[JBoss JIRA] (WFCORE-2664) Eliminate MSC optional dependency usage in RemotingServices
by Brian Stansberry (JIRA)
[ https://issues.jboss.org/browse/WFCORE-2664?page=com.atlassian.jira.plugi... ]
Brian Stansberry updated WFCORE-2664:
-------------------------------------
Fix Version/s: 3.0.0.Beta19
(was: 3.0.0.Beta18)
> Eliminate MSC optional dependency usage in RemotingServices
> -----------------------------------------------------------
>
> Key: WFCORE-2664
> URL: https://issues.jboss.org/browse/WFCORE-2664
> Project: WildFly Core
> Issue Type: Enhancement
> Affects Versions: 3.0.0.Beta14
> Reporter: Richard Opalka
> Assignee: Brian Stansberry
> Fix For: 3.0.0.Beta19
>
>
> RemotingServices.installConnectorServices() uses MSC optional dependency.
> Any change this MSC optional dependency usage might be eliminated there?
> Maybe OperationContext.hasOptionalCapability() could be used
> in ManagementRemotingServices.installDomainConnectorServices() method?
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
7 years, 8 months
[JBoss JIRA] (WFCORE-2547) Revisit the meaning of aggregate-principal-transformer
by Brian Stansberry (JIRA)
[ https://issues.jboss.org/browse/WFCORE-2547?page=com.atlassian.jira.plugi... ]
Brian Stansberry updated WFCORE-2547:
-------------------------------------
Fix Version/s: 3.0.0.Beta19
(was: 3.0.0.Beta18)
> Revisit the meaning of aggregate-principal-transformer
> ------------------------------------------------------
>
> Key: WFCORE-2547
> URL: https://issues.jboss.org/browse/WFCORE-2547
> Project: WildFly Core
> Issue Type: Bug
> Components: Security
> Reporter: Ondrej Lukas
> Assignee: Jan Kalina
> Priority: Blocker
> Labels: principal-transformer
> Fix For: 3.0.0.Beta19
>
>
> Meaning of Elytron {{aggregate-principal-transformer}} should be revised. Also one point about {{regex-validating-principal-transformer}} is included since it seems its use cases are related to aggregate-principal-transformer. See:
> * It seems that it works like "It iterates through assigned Principal Transformers and returns the first non-null transformed Principal" - is it correct and intended behaviour? Is "aggregate-principal-transformer" appropriate name for transformer which works like that?
> * What is the use case for regex-validating-principal-transformer. This transformer just checks some pattern and if it does not match then it rewrites Principal name to null. I think it can be useful in aggregate-principal-transformer, when it can check that name matches some pattern in first transformer (regex-validating-principal-transformer) and then transforms principal in another transformer (e.g. constant-principal-transformer). Is there any other use case?
> * When can aggregate-principal-transformer return any other Principal Transformer than first of the list? I think only user implemented custom-principal-transformer can currently return null (which enable iterating to another principal transformer in the list). Also regex-validating-principal-transformer can be used for returning non-first transformer, as I mentioned in previous point. Is there any real scenario when aggregate-principal-transformer can be used?
> This issue is reported based on previous discussion with engineering.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
7 years, 8 months
[JBoss JIRA] (WFCORE-2521) TLS between domain and host controllers does not work
by Brian Stansberry (JIRA)
[ https://issues.jboss.org/browse/WFCORE-2521?page=com.atlassian.jira.plugi... ]
Brian Stansberry updated WFCORE-2521:
-------------------------------------
Fix Version/s: 3.0.0.Beta19
(was: 3.0.0.Beta18)
> TLS between domain and host controllers does not work
> -----------------------------------------------------
>
> Key: WFCORE-2521
> URL: https://issues.jboss.org/browse/WFCORE-2521
> Project: WildFly Core
> Issue Type: Bug
> Components: Domain Management, Security
> Reporter: Darran Lofthouse
> Assignee: Darran Lofthouse
> Priority: Blocker
> Labels: domain-management, domain-mode, eap71_alpha, regression, ssl
> Fix For: 3.0.0.Beta19
>
>
> This is regression against EAP 7.0 . Customers relying on this feature won't be able to migrate to EAP 7.1.
> Working configuration of TLS between domain and host controller from EAP 7.0 (legacy) does not work on EAP 7.1 anymore.
> In server log there is this error:
> {code:title=server.log}
> [Host Controller] Caused by: java.io.IOException: Client starting STARTTLS but channel doesn't support SSL
> [Host Controller] at org.jboss.remoting3.remote.ClientConnectionOpenListener$StartTls.handleEvent(ClientConnectionOpenListener.java:527)
> [Host Controller] at org.jboss.remoting3.remote.ClientConnectionOpenListener$StartTls.handleEvent(ClientConnectionOpenListener.java:477)
> [Host Controller] at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:92)
> [Host Controller] at org.xnio.conduits.ReadReadyHandler$ChannelListenerHandler.readReady(ReadReadyHandler.java:66)
> [Host Controller] at org.xnio.nio.NioSocketConduit.handleReady(NioSocketConduit.java:89)
> [Host Controller] at org.xnio.nio.WorkerThread.run(WorkerThread.java:567)
> [Host Controller] at ...asynchronous invocation...(Unknown Source)
> [Host Controller] at org.jboss.remoting3.EndpointImpl.connect(EndpointImpl.java:466)
> [Host Controller] at org.jboss.remoting3.EndpointImpl.connect(EndpointImpl.java:437)
> [Host Controller] at org.jboss.remoting3.EndpointImpl.connect(EndpointImpl.java:430)
> [Host Controller] at org.jboss.as.protocol.ProtocolConnectionUtils.connect(ProtocolConnectionUtils.java:163)
> [Host Controller] at org.jboss.as.protocol.ProtocolConnectionUtils.connectSync(ProtocolConnectionUtils.java:119)
> [Host Controller] ... 9 more
> {code}
> See attached server.log for context log.
> Tests in wildfly-core covering this scenario are currently ignored:
> * SSLMasterSlaveOneWayTestCase is ignored by WFCORE-1978
> * SSLMasterSlaveTwoWayTestCase is ignored by WFCORE-2068
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
7 years, 8 months
[JBoss JIRA] (WFCORE-2500) Elytron, changing http-server-mechanism-factory of http-authentication-factory ends in reload-required state
by Brian Stansberry (JIRA)
[ https://issues.jboss.org/browse/WFCORE-2500?page=com.atlassian.jira.plugi... ]
Brian Stansberry updated WFCORE-2500:
-------------------------------------
Fix Version/s: 3.0.0.Beta19
(was: 3.0.0.Beta18)
> Elytron, changing http-server-mechanism-factory of http-authentication-factory ends in reload-required state
> ------------------------------------------------------------------------------------------------------------
>
> Key: WFCORE-2500
> URL: https://issues.jboss.org/browse/WFCORE-2500
> Project: WildFly Core
> Issue Type: Bug
> Components: Security
> Reporter: Martin Choma
> Assignee: Tomas Hofman
> Fix For: 3.0.0.Beta11, 3.0.0.Beta19
>
>
> Changing attribute changing http-server-mechanism-factory of http-authentication-factory ends in reload-required state even though header allow-resource-service-restart=true is used
> {code}
> [standalone@localhost:9990 /] /subsystem=elytron/http-authentication-factory=application-http-authentication:write-attribute(name=http-server-mechanism-factory, value=global){allow-resource-service-restart=true}
> {
> "outcome" => "success",
> "response-headers" => {
> "operation-requires-reload" => true,
> "process-state" => "reload-required"
> }
> }
> {code}
> Header should work as attribute is declared as {{"restart-required" => "resource-services"}}
> {code}
> "http-server-mechanism-factory" => {
> "type" => STRING,
> "description" => "The HttpServerAuthenticationMechanismFactory to associate with this resource",
> "expressions-allowed" => false,
> "required" => true,
> "nillable" => false,
> "capability-reference" => "org.wildfly.security.http-server-mechanism-factory",
> "min-length" => 1L,
> "max-length" => 2147483647L,
> "access-type" => "read-write",
> "storage" => "configuration",
> "restart-required" => "resource-services"
> }
> {code}
> And according to documentation [1]:
> resource-services – The operation can only immediately update the persistent configuration; applying the operation to the runtime will require a subsequent restart of some services associated with the resource. If the operation includes the request header "allow-resource-service-restart" => true, the handler for the operation will go ahead and restart the runtime service. Otherwise executing the operation will put the server into a "reload-required" state. (See the discussion of "all-services" above for more on the "reload-required" state.)
> [1] https://docs.jboss.org/author/display/WFLY10/Description+of+the+Managemen...
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
7 years, 8 months