[JBoss JIRA] (WFCORE-2360) Misleading failure description upon attempt of /host=slave/server-config=x:remove() when server-config=x is still running
by Brian Stansberry (JIRA)
[ https://issues.jboss.org/browse/WFCORE-2360?page=com.atlassian.jira.plugi... ]
Brian Stansberry commented on WFCORE-2360:
------------------------------------------
Why does the model synchronization fail?
> Misleading failure description upon attempt of /host=slave/server-config=x:remove() when server-config=x is still running
> --------------------------------------------------------------------------------------------------------------------------
>
> Key: WFCORE-2360
> URL: https://issues.jboss.org/browse/WFCORE-2360
> Project: WildFly Core
> Issue Type: Bug
> Components: Domain Management
> Reporter: Michal Jurc
> Assignee: ehsavoie Hugonnet
>
> When trying to remove a running {{server-config}} on slave host from {{host-master}} controller, the following message is produced in CLI:
> {code}[domain@localhost:9990 /] /host=hc1/server-config=server-two:remove()
> {
> "outcome" => "failed",
> "result" => {},
> "failure-description" => {"host-failure-descriptions" => {"hc1" => "WFLYHC0201: Error synchronizing the host model with the domain controller model with failure : WFLYCTL0063: Composite operation was rolled back."}},
> "rolled-back" => true
> }
> {code}
> This is not very informative. The error message from just removing running {{server-config}} managed by controller is different, and also much more informative:
> {code}[domain@localhost:9990 /] /host=master/server-config=server-two:remove()
> {
> "outcome" => "failed",
> "result" => {},
> "failure-description" => {"host-failure-descriptions" => {"master" => "WFLYHC0078: Server (server-two) still running"}},
> "rolled-back" => true
> }
> {code}
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 2 months
[JBoss JIRA] (WFLY-8319) Undertow doesn't process HTTPS request sometimes
by Balavignesh sethupathi (JIRA)
Balavignesh sethupathi created WFLY-8319:
--------------------------------------------
Summary: Undertow doesn't process HTTPS request sometimes
Key: WFLY-8319
URL: https://issues.jboss.org/browse/WFLY-8319
Project: WildFly
Issue Type: Bug
Components: Web (Undertow)
Affects Versions: 9.0.2.Final, 8.2.1.Final
Environment: Redhat Linux 7.2
Reporter: Balavignesh sethupathi
Assignee: Stuart Douglas
Attachments: testSuite.tar.gz
We are seeing this issue in undertow 1.4.8 where it fails to process a POST(HTTPS) request sent from the SOAPUI client sometimes.
We have the related info updated in the below JBoss thread:
https://developer.jboss.org/thread/273775
In short, seems like the default task thread which handled the previous HTTPS SOAP request drains the next request that is waiting to get serviced. This seems to be race condition which happens intermittently.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 2 months
[JBoss JIRA] (WFCORE-2507) Key manager exported from legacy security domain does not work Elytron server-ssl-context
by Ondrej Kotek (JIRA)
[ https://issues.jboss.org/browse/WFCORE-2507?page=com.atlassian.jira.plugi... ]
Ondrej Kotek moved JBEAP-9411 to WFCORE-2507:
---------------------------------------------
Project: WildFly Core (was: JBoss Enterprise Application Platform)
Key: WFCORE-2507 (was: JBEAP-9411)
Workflow: GIT Pull Request workflow (was: CDW with loose statuses v1)
Component/s: Security
(was: Security)
Affects Version/s: 3.0.0.Beta6
(was: 7.1.0.DR13)
> Key manager exported from legacy security domain does not work Elytron server-ssl-context
> -----------------------------------------------------------------------------------------
>
> Key: WFCORE-2507
> URL: https://issues.jboss.org/browse/WFCORE-2507
> Project: WildFly Core
> Issue Type: Bug
> Components: Security
> Affects Versions: 3.0.0.Beta6
> Reporter: Ondrej Kotek
> Priority: Critical
>
> It is not possible to use a key manager exported from legacy security domain (i.e. {{elytron-key-manager}}) in Elytron {{server-ssl-context}}. It results in:
> {noformat}
> {
> "outcome" => "failed",
> "failure-description" => {
> "WFLYCTL0080: Failed services" => {"org.wildfly.security.ssl-context.ssc" => "org.jboss.msc.service.StartException in service org.wildfly.security.ssl-context.ssc: WFLYELY00019: No 'X509ExtendedKeyManager' found in injected value."},
> "WFLYCTL0412: Required services that are not installed:" => ["org.wildfly.security.ssl-context.ssc"]
> },
> "rolled-back" => true
> }
> {noformat}
> The exported key manager is announced as {{org.wildfly.security.key-managers}} capability. Hence it is expected to work wherever the capability is requested.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 2 months
[JBoss JIRA] (WFCORE-2506) Roles are not assigned if access=identity uses Elytron security domain based on legacy security domain
by Ondrej Lukas (JIRA)
Ondrej Lukas created WFCORE-2506:
------------------------------------
Summary: Roles are not assigned if access=identity uses Elytron security domain based on legacy security domain
Key: WFCORE-2506
URL: https://issues.jboss.org/browse/WFCORE-2506
Project: WildFly Core
Issue Type: Bug
Components: Security
Reporter: Ondrej Lukas
Assignee: Darran Lofthouse
Priority: Critical
In case when Elytron security domain, which uses legacy security domain (provided through elytron-integration in legacy security subsystem), is used for identity inflow in access=identity, and authentication is provided by security domain which uses some Elytron security realm, then no roles/groups from legacy security domain are assigned to the secured identity. See reproducer for more details.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 2 months
[JBoss JIRA] (WFLY-8318) [7.1] Configuration Guide - typo in Configuring Handlers section
by Sande Gilda (JIRA)
Sande Gilda created WFLY-8318:
---------------------------------
Summary: [7.1] Configuration Guide - typo in Configuring Handlers section
Key: WFLY-8318
URL: https://issues.jboss.org/browse/WFLY-8318
Project: WildFly
Issue Type: Enhancement
Components: Documentation
Reporter: Sande Gilda
The sentence reads: "Reverse-proxy handlers allow JBoss EAP to server as a high performance reverse-proxy. "
It should read: "Reverse-proxy handlers allow JBoss EAP to serve as a high performance reverse-proxy. "
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 2 months
[JBoss JIRA] (WFCORE-2503) Legacy security domain used as Elytron security realm does not work in authorization part of aggregate-realm
by Ondrej Lukas (JIRA)
[ https://issues.jboss.org/browse/WFCORE-2503?page=com.atlassian.jira.plugi... ]
Ondrej Lukas updated WFCORE-2503:
---------------------------------
Steps to Reproduce:
1) create property files /tmp/users.properties and /tmp/roles.properties
/tmp/users.properties:
{code}
admin=admin
{code}
/roles.properties:
{code}
admin=JBossAdmin
{code}
2) Through add-user.sh add user admin with some password and role Admin for ApplicationRealm
3) add legacy configuration to application server
{code}
<security-domain name="legacyDomain" cache-type="default">
<authentication>
<login-module code="UsersRoles" flag="required">
<module-option name="usersProperties" value="/tmp/users.properties"/>
<module-option name="rolesProperties" value="/tmp/roles.properties"/>
</login-module>
</authentication>
<mapping>
<mapping-module code="SimpleRoles" type="role">
<module-option name="admin" value="User"/>
</mapping-module>
</mapping>
</security-domain>
...
<elytron-integration>
<security-realms>
<elytron-realm name="exportedDomain" legacy-jaas-config="legacyDomain"/>
</security-realms>
</elytron-integration>
{code}
4) setup Elytron part:
{code}
/subsystem=elytron/simple-role-decoder=roles-decoder:add(attribute=Roles)
/subsystem=elytron/aggregate-realm=pbauthz:add(authentication-realm=ApplicationRealm,authorization-realm=exportedDomain)
/subsystem=elytron/security-domain=elytronDomain:add(default-realm=pbauthz,permission-mapper=default-permission-mapper,realms=[{realm=pbauthz,role-decoder=roles-decoder}])
/subsystem=elytron/http-authentication-factory=elytron-http-auth:add(http-server-mechanism-factory=global,security-domain=elytronDomain,mechanism-configurations=[{mechanism-name=BASIC,mechanism-realm-configurations=[{realm-name="Exported Realm"}]}])
/subsystem=undertow/application-security-domain=print-roles:add(http-authentication-factory=elytron-http-auth)
{code}
5) Deploy application for printing roles (see attachments)
6) Access http://127.0.0.1:8080/print-roles/protected/printRoles?role=User&role=JBo... and login with admin/admin - no roles are assigned (HTTP status cod 403 is returned)
was:
1) create property files /tmp/users.properties and /tmp/roles.properties
/tmp/users.properties:
{code}
admin=admin
{code}
/roles.properties:
{code}
admin=JBossAdmin
{code}
2) Through add-user.sh add user admin with some password and role Admin
3) add legacy configuration to application server
{code}
<security-domain name="legacyDomain" cache-type="default">
<authentication>
<login-module code="UsersRoles" flag="required">
<module-option name="usersProperties" value="/tmp/users.properties"/>
<module-option name="rolesProperties" value="/tmp/roles.properties"/>
</login-module>
</authentication>
<mapping>
<mapping-module code="SimpleRoles" type="role">
<module-option name="admin" value="User"/>
</mapping-module>
</mapping>
</security-domain>
...
<elytron-integration>
<security-realms>
<elytron-realm name="exportedDomain" legacy-jaas-config="legacyDomain"/>
</security-realms>
</elytron-integration>
{code}
4) setup Elytron part:
{code}
/subsystem=elytron/simple-role-decoder=roles-decoder:add(attribute=Roles)
/subsystem=elytron/aggregate-realm=pbauthz:add(authentication-realm=ApplicationRealm,authorization-realm=exportedDomain)
/subsystem=elytron/security-domain=elytronDomain:add(default-realm=pbauthz,permission-mapper=default-permission-mapper,realms=[{realm=pbauthz,role-decoder=roles-decoder}])
/subsystem=elytron/http-authentication-factory=elytron-http-auth:add(http-server-mechanism-factory=global,security-domain=elytronDomain,mechanism-configurations=[{mechanism-name=BASIC,mechanism-realm-configurations=[{realm-name="Exported Realm"}]}])
/subsystem=undertow/application-security-domain=print-roles:add(http-authentication-factory=elytron-http-auth)
{code}
5) Deploy application for printing roles (see attachments)
6) Access http://127.0.0.1:8080/print-roles/protected/printRoles?role=User&role=JBo... and login with admin/admin - no roles are assigned (HTTP status cod 403 is returned)
> Legacy security domain used as Elytron security realm does not work in authorization part of aggregate-realm
> ------------------------------------------------------------------------------------------------------------
>
> Key: WFCORE-2503
> URL: https://issues.jboss.org/browse/WFCORE-2503
> Project: WildFly Core
> Issue Type: Bug
> Components: Security
> Reporter: Ondrej Lukas
> Assignee: Darran Lofthouse
> Priority: Critical
> Attachments: print-roles.war
>
>
> In case when legacy security domain is used as Elytron security realm and is added as authorization realm to aggregate-realm then no roles are assigned to authenticated user.
> I tried to use following legacy security domain:
> {code}
> <security-domain name="legacyDomain" cache-type="default">
> <authentication>
> <login-module code="UsersRoles" flag="required">
> <module-option name="usersProperties" value="/tmp/users.properties"/>
> <module-option name="rolesProperties" value="/tmp/roles.properties"/>
> </login-module>
> </authentication>
> <mapping>
> <mapping-module code="SimpleRoles" type="role">
> <module-option name="admin" value="User"/>
> </mapping-module>
> </mapping>
> </security-domain>
> {code}
> Roles should be assigned from mapping. Since it seems that there is no documentation related to this topic I am not sure whether roles should be assigned also from rolesProperties of UsersRoles login module - it needs to be clarified by developers.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 2 months
[JBoss JIRA] (WFLY-8317) Stack element in JGroups subsystem allows arbitrary attribute to be defined
by Radoslav Husar (JIRA)
[ https://issues.jboss.org/browse/WFLY-8317?page=com.atlassian.jira.plugin.... ]
Radoslav Husar moved JBEAP-9399 to WFLY-8317:
---------------------------------------------
Project: WildFly (was: JBoss Enterprise Application Platform)
Key: WFLY-8317 (was: JBEAP-9399)
Workflow: GIT Pull Request workflow (was: CDW with loose statuses v1)
Component/s: Clustering
(was: Clustering)
Affects Version/s: 10.1.0.Final
(was: 7.1.0.DR13)
> Stack element in JGroups subsystem allows arbitrary attribute to be defined
> ---------------------------------------------------------------------------
>
> Key: WFLY-8317
> URL: https://issues.jboss.org/browse/WFLY-8317
> Project: WildFly
> Issue Type: Bug
> Components: Clustering
> Affects Versions: 10.1.0.Final
> Reporter: Radoslav Husar
> Assignee: Radoslav Husar
> Priority: Minor
>
> When adding foo="bar" attribute to <stack> element in JGroups subsystem and running the EAP, the XML validation passes.
> There should Validation error thrown instead.
> {code:xml|title=JGroups subsystem configuration}
> <subsystem xmlns="urn:jboss:domain:jgroups:4.1">
> <channels default="ee" foo="bar">
> <channel name="ee" stack="udp"/>
> </channels>
> <stacks>
> <stack name="udp" foo="bar">
> <transport type="UDP" socket-binding="jgroups-udp"/>
> <protocol type="PING"/>
> <protocol type="MERGE3"/>
> <protocol type="FD_SOCK"/>
> <protocol type="FD_ALL"/>
> <protocol type="VERIFY_SUSPECT"/>
> <protocol type="pbcast.NAKACK2"/>
> <protocol type="UNICAST3"/>
> <protocol type="pbcast.STABLE"/>
> <protocol type="pbcast.GMS"/>
> <protocol type="UFC"/>
> <protocol type="MFC"/>
> <protocol type="FRAG2"/>
> </stack>
> </stacks>
> </subsystem>
> {code}
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 2 months