April 2017 - jboss-jira - Jboss List Archives

[JBoss JIRA] (WFLY-8544) Elytron, management interface, legacy authentication is "checked" even if Elytron authentication is configured

by Martin Choma (JIRA)

Martin Choma created WFLY-8544: ---------------------------------- Summary: Elytron, management interface, legacy authentication is "checked" even if Elytron authentication is configured Key: WFLY-8544 URL: https://issues.jboss.org/browse/WFLY-8544 Project: WildFly Issue Type: Bug Components: Security Reporter: Martin Choma Assignee: Darran Lofthouse Priority: Blocker Regression against DR15. Authentication by legacy security realm is taken in account even if just Elytron authentication should be used. I don't say legacy authentication is used in priority before Elytron (that works as expected). Just that legacy authentication is somehow "initialized". In this case check "There are no user in mngmt-user.properties file" is performed Reproducer: * Configure Elytron authentication for management interface {code} /subsystem=elytron/filesystem-realm=exampleFsRealm:add(path=fs-realm-users,relative-to=jboss.server.config.dir) /subsystem=elytron/filesystem-realm=exampleFsRealm/identity=user1:add() /subsystem=elytron/filesystem-realm=exampleFsRealm/identity=user1:set-password( clear={password="password123"}) /subsystem=elytron/simple-role-decoder=from-roles-attribute:add(attribute=Roles) /subsystem=elytron/security-domain=exampleFsSD:add(realms=[{realm=exampleFsRealm,role-decoder=from-roles-attribute}],default-realm=exampleFsRealm,permission-mapper=default-permission-mapper) /subsystem=elytron/http-authentication-factory=example-fs-http-auth:add(http-server-mechanism-factory=global,security-domain=exampleFsSD,mechanism-configurations=[{mechanism-name=BASIC,mechanism-realm-configurations=[{realm-name=exampleApplicationDomain}]}]) /core-service=management/management-interface=http-interface:write-attribute(name=http-authentication-factory, value=example-fs-http-auth) {code} * impossible to acces management interface {code} curl --user user1:password123 http://localhost.localdomain:9990/management?operation=attribute\&name=se... { "outcome" : "failed", "failure-description" : "WFLYDMHTTP0006: The security realm is not ready to process requests, see http://localhost.localdomain:9990/error", "rolled-back" : "true" } {code} Acces is granted once * security realm is undefined from management interface {code} /core-service=management/management-interface=http-interface:undefine-attribute(name=security-realm) {code} * User is added into ManagementRealm {code} ./add-user.sh -u admin -p admin -r ManagementRealm {code} {code} curl --user user1:password123 http://localhost.localdomain:9990/management?operation=attribute\&name=se... "running" {code} -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 3 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2643) Elytron Audit Logging does not support log file rotation

by Jan Kalina (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2643?page=com.atlassian.jira.plugi... ] Jan Kalina updated WFCORE-2643: ------------------------------- Labels: audit-logging rotation (was: audit-logging eap7.1-rfe-blocker rotation) > Elytron Audit Logging does not support log file rotation > -------------------------------------------------------- > > Key: WFCORE-2643 > URL: https://issues.jboss.org/browse/WFCORE-2643 > Project: WildFly Core > Issue Type: Bug > Components: Security > Reporter: Jan Kalina > Assignee: Jan Kalina > Priority: Blocker > Labels: audit-logging, rotation > > It is not possible to rotate (= rename current log file and start logging into a new one) Elytron Audit log files. It cannot be set to use the log rotation neither based on the file size (e.g. once the file size outreaches 100 MB) nor based on a time period (e.g. rotate create a new file every Sunday at midnight). > Inability to set the log rotation could lead to huge log files. Then it would be really difficult to read such files. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 3 months

1
0
0 / 0

[JBoss JIRA] (ELY-1006) Elytron Audit Logging does not support log file rotation

by Jan Kalina (JIRA)

[ https://issues.jboss.org/browse/ELY-1006?page=com.atlassian.jira.plugin.s... ] Jan Kalina reassigned ELY-1006: ------------------------------- Assignee: Jan Kalina > Elytron Audit Logging does not support log file rotation > -------------------------------------------------------- > > Key: ELY-1006 > URL: https://issues.jboss.org/browse/ELY-1006 > Project: WildFly Elytron > Issue Type: Bug > Reporter: Jan Tymel > Assignee: Jan Kalina > Priority: Blocker > Attachments: deployment.war > > > It is not possible to rotate (= rename current log file and start logging into a new one) Elytron Audit log files. It cannot be set to use the log rotation neither based on the file size (e.g. once the file size outreaches 100 MB) nor based on a time period (e.g. rotate create a new file every Sunday at midnight). > Inability to set the log rotation could lead to huge log files. Then it would be really difficult to read such files. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 3 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2645) JMX interface should allow non-string values in the jboss.as.expr JMX domain

by Brian Stansberry (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2645?page=com.atlassian.jira.plugi... ] Brian Stansberry updated WFCORE-2645: ------------------------------------- Description: Perhaps an enhancement, perhaps a bug. TypeConverters.SimpleTypeConverter.toModelNode() is casting the value to String in the expression case (i.e. for jboss.as.expr). This means if the client sends a non-string, i.e. something in the type that would be normal in the jboss.as domain, e.g. Boolean, the call will fail with a class cast exception. It seems like it would be easy enough to handle non-String. That would allow client code written for jboss.as to more easily deal with jboss.as.expr as well. Our testsuite's JmxManagementInterface client being the specific example that led me to file this. (My work on WFCORE-2633 was impacted when I wanted to use JmxManagementInterface to write a boolean value.) was: Perhaps an enhancement, perhaps a bug. TypeConverters.SimpleTypeConverter.toModelNode() is casting the value to String in the expression case (i.e. for jboss.as.expr). This means if the client sends a non-string, i.e. something in the type that would be normal in the jboss.as domain, e.g. Boolean, the call will fail with a class cast exception. It seems like it would be easy enough to handle non-String. That would allow client code written for jboss.as to more easily deal with jboss.as.expr as well. Our testsuite's JmxManagementInterface client being the specific example that led me to file this. (My work on WFCORE-2633 was impacted.) > JMX interface should allow non-string values in the jboss.as.expr JMX domain > ---------------------------------------------------------------------------- > > Key: WFCORE-2645 > URL: https://issues.jboss.org/browse/WFCORE-2645 > Project: WildFly Core > Issue Type: Enhancement > Components: Domain Management, JMX > Reporter: Brian Stansberry > > Perhaps an enhancement, perhaps a bug. > TypeConverters.SimpleTypeConverter.toModelNode() is casting the value to String in the expression case (i.e. for jboss.as.expr). This means if the client sends a non-string, i.e. something in the type that would be normal in the jboss.as domain, e.g. Boolean, the call will fail with a class cast exception. > It seems like it would be easy enough to handle non-String. That would allow client code written for jboss.as to more easily deal with jboss.as.expr as well. Our testsuite's JmxManagementInterface client being the specific example that led me to file this. (My work on WFCORE-2633 was impacted when I wanted to use JmxManagementInterface to write a boolean value.) -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 3 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2645) JMX interface should allow non-string values in the jboss.as.expr JMX domain

by Brian Stansberry (JIRA)

Brian Stansberry created WFCORE-2645: ---------------------------------------- Summary: JMX interface should allow non-string values in the jboss.as.expr JMX domain Key: WFCORE-2645 URL: https://issues.jboss.org/browse/WFCORE-2645 Project: WildFly Core Issue Type: Enhancement Components: Domain Management, JMX Reporter: Brian Stansberry Assignee: Brian Stansberry Perhaps an enhancement, perhaps a bug. TypeConverters.SimpleTypeConverter.toModelNode() is casting the value to String in the expression case (i.e. for jboss.as.expr). This means if the client sends a non-string, i.e. something in the type that would be normal in the jboss.as domain, e.g. Boolean, the call will fail with a class cast exception. It seems like it would be easy enough to handle non-String. That would allow client code written for jboss.as to more easily deal with jboss.as.expr as well. Our testsuite's JmxManagementInterface client being the specific example that led me to file this. (My work on WFCORE-2633 was impacted.) -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 3 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2645) JMX interface should allow non-string values in the jboss.as.expr JMX domain

by Brian Stansberry (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2645?page=com.atlassian.jira.plugi... ] Brian Stansberry reassigned WFCORE-2645: ---------------------------------------- Assignee: (was: Brian Stansberry) > JMX interface should allow non-string values in the jboss.as.expr JMX domain > ---------------------------------------------------------------------------- > > Key: WFCORE-2645 > URL: https://issues.jboss.org/browse/WFCORE-2645 > Project: WildFly Core > Issue Type: Enhancement > Components: Domain Management, JMX > Reporter: Brian Stansberry > > Perhaps an enhancement, perhaps a bug. > TypeConverters.SimpleTypeConverter.toModelNode() is casting the value to String in the expression case (i.e. for jboss.as.expr). This means if the client sends a non-string, i.e. something in the type that would be normal in the jboss.as domain, e.g. Boolean, the call will fail with a class cast exception. > It seems like it would be easy enough to handle non-String. That would allow client code written for jboss.as to more easily deal with jboss.as.expr as well. Our testsuite's JmxManagementInterface client being the specific example that led me to file this. (My work on WFCORE-2633 was impacted.) -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 3 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2644) Remove package org.jboss.as.server.services.path

by Brian Stansberry (JIRA)

Brian Stansberry created WFCORE-2644: ---------------------------------------- Summary: Remove package org.jboss.as.server.services.path Key: WFCORE-2644 URL: https://issues.jboss.org/browse/WFCORE-2644 Project: WildFly Core Issue Type: Task Components: Domain Management Reporter: Brian Stansberry Assignee: Brian Stansberry The classes in this package were deprecated in Feb 2012, before AS 7.1 / EAP 6.0 and are not used in full. Time to remove them. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 3 months

1
0
0 / 0

[JBoss JIRA] (WFLY-8543) JBossWS testsuite failing because of missing explicit wildfly-common dependency

by Alessio Soldano (JIRA)

Alessio Soldano created WFLY-8543: ------------------------------------- Summary: JBossWS testsuite failing because of missing explicit wildfly-common dependency Key: WFLY-8543 URL: https://issues.jboss.org/browse/WFLY-8543 Project: WildFly Issue Type: Bug Reporter: Alessio Soldano Assignee: Alessio Soldano Fix For: 11.0.0.Beta1 Lately the jbossws-cxf testsuite is failing against wfly master because org.wildfly:wildfly-webservices-tests-integration is missing an explicit dependency on org.wildfly.common:wildfly-common. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 3 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-1282) Unable to create HTTPS connection using *ECDH_RSA* cipher suites / kECDHr cipher string

by Brian Stansberry (JIRA)

[ https://issues.jboss.org/browse/WFCORE-1282?page=com.atlassian.jira.plugi... ] Brian Stansberry updated WFCORE-1282: ------------------------------------- Fix Version/s: 3.0.0.Beta15 (was: 3.0.0.Beta14) > Unable to create HTTPS connection using *ECDH_RSA* cipher suites / kECDHr cipher string > --------------------------------------------------------------------------------------- > > Key: WFCORE-1282 > URL: https://issues.jboss.org/browse/WFCORE-1282 > Project: WildFly Core > Issue Type: Bug > Components: Security > Affects Versions: 1.0.2.Final > Environment: Oracle Java > Reporter: Martin Choma > Assignee: Darran Lofthouse > Priority: Critical > Fix For: 3.0.0.Beta15 > > Attachments: client_debug_eap6.log, client_debug_eap7.log, server-cert-key-ec.jks, server_debug_eap6.log, server_debug_eap7.log > > > User using these cipher suites / cipher name in EAP6 won't be able to use it in EAP7. > Setting as critical as these cipher suites, are considered for strong and widely used in my opinion. > In server log, error "no cipher suites in common" can be seen using -Djavax.net.debug=all. > Note, that analogous configuration in EAP6 works fine. > Issue can be seen on Oracle Java only, as on OpenJDK / IBM these suites are not provided by method getDefaultCipherSuites(). > Also is it possible to log "no cipher suites in common" and similar tls handshake errors without -Djavax.net.debug for better troubleshooting? -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 3 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-887) "Deprecate" using an expression in model refs to interfaces

by Brian Stansberry (JIRA)

[ https://issues.jboss.org/browse/WFCORE-887?page=com.atlassian.jira.plugin... ] Brian Stansberry updated WFCORE-887: ------------------------------------ Fix Version/s: 3.0.0.Beta15 (was: 3.0.0.Beta14) > "Deprecate" using an expression in model refs to interfaces > ----------------------------------------------------------- > > Key: WFCORE-887 > URL: https://issues.jboss.org/browse/WFCORE-887 > Project: WildFly Core > Issue Type: Task > Components: Domain Management > Reporter: Brian Stansberry > Fix For: 3.0.0.Beta15 > > > SocketBindingGroupResourceDefinition and OutboundSocketBindingResourceDefinition both have attributes that represent model refs to interface resources, but which also allow expressions. > Model references should not allow expressions. These were "grandfathered in" when the large scale expression support roll out happened for AS 7.2 / EAP 6.1. > There's no metadata facility to record that expression support is deprecated, but the add handler for these should log a WARN if they encounter an expression. Hopefully in EAP 8 we can then remove expression support. > We should look for other cases like this too, although those changes should be separate JIRAs. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 3 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-jira April 2017