[JBoss JIRA] (WFLY-7190) Group related resources in Elytron subsystem
by Darran Lofthouse (JIRA)
[ https://issues.jboss.org/browse/WFLY-7190?page=com.atlassian.jira.plugin.... ]
Darran Lofthouse resolved WFLY-7190.
------------------------------------
Resolution: Rejected
We have had various discussions on this topic, it has been decided we do not want to add additional arbitrary layers to the model just to achieve a grouping.
> Group related resources in Elytron subsystem
> --------------------------------------------
>
> Key: WFLY-7190
> URL: https://issues.jboss.org/browse/WFLY-7190
> Project: WildFly
> Issue Type: Bug
> Components: Security
> Reporter: Ondrej Lukas
> Assignee: Darran Lofthouse
> Fix For: 11.0.0.Alpha1
>
>
> Domain model of subsystem is too flat. Every resource (realms, mappers, factories ...) is located at the base level of Elytron subsystem. Then it is hard to orientate in subsystem since it does not have deeper structure.
> Suggestion:
> It can be structuralized similar as PicketBox subsystem. There could be some subresources like realms, domains etc.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 3 months
[JBoss JIRA] (WFLY-7259) Review elytron kerberos-security-factory resource
by Darran Lofthouse (JIRA)
[ https://issues.jboss.org/browse/WFLY-7259?page=com.atlassian.jira.plugin.... ]
Darran Lofthouse updated WFLY-7259:
-----------------------------------
Priority: Critical (was: Major)
> Review elytron kerberos-security-factory resource
> -------------------------------------------------
>
> Key: WFLY-7259
> URL: https://issues.jboss.org/browse/WFLY-7259
> Project: WildFly
> Issue Type: Bug
> Components: Security
> Affects Versions: 11.0.0.Alpha1
> Reporter: Martin Choma
> Assignee: Darran Lofthouse
> Priority: Critical
> Labels: user_experience
> Fix For: 11.0.0.Alpha1
>
>
> * {{mechanism-oids}}
> ** Minimal command for kerberos security factory creation is {code}/subsystem=elytron/kerberos-security-factory=kerberos:add(principal=mchoma, path=/path/to/keytab, mechanism-oids=[1.2.840.113554.1.2.2]){code}
> ** I don't think it is user-friendly to require user to specify mechanism-oids. I think some reasonable default value should be used here.
> * {{minimum-remaining-lifetime}}
> ** please, specify units in documentation, e.g. seconds/minutes
> * {{relative-to}}
> ** as just path reference can be used here, probably should be just "expressions-allowed" => false
> ** In legacy settings it is documented better: "The name of another previously named path, or of one of the standard paths provided by the system. If 'relative-to' is provided, the value of the 'path' attribute is treated as relative to the path specified by this attribute."
> * {{server}}
> ** I assume based on {{server}} attribute INITIATE_ONLY or ACCEPT_ONLY is configured on GSSCredential [1]. Wouldn't it be useful to have also possibility to set INITIATE_AND_ACCEPT? Couldn't that be useful for example in case of identity propagation.
> * {{for-hosts}}
> ** comparing to legacy security {{kerberosIdentityType}} I am missing for-hosts. Elytron won't provide such feature?
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 3 months
[JBoss JIRA] (WFLY-7259) Review elytron kerberos-security-factory resource
by Darran Lofthouse (JIRA)
[ https://issues.jboss.org/browse/WFLY-7259?page=com.atlassian.jira.plugin.... ]
Darran Lofthouse updated WFLY-7259:
-----------------------------------
Fix Version/s: 11.0.0.Alpha1
> Review elytron kerberos-security-factory resource
> -------------------------------------------------
>
> Key: WFLY-7259
> URL: https://issues.jboss.org/browse/WFLY-7259
> Project: WildFly
> Issue Type: Bug
> Components: Security
> Affects Versions: 11.0.0.Alpha1
> Reporter: Martin Choma
> Assignee: Darran Lofthouse
> Priority: Critical
> Labels: user_experience
> Fix For: 11.0.0.Alpha1
>
>
> * {{mechanism-oids}}
> ** Minimal command for kerberos security factory creation is {code}/subsystem=elytron/kerberos-security-factory=kerberos:add(principal=mchoma, path=/path/to/keytab, mechanism-oids=[1.2.840.113554.1.2.2]){code}
> ** I don't think it is user-friendly to require user to specify mechanism-oids. I think some reasonable default value should be used here.
> * {{minimum-remaining-lifetime}}
> ** please, specify units in documentation, e.g. seconds/minutes
> * {{relative-to}}
> ** as just path reference can be used here, probably should be just "expressions-allowed" => false
> ** In legacy settings it is documented better: "The name of another previously named path, or of one of the standard paths provided by the system. If 'relative-to' is provided, the value of the 'path' attribute is treated as relative to the path specified by this attribute."
> * {{server}}
> ** I assume based on {{server}} attribute INITIATE_ONLY or ACCEPT_ONLY is configured on GSSCredential [1]. Wouldn't it be useful to have also possibility to set INITIATE_AND_ACCEPT? Couldn't that be useful for example in case of identity propagation.
> * {{for-hosts}}
> ** comparing to legacy security {{kerberosIdentityType}} I am missing for-hosts. Elytron won't provide such feature?
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 3 months
[JBoss JIRA] (WFLY-7448) Wrong description of Elytron configurable-sasl-server-factory in management model
by Darran Lofthouse (JIRA)
[ https://issues.jboss.org/browse/WFLY-7448?page=com.atlassian.jira.plugin.... ]
Darran Lofthouse updated WFLY-7448:
-----------------------------------
Summary: Wrong description of Elytron configurable-sasl-server-factory in management model (was: Wrong description of Elytron configurable-sasl-server-factory in CLI)
> Wrong description of Elytron configurable-sasl-server-factory in management model
> ---------------------------------------------------------------------------------
>
> Key: WFLY-7448
> URL: https://issues.jboss.org/browse/WFLY-7448
> Project: WildFly
> Issue Type: Bug
> Components: Security
> Affects Versions: 11.0.0.Alpha1
> Reporter: Ondrej Lukas
> Assignee: Darran Lofthouse
> Labels: user_experience
> Fix For: 11.0.0.Alpha1
>
>
> Description of {{configurable-sasl-server-factory}} resource in CLI is incorrectly copied from {{aggregate-sasl-server-factory}}. It says "description" => "A sasl server factory definition where the sasl server factory is an aggregation of other sasl server factories.".
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 3 months