[JBoss JIRA] (ELY-1151) Empty authorization name for Digest mechanism causes authentication fail
by Jan Kalina (JIRA)
[ https://issues.jboss.org/browse/ELY-1151?page=com.atlassian.jira.plugin.s... ]
Jan Kalina updated ELY-1151:
----------------------------
Fix Version/s: (was: 1.1.0.Beta44)
> Empty authorization name for Digest mechanism causes authentication fail
> ------------------------------------------------------------------------
>
> Key: ELY-1151
> URL: https://issues.jboss.org/browse/ELY-1151
> Project: WildFly Elytron
> Issue Type: Bug
> Affects Versions: 1.1.0.Beta38
> Reporter: Ondrej Lukas
> Assignee: Jan Kalina
> Priority: Blocker
>
> SASL specification says about Authorization Identity String [1]:
> {quote}
> If the authorization identity string is absent, the client is requesting to act as the identity the server associates with the client's credentials. *An empty string is equivalent to an absent authorization identity.*
> {quote}
> In case when authentication configuration includes empty name for authorization name then authentication fail. In correct behavior authentication name should be used if authorization name is empty string.
> It is caused by passing empty {{defaultName}} to {{NameCallback}} constructor which results to {{IllegalArgumentException}}. Condition in [2] checks only non-null value of {{authorizationId}} but it seems it should also check empty name.
> It can be reproduced with correctly set wildfly-config.xml (i.e. configuration where authentication succeed) - in case {{set-authorization-name}} element with empty string is added to this configuration file then authentication starts to fail.
> The same issue can occurs for every supported SASL mechanism. In needs to be revisited.
> We request blocker flag since current behavior violates SASL specification.
> [1] https://tools.ietf.org/html/rfc4422#section-3.4.1
> [2] https://github.com/wildfly-security/wildfly-elytron/blob/596f25e853c8fbae...
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 11 months
[JBoss JIRA] (ELY-1151) Empty authorization name for Digest mechanism causes authentication fail
by Jan Kalina (JIRA)
[ https://issues.jboss.org/browse/ELY-1151?page=com.atlassian.jira.plugin.s... ]
Jan Kalina commented on ELY-1151:
---------------------------------
PR 810: client side NameCallback
PR 848: server side AuthorizationCallback
> Empty authorization name for Digest mechanism causes authentication fail
> ------------------------------------------------------------------------
>
> Key: ELY-1151
> URL: https://issues.jboss.org/browse/ELY-1151
> Project: WildFly Elytron
> Issue Type: Bug
> Affects Versions: 1.1.0.Beta38
> Reporter: Ondrej Lukas
> Assignee: Jan Kalina
> Priority: Blocker
> Fix For: 1.1.0.Beta44
>
>
> SASL specification says about Authorization Identity String [1]:
> {quote}
> If the authorization identity string is absent, the client is requesting to act as the identity the server associates with the client's credentials. *An empty string is equivalent to an absent authorization identity.*
> {quote}
> In case when authentication configuration includes empty name for authorization name then authentication fail. In correct behavior authentication name should be used if authorization name is empty string.
> It is caused by passing empty {{defaultName}} to {{NameCallback}} constructor which results to {{IllegalArgumentException}}. Condition in [2] checks only non-null value of {{authorizationId}} but it seems it should also check empty name.
> It can be reproduced with correctly set wildfly-config.xml (i.e. configuration where authentication succeed) - in case {{set-authorization-name}} element with empty string is added to this configuration file then authentication starts to fail.
> The same issue can occurs for every supported SASL mechanism. In needs to be revisited.
> We request blocker flag since current behavior violates SASL specification.
> [1] https://tools.ietf.org/html/rfc4422#section-3.4.1
> [2] https://github.com/wildfly-security/wildfly-elytron/blob/596f25e853c8fbae...
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 11 months
[JBoss JIRA] (WFLY-8459) @TransactionAttribute should not be inherited per EJB 3.2 spec
by RH Bugzilla Integration (JIRA)
[ https://issues.jboss.org/browse/WFLY-8459?page=com.atlassian.jira.plugin.... ]
RH Bugzilla Integration commented on WFLY-8459:
-----------------------------------------------
Radovan STANCEL <rstancel(a)redhat.com> changed the Status of [bug 1442955|https://bugzilla.redhat.com/show_bug.cgi?id=1442955] from POST to MODIFIED
> @TransactionAttribute should not be inherited per EJB 3.2 spec
> ---------------------------------------------------------------
>
> Key: WFLY-8459
> URL: https://issues.jboss.org/browse/WFLY-8459
> Project: WildFly
> Issue Type: Bug
> Components: EJB
> Environment: JBoss EA P7.0.x
> Reporter: Stuart Douglas
> Assignee: Stuart Douglas
> Fix For: 11.0.0.Beta1
>
>
> It appears that JBoss EAP behaves as the *@TransactionAttribute* attribute was inherited.
> For example if I have a bean A that
> {noformat}
> @Stateless
> @TransactionAttribute(TransactionAttributeType.REQUIRES_NEW)
> public class ABean extends Base{
>
> public void foo(){ . . .}
> }
> {noformat}
> and a supper class
> {noformat}
> @TransactionAttribute(TransactionAttributeType.SUPPORTS)
> public class Base {
>
> @TransactionAttribute(TransactionAttributeType.NEVER)
> public void foo(){ . . }
> public void bar(){ . . .}
> }
> {noformat}
> and if I call each method
> {noformat}
> beanA.bar();
> beanA.foo();
> {noformat}
> I would expect to see *bar()* without an active transaction and *foo()* with an active transaction
> but what I see is that both method have no active transaction. This seems like spec violation since the *@TransactionAttribute* are not supposed to be inherited.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 11 months