November 2016 - jboss-jira - Jboss List Archives

[JBoss JIRA] (WFCORE-1924) Elytron simple-regex-realm-mapper "pattern" attribute has wrong description.

by Hynek Švábek (JIRA)

Hynek Švábek created WFCORE-1924: ------------------------------------ Summary: Elytron simple-regex-realm-mapper "pattern" attribute has wrong description. Key: WFCORE-1924 URL: https://issues.jboss.org/browse/WFCORE-1924 Project: WildFly Core Issue Type: Bug Components: CLI Reporter: Hynek Švábek Elytron simple-regex-realm-mapper "pattern" attribute has wrong description [1]. *Actual description* {code} The regular expression to use for this NameRewriter. {code} *Expected description* Some like that (from DMR): {code} The regular expression which must contain at least one capture group to extract the realm from the name. {code} [1] https://github.com/wildfly-security/elytron-subsystem/blob/580569d17cb6c3... -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-1924) Elytron simple-regex-realm-mapper "pattern" attribute has wrong description.

by Hynek Švábek (JIRA)

[ https://issues.jboss.org/browse/WFCORE-1924?page=com.atlassian.jira.plugi... ] Hynek Švábek reassigned WFCORE-1924: ------------------------------------ Assignee: Darran Lofthouse > Elytron simple-regex-realm-mapper "pattern" attribute has wrong description. > ---------------------------------------------------------------------------- > > Key: WFCORE-1924 > URL: https://issues.jboss.org/browse/WFCORE-1924 > Project: WildFly Core > Issue Type: Bug > Components: CLI > Reporter: Hynek Švábek > Assignee: Darran Lofthouse > > Elytron simple-regex-realm-mapper "pattern" attribute has wrong description [1]. > *Actual description* > {code} > The regular expression to use for this NameRewriter. > {code} > *Expected description* > Some like that (from DMR): > {code} > The regular expression which must contain at least one capture group to extract the realm from the name. > {code} > [1] https://github.com/wildfly-security/elytron-subsystem/blob/580569d17cb6c3... -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (ELY-713) HTTP Digest RFC2069 Support

by Darran Lofthouse (JIRA)

Darran Lofthouse created ELY-713: ------------------------------------ Summary: HTTP Digest RFC2069 Support Key: ELY-713 URL: https://issues.jboss.org/browse/ELY-713 Project: WildFly Elytron Issue Type: Sub-task Components: HTTP Reporter: Darran Lofthouse Assignee: Darran Lofthouse Fix For: 1.1.0.Beta13 This task is to implement initial RFC2069 support, the parent task will then continue the rest of the implementation. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (ELY-286) HTTP Digest Authentication

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/ELY-286?page=com.atlassian.jira.plugin.sy... ] Darran Lofthouse updated ELY-286: --------------------------------- Parent: (was: ELY-200) Issue Type: Feature Request (was: Sub-task) > HTTP Digest Authentication > -------------------------- > > Key: ELY-286 > URL: https://issues.jboss.org/browse/ELY-286 > Project: WildFly Elytron > Issue Type: Feature Request > Components: HTTP > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > Fix For: 1.1.0.Beta14 > > > Original Digest RFC [https://tools.ietf.org/html/rfc2069] > Current Digest RFC [https://tools.ietf.org/html/rfc2617] > HTTP 1.1 Authentication (Updates RFC2617) [https://tools.ietf.org/html/rfc7235] > Draft currently under discussion - [https://datatracker.ietf.org/doc/draft-ietf-httpauth-digest/] > RFC7616 Now Proposed Standard > "HTTP Digest Access Authentication", September 2015 > [https://www.rfc-editor.org/info/rfc7616] -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFLY-4321) restart of http connector without restarting whole web container

by Charles Wilhelm (JIRA)

[ https://issues.jboss.org/browse/WFLY-4321?page=com.atlassian.jira.plugin.... ] Charles Wilhelm commented on WFLY-4321: --------------------------------------- Can you give me some advice how to remove and add https listener without the need to reload? In combination with letsencrypt such a "hot" update of the keystores would be very nice. What I can do: {code} /subsystem=undertow/server=default-server/https-listener=https:remove() {code} but this needs a reload then. {code} /subsystem=undertow/server=default-server/https-listener=https:add(socket-binding=https, security-realm="UndertowRealm", enabled-protocols="TLSv1,TLSv1.1,TLSv1.2", enabled-cipher-suites="TLS_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", max-post-size="52428800", no-request-timeout="20000", tcp-keep-alive="true", socket-binding="https") {code} whereas readding does not require a reload. > restart of http connector without restarting whole web container > ---------------------------------------------------------------- > > Key: WFLY-4321 > URL: https://issues.jboss.org/browse/WFLY-4321 > Project: WildFly > Issue Type: Feature Request > Components: Web (Undertow) > Affects Versions: 8.2.0.Final > Reporter: Davide Gesino > Priority: Minor > Labels: connector,, mbeans, ssl, > Fix For: Awaiting Volunteers > > > It would be great if Undertow provided a feature Tomcat has, namely the possibility to stop the http connector without restarting the whole container. > It's useful for example in case when certificates for SSL communication change while the container is up and running. > Tomcat has this feature setting the property "org.apache.tomcat.util.ENABLE_MODELER" to true: this turn on the MBeans management for Tomcat. > Through these beans it's possible to start and stop the connectors. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (DROOLS-1351) Calling KieRepository.getKieModule() for a GAV of a non KJar throws Exception instead of returning null as per API contract.

by Matteo Mortari (JIRA)

[ https://issues.jboss.org/browse/DROOLS-1351?page=com.atlassian.jira.plugi... ] Matteo Mortari reopened DROOLS-1351: ------------------------------------ Reopened as custom WildFly VFS URL connection for {{getContentLength()}} returns 0 for non existent path instead of Java's JDK contract URLConnection -1. Awaiting reference before proceeding with adapting the fix to this new constraint. > Calling KieRepository.getKieModule() for a GAV of a non KJar throws Exception instead of returning null as per API contract. > ---------------------------------------------------------------------------------------------------------------------------- > > Key: DROOLS-1351 > URL: https://issues.jboss.org/browse/DROOLS-1351 > Project: Drools > Issue Type: Bug > Reporter: Matteo Mortari > Assignee: Matteo Mortari > Fix For: 7.0.0.Beta3 > > -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-1923) Add configuration option to make the HTTP management interface unavailable on non-master HCs

by Brian Stansberry (JIRA)

[ https://issues.jboss.org/browse/WFCORE-1923?page=com.atlassian.jira.plugi... ] Brian Stansberry updated WFCORE-1923: ------------------------------------- Description: This is a sub-requirement of WFCORE-338 and shouldn't be included independent of that without prior discussion. If a user has a group of candidate domain controllers, a classic way of providing a consistent URL for management clients in the face of changes in the elected DC is to front the set of candidates with a reverse proxy. But for that to work well, the proxy should only see one working HC at a time. For that to happen, we need the non-elected HCs to not open a listener on the HTTP management interface unless they are elected. Since users may not want this behavior (e.g. if they don't have a reverse proxy set up and thus will get no benefit), this needs to be configurable. Note that if users elect to use this function they will need to set up a native-management interface to handle the intra-domain traffic. An open question is whether the interface should not be available at all or whether it should just be that certain contexts are not available. Also worth some thought before proceeding with this is thinking about how a mod_cluster proxy would be integrated. Doing the mod_cluster integration is out of scope for this task, but it makes sense to think about it a bit so we don't go down a path that will make later mod_cluster work harder. was: This is a sub-requirement of WFCORE-338 and shouldn't be included independent of that without prior discussion. If a user has a group of candidate domain controllers, a classic way of providing a consistent URL for management clients in the face of changes in the elected DC is to front the set of candidates with a reverse proxy. But for that to work well, the proxy should only see one working HC at a time. For that to happen, we need the non-elected HCs to not open a listener on the HTTP management interface unless they are elected. Since users may not want this behavior (e.g. if they don't have a reverse proxy set up and thus will get no benefit), this needs to be configurable. An open question is whether the interface should not be available at all or whether it should just be that certain contexts are not available. Also worth some thought before proceeding with this is thinking about how a mod_cluster proxy would be integrated. Doing the mod_cluster integration is out of scope for this task, but it makes sense to think about it a bit so we don't go down a path that will make later mod_cluster work harder. > Add configuration option to make the HTTP management interface unavailable on non-master HCs > -------------------------------------------------------------------------------------------- > > Key: WFCORE-1923 > URL: https://issues.jboss.org/browse/WFCORE-1923 > Project: WildFly Core > Issue Type: Enhancement > Components: Domain Management > Reporter: Brian Stansberry > > This is a sub-requirement of WFCORE-338 and shouldn't be included independent of that without prior discussion. > If a user has a group of candidate domain controllers, a classic way of providing a consistent URL for management clients in the face of changes in the elected DC is to front the set of candidates with a reverse proxy. But for that to work well, the proxy should only see one working HC at a time. For that to happen, we need the non-elected HCs to not open a listener on the HTTP management interface unless they are elected. > Since users may not want this behavior (e.g. if they don't have a reverse proxy set up and thus will get no benefit), this needs to be configurable. > Note that if users elect to use this function they will need to set up a native-management interface to handle the intra-domain traffic. > An open question is whether the interface should not be available at all or whether it should just be that certain contexts are not available. > Also worth some thought before proceeding with this is thinking about how a mod_cluster proxy would be integrated. Doing the mod_cluster integration is out of scope for this task, but it makes sense to think about it a bit so we don't go down a path that will make later mod_cluster work harder. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-1921) Problem with capability-reference to resource whose name is number with ZERO(s) prefix.

by Hynek Švábek (JIRA)

[ https://issues.jboss.org/browse/WFCORE-1921?page=com.atlassian.jira.plugi... ] Hynek Švábek commented on WFCORE-1921: -------------------------------------- [~brian.stansberry] Yes, it was typo. I corrected it. Of course it is reproducible with correct command. > Problem with capability-reference to resource whose name is number with ZERO(s) prefix. > --------------------------------------------------------------------------------------- > > Key: WFCORE-1921 > URL: https://issues.jboss.org/browse/WFCORE-1921 > Project: WildFly Core > Issue Type: Bug > Components: Domain Management > Reporter: Hynek Švábek > Assignee: Tomaz Cerar > > Problem with resources which name contains only NUMBERS. > Particularly the number which beginning with ZERO(s). > *Scenario* > * I have resources which name contains only numbers with ZERO(s) prefix > * I want set capability-reference to it > * e.g. /subsystem=elytron/aggregate-role-mapper001=aggregateRoleMapper:add(role-mappers=[001,111]) > *Actual result* > {code} > { > "outcome" => "failed", > "failure-description" => "WFLYCTL0369: Required capabilities are not available: > org.wildfly.security.role-mapper.1; There are no known registration points which can provide this capability.", > "rolled-back" => true > } > {code} > *Expected result* > {code} > Success > {code} > *NOTE* > In my opinion is this global problem. > I tried it with another subsystem and problem is there too. > {code} > /subsystem=datasources/data-source=001:add(connection-url="url", jndi-name="java:jboss/datasources/001", driver-name=h2) > /subsystem=infinispan/cache-container=server/local-cache=default/store=string-jdbc:add(data-source=001) > {code} -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-1921) Problem with capability-reference to resource whose name is number with ZERO(s) prefix.

by Hynek Švábek (JIRA)

[ https://issues.jboss.org/browse/WFCORE-1921?page=com.atlassian.jira.plugi... ] Hynek Švábek updated WFCORE-1921: --------------------------------- Steps to Reproduce: * run EAP server ./bin/standalone.sh * run CLI ./bin/jboss-cli.sh -c if applicaple add Elytron extension and Elytron subsystem and reload server /extension=org.wildfly.extension.elytron:add() /subsystem=elytron:add() reload * /subsystem=elytron/add-prefix-role-mapper=001:add(prefix=prefix001) * /subsystem=elytron/add-prefix-role-mapper=111:add(prefix=prefix002) * */subsystem=elytron/aggregate-role-mapper=aggregateRoleMapper001:add(role-mappers=[001,111])* was: * run EAP server ./bin/standalone.sh * run CLI ./bin/jboss-cli.sh -c if applicaple add Elytron extension and Elytron subsystem and reload server /extension=org.wildfly.extension.elytron:add() /subsystem=elytron:add() reload * /subsystem=elytron/add-prefix-role-mapper=001:add(prefix=prefix001) * /subsystem=elytron/add-prefix-role-mapper=111:add(prefix=prefix002) * */subsystem=elytron/aggregate-role-mapper001=aggregateRoleMapper:add(role-mappers=[001,111])* > Problem with capability-reference to resource whose name is number with ZERO(s) prefix. > --------------------------------------------------------------------------------------- > > Key: WFCORE-1921 > URL: https://issues.jboss.org/browse/WFCORE-1921 > Project: WildFly Core > Issue Type: Bug > Components: Domain Management > Reporter: Hynek Švábek > Assignee: Tomaz Cerar > > Problem with resources which name contains only NUMBERS. > Particularly the number which beginning with ZERO(s). > *Scenario* > * I have resources which name contains only numbers with ZERO(s) prefix > * I want set capability-reference to it > * e.g. /subsystem=elytron/aggregate-role-mapper001=aggregateRoleMapper:add(role-mappers=[001,111]) > *Actual result* > {code} > { > "outcome" => "failed", > "failure-description" => "WFLYCTL0369: Required capabilities are not available: > org.wildfly.security.role-mapper.1; There are no known registration points which can provide this capability.", > "rolled-back" => true > } > {code} > *Expected result* > {code} > Success > {code} > *NOTE* > In my opinion is this global problem. > I tried it with another subsystem and problem is there too. > {code} > /subsystem=datasources/data-source=001:add(connection-url="url", jndi-name="java:jboss/datasources/001", driver-name=h2) > /subsystem=infinispan/cache-container=server/local-cache=default/store=string-jdbc:add(data-source=001) > {code} -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-1923) Add configuration option to make the HTTP management interface unavailable on non-master HCs

by Brian Stansberry (JIRA)

Brian Stansberry created WFCORE-1923: ---------------------------------------- Summary: Add configuration option to make the HTTP management interface unavailable on non-master HCs Key: WFCORE-1923 URL: https://issues.jboss.org/browse/WFCORE-1923 Project: WildFly Core Issue Type: Enhancement Components: Domain Management Reporter: Brian Stansberry This is a sub-requirement of WFCORE-338 and shouldn't be included independent of that without prior discussion. If a user has a group of candidate domain controllers, a classic way of providing a consistent URL for management clients in the face of changes in the elected DC is to front the set of candidates with a reverse proxy. But for that to work well, the proxy should only see one working HC at a time. For that to happen, we need the non-elected HCs to not open a listener on the HTTP management interface unless they are elected. Since users may not want this behavior (e.g. if they don't have a reverse proxy set up and thus will get no benefit), this needs to be configurable. An open question is whether the interface should not be available at all or whether it should just be that certain contexts are not available. Also worth some thought before proceeding with this is thinking about how a mod_cluster proxy would be integrated. Doing the mod_cluster integration is out of scope for this task, but it makes sense to think about it a bit so we don't go down a path that will make later mod_cluster work harder. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-jira November 2016