[JBoss JIRA] (SECURITY-944) AdvancedLdapLoginModule with rolesCtxDN=null leads to authentication failure
by Darran Lofthouse (JIRA)
[ https://issues.jboss.org/browse/SECURITY-944?page=com.atlassian.jira.plug... ]
Darran Lofthouse moved WFLY-6533 to SECURITY-944:
-------------------------------------------------
Project: PicketBox (was: WildFly)
Key: SECURITY-944 (was: WFLY-6533)
Workflow: classic default workflow (was: GIT Pull Request workflow )
Component/s: Negotiation
(was: Security)
Affects Version/s: Negotiation_3_0_2_Final
(was: 10.0.0.Final)
> AdvancedLdapLoginModule with rolesCtxDN=null leads to authentication failure
> ----------------------------------------------------------------------------
>
> Key: SECURITY-944
> URL: https://issues.jboss.org/browse/SECURITY-944
> Project: PicketBox
> Issue Type: Bug
> Components: Negotiation
> Affects Versions: Negotiation_3_0_2_Final
> Reporter: Ondrej Lukas
> Assignee: Tomas Hofman
>
> In case when AdvancedLdapLoginModule is correctly configured for authentication, but its attribute rolesCtxDN is not set (i.e. is null), then authentication with correct username and password fails. It is caused be internal NPE for searching roles.
> Expected behavior is that user should be authenticated but no roles should be assigned to them.
> Internal NPE:
> {code}
> java.lang.NullPointerException:
> at org.jboss.as.naming.InitialContext.getURLScheme(InitialContext.java:160)
> at org.jboss.as.naming.InitialContext.getURLOrDefaultInitCtx(InitialContext.java:128)
> at javax.naming.directory.InitialDirContext.getURLOrDefaultInitDirCtx(InitialDirContext.java:106)
> at javax.naming.directory.InitialDirContext.search(InitialDirContext.java:286)
> at javax.naming.directory.InitialDirContext.search(InitialDirContext.java:286)
> at org.jboss.security.negotiation.AdvancedLdapLoginModule.rolesSearch(AdvancedLdapLoginModule.java:720)
> at org.jboss.security.negotiation.AdvancedLdapLoginModule.innerLogin(AdvancedLdapLoginModule.java:403)
> at org.jboss.security.negotiation.AdvancedLdapLoginModule$AuthorizeAction.run(AdvancedLdapLoginModule.java:967)
> at org.jboss.security.negotiation.AdvancedLdapLoginModule.login(AdvancedLdapLoginModule.java:326)
> sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> ...
> {code}
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
10 years
[JBoss JIRA] (SECURITY-944) AdvancedLdapLoginModule with rolesCtxDN=null leads to authentication failure
by Darran Lofthouse (JIRA)
[ https://issues.jboss.org/browse/SECURITY-944?page=com.atlassian.jira.plug... ]
Darran Lofthouse updated SECURITY-944:
--------------------------------------
Fix Version/s: Negotiation_3_0_3_CR1
> AdvancedLdapLoginModule with rolesCtxDN=null leads to authentication failure
> ----------------------------------------------------------------------------
>
> Key: SECURITY-944
> URL: https://issues.jboss.org/browse/SECURITY-944
> Project: PicketBox
> Issue Type: Bug
> Components: Negotiation
> Affects Versions: Negotiation_3_0_2_Final
> Reporter: Ondrej Lukas
> Assignee: Tomas Hofman
> Fix For: Negotiation_3_0_3_CR1
>
>
> In case when AdvancedLdapLoginModule is correctly configured for authentication, but its attribute rolesCtxDN is not set (i.e. is null), then authentication with correct username and password fails. It is caused be internal NPE for searching roles.
> Expected behavior is that user should be authenticated but no roles should be assigned to them.
> Internal NPE:
> {code}
> java.lang.NullPointerException:
> at org.jboss.as.naming.InitialContext.getURLScheme(InitialContext.java:160)
> at org.jboss.as.naming.InitialContext.getURLOrDefaultInitCtx(InitialContext.java:128)
> at javax.naming.directory.InitialDirContext.getURLOrDefaultInitDirCtx(InitialDirContext.java:106)
> at javax.naming.directory.InitialDirContext.search(InitialDirContext.java:286)
> at javax.naming.directory.InitialDirContext.search(InitialDirContext.java:286)
> at org.jboss.security.negotiation.AdvancedLdapLoginModule.rolesSearch(AdvancedLdapLoginModule.java:720)
> at org.jboss.security.negotiation.AdvancedLdapLoginModule.innerLogin(AdvancedLdapLoginModule.java:403)
> at org.jboss.security.negotiation.AdvancedLdapLoginModule$AuthorizeAction.run(AdvancedLdapLoginModule.java:967)
> at org.jboss.security.negotiation.AdvancedLdapLoginModule.login(AdvancedLdapLoginModule.java:326)
> sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> ...
> {code}
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
10 years
[JBoss JIRA] (WFLY-6533) AdvancedLdapLoginModule with rolesCtxDN=null leads to authentication failure
by Tomas Hofman (JIRA)
[ https://issues.jboss.org/browse/WFLY-6533?page=com.atlassian.jira.plugin.... ]
Tomas Hofman reassigned WFLY-6533:
----------------------------------
Assignee: Tomas Hofman (was: Darran Lofthouse)
> AdvancedLdapLoginModule with rolesCtxDN=null leads to authentication failure
> ----------------------------------------------------------------------------
>
> Key: WFLY-6533
> URL: https://issues.jboss.org/browse/WFLY-6533
> Project: WildFly
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.0.0.Final
> Reporter: Ondrej Lukas
> Assignee: Tomas Hofman
>
> In case when AdvancedLdapLoginModule is correctly configured for authentication, but its attribute rolesCtxDN is not set (i.e. is null), then authentication with correct username and password fails. It is caused be internal NPE for searching roles.
> Expected behavior is that user should be authenticated but no roles should be assigned to them.
> Internal NPE:
> {code}
> java.lang.NullPointerException:
> at org.jboss.as.naming.InitialContext.getURLScheme(InitialContext.java:160)
> at org.jboss.as.naming.InitialContext.getURLOrDefaultInitCtx(InitialContext.java:128)
> at javax.naming.directory.InitialDirContext.getURLOrDefaultInitDirCtx(InitialDirContext.java:106)
> at javax.naming.directory.InitialDirContext.search(InitialDirContext.java:286)
> at javax.naming.directory.InitialDirContext.search(InitialDirContext.java:286)
> at org.jboss.security.negotiation.AdvancedLdapLoginModule.rolesSearch(AdvancedLdapLoginModule.java:720)
> at org.jboss.security.negotiation.AdvancedLdapLoginModule.innerLogin(AdvancedLdapLoginModule.java:403)
> at org.jboss.security.negotiation.AdvancedLdapLoginModule$AuthorizeAction.run(AdvancedLdapLoginModule.java:967)
> at org.jboss.security.negotiation.AdvancedLdapLoginModule.login(AdvancedLdapLoginModule.java:326)
> sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> ...
> {code}
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
10 years
[JBoss JIRA] (WFLY-6539) SingletonDeploymentDescriptorTestCase and SingletonDeploymentJBossAllTestCase fails due to http-trace disallowed
by Ivan Straka (JIRA)
Ivan Straka created WFLY-6539:
---------------------------------
Summary: SingletonDeploymentDescriptorTestCase and SingletonDeploymentJBossAllTestCase fails due to http-trace disallowed
Key: WFLY-6539
URL: https://issues.jboss.org/browse/WFLY-6539
Project: WildFly
Issue Type: Bug
Components: Test Suite
Reporter: Ivan Straka
Priority: Minor
There are two tests
* SingletonDeploymentDescriptorTestCase
* SingletonDeploymentJBossAllTestCase
that fails because http-trace is disallowed
{code:java}
Error Details
expected:<200> but was:<405>
Stack Trace
java.lang.AssertionError: expected:<200> but was:<405>
at org.junit.Assert.fail(Assert.java:88)
at org.junit.Assert.failNotEquals(Assert.java:834)
at org.junit.Assert.assertEquals(Assert.java:645)
at org.junit.Assert.assertEquals(Assert.java:631)
at org.jboss.as.test.clustering.cluster.singleton.SingletonDeploymentTestCase.test(SingletonDeploymentTestCase.java:107)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
...
{code}
We need to enable http-trace requests in testsuite configurations.
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
10 years
[JBoss JIRA] (WFLY-6539) SingletonDeploymentDescriptorTestCase and SingletonDeploymentJBossAllTestCase fails due to http-trace disallowed
by Ivan Straka (JIRA)
[ https://issues.jboss.org/browse/WFLY-6539?page=com.atlassian.jira.plugin.... ]
Ivan Straka updated WFLY-6539:
------------------------------
Affects Version/s: 10.0.0.Final
> SingletonDeploymentDescriptorTestCase and SingletonDeploymentJBossAllTestCase fails due to http-trace disallowed
> ----------------------------------------------------------------------------------------------------------------
>
> Key: WFLY-6539
> URL: https://issues.jboss.org/browse/WFLY-6539
> Project: WildFly
> Issue Type: Bug
> Components: Test Suite
> Affects Versions: 10.0.0.Final
> Reporter: Ivan Straka
> Priority: Minor
>
> There are two tests
> * SingletonDeploymentDescriptorTestCase
> * SingletonDeploymentJBossAllTestCase
> that fails because http-trace is disallowed
> {code:java}
> Error Details
> expected:<200> but was:<405>
> Stack Trace
> java.lang.AssertionError: expected:<200> but was:<405>
> at org.junit.Assert.fail(Assert.java:88)
> at org.junit.Assert.failNotEquals(Assert.java:834)
> at org.junit.Assert.assertEquals(Assert.java:645)
> at org.junit.Assert.assertEquals(Assert.java:631)
> at org.jboss.as.test.clustering.cluster.singleton.SingletonDeploymentTestCase.test(SingletonDeploymentTestCase.java:107)
> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
> ...
> {code}
> We need to enable http-trace requests in testsuite configurations.
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
10 years
[JBoss JIRA] (WFLY-6473) BeanFactoryTestCase fails with security manager
by Hynek Švábek (JIRA)
[ https://issues.jboss.org/browse/WFLY-6473?page=com.atlassian.jira.plugin.... ]
Hynek Švábek reassigned WFLY-6473:
----------------------------------
Assignee: Hynek Švábek (was: Jan Tymel)
> BeanFactoryTestCase fails with security manager
> -----------------------------------------------
>
> Key: WFLY-6473
> URL: https://issues.jboss.org/browse/WFLY-6473
> Project: WildFly
> Issue Type: Bug
> Components: Test Suite
> Reporter: Jan Tymel
> Assignee: Hynek Švábek
>
> *org.jboss.as.test.integration.pojo.test.BeanFactoryTestCase*
> {{./integration-tests.sh -DtestLogToFile=false -Dts.noSmoke -Dts.basic -Dtest=org.jboss.as.test.integration.pojo.test.BeanFactoryTestCase -Dsecurity.manager}}
> Fails with:
> {code}
> Caused by: java.security.AccessControlException: WFSM000001: Permission check failed (permission "("java.lang.RuntimePermission" "getClassLoader")" in code source "(vfs:/content/bean-factory.jar <no signer certificates>)" of "null")
> at org.wildfly.security.manager.WildFlySecurityManager.checkPermission(WildFlySecurityManager.java:273)
> at org.wildfly.security.manager.WildFlySecurityManager.checkPermission(WildFlySecurityManager.java:175)
> at org.jboss.modules.Module.getClassLoader(Module.java:421)
> at org.jboss.as.pojo.descriptor.BaseBeanFactory.create(BaseBeanFactory.java:44)
> ... 19 more
> {code}
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
10 years
[JBoss JIRA] (WFLY-6532) AdvancedLdapLoginModule with rolesCtxDN="" can lead to authentication failure
by Tomas Hofman (JIRA)
[ https://issues.jboss.org/browse/WFLY-6532?page=com.atlassian.jira.plugin.... ]
Tomas Hofman reassigned WFLY-6532:
----------------------------------
Assignee: Tomas Hofman (was: Darran Lofthouse)
> AdvancedLdapLoginModule with rolesCtxDN="" can lead to authentication failure
> -----------------------------------------------------------------------------
>
> Key: WFLY-6532
> URL: https://issues.jboss.org/browse/WFLY-6532
> Project: WildFly
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.0.0.Final
> Reporter: Ondrej Lukas
> Assignee: Tomas Hofman
>
> In case when AdvancedLdapLoginModule is correctly configured for authentication and its attribute rolesCtxDN="", then authentication can fail. This happens when any role is found in LDAP by role search. It is caused by {{canonicalize}} method which returns string which ends with comma for empty rolesCtxDN which is invalid name for searching LDAP.
> In correct behavior authentication should pass and found roles should be assigned to user.
> In case when no role is found, then authentication succeed which is correct behavior.
> Thrown exception:
> {code}
> javax.naming.InvalidNameException: cn=Echo,ou=Roles2,o=AdvancedLdapLMEmptyRolesCtxDnOptionTestCasee7b6b29d,o=primary,dc=jboss,dc=org,: [LDAP: error code 34 - Invalid root Dn given : cn=Echo,ou=Roles2,o=AdvancedLdapLMEmptyRolesCtxDnOptionTestCasee7b6b29d,o=primary,dc=jboss,dc=org, (0x63 0x6E 0x3D 0x45 0x63 0x68 0x6F 0x2C 0x6F 0x75 0x3D 0x52 0x6F 0x6C 0x65 0x73 0x32 0x2C 0x6F 0x3D 0x41 0x64 0x76 0x61 0x6E 0x63 0x65 0x64 0x4C 0x64 0x61 0x70 0x4C 0x4D 0x45 0x6D 0x70 0x74 0x79 0x52 0x6F 0x6C 0x65 0x73 0x43 0x74 0x78 0x44 0x6E 0x4F 0x70 0x74 0x69 0x6F 0x6E 0x54 0x65 0x73 0x74 0x43 0x61 0x73 0x65 0x65 0x37 0x62 0x36 0x62 0x32 0x39 0x64 0x2C 0x6F 0x3D 0x70 0x72 0x69 0x6D 0x61 0x72 0x79 0x2C 0x64 0x63 0x3D 0x6A 0x62 0x6F 0x73 0x73 0x2C 0x64 0x63 0x3D 0x6F 0x72 0x67 0x2C ) is invalid]; remaining name 'cn=Echo,ou=Roles2,o=AdvancedLdapLMEmptyRolesCtxDnOptionTestCasee7b6b29d,o=primary,dc=jboss,dc=org,'
> com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3074)
> com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2888)
> com.sun.jndi.ldap.LdapCtx.c_getAttributes(LdapCtx.java:1329)
> com.sun.jndi.toolkit.ctx.ComponentDirContext.p_getAttributes(ComponentDirContext.java:235)
> com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.getAttributes(PartialCompositeDirContext.java:141)
> com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.getAttributes(PartialCompositeDirContext.java:129)
> javax.naming.directory.InitialDirContext.getAttributes(InitialDirContext.java:142)
> javax.naming.directory.InitialDirContext.getAttributes(InitialDirContext.java:142)
> org.jboss.security.negotiation.AdvancedLdapLoginModule.obtainRole(AdvancedLdapLoginModule.java:801)
> org.jboss.security.negotiation.AdvancedLdapLoginModule.rolesSearch(AdvancedLdapLoginModule.java:737)
> org.jboss.security.negotiation.AdvancedLdapLoginModule.innerLogin(AdvancedLdapLoginModule.java:403)
> org.jboss.security.negotiation.AdvancedLdapLoginModule$AuthorizeAction.run(AdvancedLdapLoginModule.java:967)
> org.jboss.security.negotiation.AdvancedLdapLoginModule.login(AdvancedLdapLoginModule.java:326)
> sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> ...
> {code}
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
10 years
[JBoss JIRA] (DROOLS-1094) OptaPlanner Kie server service: unable to retrieve best solution
by Lukáš Petrovický (JIRA)
[ https://issues.jboss.org/browse/DROOLS-1094?page=com.atlassian.jira.plugi... ]
Lukáš Petrovický updated DROOLS-1094:
-------------------------------------
Labels: qe-recommend-fix-before-6_4_Final reported-by-qe (was: qe-recommend-fix-before-6_4_Final qe-recommend-fix-before-ga reported-by-qe)
> OptaPlanner Kie server service: unable to retrieve best solution
> ----------------------------------------------------------------
>
> Key: DROOLS-1094
> URL: https://issues.jboss.org/browse/DROOLS-1094
> Project: Drools
> Issue Type: Bug
> Components: kie server
> Affects Versions: 6.4.0.CR1
> Environment: Kie server OptaPlanner service
> Reporter: Karel Suta
> Assignee: Geoffrey De Smet
> Labels: qe-recommend-fix-before-6_4_Final, reported-by-qe
> Fix For: 6.4.0.Final, 7.0.0.Final
>
>
> When I try to retrieve best solution from Solver in Kie server OptaPlanner extension, JAXB and XSTREAM works correctly but JSON doesn't. JSON marshalling isn't able to map planning variable in planning entity.
> It can be simulated using cloudbalance problem which is part of Kie server OptaPlanner integration tests. See test method testGetBestSolution in OptaplannerIntegrationTest.
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
10 years
[JBoss JIRA] (DROOLS-1094) OptaPlanner Kie server service: unable to retrieve best solution
by Lukáš Petrovický (JIRA)
[ https://issues.jboss.org/browse/DROOLS-1094?page=com.atlassian.jira.plugi... ]
Lukáš Petrovický updated DROOLS-1094:
-------------------------------------
Labels: qe-recommend-fix-before-6_4_Final qe-recommend-fix-before-ga reported-by-qe (was: qe-recommend-fix-before-ga reported-by-qe)
> OptaPlanner Kie server service: unable to retrieve best solution
> ----------------------------------------------------------------
>
> Key: DROOLS-1094
> URL: https://issues.jboss.org/browse/DROOLS-1094
> Project: Drools
> Issue Type: Bug
> Components: kie server
> Affects Versions: 6.4.0.CR1
> Environment: Kie server OptaPlanner service
> Reporter: Karel Suta
> Assignee: Geoffrey De Smet
> Labels: qe-recommend-fix-before-6_4_Final, qe-recommend-fix-before-ga, reported-by-qe
> Fix For: 6.4.0.Final, 7.0.0.Final
>
>
> When I try to retrieve best solution from Solver in Kie server OptaPlanner extension, JAXB and XSTREAM works correctly but JSON doesn't. JSON marshalling isn't able to map planning variable in planning entity.
> It can be simulated using cloudbalance problem which is part of Kie server OptaPlanner integration tests. See test method testGetBestSolution in OptaplannerIntegrationTest.
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
10 years