January 2017 - jboss-jira - Jboss List Archives

[JBoss JIRA] (WFCORE-1891) Split WildFly Elytron into two modules with a public / private split.

by Kabir Khan (JIRA)

[ https://issues.jboss.org/browse/WFCORE-1891?page=com.atlassian.jira.plugi... ] Kabir Khan updated WFCORE-1891: ------------------------------- Fix Version/s: 3.0.0.Alpha20 (was: 3.0.0.Alpha19) > Split WildFly Elytron into two modules with a public / private split. > --------------------------------------------------------------------- > > Key: WFCORE-1891 > URL: https://issues.jboss.org/browse/WFCORE-1891 > Project: WildFly Core > Issue Type: Task > Components: Security > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > Priority: Critical > Fix For: 3.0.0.Alpha20 > > > The Elytron jar will be contained within a private module, possibly 'elytron-private' then a module 'elytron' will depend on this and make the public packages visible. > The following packages have been identified as being private: - > org.wildfly.security._private > org.wildfly.security.asn1 > org.wildfly.security.auth.realm > org.wildfly.security.auth.realm.* > org.wildfly.security.authz.jacc > org.wildfly.security.credential.store.impl > org.wildfly.security.security.digest > org.wildfly.security.http.impl > org.wildfly.security.security.keystore > org.wildfly.security.mechanism.oauth2 > org.wildfly.security.mechanism.scram > org.wildfly.security.password.impl > org.wildfly.security.password.util > org.wildfly.security.pem > org.wildfly.security.sasl > org.wildfly.security.sasl.* (Except util) > org.wildfly.security.util > org.wildfly.security.util_private > org.wildfly.security.x500 > org.wildfly.security.x500.cert -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 5 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-1964) Internal ModelControllerClient should bypass access control by default

by Kabir Khan (JIRA)

[ https://issues.jboss.org/browse/WFCORE-1964?page=com.atlassian.jira.plugi... ] Kabir Khan updated WFCORE-1964: ------------------------------- Fix Version/s: 3.0.0.Alpha20 (was: 3.0.0.Alpha19) > Internal ModelControllerClient should bypass access control by default > ---------------------------------------------------------------------- > > Key: WFCORE-1964 > URL: https://issues.jboss.org/browse/WFCORE-1964 > Project: WildFly Core > Issue Type: Task > Components: Domain Management, Security > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > Priority: Blocker > Fix For: 3.0.0.Alpha20 > > > This is continuing compatibility where in-vm clients can perform actions without triggering management access control. > It would be nice also if we could find a way to make it possible to selectively disable this for cases where we want identity propagation between applications and the management tier. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 5 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-1955) Wrap Kerberos behaviour of legacy realms with Elytron components

by Kabir Khan (JIRA)

[ https://issues.jboss.org/browse/WFCORE-1955?page=com.atlassian.jira.plugi... ] Kabir Khan updated WFCORE-1955: ------------------------------- Fix Version/s: 3.0.0.Alpha20 (was: 3.0.0.Alpha19) > Wrap Kerberos behaviour of legacy realms with Elytron components > ---------------------------------------------------------------- > > Key: WFCORE-1955 > URL: https://issues.jboss.org/browse/WFCORE-1955 > Project: WildFly Core > Issue Type: Task > Components: Domain Management, Security > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > Priority: Blocker > Fix For: 3.0.0.Alpha20 > > > An re-enable the following test: - > * org.jboss.as.test.integration.domain.KerberosServerIdentityTestCase -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 5 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-1956) Audit logging post migration to WildFly Elytron

by Kabir Khan (JIRA)

[ https://issues.jboss.org/browse/WFCORE-1956?page=com.atlassian.jira.plugi... ] Kabir Khan updated WFCORE-1956: ------------------------------- Fix Version/s: 3.0.0.Alpha20 (was: 3.0.0.Alpha19) > Audit logging post migration to WildFly Elytron > ----------------------------------------------- > > Key: WFCORE-1956 > URL: https://issues.jboss.org/browse/WFCORE-1956 > Project: WildFly Core > Issue Type: Task > Components: Domain Management, Security > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > Priority: Blocker > Fix For: 3.0.0.Alpha20 > > > Also re-enable the following test: - > * org.jboss.as.test.integration.domain.suites.AuditLogTestCase -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 5 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-1963) Clean up the 'TODO Elytron' issues.

by Kabir Khan (JIRA)

[ https://issues.jboss.org/browse/WFCORE-1963?page=com.atlassian.jira.plugi... ] Kabir Khan updated WFCORE-1963: ------------------------------- Fix Version/s: 3.0.0.Alpha20 (was: 3.0.0.Alpha19) > Clean up the 'TODO Elytron' issues. > ----------------------------------- > > Key: WFCORE-1963 > URL: https://issues.jboss.org/browse/WFCORE-1963 > Project: WildFly Core > Issue Type: Task > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > Priority: Blocker > Fix For: 3.0.0.Alpha20 > > > A few classes have 'TODO Elytron' comments that need addressing. > Current List: - > {noformat} > ./core-model-test/tests/src/test/java/org/jboss/as/core/model/test/access/RoleMappingTestCase.java > ./jmx/src/test/java/org/jboss/as/jmx/rbac/JmxRbacTestCase.java > ./remoting/subsystem/src/main/java/org/jboss/as/remoting/RemotingHttpUpgradeService.java > ./remoting/subsystem/src/main/java/org/jboss/as/remoting/AbstractStreamServerService.java > ./testsuite/standalone/src/test/java/org/wildfly/core/test/standalone/mgmt/api/core/ConfigurationChangesHistoryTestCase.java > ./host-controller/src/main/java/org/jboss/as/domain/controller/plan/AbstractServerGroupRolloutTask.java > ./controller/src/main/java/org/jboss/as/controller/remote/TransactionalProtocolOperationHandler.java > ./controller/src/main/java/org/jboss/as/controller/ParallelBootOperationStepHandler.java > ./controller/src/main/java/org/jboss/as/controller/access/management/ManagementSecurityIdentitySupplier.java > ./server/src/main/java/org/jboss/as/server/mgmt/domain/HostControllerConnectionService.java > ./domain-management/src/main/java/org/jboss/as/domain/management/security/UserDomainCallbackHandler.java > ./domain-management/src/main/java/org/jboss/as/domain/management/security/WhoAmIOperation.java > ./domain-management/src/main/java/org/jboss/as/domain/management/security/PlugInAuthenticationCallbackHandler.java > ./domain-management/src/main/java/org/jboss/as/domain/management/security/JaasCallbackHandler.java > ./domain-management/src/main/java/org/jboss/as/domain/management/security/KerberosCallbackHandler.java > ./domain-management/src/main/java/org/jboss/as/domain/management/security/ClientCertCallbackHandler.java > {noformat} -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 5 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-1958) Clean up testsuite Elytron registration

by Kabir Khan (JIRA)

[ https://issues.jboss.org/browse/WFCORE-1958?page=com.atlassian.jira.plugi... ] Kabir Khan updated WFCORE-1958: ------------------------------- Fix Version/s: 3.0.0.Alpha20 (was: 3.0.0.Alpha19) > Clean up testsuite Elytron registration > --------------------------------------- > > Key: WFCORE-1958 > URL: https://issues.jboss.org/browse/WFCORE-1958 > Project: WildFly Core > Issue Type: Task > Components: Test Suite > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > Priority: Blocker > Fix For: 3.0.0.Alpha20 > > > In a couple of places we have artificially registered the WildFly Elytron Security provider, we need to address this so tests can automatically have it available to them.. > Also re-enable the following test case: - > * org.jboss.as.test.integration.domain.suites.FullRbacProviderRunAsTestSuite -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 5 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2046) KeyManager synchronization issue when using IBM JDK

by Kabir Khan (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2046?page=com.atlassian.jira.plugi... ] Kabir Khan updated WFCORE-2046: ------------------------------- Fix Version/s: 3.0.0.Alpha20 (was: 3.0.0.Alpha19) > KeyManager synchronization issue when using IBM JDK > --------------------------------------------------- > > Key: WFCORE-2046 > URL: https://issues.jboss.org/browse/WFCORE-2046 > Project: WildFly Core > Issue Type: Bug > Components: Security > Reporter: Josef Cacek > Assignee: Darran Lofthouse > Priority: Blocker > Fix For: 3.0.0.Alpha20 > > Attachments: test-app-ibm-jdk-keymanager-sync.zip > > > We hit a {{KeyManagerFactory}} related synchronization issue in {{org.jboss.as.domain.management.security.AbstractKeyManagerService.createKeyManagers(boolean)}} method on IBM JDK. The issue occurs if there are more security realms with SSL identities in EAP and they have keystores with different passwords. > As the ApplicationRealm (in EAP 7.1) has preconfigured ssl identity configuration, the risk customers will hit this when they add their own security realm with a ssl identity is big. The frequency we hit this issue is more than 10% cases on our machines. > Our debugging suggests the problem is located in IBM JDK implementation of {{javax.net.ssl.KeyManagerFactorySpi}} (class {{com.ibm.jsse2.ae$a}}). > The workflow: > # user calls {{keyManagerFactory.init(keyStore, keystorePassword)}} which invokes {{com.ibm.jsse2.ae$a.engineInit(Keystore keyStore, char[] password)}} > # the password (from the second method parameter) is stored into static field {{com.ibm.jsse2.ae.d}} and in the next step the field is used as parameter for creating new object {{new com.ibm.jsse2.aw(keyStore, d)}} > # the previous step is not synchronized and when more threads call {{keyManagerFactory.init()}} with different passwords, wrong password may be used for retrieving a key from keystore. > *Possible workaround* > We could workaround this issue on EAP side (until it's fixed in the JDK) by synchronizing {{keyManagerFactory.init()}} call in {{AbstractKeyManagerService.createKeyManagers(boolean)}} when IBM JDK is used. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 5 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2025) CLI SSLContext Priority

by Kabir Khan (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2025?page=com.atlassian.jira.plugi... ] Kabir Khan updated WFCORE-2025: ------------------------------- Fix Version/s: 3.0.0.Alpha20 (was: 3.0.0.Alpha19) > CLI SSLContext Priority > ----------------------- > > Key: WFCORE-2025 > URL: https://issues.jboss.org/browse/WFCORE-2025 > Project: WildFly Core > Issue Type: Task > Components: CLI, Security > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > Priority: Critical > Fix For: 3.0.0.Alpha20 > > > We have three different places an SSLContext could come from for the CLI: - > # CLI Configuration > # AuthenticationClient Configuration > # Default interactive SSLContext > We need to ensure they are prioritised as above. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 5 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2016) Change sasl-authentication-factor for management auth works after reload, but not after server restart

by Kabir Khan (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2016?page=com.atlassian.jira.plugi... ] Kabir Khan updated WFCORE-2016: ------------------------------- Fix Version/s: 3.0.0.Alpha20 (was: 3.0.0.Alpha19) > Change sasl-authentication-factor for management auth works after reload, but not after server restart > ------------------------------------------------------------------------------------------------------ > > Key: WFCORE-2016 > URL: https://issues.jboss.org/browse/WFCORE-2016 > Project: WildFly Core > Issue Type: Bug > Components: Domain Management, Security > Reporter: Zach Rhoads > Assignee: Darran Lofthouse > Fix For: 3.0.0.Alpha20 > > > I can successfully configure a new sasl-authentication-factory and assign it to the management interface: > {code} > /subsystem=elytron/filesystem-realm=exampleFsRealm:add(path=fs-realm-users,relative-to=jboss.server.config.dir) > /subsystem=elytron/filesystem-realm=exampleFsRealm/identity=user1:add() > /subsystem=elytron/filesystem-realm=exampleFsRealm/identity=user1:set-password(clear={password="password123"}) > /subsystem=elytron/filesystem-realm=exampleFsRealm/identity=user1:add-attribute(name=Roles, value=["Admin","Guest"]) > /subsystem=elytron/simple-role-decoder=from-roles-attribute:add(attribute=Roles) > /subsystem=elytron/security-domain=exampleFsSD:add(realms=[{realm=exampleFsRealm,role-decoder=from-roles-attribute}],default-realm=exampleFsRealm,permission-mapper=login-permission-mapper) > /subsystem=elytron/sasl-authentication-factory=example-sasl-auth:add(sasl-server-factory=configured,security-domain=exampleFsSD,mechanism-configurations=[{mechanism-name=DIGEST-MD5,mechanism-realm-configurations=[{realm-name=exampleSaslRealm}]}]) > /core-service=management/management-interface=http-interface:write-attribute(name=http-upgrade.sasl-authentication-factory, value=example-sasl-auth) > reload > {code} > after reload, i am forced to re-authenticate and it succeeds: > {code} > [standalone@localhost:9990 /] reload > Authenticating against security realm: exampleSaslRealm > Username: user1 > Password: > [standalone@localhost:9990 /] > {code} > Once i restart the server though and try to connect, i get a timeout: > {code} > $ ./jboss-cli.sh -c > Failed to connect to the controller: The controller is not available at localhost:9990: java.net.ConnectException: WFLYPRT0023: Could not connect to remote+http://localhost:9990. The connection timed out: WFLYPRT0023: Could not connect to remote+http://localhost:9990. The connection timed out > {code} > It also fails if i force no local auth: > {code} > $ ./jboss-cli.sh -c --no-local-auth > Failed to connect to the controller: The controller is not available at localhost:9990: java.net.ConnectException: WFLYPRT0023: Could not connect to remote+http://localhost:9990. The connection timed out: WFLYPRT0023: Could not connect to remote+http://localhost:9990. The connection timed out > {code}/ -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 5 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-1965) Remove the jboss-logging-annotations dependency from the core feature pack.

by Kabir Khan (JIRA)

[ https://issues.jboss.org/browse/WFCORE-1965?page=com.atlassian.jira.plugi... ] Kabir Khan updated WFCORE-1965: ------------------------------- Fix Version/s: 3.0.0.Alpha20 (was: 3.0.0.Alpha19) > Remove the jboss-logging-annotations dependency from the core feature pack. > --------------------------------------------------------------------------- > > Key: WFCORE-1965 > URL: https://issues.jboss.org/browse/WFCORE-1965 > Project: WildFly Core > Issue Type: Task > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > Priority: Critical > Fix For: 3.0.0.Alpha20 > > > This was added inadvertently with some other changes: - > {noformat} > <dependency> > <groupId>org.jboss.logging</groupId> > <artifactId>jboss-logging-annotations</artifactId> > </dependency> > {noformat} -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 5 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-jira January 2017