November 2016 - jboss-jira - Jboss List Archives

[JBoss JIRA] (WFCORE-1964) Internal ModelControllerClient should bypass access control by default

by Brian Stansberry (JIRA)

[ https://issues.jboss.org/browse/WFCORE-1964?page=com.atlassian.jira.plugi... ] Brian Stansberry commented on WFCORE-1964: ------------------------------------------ The client is obtained via service injection of a ModelController and then invoking its ModelControllerClient createClient(Executor executor) method. The ModelController interface is only implemented by us so we are via to add other methods to it, e.g. a createClient variant that somehow specifies that some sort of inflow should happen when that client is used. The default behavior should be as it was in WF 10 or earlier; calls end up with SUPERUSER-like powers. Just an FYI: I may want to refactor the ModelController interface a bit, to separate the createClient API from the "execute" API. There are two different kinds of users for those methods and it would be better if the createClient callers didn't see the "execute" methods. The createClient stuff would then be available via a capability. The "execute" stuff is purely internal to the kernel, so no capability-based access. > Internal ModelControllerClient should bypass access control by default > ---------------------------------------------------------------------- > > Key: WFCORE-1964 > URL: https://issues.jboss.org/browse/WFCORE-1964 > Project: WildFly Core > Issue Type: Task > Components: Domain Management, Security > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > Priority: Blocker > Fix For: 3.0.0.Alpha12 > > > This is continuing compatibility where in-vm clients can perform actions without triggering management access control. > It would be nice also if we could find a way to make it possible to selectively disable this for cases where we want identity propagation between applications and the management tier. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-1963) Clean up the 'TODO Elytron' issues.

by Brian Stansberry (JIRA)

[ https://issues.jboss.org/browse/WFCORE-1963?page=com.atlassian.jira.plugi... ] Brian Stansberry commented on WFCORE-1963: ------------------------------------------ I noticed that https://github.com/wildfly/wildfly-core/pull/1921 has quite a few "TODO" comments that weren't in the "TODO Elytron" form. IIRC more toward the bottom of the diff. I'd have suggested correcting that to make future searching easier, but we're kind of in a rush right now. ;) But those should be considered as well. > Clean up the 'TODO Elytron' issues. > ----------------------------------- > > Key: WFCORE-1963 > URL: https://issues.jboss.org/browse/WFCORE-1963 > Project: WildFly Core > Issue Type: Task > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > Priority: Blocker > Fix For: 3.0.0.Alpha12 > > > A few classes have 'TODO Elytron' comments that need addressing. > Current List: - > {noformat} > ./core-model-test/tests/src/test/java/org/jboss/as/core/model/test/access/RoleMappingTestCase.java > ./jmx/src/test/java/org/jboss/as/jmx/rbac/JmxRbacTestCase.java > ./remoting/subsystem/src/main/java/org/jboss/as/remoting/RemotingHttpUpgradeService.java > ./remoting/subsystem/src/main/java/org/jboss/as/remoting/AbstractStreamServerService.java > ./testsuite/standalone/src/test/java/org/wildfly/core/test/standalone/mgmt/api/core/ConfigurationChangesHistoryTestCase.java > ./host-controller/src/main/java/org/jboss/as/domain/controller/plan/AbstractServerGroupRolloutTask.java > ./controller/src/main/java/org/jboss/as/controller/remote/TransactionalProtocolOperationHandler.java > ./controller/src/main/java/org/jboss/as/controller/ParallelBootOperationStepHandler.java > ./controller/src/main/java/org/jboss/as/controller/access/management/ManagementSecurityIdentitySupplier.java > ./server/src/main/java/org/jboss/as/server/mgmt/domain/HostControllerConnectionService.java > ./domain-management/src/main/java/org/jboss/as/domain/management/security/UserDomainCallbackHandler.java > ./domain-management/src/main/java/org/jboss/as/domain/management/security/WhoAmIOperation.java > ./domain-management/src/main/java/org/jboss/as/domain/management/security/PlugInAuthenticationCallbackHandler.java > ./domain-management/src/main/java/org/jboss/as/domain/management/security/JaasCallbackHandler.java > ./domain-management/src/main/java/org/jboss/as/domain/management/security/KerberosCallbackHandler.java > ./domain-management/src/main/java/org/jboss/as/domain/management/security/ClientCertCallbackHandler.java > {noformat} -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-1965) Remove the jboss-logging-annotations dependency from the core feature pack.

by Darran Lofthouse (JIRA)

Darran Lofthouse created WFCORE-1965: ---------------------------------------- Summary: Remove the jboss-logging-annotations dependency from the core feature pack. Key: WFCORE-1965 URL: https://issues.jboss.org/browse/WFCORE-1965 Project: WildFly Core Issue Type: Task Reporter: Darran Lofthouse Assignee: Darran Lofthouse Priority: Critical Fix For: 3.0.0.Alpha12 This was added inadvertently with some other changes: - {noformat} <dependency> <groupId>org.jboss.logging</groupId> <artifactId>jboss-logging-annotations</artifactId> </dependency> {noformat} -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-1964) Internal ModelControllerClient should bypass access control by default

by Darran Lofthouse (JIRA)

Darran Lofthouse created WFCORE-1964: ---------------------------------------- Summary: Internal ModelControllerClient should bypass access control by default Key: WFCORE-1964 URL: https://issues.jboss.org/browse/WFCORE-1964 Project: WildFly Core Issue Type: Task Components: Domain Management, Security Reporter: Darran Lofthouse Assignee: Darran Lofthouse Priority: Blocker Fix For: 3.0.0.Alpha12 This is continuing compatibility where in-vm clients can perform actions without triggering management access control. It would be nice also if we could find a way to make it possible to selectively disable this for cases where we want identity propagation between applications and the management tier. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (ELY-368) Add optional Supplier<Provider[]> to realm implementations

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/ELY-368?page=com.atlassian.jira.plugin.sy... ] Darran Lofthouse updated ELY-368: --------------------------------- Fix Version/s: 1.1.0.Beta14 (was: 1.1.0.Beta15) > Add optional Supplier<Provider[]> to realm implementations > ---------------------------------------------------------- > > Key: ELY-368 > URL: https://issues.jboss.org/browse/ELY-368 > Project: WildFly Elytron > Issue Type: Enhancement > Reporter: David Lloyd > Priority: Critical > Fix For: 1.1.0.Beta14 > > > Realms use key factories, certificate factories, password factories, etc. Most of the time they just use the default installed providers. Enhance the realms to accept an optional {{Supplier<Provider[]>}} which will be used to load these kinds of things. The default supplier should be {{Security::getProviders()}}. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (ELY-368) Add optional Supplier<Provider[]> to realm implementations and authentication mechanisms.

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/ELY-368?page=com.atlassian.jira.plugin.sy... ] Darran Lofthouse updated ELY-368: --------------------------------- Summary: Add optional Supplier<Provider[]> to realm implementations and authentication mechanisms. (was: Add optional Supplier<Provider[]> to realm implementations) > Add optional Supplier<Provider[]> to realm implementations and authentication mechanisms. > ----------------------------------------------------------------------------------------- > > Key: ELY-368 > URL: https://issues.jboss.org/browse/ELY-368 > Project: WildFly Elytron > Issue Type: Enhancement > Reporter: David Lloyd > Priority: Critical > Fix For: 1.1.0.Beta14 > > > Realms use key factories, certificate factories, password factories, etc. Most of the time they just use the default installed providers. Enhance the realms to accept an optional {{Supplier<Provider[]>}} which will be used to load these kinds of things. The default supplier should be {{Security::getProviders()}}. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (ELY-368) Add optional Supplier<Provider[]> to realm implementations

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/ELY-368?page=com.atlassian.jira.plugin.sy... ] Darran Lofthouse updated ELY-368: --------------------------------- Priority: Critical (was: Major) > Add optional Supplier<Provider[]> to realm implementations > ---------------------------------------------------------- > > Key: ELY-368 > URL: https://issues.jboss.org/browse/ELY-368 > Project: WildFly Elytron > Issue Type: Enhancement > Reporter: David Lloyd > Priority: Critical > Fix For: 1.1.0.Beta15 > > > Realms use key factories, certificate factories, password factories, etc. Most of the time they just use the default installed providers. Enhance the realms to accept an optional {{Supplier<Provider[]>}} which will be used to load these kinds of things. The default supplier should be {{Security::getProviders()}}. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-1963) Clean up the 'TODO Elytron' issues.

by Darran Lofthouse (JIRA)

Darran Lofthouse created WFCORE-1963: ---------------------------------------- Summary: Clean up the 'TODO Elytron' issues. Key: WFCORE-1963 URL: https://issues.jboss.org/browse/WFCORE-1963 Project: WildFly Core Issue Type: Task Reporter: Darran Lofthouse Assignee: Darran Lofthouse Priority: Blocker Fix For: 3.0.0.Alpha12 A few classes have 'TODO Elytron' comments that need addressing. Current List: - {noformat} ./core-model-test/tests/src/test/java/org/jboss/as/core/model/test/access/RoleMappingTestCase.java ./jmx/src/test/java/org/jboss/as/jmx/rbac/JmxRbacTestCase.java ./remoting/subsystem/src/main/java/org/jboss/as/remoting/RemotingHttpUpgradeService.java ./remoting/subsystem/src/main/java/org/jboss/as/remoting/AbstractStreamServerService.java ./testsuite/standalone/src/test/java/org/wildfly/core/test/standalone/mgmt/api/core/ConfigurationChangesHistoryTestCase.java ./host-controller/src/main/java/org/jboss/as/domain/controller/plan/AbstractServerGroupRolloutTask.java ./controller/src/main/java/org/jboss/as/controller/remote/TransactionalProtocolOperationHandler.java ./controller/src/main/java/org/jboss/as/controller/ParallelBootOperationStepHandler.java ./controller/src/main/java/org/jboss/as/controller/access/management/ManagementSecurityIdentitySupplier.java ./server/src/main/java/org/jboss/as/server/mgmt/domain/HostControllerConnectionService.java ./domain-management/src/main/java/org/jboss/as/domain/management/security/UserDomainCallbackHandler.java ./domain-management/src/main/java/org/jboss/as/domain/management/security/WhoAmIOperation.java ./domain-management/src/main/java/org/jboss/as/domain/management/security/PlugInAuthenticationCallbackHandler.java ./domain-management/src/main/java/org/jboss/as/domain/management/security/JaasCallbackHandler.java ./domain-management/src/main/java/org/jboss/as/domain/management/security/KerberosCallbackHandler.java ./domain-management/src/main/java/org/jboss/as/domain/management/security/ClientCertCallbackHandler.java {noformat} -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (JBEE-170) Replace jboss jboss-jstl-api_1.2_spec with apache taglibs-standard-spec

by Tomaz Cerar (JIRA)

[ https://issues.jboss.org/browse/JBEE-170?page=com.atlassian.jira.plugin.s... ] Tomaz Cerar updated JBEE-170: ----------------------------- Component/s: jboss-javaee-specs > Replace jboss jboss-jstl-api_1.2_spec with apache taglibs-standard-spec > ----------------------------------------------------------------------- > > Key: JBEE-170 > URL: https://issues.jboss.org/browse/JBEE-170 > Project: JBoss JavaEE Spec APIs > Issue Type: Task > Components: jboss-javaee-specs > Reporter: Petr Sakař > Assignee: Tomaz Cerar > > Replace jboss jboss-jstl-api_1.2_spec with apache taglibs-standard-spec > See related JBEAP-5644 -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (JBEE-170) Replace jboss jboss-jstl-api_1.2_spec with apache taglibs-standard-spec

by Tomaz Cerar (JIRA)

[ https://issues.jboss.org/browse/JBEE-170?page=com.atlassian.jira.plugin.s... ] Tomaz Cerar moved JBEAP-6998 to JBEE-170: ----------------------------------------- Project: JBoss JavaEE Spec APIs (was: JBoss Enterprise Application Platform) Key: JBEE-170 (was: JBEAP-6998) Issue Type: Task (was: Library Upgrade) Workflow: classic default workflow (was: CDW with loose statuses v1) Target Release: (was: 7.1.0.GA) > Replace jboss jboss-jstl-api_1.2_spec with apache taglibs-standard-spec > ----------------------------------------------------------------------- > > Key: JBEE-170 > URL: https://issues.jboss.org/browse/JBEE-170 > Project: JBoss JavaEE Spec APIs > Issue Type: Task > Reporter: Petr Sakař > Assignee: Tomaz Cerar > > Replace jboss jboss-jstl-api_1.2_spec with apache taglibs-standard-spec > See related JBEAP-5644 -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-jira November 2016