June 2017 - jboss-jira - Jboss List Archives

[JBoss JIRA] (ELY-715) SPNEGO: missing negstat field in the first reply

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/ELY-715?page=com.atlassian.jira.plugin.sy... ] Darran Lofthouse resolved ELY-715. ---------------------------------- Resolution: Rejected > SPNEGO: missing negstat field in the first reply > ------------------------------------------------ > > Key: ELY-715 > URL: https://issues.jboss.org/browse/ELY-715 > Project: WildFly Elytron > Issue Type: Bug > Components: Authentication Mechanisms > Reporter: Jan Kalina > Assignee: Darran Lofthouse > Fix For: 1.1.0.CR2 > > > When the client sends an initial SPNEGO token with Kerberos as preferred mechanism and includes an invalid kerberos token, then client expects to see the {{WWW-Authenticate}} HTTP header with SPNEGO response {{negTokenResp[ negState = reject ]}}. > As stated in [SPNEGO specification|https://tools.ietf.org/html/rfc4178#section-4.2.2] negstat is required in first reply: > {code:borderStyle=dashed} > negState > ... > This field is REQUIRED in the first reply from the target, and is > OPTIONAL thereafter. When negState is absent, the actual state > should be inferred from the state of the negotiated mechanism > context. > {code} -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 10 months

1
0
0 / 0

[JBoss JIRA] (ELY-617) Review 'null' handling for MechanismConfiguration and MechanismRealmConfiguration

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/ELY-617?page=com.atlassian.jira.plugin.sy... ] Darran Lofthouse resolved ELY-617. ---------------------------------- Resolution: Out of Date > Review 'null' handling for MechanismConfiguration and MechanismRealmConfiguration > --------------------------------------------------------------------------------- > > Key: ELY-617 > URL: https://issues.jboss.org/browse/ELY-617 > Project: WildFly Elytron > Issue Type: Task > Components: API / SPI > Reporter: Darran Lofthouse > Fix For: 1.1.0.CR2 > > > Javadoc states various NameRewriter instances will not be null, implementation suggests otherwise. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 10 months

1
0
0 / 0

[JBoss JIRA] (ELY-613) Some nested classes should be considered to be static nested in Elytron

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/ELY-613?page=com.atlassian.jira.plugin.sy... ] Darran Lofthouse updated ELY-613: --------------------------------- Fix Version/s: 1.2.0.Beta1 (was: 1.1.0.CR2) > Some nested classes should be considered to be static nested in Elytron > ----------------------------------------------------------------------- > > Key: ELY-613 > URL: https://issues.jboss.org/browse/ELY-613 > Project: WildFly Elytron > Issue Type: Bug > Affects Versions: 1.1.0.Beta7 > Reporter: Ondrej Lukas > Assignee: Darran Lofthouse > Labels: static_analysis > Fix For: 1.2.0.Beta1 > > > There are some inner classes in Elytron which should be considered to be static nested to avoid dependency on their outer class. Following nested classes should be considered: > * LoadedIdentity and Identity from org.wildfly.security.auth.realm.FileSystemSecurityRealm > * DecoderState from org.wildfly.security.asn1.DERDecoder > * AccountEntry from org.wildfly.security.auth.realm.LegacyPropertiesSecurityRealm > * JaasAuthorizationIdentity and DefaultCallbackHandler from org.wildfly.security.auth.realm.JaasSecurityRealm > * LoadKey from org.wildfly.security.keystore.AtomicLoadKeyStore -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 10 months

1
0
0 / 0

[JBoss JIRA] (ELY-747) Is SSLContextAuthenticationConfiguration Still required now sslRules are separated.

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/ELY-747?page=com.atlassian.jira.plugin.sy... ] Darran Lofthouse resolved ELY-747. ---------------------------------- Resolution: Out of Date > Is SSLContextAuthenticationConfiguration Still required now sslRules are separated. > ----------------------------------------------------------------------------------- > > Key: ELY-747 > URL: https://issues.jboss.org/browse/ELY-747 > Project: WildFly Elytron > Issue Type: Task > Components: Authentication Client > Reporter: Darran Lofthouse > Assignee: David Lloyd > Fix For: 1.1.0.CR2 > > -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 10 months

1
0
0 / 0

[JBoss JIRA] (ELY-728) The map backing SimpleMapBackedSecurityRealm should be an identity map not a password map.

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/ELY-728?page=com.atlassian.jira.plugin.sy... ] Darran Lofthouse updated ELY-728: --------------------------------- Fix Version/s: 1.2.0.Beta1 (was: 1.1.0.CR2) > The map backing SimpleMapBackedSecurityRealm should be an identity map not a password map. > ------------------------------------------------------------------------------------------ > > Key: ELY-728 > URL: https://issues.jboss.org/browse/ELY-728 > Project: WildFly Elytron > Issue Type: Task > Components: API / SPI, Realms > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > Priority: Critical > Fix For: 1.2.0.Beta1 > > > This realm is useful in cases where we need an identity to exist where the mechanism has performed validation without requiring access to credentials. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 10 months

1
0
0 / 0

[JBoss JIRA] (ELY-726) Default Mechanism Ordering Implementation

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/ELY-726?page=com.atlassian.jira.plugin.sy... ] Darran Lofthouse resolved ELY-726. ---------------------------------- Resolution: Won't Fix > Default Mechanism Ordering Implementation > ----------------------------------------- > > Key: ELY-726 > URL: https://issues.jboss.org/browse/ELY-726 > Project: WildFly Elytron > Issue Type: Task > Components: SASL > Reporter: Darran Lofthouse > Fix For: 1.1.0.CR2 > > > We have to have some form of mechanism ordering anyway to get silent mechanisms to the front of the queue. > SaslMechanismInformation may need some updates but we have plenty of information about the mechanisms so we should be able to put together a reasonable documented ordering. > Stronger mechanisms that can complete without interaction with the client can be pulled up the list as they can quickly silently fail where AuthenticationClient does not have enough information to handle them. This set probably includes JBOSS_LOCAL_USER, EXTERNAL, GSSAPI, GS2, and the token mechs. > For username / password mechanisms we can ensure PLAIN goes last. > Of the CRAM, Digest, and SCRAM set I would suggest first order by digest algorithm and then SCRAM -> Digest -> CRAM. > There will be the opportunity for plenty of discussions on is X really better than Y but I think a reasonable default implementation that is documented will be much better than today's current random ordering. Once filtering has been applied to take into account things like available credentials in the realms etc. > I would expect most lists to be very small, maybe some silent mechs a token mech and one or two username / password mechs depending on consistency of an identity store. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 10 months

1
0
0 / 0

[JBoss JIRA] (ELY-722) Move callback handler interactions to a common base class for HTTP mechanisms, .

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/ELY-722?page=com.atlassian.jira.plugin.sy... ] Darran Lofthouse updated ELY-722: --------------------------------- Fix Version/s: 1.2.0.Beta1 (was: 1.1.0.CR2) > Move callback handler interactions to a common base class for HTTP mechanisms,. > ------------------------------------------------------------------------------- > > Key: ELY-722 > URL: https://issues.jboss.org/browse/ELY-722 > Project: WildFly Elytron > Issue Type: Enhancement > Components: HTTP > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > Fix For: 1.2.0.Beta1 > > > This is to follow a similar pattern as is used for the SASL mechanisms. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 10 months

1
0
0 / 0

[JBoss JIRA] (ELY-774) KeystorePasswordStore needs to be optionally passed a Supplier<Provider[]>

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/ELY-774?page=com.atlassian.jira.plugin.sy... ] Darran Lofthouse resolved ELY-774. ---------------------------------- Resolution: Out of Date > KeystorePasswordStore needs to be optionally passed a Supplier<Provider[]> > -------------------------------------------------------------------------- > > Key: ELY-774 > URL: https://issues.jboss.org/browse/ELY-774 > Project: WildFly Elytron > Issue Type: Task > Components: Credential Store > Reporter: Darran Lofthouse > Assignee: Peter Skopek > Fix For: 1.1.0.CR2 > > > The current implementation assumes it is globally registered but we may want a configuration without global registration. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 10 months

1
0
0 / 0

[JBoss JIRA] (ELY-770) Review SASL mechanism handling of isComplete()

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/ELY-770?page=com.atlassian.jira.plugin.sy... ] Darran Lofthouse resolved ELY-770. ---------------------------------- Resolution: Rejected > Review SASL mechanism handling of isComplete() > ---------------------------------------------- > > Key: ELY-770 > URL: https://issues.jboss.org/browse/ELY-770 > Project: WildFly Elytron > Issue Type: Task > Components: SASL > Reporter: Darran Lofthouse > Priority: Critical > Fix For: 1.1.0.CR2 > > > The javadoc of the isComplete() method states: - > _Determines whether the authentication exchange has completed. This method is typically called after each invocation of evaluateResponse() to determine whether the authentication has completed successfully or should be continued._ > Also getAuthorizationID() states: - > _Reports the authorization ID in effect for the client of this session. This method can only be called if isComplete() returns true. > _ > Although the former is very vague there just seem to be a suggestion that complete means successfully complete, our mechs are setting complete very early and other wrappers such as AuthenticationCompleteCallbackSaslServerFactory are using complete as a flag to report failures. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 10 months

1
0
0 / 0

[JBoss JIRA] (ELY-765) ServiceLoader Provider and SaslClientFactory discovery should be able to use system ClassLoader

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/ELY-765?page=com.atlassian.jira.plugin.sy... ] Darran Lofthouse resolved ELY-765. ---------------------------------- Resolution: Out of Date > ServiceLoader Provider and SaslClientFactory discovery should be able to use system ClassLoader > ----------------------------------------------------------------------------------------------- > > Key: ELY-765 > URL: https://issues.jboss.org/browse/ELY-765 > Project: WildFly Elytron > Issue Type: Enhancement > Components: Authentication Client > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > Fix For: 1.1.0.CR2 > > > Clients may not be running using a JBoss Modules ClassLoader. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 10 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-jira June 2017