". To have it aligned with the expected expiration behavior, I believe it should be rewritten as:
{code:java}
rule "Expiring event init"
when
$t : time_Var($now : Value != null) over window:length(1) from entry-point "time_Ep"
not ExpiringEvent_Var(this coincides $t) from entry-point "ExpiringEvent_Ep"
then
...
{code}
This is however a limited view on the complete rule base, so further alignments may be necessary.
P.s.: I also seize the chance to highlight having to manually manage a Pojo/wrapper for the value of the session's pseudo-clock is not a best practice and should be avoided where possible..
> Explicit expiration of event not effective - regression from 6.4 to 6.5
> -----------------------------------------------------------------------
>
> Key: DROOLS-1347
> URL: https://issues.jboss.org/browse/DROOLS-1347
> Project: Drools
> Issue Type: Bug
> Components: core engine
> Affects Versions: 6.5.0.Final
> Reporter: Thibault Daoulas
> Assignee: Matteo Mortari
>
> I just ugraded my project from Drools 6.4.0.Final to 6.5.0.Final and have now quite a few tests on rules that fail, all have in common that they test the expiration of events, where an event that should have been removed from the working memory is still present.
--
This message was sent by Atlassian JIRA
(v7.2.2#72004)
9 years, 6 months