[JBoss JIRA] (WFLY-7687) Authentication based on certificates does not work in Elytron with Undertow
by Jan Tymel (JIRA)
[ https://issues.jboss.org/browse/WFLY-7687?page=com.atlassian.jira.plugin.... ]
Jan Tymel updated WFLY-7687:
----------------------------
Attachment: deployment.war
> Authentication based on certificates does not work in Elytron with Undertow
> ---------------------------------------------------------------------------
>
> Key: WFLY-7687
> URL: https://issues.jboss.org/browse/WFLY-7687
> Project: WildFly
> Issue Type: Bug
> Components: Security
> Reporter: Jan Tymel
> Assignee: Darran Lofthouse
> Priority: Critical
> Attachments: deployment.war, keystores.zip, standalone-elytron.xml
>
>
> It is not possible to set up authentication based on certificates. I followed the community documentation [1,2] to set up 2-way SSL for apps and certificates based auth. Everything worked as expected until I tried to deploy an app. I got this output
> {code}
> 14:50:29,352 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 65) MSC000001: Failed to start service jboss.undertow.deployment.default-server.default-host./deployment: org.jboss.msc.service.StartException in service jboss.undertow.deployment.default-server.default-host./deployment: java.lang.RuntimeException: java.lang.IllegalStateException: WFLYUT0085: The required mechanism 'CLIENT_CERT' is not available from the HttpAuthenticationFactory.
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:85)
> at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
> at java.util.concurrent.FutureTask.run(FutureTask.java:266)
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> at java.lang.Thread.run(Thread.java:745)
> at org.jboss.threads.JBossThread.run(JBossThread.java:320)
> Caused by: java.lang.RuntimeException: java.lang.IllegalStateException: WFLYUT0085: The required mechanism 'CLIENT_CERT' is not available from the HttpAuthenticationFactory.
> at io.undertow.servlet.core.DeploymentManagerImpl.deploy(DeploymentManagerImpl.java:237)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:100)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:82)
> ... 6 more
> Caused by: java.lang.IllegalStateException: WFLYUT0085: The required mechanism 'CLIENT_CERT' is not available from the HttpAuthenticationFactory.
> at org.wildfly.extension.undertow.ApplicationSecurityDomainDefinition$ApplicationSecurityDomainService.lambda$initialSecurityHandler$4(ApplicationSecurityDomainDefinition.java:348)
> at java.lang.Iterable.forEach(Iterable.java:75)
> at org.wildfly.extension.undertow.ApplicationSecurityDomainDefinition$ApplicationSecurityDomainService.initialSecurityHandler(ApplicationSecurityDomainDefinition.java:345)
> at org.wildfly.extension.undertow.ApplicationSecurityDomainDefinition$ApplicationSecurityDomainService.lambda$applyElytronSecurity$0(ApplicationSecurityDomainDefinition.java:293)
> at io.undertow.servlet.core.DeploymentManagerImpl.setupSecurityHandlers(DeploymentManagerImpl.java:404)
> at io.undertow.servlet.core.DeploymentManagerImpl.access$600(DeploymentManagerImpl.java:119)
> at io.undertow.servlet.core.DeploymentManagerImpl$1.call(DeploymentManagerImpl.java:207)
> at io.undertow.servlet.core.DeploymentManagerImpl$1.call(DeploymentManagerImpl.java:172)
> at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)
> at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1671)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1671)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1671)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1671)
> at io.undertow.servlet.core.DeploymentManagerImpl.deploy(DeploymentManagerImpl.java:235)
> ... 8 more
> 14:50:29,356 ERROR [org.jboss.as.controller.management-operation] (DeploymentScanner-threads - 2) WFLYCTL0013: Operation ("deploy") failed - address: ([("deployment" => "deployment.war")]) - failure description: {
> "WFLYCTL0080: Failed services" => {"jboss.undertow.deployment.default-server.default-host./deployment" => "org.jboss.msc.service.StartException in service jboss.undertow.deployment.default-server.default-host./deployment: java.lang.RuntimeException: java.lang.IllegalStateException: WFLYUT0085: The required mechanism 'CLIENT_CERT' is not available from the HttpAuthenticationFactory.
> Caused by: java.lang.RuntimeException: java.lang.IllegalStateException: WFLYUT0085: The required mechanism 'CLIENT_CERT' is not available from the HttpAuthenticationFactory.
> Caused by: java.lang.IllegalStateException: WFLYUT0085: The required mechanism 'CLIENT_CERT' is not available from the HttpAuthenticationFactory."},
> "WFLYCTL0412: Required services that are not installed:" => ["jboss.undertow.deployment.default-server.default-host./deployment"],
> "WFLYCTL0180: Services with missing/unavailable dependencies" => undefined
> {code}
> This might be caused by different representation of {{CLIENT-CERT}} attribute within Elytron and Undertow. It appears that Elytron uses {{CLIENT-CERT}} [3] whereas Undertow uses {{CLIENT_CERT}} [4]
> [1] https://docs.jboss.org/author/display/WFLY/Elytron+Examples#ElytronExampl...
> [2] https://docs.jboss.org/author/display/WFLY/Elytron+Examples#ElytronExampl...
> [3] https://github.com/wildfly-security/wildfly-elytron/blob/master/src/main/...
> [4] https://github.com/undertow-io/undertow/blob/master/core/src/main/java/io...
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 5 months
[JBoss JIRA] (WFLY-7687) Authentication based on certificates does not work in Elytron with Undertow
by Jan Tymel (JIRA)
Jan Tymel created WFLY-7687:
-------------------------------
Summary: Authentication based on certificates does not work in Elytron with Undertow
Key: WFLY-7687
URL: https://issues.jboss.org/browse/WFLY-7687
Project: WildFly
Issue Type: Bug
Components: Security
Reporter: Jan Tymel
Assignee: Darran Lofthouse
Priority: Critical
It is not possible to set up authentication based on certificates. I followed the community documentation [1,2] to set up 2-way SSL for apps and certificates based auth. Everything worked as expected until I tried to deploy an app. I got this output
{code}
14:50:29,352 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 65) MSC000001: Failed to start service jboss.undertow.deployment.default-server.default-host./deployment: org.jboss.msc.service.StartException in service jboss.undertow.deployment.default-server.default-host./deployment: java.lang.RuntimeException: java.lang.IllegalStateException: WFLYUT0085: The required mechanism 'CLIENT_CERT' is not available from the HttpAuthenticationFactory.
at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:85)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
at org.jboss.threads.JBossThread.run(JBossThread.java:320)
Caused by: java.lang.RuntimeException: java.lang.IllegalStateException: WFLYUT0085: The required mechanism 'CLIENT_CERT' is not available from the HttpAuthenticationFactory.
at io.undertow.servlet.core.DeploymentManagerImpl.deploy(DeploymentManagerImpl.java:237)
at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:100)
at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:82)
... 6 more
Caused by: java.lang.IllegalStateException: WFLYUT0085: The required mechanism 'CLIENT_CERT' is not available from the HttpAuthenticationFactory.
at org.wildfly.extension.undertow.ApplicationSecurityDomainDefinition$ApplicationSecurityDomainService.lambda$initialSecurityHandler$4(ApplicationSecurityDomainDefinition.java:348)
at java.lang.Iterable.forEach(Iterable.java:75)
at org.wildfly.extension.undertow.ApplicationSecurityDomainDefinition$ApplicationSecurityDomainService.initialSecurityHandler(ApplicationSecurityDomainDefinition.java:345)
at org.wildfly.extension.undertow.ApplicationSecurityDomainDefinition$ApplicationSecurityDomainService.lambda$applyElytronSecurity$0(ApplicationSecurityDomainDefinition.java:293)
at io.undertow.servlet.core.DeploymentManagerImpl.setupSecurityHandlers(DeploymentManagerImpl.java:404)
at io.undertow.servlet.core.DeploymentManagerImpl.access$600(DeploymentManagerImpl.java:119)
at io.undertow.servlet.core.DeploymentManagerImpl$1.call(DeploymentManagerImpl.java:207)
at io.undertow.servlet.core.DeploymentManagerImpl$1.call(DeploymentManagerImpl.java:172)
at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)
at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1671)
at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1671)
at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1671)
at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1671)
at io.undertow.servlet.core.DeploymentManagerImpl.deploy(DeploymentManagerImpl.java:235)
... 8 more
14:50:29,356 ERROR [org.jboss.as.controller.management-operation] (DeploymentScanner-threads - 2) WFLYCTL0013: Operation ("deploy") failed - address: ([("deployment" => "deployment.war")]) - failure description: {
"WFLYCTL0080: Failed services" => {"jboss.undertow.deployment.default-server.default-host./deployment" => "org.jboss.msc.service.StartException in service jboss.undertow.deployment.default-server.default-host./deployment: java.lang.RuntimeException: java.lang.IllegalStateException: WFLYUT0085: The required mechanism 'CLIENT_CERT' is not available from the HttpAuthenticationFactory.
Caused by: java.lang.RuntimeException: java.lang.IllegalStateException: WFLYUT0085: The required mechanism 'CLIENT_CERT' is not available from the HttpAuthenticationFactory.
Caused by: java.lang.IllegalStateException: WFLYUT0085: The required mechanism 'CLIENT_CERT' is not available from the HttpAuthenticationFactory."},
"WFLYCTL0412: Required services that are not installed:" => ["jboss.undertow.deployment.default-server.default-host./deployment"],
"WFLYCTL0180: Services with missing/unavailable dependencies" => undefined
{code}
This might be caused by different representation of {{CLIENT-CERT}} attribute within Elytron and Undertow. It appears that Elytron uses {{CLIENT-CERT}} [3] whereas Undertow uses {{CLIENT_CERT}} [4]
[1] https://docs.jboss.org/author/display/WFLY/Elytron+Examples#ElytronExampl...
[2] https://docs.jboss.org/author/display/WFLY/Elytron+Examples#ElytronExampl...
[3] https://github.com/wildfly-security/wildfly-elytron/blob/master/src/main/...
[4] https://github.com/undertow-io/undertow/blob/master/core/src/main/java/io...
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 5 months
[JBoss JIRA] (WFLY-7150) EJB injection with indirection via web.xml is ignored
by RH Bugzilla Integration (JIRA)
[ https://issues.jboss.org/browse/WFLY-7150?page=com.atlassian.jira.plugin.... ]
RH Bugzilla Integration commented on WFLY-7150:
-----------------------------------------------
Petr Jurak <pjurak(a)redhat.com> changed the Status of [bug 1377705|https://bugzilla.redhat.com/show_bug.cgi?id=1377705] from ASSIGNED to POST
> EJB injection with indirection via web.xml is ignored
> -----------------------------------------------------
>
> Key: WFLY-7150
> URL: https://issues.jboss.org/browse/WFLY-7150
> Project: WildFly
> Issue Type: Bug
> Components: CDI / Weld, Web (Undertow)
> Reporter: Wolf-Dieter Fink
> Assignee: Stuart Douglas
> Fix For: 11.0.0.Alpha1
>
>
> If a web application contains a Servlet and a REST service (as CDI Bean) with an @EJB(lookup="java:comp/env/xxxx") injection for a indirection via web.xml/jboss-web.xml the CDI Bean will ignore it without any message whereas the Servlet inject the EJB proxy as expected.
> This approach is used to be able to change/adjust the target EJB by changing the DD and not the application code.
> Reproducer can be found here:
> git@github.com:wfink/jboss-eap-quickstarts.git
> BRANCH: 6.4.x_ejb-multi-server_reproducerEJB-injection2
> SubProject: ejb-multi-server (used only a part of it to have a web-app and a ejb-app)
> see ejb-multi-server/README-reproducerEJB-injection
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 5 months
[JBoss JIRA] (ELY-798) FIPS cipher suite security level in not used
by Ondrej Kotek (JIRA)
[ https://issues.jboss.org/browse/ELY-798?page=com.atlassian.jira.plugin.sy... ]
Ondrej Kotek updated ELY-798:
-----------------------------
Description:
There is defined FIPS cipher suite security level name [1,2], but there are no cipher suites with such level [1]. Do we expect some cipher suites with such level to be added? Or {{(fips value == true) => FIPS security level}}?
There is also preparation for matching FIPS cipher suites [4], which is not used. {{CipherSuiteSelector}} [5,6] could offer _FIPS_ keyword to enable users to set FIPS cipher suites easily.
[1] https://github.com/wildfly-security/wildfly-elytron/blob/master/src/main/...
[2] https://github.com/wildfly-security/wildfly-elytron/blob/master/src/main/...
[3] https://github.com/wildfly-security/wildfly-elytron/blob/master/src/main/...
[4] https://github.com/wildfly-security/wildfly-elytron/blob/master/src/main/...
[5] https://github.com/wildfly-security/wildfly-elytron/blob/master/src/main/...
[6] https://github.com/wildfly-security/wildfly-elytron/blob/master/src/main/...
was:
There is defined FIPS cipher suite security level name [1,2], but there are no cipher suites with such level [1]. Do we expect some cipher suites with such level to be added? Or {{(fips value == true) => FIPS security level}}?
There is is preparation for matching FIPS cipher suites [4], which is not used. {{CipherSuiteSelector}} [5,6] could offer _FIPS_ keyword to enable users to set FIPS cipher suites easily.
[1] https://github.com/wildfly-security/wildfly-elytron/blob/master/src/main/...
[2] https://github.com/wildfly-security/wildfly-elytron/blob/master/src/main/...
[3] https://github.com/wildfly-security/wildfly-elytron/blob/master/src/main/...
[4] https://github.com/wildfly-security/wildfly-elytron/blob/master/src/main/...
[5] https://github.com/wildfly-security/wildfly-elytron/blob/master/src/main/...
[6] https://github.com/wildfly-security/wildfly-elytron/blob/master/src/main/...
> FIPS cipher suite security level in not used
> --------------------------------------------
>
> Key: ELY-798
> URL: https://issues.jboss.org/browse/ELY-798
> Project: WildFly Elytron
> Issue Type: Bug
> Components: SSL
> Affects Versions: 1.1.0.Beta16
> Reporter: Ondrej Kotek
> Assignee: Darran Lofthouse
>
> There is defined FIPS cipher suite security level name [1,2], but there are no cipher suites with such level [1]. Do we expect some cipher suites with such level to be added? Or {{(fips value == true) => FIPS security level}}?
> There is also preparation for matching FIPS cipher suites [4], which is not used. {{CipherSuiteSelector}} [5,6] could offer _FIPS_ keyword to enable users to set FIPS cipher suites easily.
> [1] https://github.com/wildfly-security/wildfly-elytron/blob/master/src/main/...
> [2] https://github.com/wildfly-security/wildfly-elytron/blob/master/src/main/...
> [3] https://github.com/wildfly-security/wildfly-elytron/blob/master/src/main/...
> [4] https://github.com/wildfly-security/wildfly-elytron/blob/master/src/main/...
> [5] https://github.com/wildfly-security/wildfly-elytron/blob/master/src/main/...
> [6] https://github.com/wildfly-security/wildfly-elytron/blob/master/src/main/...
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 5 months
[JBoss JIRA] (WFLY-7686) Inconsistent attribute desription of security domain
by Juraj Duráni (JIRA)
Juraj Duráni created WFLY-7686:
----------------------------------
Summary: Inconsistent attribute desription of security domain
Key: WFLY-7686
URL: https://issues.jboss.org/browse/WFLY-7686
Project: WildFly
Issue Type: Bug
Components: CLI
Affects Versions: 10.1.0.Final
Reporter: Juraj Duráni
Assignee: Jason Greene
Priority: Minor
Some attributes have inconsistent description (obtained using 'read-resource-description' operation):
- Missing module attribute:
{code:plain|title=Missing module attribute}
[standalone@localhost:9990 /] /subsystem=security/security-domain=other/mapping=classic:read-resource-description
{
"outcome" => "success",
"result" => {
"description" => "Mapping configuration. Configures a list of mapping modules to be used for principal, role, attribute and credential mapping.",
"deprecated" => {
"since" => "1.3.0",
"reason" => "The Security subsystem is deprecated and may be removed, significantly revised, or limited to managed domain legacy server use in future versions."
},
"access-constraints" => {
"sensitive" => {"security-domain" => {"type" => "core"}},
"application" => {"security-domain" => {"type" => "security"}}
},
"attributes" => {"mapping-modules" => {
"type" => LIST,
"description" => "List of modules that map principal, role, and credential information",
"expressions-allowed" => false,
"nillable" => true,
"deprecated" => {
"since" => "1.2.0",
"reason" => "Use of this attribute is deprecated, use resource"
},
"value-type" => {
"code" => {
"description" => "Class name of the module to be instantiated.",
"type" => STRING,
"nillable" => false,
"min-length" => 1
},
"type" => {
"description" => "Type of mapping this module performs. Allowed values are principal, role, attribute or credential..",
"type" => STRING,
"nillable" => false
},
"module-options" => {
"description" => "List of module options containing a name/value pair.",
"type" => OBJECT,
"value-type" => STRING,
"nillable" => true
}
},
"access-type" => "read-write",
"storage" => "configuration",
"restart-required" => "all-services"
}},
"operations" => undefined,
"notifications" => undefined,
"children" => {"mapping-module" => {
"description" => "List of modules that map principal, role, and credential information",
"model-description" => undefined
}}
}
}
{code}
- Module description in policy-module refers to "login module"
{code:plain|title=Inaccurate description}
[standalone@localhost:9990 /] /subsystem=security/security-domain=other/authorization=classic/policy-module=a:read-resource-description
{
"outcome" => "success",
"result" => {
"description" => "List of authentication modules",
"access-constraints" => {
"sensitive" => {"security-domain" => {"type" => "core"}},
"application" => {"security-domain" => {"type" => "security"}}
},
"attributes" => {
"code" => {
"type" => STRING,
"description" => "Class name of the module to be instantiated.",
"expressions-allowed" => false,
"nillable" => false,
"min-length" => 1L,
"max-length" => 2147483647L,
"access-type" => "read-write",
"storage" => "configuration",
"restart-required" => "no-services"
},
"flag" => {
"type" => STRING,
"description" => "The flag controls how the module participates in the overall procedure. Allowed values are requisite, required, sufficient or optional.",
"expressions-allowed" => true,
"nillable" => false,
"allowed" => [
"required",
"requisite",
"sufficient",
"optional"
],
"access-type" => "read-write",
"storage" => "configuration",
"restart-required" => "no-services"
},
"module" => {
"type" => STRING,
"description" => "Name of JBoss Module where the login module is located.",
"expressions-allowed" => false,
"nillable" => true,
"min-length" => 1L,
"max-length" => 2147483647L,
"access-type" => "read-write",
"storage" => "configuration",
"restart-required" => "no-services"
},
"module-options" => {
"type" => OBJECT,
"description" => "List of module options containing a name/value pair.",
"expressions-allowed" => true,
"nillable" => true,
"value-type" => STRING,
"access-type" => "read-write",
"storage" => "configuration",
"restart-required" => "no-services"
}
},
"operations" => undefined,
"notifications" => undefined,
"children" => {}
}
}
{code}
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 5 months
[JBoss JIRA] (WFCORE-2051) http and https URL format should be documented in help
by Jean-Francois Denise (JIRA)
Jean-Francois Denise created WFCORE-2051:
--------------------------------------------
Summary: http and https URL format should be documented in help
Key: WFCORE-2051
URL: https://issues.jboss.org/browse/WFCORE-2051
Project: WildFly Core
Issue Type: Feature Request
Components: CLI
Reporter: Jean-Francois Denise
Assignee: Jean-Francois Denise
I remember having had some trouble to find out the right HTTPS URL. I think that we should update the help with the usage of http+remote and https+remote.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 5 months