[JBoss JIRA] (ELY-975) Add authenticate methods to SecurityDomain
by Darran Lofthouse (JIRA)
[ https://issues.jboss.org/browse/ELY-975?page=com.atlassian.jira.plugin.sy... ]
Darran Lofthouse updated ELY-975:
---------------------------------
Summary: Add authenticate methods to SecurityDomain (was: Add a SecurityDomainAuthenticationClient)
> Add authenticate methods to SecurityDomain
> ------------------------------------------
>
> Key: ELY-975
> URL: https://issues.jboss.org/browse/ELY-975
> Project: WildFly Elytron
> Issue Type: Feature Request
> Components: API / SPI
> Reporter: Darran Lofthouse
> Assignee: Darran Lofthouse
> Fix For: 1.1.0.Beta28
>
>
> This will be backed by a permission check and obtainable from a SecurityDomain, it will expose methods to enable Evidence verification and authorization to obtain a SecurityIdentity without full access to the ServerAuthenticationContext being required.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 2 months
[JBoss JIRA] (ELY-975) Add authenticate methods to SecurityDomain
by Darran Lofthouse (JIRA)
[ https://issues.jboss.org/browse/ELY-975?page=com.atlassian.jira.plugin.sy... ]
Darran Lofthouse updated ELY-975:
---------------------------------
Description: Add authenticate methods to SecurityDomain, this should still have a permission check but is allows code to programatically authenticate without needing access to the ServerAuthenticationContext. (was: This will be backed by a permission check and obtainable from a SecurityDomain, it will expose methods to enable Evidence verification and authorization to obtain a SecurityIdentity without full access to the ServerAuthenticationContext being required.)
> Add authenticate methods to SecurityDomain
> ------------------------------------------
>
> Key: ELY-975
> URL: https://issues.jboss.org/browse/ELY-975
> Project: WildFly Elytron
> Issue Type: Feature Request
> Components: API / SPI
> Reporter: Darran Lofthouse
> Assignee: Darran Lofthouse
> Fix For: 1.1.0.Beta28
>
>
> Add authenticate methods to SecurityDomain, this should still have a permission check but is allows code to programatically authenticate without needing access to the ServerAuthenticationContext.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 2 months
[JBoss JIRA] (ELY-972) Elytron Audit Logging does not log failed authentication
by Darran Lofthouse (JIRA)
[ https://issues.jboss.org/browse/ELY-972?page=com.atlassian.jira.plugin.sy... ]
Darran Lofthouse commented on ELY-972:
--------------------------------------
We want to add some new event types to maybe capture the difference between failing the authentication step and the authorization step.
> Elytron Audit Logging does not log failed authentication
> --------------------------------------------------------
>
> Key: ELY-972
> URL: https://issues.jboss.org/browse/ELY-972
> Project: WildFly Elytron
> Issue Type: Bug
> Reporter: Jan Tymel
> Assignee: Jan Kalina
> Priority: Blocker
>
> Successful authentication is correctly handled by Elytron Audit Logging. However, if user provides incorrect password (~ authentication fails) there is no such record in audit log file.
> Logging of failed authentication is one of the requirements for this Elytron Audit Logging feature. Therefore setting blocker priority.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 2 months
[JBoss JIRA] (ELY-972) Elytron Audit Logging does not log failed authentication
by Jan Kalina (JIRA)
[ https://issues.jboss.org/browse/ELY-972?page=com.atlassian.jira.plugin.sy... ]
Jan Kalina commented on ELY-972:
--------------------------------
The only problem is, SecurityAuthenticationFailedEvent accept SecurityIdentity, which is anonymous in captureIdentity - if we want to see who is unsuccessfuly trying to log in, we need to use RealmIdentity - should not it be used in SecurityAuthenticationFailedEvent instead?
> Elytron Audit Logging does not log failed authentication
> --------------------------------------------------------
>
> Key: ELY-972
> URL: https://issues.jboss.org/browse/ELY-972
> Project: WildFly Elytron
> Issue Type: Bug
> Reporter: Jan Tymel
> Assignee: Jan Kalina
> Priority: Blocker
>
> Successful authentication is correctly handled by Elytron Audit Logging. However, if user provides incorrect password (~ authentication fails) there is no such record in audit log file.
> Logging of failed authentication is one of the requirements for this Elytron Audit Logging feature. Therefore setting blocker priority.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 2 months
[JBoss JIRA] (ELY-972) Elytron Audit Logging does not log failed authentication
by Jan Kalina (JIRA)
[ https://issues.jboss.org/browse/ELY-972?page=com.atlassian.jira.plugin.sy... ]
Jan Kalina commented on ELY-972:
--------------------------------
As the existing audit logging messages are logged under control of ServerAuthenticationContext, I believe we should emit authentication fail messages also here, as part of fail() of approriate States.
Or what is to think here, [~dlofthouse]?
> Elytron Audit Logging does not log failed authentication
> --------------------------------------------------------
>
> Key: ELY-972
> URL: https://issues.jboss.org/browse/ELY-972
> Project: WildFly Elytron
> Issue Type: Bug
> Reporter: Jan Tymel
> Assignee: Jan Kalina
> Priority: Blocker
>
> Successful authentication is correctly handled by Elytron Audit Logging. However, if user provides incorrect password (~ authentication fails) there is no such record in audit log file.
> Logging of failed authentication is one of the requirements for this Elytron Audit Logging feature. Therefore setting blocker priority.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 2 months
[JBoss JIRA] (ELY-975) Add a SecurityDomainAuthenticationClient
by Darran Lofthouse (JIRA)
Darran Lofthouse created ELY-975:
------------------------------------
Summary: Add a SecurityDomainAuthenticationClient
Key: ELY-975
URL: https://issues.jboss.org/browse/ELY-975
Project: WildFly Elytron
Issue Type: Feature Request
Components: API / SPI
Reporter: Darran Lofthouse
Assignee: Darran Lofthouse
Fix For: 1.1.0.Beta28
This will be backed by a permission check and obtainable from a SecurityDomain, it will expose methods to enable Evidence verification and authorization to obtain a SecurityIdentity without full access to the ServerAuthenticationContext being required.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 2 months
[JBoss JIRA] (WFLY-8182) Convert *-authentication-factory resources to be child resources of security-domain
by Darran Lofthouse (JIRA)
Darran Lofthouse created WFLY-8182:
--------------------------------------
Summary: Convert *-authentication-factory resources to be child resources of security-domain
Key: WFLY-8182
URL: https://issues.jboss.org/browse/WFLY-8182
Project: WildFly
Issue Type: Task
Components: Security
Reporter: Darran Lofthouse
Assignee: Darran Lofthouse
Fix For: 11.0.0.Alpha1
This is a good example of where child resources work.
The authentication factory resources have a mandatory dependency on a single security domain.
The configuration within the factory is related to it's security domain.
There is only a single resource that can provide security domains.
The behaviour of the parent is unaffected by the existence or configuration of the child.
The parent and child manage their own services independently with the child's service depending on the parent's service.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 2 months
[JBoss JIRA] (WFLY-8181) broadcast-group capability must include the messaging server name
by Jeff Mesnil (JIRA)
Jeff Mesnil created WFLY-8181:
---------------------------------
Summary: broadcast-group capability must include the messaging server name
Key: WFLY-8181
URL: https://issues.jboss.org/browse/WFLY-8181
Project: WildFly
Issue Type: Bug
Components: JMS
Affects Versions: 10.1.0.Final
Reporter: Jeff Mesnil
Assignee: Jeff Mesnil
Capabilities registered by the messaging-server's broadcast-group resources are using the pattern:
org.wildfly.messaging.activemq.broadcast-group.channel-factory.<broadcast-group name>
This prevents having 2 broadcast-groups belonging to different ActiveMQ servers using the same name configured in the same profile.
Instead, the ActiveMQ server name should be part of the capability name, e.g.
org.wildfly.messaging.activemq.broadcast-group.channel-factory.<server name>.<broadcast-group name>
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 2 months
[JBoss JIRA] (WFLY-8180) Add core-management extension to the feature packs
by ehsavoie Hugonnet (JIRA)
[ https://issues.jboss.org/browse/WFLY-8180?page=com.atlassian.jira.plugin.... ]
ehsavoie Hugonnet moved JBEAP-9002 to WFLY-8180:
------------------------------------------------
Project: WildFly (was: JBoss Enterprise Application Platform)
Key: WFLY-8180 (was: JBEAP-9002)
Workflow: GIT Pull Request workflow (was: CDW with loose statuses v1)
Component/s: Domain Management
(was: Domain Management)
Affects Version/s: 10.1.0.Final
(was: 7.1.0.DR12)
> Add core-management extension to the feature packs
> --------------------------------------------------
>
> Key: WFLY-8180
> URL: https://issues.jboss.org/browse/WFLY-8180
> Project: WildFly
> Issue Type: Bug
> Components: Domain Management
> Affects Versions: 10.1.0.Final
> Reporter: ehsavoie Hugonnet
> Assignee: ehsavoie Hugonnet
>
> The servlet and full distributions don't have the core-management extension defined. Add it to those 2 feature packs.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 2 months