January 2017 - jboss-jira - Jboss List Archives

[JBoss JIRA] (ELY-863) Elytron ldap-realm allows access with empty password

by Jan Kalina (JIRA)

Jan Kalina created ELY-863: ------------------------------ Summary: Elytron ldap-realm allows access with empty password Key: ELY-863 URL: https://issues.jboss.org/browse/ELY-863 Project: WildFly Elytron Issue Type: Bug Components: Realms Affects Versions: 1.1.0.Beta17 Reporter: Jan Kalina Assignee: Jan Kalina Priority: Blocker An empty password is treated as an anonymous login by some LDAP servers (e.g. by Microsoft Active Directory). In case when Elytron ldap-realm is configured for that type of LDAP server then access with empty password to secured web resource guarded by that ldap-realm is always granted. There should be some attribute for configuring whether empty password should be accepted by ldap-realm. Similar issue occurs in previous versions of application server, see: * https://bugzilla.redhat.com/show_bug.cgi?id=901251 * https://bugzilla.redhat.com/show_bug.cgi?id=885569 -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 4 months

1
0
0 / 0

[JBoss JIRA] (WFLY-7866) Elytron ldap-realm allows access with empty password

by Jan Kalina (JIRA)

[ https://issues.jboss.org/browse/WFLY-7866?page=com.atlassian.jira.plugin.... ] Jan Kalina moved ELY-863 to WFLY-7866: -------------------------------------- Project: WildFly (was: WildFly Elytron) Key: WFLY-7866 (was: ELY-863) Component/s: Security (was: Realms) Affects Version/s: (was: 1.1.0.Beta17) > Elytron ldap-realm allows access with empty password > ---------------------------------------------------- > > Key: WFLY-7866 > URL: https://issues.jboss.org/browse/WFLY-7866 > Project: WildFly > Issue Type: Bug > Components: Security > Reporter: Jan Kalina > Assignee: Jan Kalina > Priority: Blocker > > An empty password is treated as an anonymous login by some LDAP servers (e.g. by Microsoft Active Directory). In case when Elytron ldap-realm is configured for that type of LDAP server then access with empty password to secured web resource guarded by that ldap-realm is always granted. > There should be some attribute for configuring whether empty password should be accepted by ldap-realm. > Similar issue occurs in previous versions of application server, see: > * https://bugzilla.redhat.com/show_bug.cgi?id=901251 > * https://bugzilla.redhat.com/show_bug.cgi?id=885569 -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 4 months

1
0
0 / 0

[JBoss JIRA] (WFLY-7821) Roll back undertow 1.4.6 override in main distribution

by Tomaz Cerar (JIRA)

[ https://issues.jboss.org/browse/WFLY-7821?page=com.atlassian.jira.plugin.... ] Tomaz Cerar closed WFLY-7821. ----------------------------- Resolution: Won't Do > Roll back undertow 1.4.6 override in main distribution > ------------------------------------------------------ > > Key: WFLY-7821 > URL: https://issues.jboss.org/browse/WFLY-7821 > Project: WildFly > Issue Type: Task > Components: Build System > Reporter: Tomaz Cerar > Assignee: Tomaz Cerar > -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 4 months

1
0
0 / 0

[JBoss JIRA] (ELY-850) Elytron ldap-realm allows access with empty password

by Jan Kalina (JIRA)

[ https://issues.jboss.org/browse/ELY-850?page=com.atlassian.jira.plugin.sy... ] Jan Kalina reassigned ELY-850: ------------------------------ Assignee: Jan Kalina (was: Darran Lofthouse) > Elytron ldap-realm allows access with empty password > ---------------------------------------------------- > > Key: ELY-850 > URL: https://issues.jboss.org/browse/ELY-850 > Project: WildFly Elytron > Issue Type: Bug > Components: Realms > Affects Versions: 1.1.0.Beta17 > Reporter: Ondrej Lukas > Assignee: Jan Kalina > Priority: Blocker > > An empty password is treated as an anonymous login by some LDAP servers (e.g. by Microsoft Active Directory). In case when Elytron ldap-realm is configured for that type of LDAP server then access with empty password to secured web resource guarded by that ldap-realm is always granted. > There should be some attribute for configuring whether empty password should be accepted by ldap-realm. > Similar issue occurs in previous versions of application server, see: > * https://bugzilla.redhat.com/show_bug.cgi?id=901251 > * https://bugzilla.redhat.com/show_bug.cgi?id=885569 -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 4 months

1
0
0 / 0

[JBoss JIRA] (DROOLS-514) Clean up jetty dependencies in kie-parent-with-dependencies pom.xml

by Michael Biarnes Kiefer (JIRA)

[ https://issues.jboss.org/browse/DROOLS-514?page=com.atlassian.jira.plugin... ] Michael Biarnes Kiefer edited comment on DROOLS-514 at 1/10/17 6:11 AM: ------------------------------------------------------------------------ Looking which modules use jetty: (kie 7.0.0-SNAPSHOT - master branch)..: *droolsjbpm-build-bootstrap/pom.xm*l..: <version.org.mortbay.jetty.runner>8.1.7.v20120910</version.org.mortbay.jetty.runner> <dependency> <groupId>org.mortbay.jetty</groupId> <artifactId>jetty-runner</artifactId> <version>${version.org.mortbay.jetty.runner}</version> </dependency> <dependency> <groupId>org.eclipse.jetty</groupId> <artifactId>jetty-proxy</artifactId> <version>${version.org.eclipse.jetty}</version> </dependency> The version: <version.org.eclipse.jetty>9.2.14.v20151106</version.org.eclipse.jetty> is coming from jboss-ip-bom 7.0.0.CR6. I removed org.eclipse.jetty:jetty-proxy:${version.org.eclipse.jetty} from droolsjbpm-build-bootstrap/pom.xml as this is defined in jboss-ip-bom. I also found jetty dependencies and imports in these modules: but all of them are <scope>test</scope> droolsjbpm-integration/kie-server-parent/kie-server-common/pom.xml droolsjbpm-integration/kie-server-parent/kie-server-common/src/test/java/org/kie/server/common/rest/KieServerHttpRequestTest.java..: droolsjbpm-integration/kie-server-parent/kie-server-common/src/test/java/org/kie/server/common/rest/ServerTestCase.java..: Attached you will find the dependency-tree with jetty dependencies. [^depTree-droolsjbpmIntegration.txt] was (Author: mbiarnes): Looking which modules use jetty: (kie 7.0.0-SNAPSHOT - master branch)..: *droolsjbpm-build-bootstrap/pom.xm*l..: <version.org.mortbay.jetty.runner>8.1.7.v20120910</version.org.mortbay.jetty.runner> <dependency> <groupId>org.mortbay.jetty</groupId> <artifactId>jetty-runner</artifactId> <version>${version.org.mortbay.jetty.runner}</version> </dependency> <dependency> <groupId>org.eclipse.jetty</groupId> <artifactId>jetty-proxy</artifactId> <version>${version.org.eclipse.jetty}</version> </dependency> The version: <version.org.eclipse.jetty>9.2.14.v20151106</version.org.eclipse.jetty> is coming from jboss-ip-bom 7.0.0.CR6. I removed org.eclipse.jetty:jetty-proxy:${version.org.eclipse.jetty} from droolsjbpm-build-bootstrap/pom.xml as this is defined in jboss-ip-bom. I also found jetty dependencies and imports in these modules: but all of them are <scope>test</scope> droolsjbpm-integration/kie-server-parent/kie-server-common/pom.xml droolsjbpm-integration/kie-server-parent/kie-server-common/src/test/java/org/kie/server/common/rest/KieServerHttpRequestTest.java..: droolsjbpm-integration/kie-server-parent/kie-server-common/src/test/java/org/kie/server/common/rest/ServerTestCase.java..: Attached you will find the dependency-tree with jetty dependencies. > Clean up jetty dependencies in kie-parent-with-dependencies pom.xml > ------------------------------------------------------------------- > > Key: DROOLS-514 > URL: https://issues.jboss.org/browse/DROOLS-514 > Project: Drools > Issue Type: Task > Affects Versions: 6.1.0.Beta4 > Reporter: Geoffrey De Smet > Assignee: Michael Biarnes Kiefer > Attachments: depTree-droolsjbpmIntegration.txt, jetty-depTree.txt > > > 1) Make an inventory (using "mvn-all dependency:tree) of all modules that use jetty dependency and clearly indicate per module: > - Jetty groupId and Jetty version > - Scope: test or production > - Build classpath: normal dependency or plugin dependency (latter makes scope n/a) > 2) In theory, we should have no normal dependency in a non-test scope to Jetty, as our stuff is deployed on JBoss EAP, Tomcat, Jetty and WildFly alike. Is this true? > GWT does use Jetty, but only during compilation (= plugin classpath, not the dependencies classpath). gwt-dev is a fat jar that includes jetty even... but gwt-dev shouldn' be in the dependencies either (but it is and it needs to be removed!). > 3) Based on this inventory, discuss with ge0ffrey and mantis plan of attack. > Goal: Get rid of the jetty mess in kie-parent-with-dependencies. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 4 months

1
0
0 / 0

[JBoss JIRA] (DROOLS-514) Clean up jetty dependencies in kie-parent-with-dependencies pom.xml

by Michael Biarnes Kiefer (JIRA)

[ https://issues.jboss.org/browse/DROOLS-514?page=com.atlassian.jira.plugin... ] Michael Biarnes Kiefer updated DROOLS-514: ------------------------------------------ Attachment: depTree-droolsjbpmIntegration.txt > Clean up jetty dependencies in kie-parent-with-dependencies pom.xml > ------------------------------------------------------------------- > > Key: DROOLS-514 > URL: https://issues.jboss.org/browse/DROOLS-514 > Project: Drools > Issue Type: Task > Affects Versions: 6.1.0.Beta4 > Reporter: Geoffrey De Smet > Assignee: Michael Biarnes Kiefer > Attachments: depTree-droolsjbpmIntegration.txt, jetty-depTree.txt > > > 1) Make an inventory (using "mvn-all dependency:tree) of all modules that use jetty dependency and clearly indicate per module: > - Jetty groupId and Jetty version > - Scope: test or production > - Build classpath: normal dependency or plugin dependency (latter makes scope n/a) > 2) In theory, we should have no normal dependency in a non-test scope to Jetty, as our stuff is deployed on JBoss EAP, Tomcat, Jetty and WildFly alike. Is this true? > GWT does use Jetty, but only during compilation (= plugin classpath, not the dependencies classpath). gwt-dev is a fat jar that includes jetty even... but gwt-dev shouldn' be in the dependencies either (but it is and it needs to be removed!). > 3) Based on this inventory, discuss with ge0ffrey and mantis plan of attack. > Goal: Get rid of the jetty mess in kie-parent-with-dependencies. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 4 months

1
0
0 / 0

[JBoss JIRA] (DROOLS-514) Clean up jetty dependencies in kie-parent-with-dependencies pom.xml

by Michael Biarnes Kiefer (JIRA)

[ https://issues.jboss.org/browse/DROOLS-514?page=com.atlassian.jira.plugin... ] Michael Biarnes Kiefer edited comment on DROOLS-514 at 1/10/17 6:09 AM: ------------------------------------------------------------------------ Looking which modules use jetty: (kie 7.0.0-SNAPSHOT - master branch)..: *droolsjbpm-build-bootstrap/pom.xm*l..: <version.org.mortbay.jetty.runner>8.1.7.v20120910</version.org.mortbay.jetty.runner> <dependency> <groupId>org.mortbay.jetty</groupId> <artifactId>jetty-runner</artifactId> <version>${version.org.mortbay.jetty.runner}</version> </dependency> <dependency> <groupId>org.eclipse.jetty</groupId> <artifactId>jetty-proxy</artifactId> <version>${version.org.eclipse.jetty}</version> </dependency> The version: <version.org.eclipse.jetty>9.2.14.v20151106</version.org.eclipse.jetty> is coming from jboss-ip-bom 7.0.0.CR6. I removed org.eclipse.jetty:jetty-proxy:${version.org.eclipse.jetty} from droolsjbpm-build-bootstrap/pom.xml as this is defined in jboss-ip-bom. I also found jetty dependencies and imports in these modules: but all of them are <scope>test</scope> droolsjbpm-integration/kie-server-parent/kie-server-common/pom.xml droolsjbpm-integration/kie-server-parent/kie-server-common/src/test/java/org/kie/server/common/rest/KieServerHttpRequestTest.java..: droolsjbpm-integration/kie-server-parent/kie-server-common/src/test/java/org/kie/server/common/rest/ServerTestCase.java..: Attached you will find the dependency-tree with jetty dependencies. was (Author: mbiarnes): Looking which modules use jetty: (kie 7.0.0-SNAPSHOT - master branch)..: *droolsjbpm-build-bootstrap/pom.xm*l..: <version.org.mortbay.jetty.runner>8.1.7.v20120910</version.org.mortbay.jetty.runner> <dependency> <groupId>org.mortbay.jetty</groupId> <artifactId>jetty-runner</artifactId> <version>${version.org.mortbay.jetty.runner}</version> </dependency> <dependency> <groupId>org.eclipse.jetty</groupId> <artifactId>jetty-proxy</artifactId> <version>${version.org.eclipse.jetty}</version> </dependency> The version: <version.org.eclipse.jetty>9.2.14.v20151106</version.org.eclipse.jetty> is coming from jboss-ip-bom 7.0.0.CR6. I removed org.eclipse.jetty:jetty-proxy:${version.org.eclipse.jetty} from droolsjbpm-build-bootstrap/pom.xml as this is defined in jboss-ip-bom. I also found jetty dependencies and imports in these modules: but all of them are <scope>test</scope> droolsjbpm-integration/kie-server-parent/kie-server-common/pom.xml droolsjbpm-integration/kie-server-parent/kie-server-common/src/test/java/org/kie/server/common/rest/KieServerHttpRequestTest.java..: droolsjbpm-integration/kie-server-parent/kie-server-common/src/test/java/org/kie/server/common/rest/ServerTestCase.java..: > Clean up jetty dependencies in kie-parent-with-dependencies pom.xml > ------------------------------------------------------------------- > > Key: DROOLS-514 > URL: https://issues.jboss.org/browse/DROOLS-514 > Project: Drools > Issue Type: Task > Affects Versions: 6.1.0.Beta4 > Reporter: Geoffrey De Smet > Assignee: Michael Biarnes Kiefer > Attachments: jetty-depTree.txt > > > 1) Make an inventory (using "mvn-all dependency:tree) of all modules that use jetty dependency and clearly indicate per module: > - Jetty groupId and Jetty version > - Scope: test or production > - Build classpath: normal dependency or plugin dependency (latter makes scope n/a) > 2) In theory, we should have no normal dependency in a non-test scope to Jetty, as our stuff is deployed on JBoss EAP, Tomcat, Jetty and WildFly alike. Is this true? > GWT does use Jetty, but only during compilation (= plugin classpath, not the dependencies classpath). gwt-dev is a fat jar that includes jetty even... but gwt-dev shouldn' be in the dependencies either (but it is and it needs to be removed!). > 3) Based on this inventory, discuss with ge0ffrey and mantis plan of attack. > Goal: Get rid of the jetty mess in kie-parent-with-dependencies. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 4 months

1
0
0 / 0

[JBoss JIRA] (DROOLS-514) Clean up jetty dependencies in kie-parent-with-dependencies pom.xml

by Michael Biarnes Kiefer (JIRA)

[ https://issues.jboss.org/browse/DROOLS-514?page=com.atlassian.jira.plugin... ] Michael Biarnes Kiefer commented on DROOLS-514: ----------------------------------------------- Looking which modules use jetty: (kie 7.0.0-SNAPSHOT - master branch)..: *droolsjbpm-build-bootstrap/pom.xm*l..: <version.org.mortbay.jetty.runner>8.1.7.v20120910</version.org.mortbay.jetty.runner> <dependency> <groupId>org.mortbay.jetty</groupId> <artifactId>jetty-runner</artifactId> <version>${version.org.mortbay.jetty.runner}</version> </dependency> <dependency> <groupId>org.eclipse.jetty</groupId> <artifactId>jetty-proxy</artifactId> <version>${version.org.eclipse.jetty}</version> </dependency> The version: <version.org.eclipse.jetty>9.2.14.v20151106</version.org.eclipse.jetty> is coming from jboss-ip-bom 7.0.0.CR6. I removed org.eclipse.jetty:jetty-proxy:${version.org.eclipse.jetty} from droolsjbpm-build-bootstrap/pom.xml as this is defined in jboss-ip-bom. I also found jetty dependencies and imports in these modules: but all of them are <scope>test</scope> droolsjbpm-integration/kie-server-parent/kie-server-common/pom.xml droolsjbpm-integration/kie-server-parent/kie-server-common/src/test/java/org/kie/server/common/rest/KieServerHttpRequestTest.java..: droolsjbpm-integration/kie-server-parent/kie-server-common/src/test/java/org/kie/server/common/rest/ServerTestCase.java..: > Clean up jetty dependencies in kie-parent-with-dependencies pom.xml > ------------------------------------------------------------------- > > Key: DROOLS-514 > URL: https://issues.jboss.org/browse/DROOLS-514 > Project: Drools > Issue Type: Task > Affects Versions: 6.1.0.Beta4 > Reporter: Geoffrey De Smet > Assignee: Michael Biarnes Kiefer > Attachments: jetty-depTree.txt > > > 1) Make an inventory (using "mvn-all dependency:tree) of all modules that use jetty dependency and clearly indicate per module: > - Jetty groupId and Jetty version > - Scope: test or production > - Build classpath: normal dependency or plugin dependency (latter makes scope n/a) > 2) In theory, we should have no normal dependency in a non-test scope to Jetty, as our stuff is deployed on JBoss EAP, Tomcat, Jetty and WildFly alike. Is this true? > GWT does use Jetty, but only during compilation (= plugin classpath, not the dependencies classpath). gwt-dev is a fat jar that includes jetty even... but gwt-dev shouldn' be in the dependencies either (but it is and it needs to be removed!). > 3) Based on this inventory, discuss with ge0ffrey and mantis plan of attack. > Goal: Get rid of the jetty mess in kie-parent-with-dependencies. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 4 months

1
0
0 / 0

[JBoss JIRA] (WFLY-7865) We cannot define CS file location outside of EAP directory

by Hynek Švábek (JIRA)

[ https://issues.jboss.org/browse/WFLY-7865?page=com.atlassian.jira.plugin.... ] Hynek Švábek reassigned WFLY-7865: ---------------------------------- Assignee: Peter Skopek (was: Darran Lofthouse) > We cannot define CS file location outside of EAP directory > ---------------------------------------------------------- > > Key: WFLY-7865 > URL: https://issues.jboss.org/browse/WFLY-7865 > Project: WildFly > Issue Type: Bug > Components: Security > Reporter: Hynek Švábek > Assignee: Peter Skopek > Priority: Critical > > We aren't able define location of CS file outside of EAP directory. When user has CS file on NFS he isn't able to reach this file. > Define CS file location to JBOSS_HOME/Standalone/data directory: > {code} > /subsystem=elytron/credential-store=CredStore001:add(uri="cr-store://test/cs123.jceks?create.storage=true", credential-reference={clear-text=pass123}, relative-to=jboss.server.data.dir) > {code} > When I try set relative to TEMP directory: > {code} > /subsystem=elytron/credential-store=CredStore002:add(uri="cr-store://test/cs123.jceks?create.storage=true", credential-reference={clear-text=pass123}, relative-to=java.io.tmpdir) > {code} > I get this error > {code} > { > "outcome" => "failed", > "failure-description" => { > "WFLYCTL0412: Required services that are not installed:" => ["jboss.server.path.\"java.io.tmpdir\""], > "WFLYCTL0180: Services with missing/unavailable dependencies" => ["org.wildfly.security.credential-store.CredStore002 is missing [jboss.server.path.\"java.io.tmpdir\"]"] > }, > "rolled-back" => true > } > {code} > *NOTE:* > *relative-to* is resolved here https://github.com/wildfly-security/elytron-subsystem/blob/c223be428b9a6f... -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 4 months

1
0
0 / 0

[JBoss JIRA] (WFLY-7498) Elytron Credential Store "store.base" parameter doesn't work properly.

by Hynek Švábek (JIRA)

[ https://issues.jboss.org/browse/WFLY-7498?page=com.atlassian.jira.plugin.... ] Hynek Švábek closed WFLY-7498. ------------------------------ Resolution: Won't Fix There was refactoring of this functionality. There is *relative-to* attribute insted of *store.base* parameter. New Jira issues is here https://issues.jboss.org/browse/WFLY-7865 > Elytron Credential Store "store.base" parameter doesn't work properly. > ---------------------------------------------------------------------- > > Key: WFLY-7498 > URL: https://issues.jboss.org/browse/WFLY-7498 > Project: WildFly > Issue Type: Bug > Components: Security > Reporter: Hynek Švábek > Assignee: Peter Skopek > Priority: Blocker > > Elytron Credential Store "store.base" parameter doesn't work properly. > I tried create credential store from scratch: > {code} > /subsystem=elytron/credential-store=cs001_sb:add(uri="cr-store://test/key126.jceks?store.password=pass123;key.password=pass456;create.storage=true; > store.base=/tmp;key.alias=MY_ALIAS") > {code} > {code} > /subsystem=elytron/credential-store=cs001_sb/alias=alias001:add(secret-value=secValue) > {code} > and credential store file *is created in JBOSS_EAP/Standalone/data path not in /tmp.* > *My investigation* > * Here it seems fine https://github.com/wildfly-security/wildfly-elytron/blob/0f0e0109c2652fdc... > * Maybe some kind of compiler optimisation (switch line execution?) https://github.com/wildfly-security/wildfly-elytron/blob/0f0e0109c2652fdc... -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 4 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-jira January 2017