October 2017 - jboss-jira - Jboss List Archives

[JBoss JIRA] (SECURITY-979) Referrals roles assignment for referral user does not work for LdapExtLoginModule with Active Directory

by Jiri Ondrusek (JIRA)

[ https://issues.jboss.org/browse/SECURITY-979?page=com.atlassian.jira.plug... ] Jiri Ondrusek updated SECURITY-979: ----------------------------------- Git Pull Request: (was: https://github.com/picketbox/picketbox/pull/73) > Referrals roles assignment for referral user does not work for LdapExtLoginModule with Active Directory > ------------------------------------------------------------------------------------------------------- > > Key: SECURITY-979 > URL: https://issues.jboss.org/browse/SECURITY-979 > Project: PicketBox > Issue Type: Bug > Affects Versions: PicketBox_5_0_2.Final > Reporter: Jiri Ondrusek > Assignee: Jiri Ondrusek > Priority: Minor > > Consider two MS Active Directory domains with configured crossRef to each other. EAP using LdapExtLoginModule for MS AD with referrals and rolesCtxDN is set to the referral DN where user account are stored; also EAP is configured for searching roles based on users entries (mapping users to roles). > If referral users (from EAP point of view - hostname is configured for original LDAP and user is obtained as referral user - from second of domains) authenticate then they have not assigned roles from AD attribute from 'roleAttributeID' option. > Example: > I have two MS AD domains - DC=jboss,DC=test (Domain A) and DC=jboss,DC=test2 (Domain B) with crossRef. > Part of ldif for Domain A: > {code} > ... > dn: CN=TheDuke,OU=Roles,O=eapqe,DC=jboss,DC=test > objectClass: groupOfNames > objectClass: top > cn: TheDuke > businessCategory: CN=jduke,OU=People,O=eapqe,DC=jboss,DC=test2 > member: CN=jdukeNotUsed,OU=People,O=eapqe,DC=jboss,DC=test > ... > {code} > Part of ldif for Domain B: > {code} > ... > dn: CN=jduke,OU=People,O=eapqe,DC=jboss,DC=test2 > objectclass: top > objectclass: person > objectClass: inetOrgPerson > cn: jduke > sn: Duke > description: CN=TheDuke,OU=Roles,O=eapqe,DC=jboss,DC=test > description: CN=Admin,OU=Roles,O=eapqe,DC=jboss,DC=test2 > userPassword: Password1 > dn: CN=Admin,OU=Roles,O=eapqe,DC=jboss,DC=test2 > objectClass: groupOfNames > objectClass: top > cn: Admin > businessCategory: CN=jduke,OU=People,O=eapqe,DC=jboss,DC=test2 > member: CN=jdukeNotUsed,OU=People,O=eapqe,DC=jboss,DC=test2 > ... > {code} > EAP LdapExtLoginModule is configured: > {code:xml} > <security-domain name="LdapExtReferrals"> > <authentication> > <login-module code="org.jboss.security.auth.spi.LdapExtLoginModule" flag="required"> > <module-option name="java.naming.factory.initial" value="com.sun.jndi.ldap.LdapCtxFactory"/> > <module-option name="java.naming.provider.url" value="HOSTNAME_OF_DOMAIN_A"/> > <module-option name="bindDN" value="BIND_DN"/> > <module-option name="bindCredential" value="PASSWORD"/> > <module-option name="referralUserAttributeIDToCheck" value="businessCategory"/> > <module-option name="roleAttributeIsDN" value="true"/> > <module-option name="roleFilter" value="(CN={0})"/> > <module-option name="roleAttributeID" value="description"/> > <module-option name="baseCtxDN" value="OU=People,O=eapqe,DC=jboss,DC=test2"/>  > <module-option name="rolesCtxDN" value="OU=People,O=eapqe,DC=jboss,DC=test2"/>  > <module-option name="java.naming.security.authentication" value="simple"/> > <module-option name="java.naming.referral" value="follow"/> > <module-option name="distinguishedNameAttribute" value="whatever"/>  > <module-option name="throwValidateError" value="true"/> > <module-option name="baseFilter" value="(CN={0})"/> > <module-option name="roleNameAttributeID" value="CN"/> > </login-module> > </authentication> > </security-domain> > {code} > Then when jduke try to authenticate to application roles TheDuke and Admin should be assigned to him. -- This message was sent by Atlassian JIRA (v7.5.0#75005)

8 years, 9 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-3041) Cannot add policy resource with no parameter

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/WFCORE-3041?page=com.atlassian.jira.plugi... ] Darran Lofthouse commented on WFCORE-3041: ------------------------------------------ https://github.com/wildfly-security/elytron-subsystem/blame/1.0.0.Beta11/... > Cannot add policy resource with no parameter > -------------------------------------------- > > Key: WFCORE-3041 > URL: https://issues.jboss.org/browse/WFCORE-3041 > Project: WildFly Core > Issue Type: Bug > Components: Security > Reporter: Claudio Miranda > Assignee: Michal Petrov > > subsystem=elytron/policy resources has no required attributes, but it fails to add a resource with no parameters. > {code} > /profile=full/subsystem=elytron/policy=policy_test:add > { > "outcome" => "failed", > "result" => undefined, > "failure-description" => {"WFLYDC0074: Operation failed or was rolled back on all servers. Server failures:" => {"server-group" => {"main-server-group" => {"host" => {"master" => {"server-one" => "Could find policy provider with name [policy_test]"}}}}}}, > "rolled-back" => true, > "server-groups" => {"main-server-group" => {"host" => {"master" => {"server-one" => {"response" => { > "outcome" => "failed", > "failure-description" => "Could find policy provider with name [policy_test]", > "rolled-back" => true > }}}}}} > } > {code} > To add is necessary to inform either custom-policy or jacc-policy > {code} > /profile=full/subsystem=elytron/policy=policy2:add(jacc-policy=[{name=policy2}]) > { > "outcome" => "success", > "result" => undefined, > "server-groups" => {"main-server-group" => {"host" => {"master" => {"server-one" => {"response" => { > "outcome" => "success", > "response-headers" => { > "operation-requires-reload" => true, > "process-state" => "reload-required" > } > }}}}}} > } > {code} > There is also a problem related to "default-policy" being set to a non existent policy. -- This message was sent by Atlassian JIRA (v7.5.0#75005)

8 years, 9 months

1
0
0 / 0

[JBoss JIRA] (WFLY-6777) Upgrade to OpenJPA impl compatible with JDK9

by Scott Marlow (JIRA)

[ https://issues.jboss.org/browse/WFLY-6777?page=com.atlassian.jira.plugin.... ] Scott Marlow commented on WFLY-6777: ------------------------------------ When OpenJPA supports JDK9, we should update surefire.excludeTests in wildfly/testsuite/compat/pom.xml to not exclude the OpenJPA tests. > Upgrade to OpenJPA impl compatible with JDK9 > -------------------------------------------- > > Key: WFLY-6777 > URL: https://issues.jboss.org/browse/WFLY-6777 > Project: WildFly > Issue Type: Sub-task > Components: JPA / Hibernate > Reporter: Tomaz Cerar > Assignee: Scott Marlow > Priority: Minor > > OpenJPA tests currently hang our testsuite as serp bytecode enhancer that OpenJPA uses hangs the deployment. > For now test is not run on JDK9, but this should be re-enabled once there is release of openjpa that works fine with jdk9 -- This message was sent by Atlassian JIRA (v7.5.0#75005)

8 years, 9 months

1
0
0 / 0

[JBoss JIRA] (WFLY-6777) Upgrade to OpenJPA impl compatible with JDK9

by Scott Marlow (JIRA)

[ https://issues.jboss.org/browse/WFLY-6777?page=com.atlassian.jira.plugin.... ] Scott Marlow updated WFLY-6777: ------------------------------- Fix Version/s: (was: 11.0.0.Final) > Upgrade to OpenJPA impl compatible with JDK9 > -------------------------------------------- > > Key: WFLY-6777 > URL: https://issues.jboss.org/browse/WFLY-6777 > Project: WildFly > Issue Type: Sub-task > Components: JPA / Hibernate > Reporter: Tomaz Cerar > Assignee: Scott Marlow > Priority: Minor > > OpenJPA tests currently hang our testsuite as serp bytecode enhancer that OpenJPA uses hangs the deployment. > For now test is not run on JDK9, but this should be re-enabled once there is release of openjpa that works fine with jdk9 -- This message was sent by Atlassian JIRA (v7.5.0#75005)

8 years, 9 months

1
0
0 / 0

[JBoss JIRA] (WFLY-6777) Upgrade to OpenJPA impl compatible with JDK9

by Scott Marlow (JIRA)

[ https://issues.jboss.org/browse/WFLY-6777?page=com.atlassian.jira.plugin.... ] Scott Marlow updated WFLY-6777: ------------------------------- Summary: Upgrade to OpenJPA impl compatible with JDK9 (was: Upgrade to OpenJPA 2.4.1 to avoid testsuite hang on JDK9) > Upgrade to OpenJPA impl compatible with JDK9 > -------------------------------------------- > > Key: WFLY-6777 > URL: https://issues.jboss.org/browse/WFLY-6777 > Project: WildFly > Issue Type: Sub-task > Components: JPA / Hibernate > Reporter: Tomaz Cerar > Assignee: Scott Marlow > Priority: Minor > Fix For: 11.0.0.Final > > > OpenJPA tests currently hang our testsuite as serp bytecode enhancer that OpenJPA uses hangs the deployment. > For now test is not run on JDK9, but this should be re-enabled once there is release of openjpa that works fine with jdk9 -- This message was sent by Atlassian JIRA (v7.5.0#75005)

8 years, 9 months

1
0
0 / 0

[JBoss JIRA] (WFLY-6777) Upgrade to OpenJPA 2.4.1 to avoid testsuite hang on JDK9

by Scott Marlow (JIRA)

[ https://issues.jboss.org/browse/WFLY-6777?page=com.atlassian.jira.plugin.... ] Scott Marlow reopened WFLY-6777: -------------------------------- > Upgrade to OpenJPA 2.4.1 to avoid testsuite hang on JDK9 > -------------------------------------------------------- > > Key: WFLY-6777 > URL: https://issues.jboss.org/browse/WFLY-6777 > Project: WildFly > Issue Type: Sub-task > Components: JPA / Hibernate > Reporter: Tomaz Cerar > Assignee: Scott Marlow > Priority: Minor > Fix For: 11.0.0.Final > > > OpenJPA tests currently hang our testsuite as serp bytecode enhancer that OpenJPA uses hangs the deployment. > For now test is not run on JDK9, but this should be re-enabled once there is release of openjpa that works fine with jdk9 -- This message was sent by Atlassian JIRA (v7.5.0#75005)

8 years, 9 months

1
0
0 / 0

[JBoss JIRA] (WFLY-6777) Upgrade to OpenJPA 2.4.1 to avoid testsuite hang on JDK9

by Scott Marlow (JIRA)

[ https://issues.jboss.org/browse/WFLY-6777?page=com.atlassian.jira.plugin.... ] Scott Marlow commented on WFLY-6777: ------------------------------------ [~brian.stansberry] actually, I don't think this can be resolved yet, reopening... > Upgrade to OpenJPA 2.4.1 to avoid testsuite hang on JDK9 > -------------------------------------------------------- > > Key: WFLY-6777 > URL: https://issues.jboss.org/browse/WFLY-6777 > Project: WildFly > Issue Type: Sub-task > Components: JPA / Hibernate > Reporter: Tomaz Cerar > Assignee: Scott Marlow > Priority: Minor > Fix For: 11.0.0.Final > > > OpenJPA tests currently hang our testsuite as serp bytecode enhancer that OpenJPA uses hangs the deployment. > For now test is not run on JDK9, but this should be re-enabled once there is release of openjpa that works fine with jdk9 -- This message was sent by Atlassian JIRA (v7.5.0#75005)

8 years, 9 months

1
0
0 / 0

[JBoss JIRA] (WFLY-6777) Upgrade to OpenJPA 2.4.1 to avoid testsuite hang on JDK9

by Scott Marlow (JIRA)

[ https://issues.jboss.org/browse/WFLY-6777?page=com.atlassian.jira.plugin.... ] Scott Marlow updated WFLY-6777: ------------------------------- Summary: Upgrade to OpenJPA 2.4.1 to avoid testsuite hang on JDK9 (was: Upgrade to OpenJPA impl compatible with JDK9) > Upgrade to OpenJPA 2.4.1 to avoid testsuite hang on JDK9 > -------------------------------------------------------- > > Key: WFLY-6777 > URL: https://issues.jboss.org/browse/WFLY-6777 > Project: WildFly > Issue Type: Sub-task > Components: JPA / Hibernate > Reporter: Tomaz Cerar > Assignee: Scott Marlow > Priority: Minor > Fix For: 11.0.0.Final > > > OpenJPA tests currently hang our testsuite as serp bytecode enhancer that OpenJPA uses hangs the deployment. > For now test is not run on JDK9, but this should be re-enabled once there is release of openjpa that works fine with jdk9 -- This message was sent by Atlassian JIRA (v7.5.0#75005)

8 years, 9 months

1
0
0 / 0

[JBoss JIRA] (WFLY-6777) Upgrade to OpenJPA 2.4.1 to avoid testsuite hang on JDK9

by Scott Marlow (JIRA)

[ https://issues.jboss.org/browse/WFLY-6777?page=com.atlassian.jira.plugin.... ] Scott Marlow closed WFLY-6777. ------------------------------ Resolution: Done > Upgrade to OpenJPA 2.4.1 to avoid testsuite hang on JDK9 > -------------------------------------------------------- > > Key: WFLY-6777 > URL: https://issues.jboss.org/browse/WFLY-6777 > Project: WildFly > Issue Type: Sub-task > Components: JPA / Hibernate > Reporter: Tomaz Cerar > Assignee: Scott Marlow > Priority: Minor > Fix For: 11.0.0.Final > > > OpenJPA tests currently hang our testsuite as serp bytecode enhancer that OpenJPA uses hangs the deployment. > For now test is not run on JDK9, but this should be re-enabled once there is release of openjpa that works fine with jdk9 -- This message was sent by Atlassian JIRA (v7.5.0#75005)

8 years, 9 months

1
0
0 / 0

[JBoss JIRA] (WFLY-6777) Upgrade to OpenJPA impl compatible with JDK9

by Scott Marlow (JIRA)

[ https://issues.jboss.org/browse/WFLY-6777?page=com.atlassian.jira.plugin.... ] Scott Marlow updated WFLY-6777: ------------------------------- Fix Version/s: 11.0.0.Final > Upgrade to OpenJPA impl compatible with JDK9 > -------------------------------------------- > > Key: WFLY-6777 > URL: https://issues.jboss.org/browse/WFLY-6777 > Project: WildFly > Issue Type: Sub-task > Components: JPA / Hibernate > Reporter: Tomaz Cerar > Assignee: Scott Marlow > Priority: Minor > Fix For: 11.0.0.Final > > > OpenJPA tests currently hang our testsuite as serp bytecode enhancer that OpenJPA uses hangs the deployment. > For now test is not run on JDK9, but this should be re-enabled once there is release of openjpa that works fine with jdk9 -- This message was sent by Atlassian JIRA (v7.5.0#75005)

8 years, 9 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-jira October 2017