[JBoss JIRA] (WFCORE-1647) Default app-name value of Syslog handler in Audit Logging violates specification
by Ken Wills (JIRA)
[ https://issues.jboss.org/browse/WFCORE-1647?page=com.atlassian.jira.plugi... ]
Ken Wills commented on WFCORE-1647:
-----------------------------------
[~bstansberry] I've just patched this to replace any non-printing chars or a space with '-', I'll send up the PR. (I just noticed your additional comment before I grabbed the ticket.
> Default app-name value of Syslog handler in Audit Logging violates specification
> --------------------------------------------------------------------------------
>
> Key: WFCORE-1647
> URL: https://issues.jboss.org/browse/WFCORE-1647
> Project: WildFly Core
> Issue Type: Bug
> Components: Domain Management
> Affects Versions: 3.0.0.Alpha3
> Reporter: Jan Tymel
> Assignee: Ken Wills
>
> According to syslog specification[1] {{app-name}} cannot contain space character (" "). However, the default value in WildFly Core 3.0.0.Alpha3 is {{WildFly Core}}. This results in the syslog server is not able to capture Process ID from which the message was sent.
> E.g. following piece of information is captured {{WildFly[Core] (...)}} instead of {{WildFlyCore[795]}}
> Suggestions for improvement:
> Change default value {{WildFly Core}} to one without space character.
> Also please consider addition of check whether {{app-name}} contains space character.
> [1] https://tools.ietf.org/html/rfc5424#page-8
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
8 years, 6 months
[JBoss JIRA] (WFCORE-1647) Default app-name value of Syslog handler in Audit Logging violates specification
by Ken Wills (JIRA)
[ https://issues.jboss.org/browse/WFCORE-1647?page=com.atlassian.jira.plugi... ]
Ken Wills reassigned WFCORE-1647:
---------------------------------
Assignee: Ken Wills (was: Tomaz Cerar)
> Default app-name value of Syslog handler in Audit Logging violates specification
> --------------------------------------------------------------------------------
>
> Key: WFCORE-1647
> URL: https://issues.jboss.org/browse/WFCORE-1647
> Project: WildFly Core
> Issue Type: Bug
> Components: Domain Management
> Affects Versions: 3.0.0.Alpha3
> Reporter: Jan Tymel
> Assignee: Ken Wills
>
> According to syslog specification[1] {{app-name}} cannot contain space character (" "). However, the default value in WildFly Core 3.0.0.Alpha3 is {{WildFly Core}}. This results in the syslog server is not able to capture Process ID from which the message was sent.
> E.g. following piece of information is captured {{WildFly[Core] (...)}} instead of {{WildFlyCore[795]}}
> Suggestions for improvement:
> Change default value {{WildFly Core}} to one without space character.
> Also please consider addition of check whether {{app-name}} contains space character.
> [1] https://tools.ietf.org/html/rfc5424#page-8
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
8 years, 6 months
[JBoss JIRA] (WFLY-6809) Web authentication not treating "**" role constraint as expected
by Guillermo González de Agüero (JIRA)
[ https://issues.jboss.org/browse/WFLY-6809?page=com.atlassian.jira.plugin.... ]
Guillermo González de Agüero commented on WFLY-6809:
----------------------------------------------------
I read somewhere that the "**" role was a coordinated effort from the Servlet, EJB and JACC specs.
Check section 3.1.3.2 of the JACC spec (http://download.oracle.com/otndocs/jcp/jacc-1_5-mrel3-eval-spec/):
??A WebResourcePermission must be added to the corresponding role for each distinct combination in the cross-product of url-pattern and role-name occurring in the security-constraint elements that contain an auth-constraint naming roles. If the “any authenticated user” role-name, “\*\*”, occurs in an auth-constraint, a WebResourcePermission must also be added to the “\*\*” role. When an auth-constraint names the reserved role-name, "\*", all of the patterns in the containing security-constraint must be combined with all of the roles defined in the web application; which must not include the role “\*\*” unless the application has defined an application role named “\*\*”.??
As a side note, Payara/GlassFish behaves the way I mentioned. Don't know about other containers.
> Web authentication not treating "**" role constraint as expected
> ----------------------------------------------------------------
>
> Key: WFLY-6809
> URL: https://issues.jboss.org/browse/WFLY-6809
> Project: WildFly
> Issue Type: Bug
> Components: Web (Undertow)
> Affects Versions: 10.0.0.Final
> Reporter: Guillermo González de Agüero
> Assignee: Stuart Douglas
> Attachments: rolestest.war
>
>
> Servlet spec 3.1 states at point 13.3:
> ??If the role-name of the security-role to be tested is “**”, and the application has NOT declared an application security-role with role-name “**”, isUserInRole must only return true if the user has been authenticated; that is, only when getRemoteUser and getUserPrincipal would both return a non-null value. Otherwise, the container must check the user for membership in the application role.??
> But Undertow treats the special role "**" as any other. With the following web.xml authorization succeeds, but authorization fails (403):
> {code:xml}
> <?xml version="1.0" encoding="UTF-8"?>
> <web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
> xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
> version="3.1">
> <security-constraint>
> <web-resource-collection>
> <url-pattern>/*</url-pattern>
> </web-resource-collection>
> <auth-constraint>
> <role-name>**</role-name>
> </auth-constraint>
> </security-constraint>
> <login-config>
> <auth-method>BASIC</auth-method>
> </login-config>
> </web-app>
> {code}
> With the following, and authenticating a user that has a role "**", the requested page is shown:
> {code:xml}
> <?xml version="1.0" encoding="UTF-8"?>
> <web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
> xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
> version="3.1">
> <security-constraint>
> <web-resource-collection>
> <url-pattern>/*</url-pattern>
> </web-resource-collection>
> <auth-constraint>
> <role-name>**</role-name>
> </auth-constraint>
> </security-constraint>
> <login-config>
> <auth-method>BASIC</auth-method>
> </login-config>
> <security-role>
> <role-name>**</role-name>
> </security-role>
> </web-app>
> {code}
> Reproducer war is attached.
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
8 years, 6 months
[JBoss JIRA] (WFCORE-1647) Default app-name value of Syslog handler in Audit Logging violates specification
by Brian Stansberry (JIRA)
[ https://issues.jboss.org/browse/WFCORE-1647?page=com.atlassian.jira.plugi... ]
Brian Stansberry reassigned WFCORE-1647:
----------------------------------------
Assignee: Tomaz Cerar (was: Brian Stansberry)
[~ctomc] Please confirm that no problem will exist if whatever drives this has a space (not just that it's ok with the current data.) If it's ok, please resolve, if not perhaps replacing space with underscore can work. Or just removing.
> Default app-name value of Syslog handler in Audit Logging violates specification
> --------------------------------------------------------------------------------
>
> Key: WFCORE-1647
> URL: https://issues.jboss.org/browse/WFCORE-1647
> Project: WildFly Core
> Issue Type: Bug
> Components: Domain Management
> Affects Versions: 3.0.0.Alpha3
> Reporter: Jan Tymel
> Assignee: Tomaz Cerar
>
> According to syslog specification[1] {{app-name}} cannot contain space character (" "). However, the default value in WildFly Core 3.0.0.Alpha3 is {{WildFly Core}}. This results in the syslog server is not able to capture Process ID from which the message was sent.
> E.g. following piece of information is captured {{WildFly[Core] (...)}} instead of {{WildFlyCore[795]}}
> Suggestions for improvement:
> Change default value {{WildFly Core}} to one without space character.
> Also please consider addition of check whether {{app-name}} contains space character.
> [1] https://tools.ietf.org/html/rfc5424#page-8
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
8 years, 6 months
[JBoss JIRA] (WFCORE-710) Make ServerOperationResolver handle deployment-overlays similarly to deployments
by Brian Stansberry (JIRA)
[ https://issues.jboss.org/browse/WFCORE-710?page=com.atlassian.jira.plugin... ]
Brian Stansberry reassigned WFCORE-710:
---------------------------------------
Assignee: (was: Brian Stansberry)
> Make ServerOperationResolver handle deployment-overlays similarly to deployments
> --------------------------------------------------------------------------------
>
> Key: WFCORE-710
> URL: https://issues.jboss.org/browse/WFCORE-710
> Project: WildFly Core
> Issue Type: Feature Request
> Components: Domain Management
> Affects Versions: 2.0.0.Alpha2
> Reporter: Kabir Khan
> Fix For: 3.0.0.Alpha4
>
>
> Currently in domain mode a
> {code}
> /deployment-overlay=xxx:add(...)
> {code}
> results in a deployment overlay on ALL servers.
> However for deployments
> {code}
> /deployment=xxx:add(...)
> {code}
> does not get pushed to the servers. This happens when it is associated with a server group:
> {code}
> /server-group=zzz/deployment=xxx:add(...)
> {code}
> Similarly
> {code}
> /deployment-overlay=xxx:add(...)
> {code}
> should not get pushed to the servers, until we have a
> {code}
> /server-group=zzz/deployment=yyy:add(...)
> {code}
> which picks out the servers we want to have the overlay
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
8 years, 6 months
[JBoss JIRA] (WFLY-6827) JGroups subsystem version bump needed
by Brian Stansberry (JIRA)
[ https://issues.jboss.org/browse/WFLY-6827?page=com.atlassian.jira.plugin.... ]
Brian Stansberry commented on WFLY-6827:
----------------------------------------
WFLY-6828 is a dup of this but has some more details on where the add-index stuff came from.
> JGroups subsystem version bump needed
> -------------------------------------
>
> Key: WFLY-6827
> URL: https://issues.jboss.org/browse/WFLY-6827
> Project: WildFly
> Issue Type: Bug
> Components: Clustering
> Reporter: Kabir Khan
> Assignee: Paul Ferraro
> Priority: Blocker
> Fix For: 10.1.0.Final
>
>
> Doing a model comparison of current master against EAP 7.0.0 I came across this:
> {code}
> ====== Resource root address: ["subsystem" => "jdr"] - Current version: 1.2.0; legacy version: 1.2.0 =======
> ====== Resource root address: ["subsystem" => "jgroups"] - Current version: 4.0.0; legacy version: 4.0.0 =======
> --- Problems for relative address to root ["channel" => "*","fork" => "*","protocol" => "*"]:
> Missing parameters for operation 'add' in current: []; missing in legacy [add-index]
> --- Problems for relative address to root ["channel" => "ee","fork" => "*","protocol" => "*"]:
> Missing parameters for operation 'add' in current: []; missing in legacy [add-index]
> --- Problems for relative address to root ["channel" => "ee","protocol" => "UDP"]:
> Missing attributes in current: []; missing in legacy [bundler_class]
> --- Problems for relative address to root ["stack" => "*","protocol" => "*"]:
> {code}
> The missing add-index was due to the non-auto-generated add handler operation definition not including that. bundler_class appears to be a runtime attribute.
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
8 years, 6 months