[JBoss JIRA] (WFLY-7677) Missing validation for write-attribute operation for introspection-url from Elytron token-realm
by Ondrej Lukas (JIRA)
Ondrej Lukas created WFLY-7677:
----------------------------------
Summary: Missing validation for write-attribute operation for introspection-url from Elytron token-realm
Key: WFLY-7677
URL: https://issues.jboss.org/browse/WFLY-7677
Project: WildFly
Issue Type: Bug
Components: Security
Reporter: Ondrej Lukas
Assignee: Darran Lofthouse
{{add}} operation for Elytron {{token-realm}} checks whether {{oauth2-introspection.introspection-url}} includes valid URL. However, in case when invalid URL is added with write-attribute operation then there is no validation. It results to failures during reloading/restarting server.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 5 months
[JBoss JIRA] (WFLY-6971) MDB cannot be deployed after migration due to invalid cache configuration. Log a message in order to detect and reject any invalid configuration.
by Panagiotis Sotiropoulos (JIRA)
[ https://issues.jboss.org/browse/WFLY-6971?page=com.atlassian.jira.plugin.... ]
Panagiotis Sotiropoulos commented on WFLY-6971:
-----------------------------------------------
Hello Paul,
I tried to modify the Passivation Store Add as suggested, but this would not help as, there, only the DistributableCacheFactoryBuilderService is installed (on demand) [in this case for two different passivation stores]. I will continue the effort, but in case there is some time constraint I have assigned the upstream to you.
Regards,
Panagiotis
> MDB cannot be deployed after migration due to invalid cache configuration. Log a message in order to detect and reject any invalid configuration.
> -------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: WFLY-6971
> URL: https://issues.jboss.org/browse/WFLY-6971
> Project: WildFly
> Issue Type: Bug
> Components: EJB, JMS
> Affects Versions: 10.1.0.CR1
> Reporter: Panagiotis Sotiropoulos
> Assignee: Paul Ferraro
> Priority: Critical
> Attachments: mdb-1.0-SNAPSHOT.jar, standalone-full-ha.xml_eap6
>
> Original Estimate: 2 days
> Remaining Estimate: 2 days
>
> If EAP 7 with (manually) migrated configuration from EAP 6.4.7.CP server is started then MDB deployment fails with:
> {code}
> 14:17:09,432 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-3) MSC000001: Failed to start service jboss.deployment.unit."mdb-1.0-SNAPSHOT.jar".cache-dependencies-installer: org.jboss.msc.service.StartException in service jboss.deployment.unit."mdb-1.0-SNAPSHOT.jar".cache-dependencies-installer: Failed to start service
> at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1904) [jboss-msc-1.2.6.Final-redhat-1.jar:1.2.6.Final-redhat-1]
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [rt.jar:1.8.0_71]
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [rt.jar:1.8.0_71]
> at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_71]
> Caused by: org.jboss.msc.service.DuplicateServiceException: Service jboss.infinispan.ejb."mdb-1.0-SNAPSHOT.jar".config is already registered
> at org.jboss.msc.service.ServiceRegistrationImpl.setInstance(ServiceRegistrationImpl.java:158) [jboss-msc-1.2.6.Final-redhat-1.jar:1.2.6.Final-redhat-1]
> at org.jboss.msc.service.ServiceControllerImpl.startInstallation(ServiceControllerImpl.java:235) [jboss-msc-1.2.6.Final-redhat-1.jar:1.2.6.Final-redhat-1]
> at org.jboss.msc.service.ServiceContainerImpl.install(ServiceContainerImpl.java:768) [jboss-msc-1.2.6.Final-redhat-1.jar:1.2.6.Final-redhat-1]
> at org.jboss.msc.service.ServiceTargetImpl.install(ServiceTargetImpl.java:223) [jboss-msc-1.2.6.Final-redhat-1.jar:1.2.6.Final-redhat-1]
> at org.jboss.msc.service.ServiceControllerImpl$ChildServiceTarget.install(ServiceControllerImpl.java:2401) [jboss-msc-1.2.6.Final-redhat-1.jar:1.2.6.Final-redhat-1]
> at org.jboss.msc.service.ServiceTargetImpl.install(ServiceTargetImpl.java:223) [jboss-msc-1.2.6.Final-redhat-1.jar:1.2.6.Final-redhat-1]
> at org.jboss.msc.service.ServiceControllerImpl$ChildServiceTarget.install(ServiceControllerImpl.java:2401) [jboss-msc-1.2.6.Final-redhat-1.jar:1.2.6.Final-redhat-1]
> at org.jboss.msc.service.ServiceBuilderImpl.install(ServiceBuilderImpl.java:317) [jboss-msc-1.2.6.Final-redhat-1.jar:1.2.6.Final-redhat-1]
> at org.jboss.as.ejb3.cache.distributable.DistributableCacheFactoryBuilderService.installDeploymentUnitDependencies(DistributableCacheFactoryBuilderService.java:93)
> at org.jboss.as.ejb3.deployment.processors.CacheDependenciesProcessor$1.start(CacheDependenciesProcessor.java:50)
> at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1948) [jboss-msc-1.2.6.Final-redhat-1.jar:1.2.6.Final-redhat-1]
> at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1881) [jboss-msc-1.2.6.Final-redhat-1.jar:1.2.6.Final-redhat-1]
> ... 3 more
> {code}
> Problem seems to be configuration of caches in ejb subsystem which looks like:
> {code}
> <subsystem xmlns="urn:jboss:domain:ejb3:4.0">
> ...
> <caches>
> <cache name="simple" aliases="NoPassivationCache"/>
> <cache name="passivating" passivation-store-ref="file" aliases="SimpleStatefulCache"/>
> <cache name="clustered" passivation-store-ref="infinispan" aliases="StatefulTreeCache"/>
> </caches>
> ...
> </subsystem>
> {code}
> If any of lines:
> {code}
> <cache name="passivating" passivation-store-ref="file" aliases="SimpleStatefulCache"/>
> <cache name="clustered" passivation-store-ref="infinispan"
> {code}
> is removed or I take default configuration from EAP 7:
> {code}
> <caches>
> <cache name="simple"/>
> <cache name="distributable" passivation-store-ref="infinispan" aliases="passivating clustered"/>
> </caches>
> {code}
> then MDB is deployed.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 5 months
[JBoss JIRA] (WFLY-7676) Description of Elytron oauth2-introspection resource is copy/pasted from jwt
by Ondrej Lukas (JIRA)
[ https://issues.jboss.org/browse/WFLY-7676?page=com.atlassian.jira.plugin.... ]
Ondrej Lukas updated WFLY-7676:
-------------------------------
Description:
Description of {{oauth2-introspection}} resource from Elytron {{token-realm}} is copy/pasted from description of {{jwt}}.
It is similar as WFLY-7573, but its description (and also its linked fix) talks only about description of attributes. This Jira is related to description of whole resource which currently says:
"A token validator to be used in conjunction with a token-based realm that handles security tokens based on the JWT/JWS standard."
was:
Description of {{oauth2-introspection}} resource from Elytron {{token-realm}} is copy/pasted from description of {{jwt}}.
It is similar as JBEAP-7122, but its description (and also its linked fix) talks only about description of attributes. This Jira is related to description of whole resource which currently says:
"A token validator to be used in conjunction with a token-based realm that handles security tokens based on the JWT/JWS standard."
Labels: user_experience (was: )
Affects Version/s: 11.0.0.Alpha1
> Description of Elytron oauth2-introspection resource is copy/pasted from jwt
> ----------------------------------------------------------------------------
>
> Key: WFLY-7676
> URL: https://issues.jboss.org/browse/WFLY-7676
> Project: WildFly
> Issue Type: Bug
> Components: Security
> Affects Versions: 11.0.0.Alpha1
> Reporter: Ondrej Lukas
> Assignee: Darran Lofthouse
> Labels: user_experience
>
> Description of {{oauth2-introspection}} resource from Elytron {{token-realm}} is copy/pasted from description of {{jwt}}.
> It is similar as WFLY-7573, but its description (and also its linked fix) talks only about description of attributes. This Jira is related to description of whole resource which currently says:
> "A token validator to be used in conjunction with a token-based realm that handles security tokens based on the JWT/JWS standard."
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 5 months
[JBoss JIRA] (WFLY-7676) Description of Elytron oauth2-introspection resource is copy/pasted from jwt
by Ondrej Lukas (JIRA)
Ondrej Lukas created WFLY-7676:
----------------------------------
Summary: Description of Elytron oauth2-introspection resource is copy/pasted from jwt
Key: WFLY-7676
URL: https://issues.jboss.org/browse/WFLY-7676
Project: WildFly
Issue Type: Bug
Components: Security
Reporter: Ondrej Lukas
Assignee: Darran Lofthouse
Description of {{oauth2-introspection}} resource from Elytron {{token-realm}} is copy/pasted from description of {{jwt}}.
It is similar as JBEAP-7122, but its description (and also its linked fix) talks only about description of attributes. This Jira is related to description of whole resource which currently says:
"A token validator to be used in conjunction with a token-based realm that handles security tokens based on the JWT/JWS standard."
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 5 months
[JBoss JIRA] (WFLY-7616) Setting 'site' attribute of cache-container transport fails on WF 10.1.0
by Joe Siponen (JIRA)
[ https://issues.jboss.org/browse/WFLY-7616?page=com.atlassian.jira.plugin.... ]
Joe Siponen updated WFLY-7616:
------------------------------
Description:
The documentation for the Infinispan Subsystem in Wildfly 10 (https://docs.jboss.org/author/display/WFLY10/Infinispan+Subsystem) suggest that it should be possible to set the following attributes on the transport element of the cache-container:
site: This attribute configures the site id of the cache container.
rack: This attribute configures the rack id of the cache container.
machine: This attribute configures the machine id of the cache container
Setting these will fail due to parsing errors:
[Host Controller] 14:32:41,557 ERROR [org.jboss.as.host.controller] (Controller Boot Thread) WFLYHC0033: Caught exception during boot: org.jboss.as.controller.persistence.ConfigurationPersistenceException: WFLYCTL0085: Failed to parse configuration
[Host Controller] Message: WFLYCTL0197: Unexpected attribute 'machine' encountered
Further investigation revealed that this failure was due to the configuration having been moved to the transport element of the jgroups subsystem. Therefore it would be good if this was removed from the documentation for the infinispan subsystem. However, if these settings affect the server hinting for infinispan (http://infinispan.org/docs/stable/user_guide/user_guide.html#ServerHinting) then some hint regarding these settings and how they pertain to server hinting would still need to be documented.
was:
The documentation for the Infinispan Subsystem in Wildfly 10 (https://docs.jboss.org/author/display/WFLY10/Infinispan+Subsystem) suggest that it should be possible to set the following attributes on the transport element of the cache-container:
site: This attribute configures the site id of the cache container.
rack: This attribute configures the rack id of the cache container.
machine: This attribute configures the machine id of the cache container
Setting these will fail due to parsing errors:
[Host Controller] 14:32:41,557 ERROR [org.jboss.as.host.controller] (Controller Boot Thread) WFLYHC0033: Caught exception during boot: org.jboss.as.controller.persistence.ConfigurationPersistenceException: WFLYCTL0085: Failed to parse configuration
[Host Controller] Message: WFLYCTL0197: Unexpected attribute 'machine' encountered
Further investigation revealed that this configuration was moved to the transport element of the jgroups subsystem and, thus, it would nice if this was removed from the documentation in for infinispan. However, if these settings affect the server hinting for infinispan (http://infinispan.org/docs/stable/user_guide/user_guide.html#ServerHinting) it would still be nice if this was explained in this documentation page.
> Setting 'site' attribute of cache-container transport fails on WF 10.1.0
> ------------------------------------------------------------------------
>
> Key: WFLY-7616
> URL: https://issues.jboss.org/browse/WFLY-7616
> Project: WildFly
> Issue Type: Feature Request
> Components: Documentation
> Affects Versions: 10.1.0.Final
> Reporter: Joe Siponen
> Priority: Minor
> Labels: infinispan
>
> The documentation for the Infinispan Subsystem in Wildfly 10 (https://docs.jboss.org/author/display/WFLY10/Infinispan+Subsystem) suggest that it should be possible to set the following attributes on the transport element of the cache-container:
> site: This attribute configures the site id of the cache container.
> rack: This attribute configures the rack id of the cache container.
> machine: This attribute configures the machine id of the cache container
> Setting these will fail due to parsing errors:
> [Host Controller] 14:32:41,557 ERROR [org.jboss.as.host.controller] (Controller Boot Thread) WFLYHC0033: Caught exception during boot: org.jboss.as.controller.persistence.ConfigurationPersistenceException: WFLYCTL0085: Failed to parse configuration
> [Host Controller] Message: WFLYCTL0197: Unexpected attribute 'machine' encountered
> Further investigation revealed that this failure was due to the configuration having been moved to the transport element of the jgroups subsystem. Therefore it would be good if this was removed from the documentation for the infinispan subsystem. However, if these settings affect the server hinting for infinispan (http://infinispan.org/docs/stable/user_guide/user_guide.html#ServerHinting) then some hint regarding these settings and how they pertain to server hinting would still need to be documented.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 5 months
[JBoss JIRA] (ELY-794) Missing input username wildcard for role/attribute search in Elytron ldap-realm
by Ondrej Lukas (JIRA)
[ https://issues.jboss.org/browse/ELY-794?page=com.atlassian.jira.plugin.sy... ]
Ondrej Lukas updated ELY-794:
-----------------------------
Affects Version/s: 1.1.0.Beta13
> Missing input username wildcard for role/attribute search in Elytron ldap-realm
> -------------------------------------------------------------------------------
>
> Key: ELY-794
> URL: https://issues.jboss.org/browse/ELY-794
> Project: WildFly Elytron
> Issue Type: Bug
> Affects Versions: 1.1.0.Beta13
> Reporter: Ondrej Lukas
> Assignee: Darran Lofthouse
> Priority: Critical
>
> Scenario: I am trying to assign role from LDAP to user. I would like to use input username (e.g. admin) in filter, not full user DN (e.g. uid=admin,ou=People,dc=jboss,dc=org). It seems Elytron ldap-realm does not provide any wildcard which can be used for input username.
> In EAP 7.0 (with PicketBox), LdapExtLoginModule provides roleFilter option which filter can contain following wildcards:
> * {{\{0\}}} - for input username
> * {{\{1\}}} - for authenticated full user DN
> It seems that Elytron supports only wildcard for authenticated full user DN (through {{\{0\}}} wildcard). Wildcard for input username should be added.
> It would be useful, when order of wildcards will be the same as in EAP 7.0 - i.e. not just add the new {{\{1\}}} for input username, but use {{\{0\}}} for input username and {{\{1\}}} for authenticated full user DN. This order is also better due to wildcard {{\{0\}}} will mean the same in identity filter and in role/attribute filter.
> Missing this feature in Elytron can lead to situation when migration from PicketBox to Elytron will not be possible since LDAP structure for role assignment used by legacy solution will not be able to work correctly with Elytron.
> Example of usage:
> I would like to use filter like {{(description=SOME_INPUT_USERNAME_WILDCARD)}} for assigning role JBossAdmin to user jduke in following ldif:
> {code}
> dn: ou=People,dc=jboss,dc=org
> objectclass: top
> objectclass: organizationalUnit
> ou: People
> dn: uid=jduke,ou=People,dc=jboss,dc=org
> objectclass: top
> objectclass: person
> objectclass: inetOrgPerson
> uid: jduke
> cn: Java Duke
> sn: Duke
> userPassword: Password
> dn: uid=notUsedUser,ou=People,dc=jboss,dc=org
> objectclass: top
> objectclass: person
> objectclass: inetOrgPerson
> uid: notUsedUser
> cn: not used user
> sn: notUsedUser
> userPassword: Password
> dn: ou=Roles,dc=jboss,dc=org
> objectclass: top
> objectclass: organizationalUnit
> ou: Roles
> dn: cn=JBossAdmin,ou=Roles,dc=jboss,dc=org
> objectclass: top
> objectclass: groupOfNames
> cn: JBossAdmin
> member: uid=notUsedUser,ou=People,dc=jboss,dc=org
> description: jduke
> {code}
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 5 months
[JBoss JIRA] (ELY-794) Missing input username wildcard for role/attribute search in Elytron ldap-realm
by Ondrej Lukas (JIRA)
[ https://issues.jboss.org/browse/ELY-794?page=com.atlassian.jira.plugin.sy... ]
Ondrej Lukas updated ELY-794:
-----------------------------
Component/s: Realms
> Missing input username wildcard for role/attribute search in Elytron ldap-realm
> -------------------------------------------------------------------------------
>
> Key: ELY-794
> URL: https://issues.jboss.org/browse/ELY-794
> Project: WildFly Elytron
> Issue Type: Bug
> Components: Realms
> Affects Versions: 1.1.0.Beta13
> Reporter: Ondrej Lukas
> Assignee: Darran Lofthouse
> Priority: Critical
>
> Scenario: I am trying to assign role from LDAP to user. I would like to use input username (e.g. admin) in filter, not full user DN (e.g. uid=admin,ou=People,dc=jboss,dc=org). It seems Elytron ldap-realm does not provide any wildcard which can be used for input username.
> In EAP 7.0 (with PicketBox), LdapExtLoginModule provides roleFilter option which filter can contain following wildcards:
> * {{\{0\}}} - for input username
> * {{\{1\}}} - for authenticated full user DN
> It seems that Elytron supports only wildcard for authenticated full user DN (through {{\{0\}}} wildcard). Wildcard for input username should be added.
> It would be useful, when order of wildcards will be the same as in EAP 7.0 - i.e. not just add the new {{\{1\}}} for input username, but use {{\{0\}}} for input username and {{\{1\}}} for authenticated full user DN. This order is also better due to wildcard {{\{0\}}} will mean the same in identity filter and in role/attribute filter.
> Missing this feature in Elytron can lead to situation when migration from PicketBox to Elytron will not be possible since LDAP structure for role assignment used by legacy solution will not be able to work correctly with Elytron.
> Example of usage:
> I would like to use filter like {{(description=SOME_INPUT_USERNAME_WILDCARD)}} for assigning role JBossAdmin to user jduke in following ldif:
> {code}
> dn: ou=People,dc=jboss,dc=org
> objectclass: top
> objectclass: organizationalUnit
> ou: People
> dn: uid=jduke,ou=People,dc=jboss,dc=org
> objectclass: top
> objectclass: person
> objectclass: inetOrgPerson
> uid: jduke
> cn: Java Duke
> sn: Duke
> userPassword: Password
> dn: uid=notUsedUser,ou=People,dc=jboss,dc=org
> objectclass: top
> objectclass: person
> objectclass: inetOrgPerson
> uid: notUsedUser
> cn: not used user
> sn: notUsedUser
> userPassword: Password
> dn: ou=Roles,dc=jboss,dc=org
> objectclass: top
> objectclass: organizationalUnit
> ou: Roles
> dn: cn=JBossAdmin,ou=Roles,dc=jboss,dc=org
> objectclass: top
> objectclass: groupOfNames
> cn: JBossAdmin
> member: uid=notUsedUser,ou=People,dc=jboss,dc=org
> description: jduke
> {code}
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 5 months
[JBoss JIRA] (ELY-794) Missing input username wildcard for role/attribute search in Elytron ldap-realm
by Ondrej Lukas (JIRA)
Ondrej Lukas created ELY-794:
--------------------------------
Summary: Missing input username wildcard for role/attribute search in Elytron ldap-realm
Key: ELY-794
URL: https://issues.jboss.org/browse/ELY-794
Project: WildFly Elytron
Issue Type: Bug
Reporter: Ondrej Lukas
Assignee: Darran Lofthouse
Priority: Critical
Scenario: I am trying to assign role from LDAP to user. I would like to use input username (e.g. admin) in filter, not full user DN (e.g. uid=admin,ou=People,dc=jboss,dc=org). It seems Elytron ldap-realm does not provide any wildcard which can be used for input username.
In EAP 7.0 (with PicketBox), LdapExtLoginModule provides roleFilter option which filter can contain following wildcards:
* {{\{0\}}} - for input username
* {{\{1\}}} - for authenticated full user DN
It seems that Elytron supports only wildcard for authenticated full user DN (through {{\{0\}}} wildcard). Wildcard for input username should be added.
It would be useful, when order of wildcards will be the same as in EAP 7.0 - i.e. not just add the new {{\{1\}}} for input username, but use {{\{0\}}} for input username and {{\{1\}}} for authenticated full user DN. This order is also better due to wildcard {{\{0\}}} will mean the same in identity filter and in role/attribute filter.
Missing this feature in Elytron can lead to situation when migration from PicketBox to Elytron will not be possible since LDAP structure for role assignment used by legacy solution will not be able to work correctly with Elytron.
Example of usage:
I would like to use filter like {{(description=SOME_INPUT_USERNAME_WILDCARD)}} for assigning role JBossAdmin to user jduke in following ldif:
{code}
dn: ou=People,dc=jboss,dc=org
objectclass: top
objectclass: organizationalUnit
ou: People
dn: uid=jduke,ou=People,dc=jboss,dc=org
objectclass: top
objectclass: person
objectclass: inetOrgPerson
uid: jduke
cn: Java Duke
sn: Duke
userPassword: Password
dn: uid=notUsedUser,ou=People,dc=jboss,dc=org
objectclass: top
objectclass: person
objectclass: inetOrgPerson
uid: notUsedUser
cn: not used user
sn: notUsedUser
userPassword: Password
dn: ou=Roles,dc=jboss,dc=org
objectclass: top
objectclass: organizationalUnit
ou: Roles
dn: cn=JBossAdmin,ou=Roles,dc=jboss,dc=org
objectclass: top
objectclass: groupOfNames
cn: JBossAdmin
member: uid=notUsedUser,ou=People,dc=jboss,dc=org
description: jduke
{code}
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 5 months