[JBoss JIRA] (ELY-274) Add handling for ExtendedChoiceCallback to AuthenticationConfiguration
by Farah Juma (JIRA)
[ https://issues.jboss.org/browse/ELY-274?page=com.atlassian.jira.plugin.sy... ]
Farah Juma commented on ELY-274:
--------------------------------
Verified that support for the {{ExtendedChoiceCallback}} is still necessary for the OTP SASL mechanism. (This callback is used by {{OTPSaslClient}} to determine the one-time password response type, i.e., “hex”, “word”, “init-hex”, or “init-word”.) Note that I’ve modified Kabir’s changes slightly so that a String choice is specified via the {{AuthenticationConfiguration}} instead of an index into the choices list. This is similar to the way a realm choice can currently be specified.
> Add handling for ExtendedChoiceCallback to AuthenticationConfiguration
> ----------------------------------------------------------------------
>
> Key: ELY-274
> URL: https://issues.jboss.org/browse/ELY-274
> Project: WildFly Elytron
> Issue Type: Feature Request
> Components: Callbacks
> Reporter: Kabir Khan
> Assignee: Kabir Khan
> Fix For: 1.1.0.Beta6
>
>
> Needed for things like OTP
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
9 years, 11 months
[JBoss JIRA] (ELY-273) Expose RealmIdentity.getAttributes()
by Farah Juma (JIRA)
[ https://issues.jboss.org/browse/ELY-273?page=com.atlassian.jira.plugin.sy... ]
Farah Juma commented on ELY-273:
--------------------------------
Verified that this is still necessary. The timeout info that’s needed in order to prevent multiple simultaneous authentication sessions for the OTP SASL mechanism is currently stored using a {{RealmIdentity}} attribute. Thus, the {{RealmIdentity#getAttributes}} method is needed to access this attribute for a given identity.
> Expose RealmIdentity.getAttributes()
> ------------------------------------
>
> Key: ELY-273
> URL: https://issues.jboss.org/browse/ELY-273
> Project: WildFly Elytron
> Issue Type: Feature Request
> Components: Realms
> Reporter: Kabir Khan
> Assignee: Kabir Khan
> Fix For: 1.1.0.Beta6
>
>
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
9 years, 11 months
[JBoss JIRA] (ELY-535) Make use of realm events to handle password updates and resets for the OTP SASL mechanism
by Farah Juma (JIRA)
[ https://issues.jboss.org/browse/ELY-535?page=com.atlassian.jira.plugin.sy... ]
Farah Juma commented on ELY-535:
--------------------------------
For handling OTP credential updates, my initial thought was that we’d be able to eliminate the {{CredentialUpdateCallback}} and just make use of a {{RealmAuthenticationEvent}} to update an OTP credential once authentication has completed. However, there doesn’t seem to be a good way for {{ServerAuthenticationContext}} to keep track of the actual credential that was used in an authentication in order to pass it to a {{RealmAuthenticationEvent}}. Thus, it seems to make more sense to add support for a new event that indicates a credential change for a realm identity and then handle a {{CredentialUpdateCallback}} by handling this new event.
> Make use of realm events to handle password updates and resets for the OTP SASL mechanism
> -----------------------------------------------------------------------------------------
>
> Key: ELY-535
> URL: https://issues.jboss.org/browse/ELY-535
> Project: WildFly Elytron
> Issue Type: Feature Request
> Components: SASL
> Reporter: Farah Juma
> Assignee: Farah Juma
>
> For the OTP SASL mechanism, the stored credential needs to be updated once a guess has been verified. In the standard case, this involves updating the stored hash based on the guess and decrementing the sequence number by 1. The OTP SASL mechanism also supports OTP sequence resets, where a user provides both a guess and a new OTP password with new parameters. If verification of the guess succeeds, then the stored credential is updated based on the new password and new parameters. However, if verification of the guess succeeds but the new password/parameters are invalid, then the stored hash is updated based on the guess and the sequence number is decremented by 1, as in the non-reset case (note that SASL auth fails in this case though).
> PR #277 [adds handling|https://github.com/kabir/wildfly-elytron/blob/otp-test/src/main/...] for a {{CredentialUpdateCallback}} in {{ServerAuthenticationContext}}. This is used to handle both the OTP sequence reset case as well as the non-reset case. Instead of manipulating the realm identity directly in the SAC callback handler, we should be able to make use of [realm events|https://github.com/wildfly-security/wildfly-elytron/pull/295] so that the realm itself can handle OTP updates and resets.
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
9 years, 11 months
[JBoss JIRA] (ELY-555) Adjust MechanismConfiguration to reference a single SecurityFactory<Credential>
by Darran Lofthouse (JIRA)
Darran Lofthouse created ELY-555:
------------------------------------
Summary: Adjust MechanismConfiguration to reference a single SecurityFactory<Credential>
Key: ELY-555
URL: https://issues.jboss.org/browse/ELY-555
Project: WildFly Elytron
Issue Type: Enhancement
Components: API / SPI
Reporter: Darran Lofthouse
Assignee: Darran Lofthouse
Fix For: 1.1.0.Beta6
This configuration is already mechanism specific, ELY-554 will also make it server specific - by which point a reference to a single Factory will be sufficient.
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
9 years, 11 months
[JBoss JIRA] (WFLY-6527) Cannot lookup RemoteConnectionFactory using https-remoting
by George Turner (JIRA)
[ https://issues.jboss.org/browse/WFLY-6527?page=com.atlassian.jira.plugin.... ]
George Turner commented on WFLY-6527:
-------------------------------------
It is not possible, we are already behind our deadlines. I have migrated all remote ejb and jms code to using servlet interfaces. That seems to be the ONLY thing in WildFly that handles mutual 2 way SSL.
> Cannot lookup RemoteConnectionFactory using https-remoting
> ----------------------------------------------------------
>
> Key: WFLY-6527
> URL: https://issues.jboss.org/browse/WFLY-6527
> Project: WildFly
> Issue Type: Bug
> Components: Remoting
> Affects Versions: 10.0.0.Final
> Environment: RedHat Linux, Java 1.8
> Reporter: George Turner
> Assignee: David Lloyd
>
> I have successfully configured the system for two way ssl. I can connect to a topic from a standalone client, but I cannot connect with the same code from an EJB client using the following:
> Properties props = new Properties();
> props.put(Context.INITIAL_CONTEXT_FACTORY, "org.jboss.naming.remote.client.InitialContextFactory");
> ctx = new InitialContext(props);
> ConnectionFactory cf = (ConnectionFactory) ctx.lookup("jms/RemoteConnectionFactory");
> It seems to "attach" the stateless bean to the first remote instance and then the second remote instance lookup fails. I have tried using the EJBClientContext properties (as used for EJB lookups) but no help. There is VERY little documentation about using https-remoting.
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
9 years, 11 months