[JBoss JIRA] (WFLY-8881) Artemis client uses unbounded threap pool
by Jeff Mesnil (JIRA)
Jeff Mesnil created WFLY-8881:
---------------------------------
Summary: Artemis client uses unbounded threap pool
Key: WFLY-8881
URL: https://issues.jboss.org/browse/WFLY-8881
Project: WildFly
Issue Type: Bug
Components: JMS
Affects Versions: 11.0.0.Alpha1
Reporter: Jeff Mesnil
Assignee: Jeff Mesnil
Priority: Critical
Artemis client thread pool can be configured using the messaging-activemq subsystem's global-client-thread-pool-max-size attribute (introduced in 11.0.0.Alpha1).
By mistake, the default value of this attribute was set to -1 (through the ActiveMQClient.DEFAULT_THREAD_POOL_MAX_SIZE constants).
This means that unless configured otherwise, the Artemis clients running in the app server (e.g. MDB code) will use an unbounded thread pool.
The correct configuration is to *not* have a default value. If that's the case, Artemis will determine the size of the pool depending on the number of processors (8 * Runtime.getRuntime().availableProcessors())
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 11 months
[JBoss JIRA] (WFCORE-2906) Server-identity/secret has required "value" attribute, but there is now credential-reference too and there is no way how to update existing resource to use another option.
by Hynek Švábek (JIRA)
[ https://issues.jboss.org/browse/WFCORE-2906?page=com.atlassian.jira.plugi... ]
Hynek Švábek commented on WFCORE-2906:
--------------------------------------
[~ehugonnet], [~brian.stansberry]
Thanks a lot for clarification.
> Server-identity/secret has required "value" attribute, but there is now credential-reference too and there is no way how to update existing resource to use another option.
> ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: WFCORE-2906
> URL: https://issues.jboss.org/browse/WFCORE-2906
> Project: WildFly Core
> Issue Type: Bug
> Components: Security
> Reporter: Hynek Švábek
> Assignee: ehsavoie Hugonnet
> Priority: Blocker
>
> Server-identity/secret has required "value" attribute, but there is now credential-reference too and there is no way how to update existing resource to use another option.
> "Value" and credential-reference are mutually exclusive and one of them must be set.
> *There must be a way how to update existing server-identity/secret for change "value" to credential-reference and vice versa.*
> *User is not able to do some like that:*
> {code}
> /core-service=management/security-realm=ManagementRealm/server-identity=secret:write-attribute(name=credential-reference, value={clear-text=pass123})
> {
> "outcome" => "failed",
> "failure-description" => "WFLYCTL0105: credential-reference is invalid in combination with value",
> "rolled-back" => true
> }
> [standalone@localhost:9990 /] /core-service=management/security-realm=ManagementRealm/server-identity=secret:undefine-attribute(name=value
> {
> "outcome" => "failed",
> "failure-description" => "WFLYCTL0172: value is required",
> "rolled-back" => true
> }
> {code}
> *resource-description*
> {code:collapse}
> [domain@localhost:9990 /] /host=master/core-service=management/security-realm=ManagementRealm/server-identity=secret:read-resource-description
> {
> "outcome" => "success",
> "result" => {
> "description" => "Configuration of the secret/password-based identity of a server or host controller.",
> "deprecated" => {
> "since" => "1.7.0",
> "reason" => "The security-realm configuration is deprecated and may be removed or moved in future versions."
> },
> "access-constraints" => {"sensitive" => {"security-realm" => {"type" => "core"}}},
> "attributes" => {
> "credential-reference" => {
> "type" => OBJECT,
> "description" => "The reference to credential for the secret / password stored in CredentialStore under defined alias or clear text password.",
> "expressions-allowed" => false,
> "required" => false,
> "nillable" => true,
> "alternatives" => ["value"],
> "access-constraints" => {"sensitive" => {"credential" => {"type" => "core"}}},
> "value-type" => {
> "store" => {
> "type" => STRING,
> "description" => "The name of the credential store holding the alias to credential.",
> "expressions-allowed" => false,
> "required" => false,
> "nillable" => true,
> "alternatives" => ["clear-text"],
> "requires" => ["alias"],
> "min-length" => 1L,
> "max-length" => 2147483647L
> },
> "alias" => {
> "type" => STRING,
> "description" => "The alias which denotes stored secret or credential in the store.",
> "expressions-allowed" => true,
> "required" => false,
> "nillable" => true,
> "requires" => ["store"],
> "min-length" => 1L,
> "max-length" => 2147483647L
> },
> "type" => {
> "type" => STRING,
> "description" => "The type of credential this reference is denoting.",
> "expressions-allowed" => true,
> "required" => false,
> "nillable" => true,
> "min-length" => 1L,
> "max-length" => 2147483647L
> },
> "clear-text" => {
> "type" => STRING,
> "description" => "Secret specified using clear text. Check credential store way of supplying credential/secrets to services.",
> "expressions-allowed" => true,
> "required" => false,
> "nillable" => true,
> "alternatives" => ["store"],
> "min-length" => 1L,
> "max-length" => 2147483647L
> }
> },
> "access-type" => "read-write",
> "storage" => "configuration",
> "restart-required" => "no-services"
> },
> "value" => {
> "type" => STRING,
> "description" => "The secret / password - Base64 Encoded.",
> "expressions-allowed" => true,
> "required" => true,
> "nillable" => true,
> "alternatives" => ["credential-reference"],
> "min-length" => 1L,
> "max-length" => 2147483647L,
> "access-type" => "read-write",
> "storage" => "configuration",
> "restart-required" => "no-services"
> }
> },
> "operations" => undefined,
> "notifications" => undefined,
> "children" => {}
> }
> }
> {code}
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 11 months
[JBoss JIRA] (WFLY-8880) Auth token properties are not applied using legacy AUTH configuration
by Paul Ferraro (JIRA)
[ https://issues.jboss.org/browse/WFLY-8880?page=com.atlassian.jira.plugin.... ]
Paul Ferraro moved JBEAP-11331 to WFLY-8880:
--------------------------------------------
Project: WildFly (was: JBoss Enterprise Application Platform)
Key: WFLY-8880 (was: JBEAP-11331)
Workflow: GIT Pull Request workflow (was: CDW with loose statuses v1)
Component/s: Clustering
(was: Clustering)
Affects Version/s: No Release
(was: 7.1.0.DR18)
(was: 7.1.0.DR19)
> Auth token properties are not applied using legacy AUTH configuration
> ---------------------------------------------------------------------
>
> Key: WFLY-8880
> URL: https://issues.jboss.org/browse/WFLY-8880
> Project: WildFly
> Issue Type: Bug
> Components: Clustering
> Affects Versions: No Release
> Reporter: Paul Ferraro
> Assignee: Paul Ferraro
>
> This is related to the discussion that [~lakagwu] started on JBEAP-10285. I reproduced the NPE he was getting, went through the stacktrace, and I think it's a bug.
> {noformat}
> 08:53:37,361 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 67) MSC000001: Failed to start service org.wildfly.clustering.jgroups.channel.ee: org.jboss.msc.service.StartException in service org.wildfly.clustering.jgroups.channel.ee: java.lang.NullPointerException
> at org.jboss.as.clustering.jgroups.subsystem.ChannelBuilder.start(ChannelBuilder.java:104)
> at org.wildfly.clustering.service.AsynchronousServiceBuilder.lambda$start$0(AsynchronousServiceBuilder.java:99)
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> at java.lang.Thread.run(Thread.java:748)
> at org.jboss.threads.JBossThread.run(JBossThread.java:320)
> Caused by: java.lang.NullPointerException
> at org.jboss.modules.ConcurrentClassLoader.getResourceAsStream(ConcurrentClassLoader.java:366)
> at org.jgroups.auth.X509Token.setCertificate(X509Token.java:180)
> at org.jgroups.protocols.AUTH.init(AUTH.java:101)
> at org.jgroups.stack.ProtocolStack.initProtocolStack(ProtocolStack.java:861)
> at org.jgroups.stack.ProtocolStack.init(ProtocolStack.java:831)
> at org.jboss.as.clustering.jgroups.JChannelFactory.createChannel(JChannelFactory.java:108)
> at org.jboss.as.clustering.jgroups.subsystem.ChannelBuilder.start(ChannelBuilder.java:102)
> ... 5 more
> {noformat}
> It looks like the only reason {{ConcurrentClassLoader}} would throw an NPE instead of returning null in {{getResourceAsStream}} is that the name (in this case {{keystore_path}}) is null. That means the {{keystore_path}} is not propagated from EAP configuration to JGroups when the protocol stack is being created.
> The {{getResourceAsStream}} is still expected to fail, as the keystore is not on the classpath, but it should be found after that via the {{FileInputStream}} check that JGroups does.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 11 months
[JBoss JIRA] (WFCORE-2906) Server-identity/secret has required "value" attribute, but there is now credential-reference too and there is no way how to update existing resource to use another option.
by Brian Stansberry (JIRA)
[ https://issues.jboss.org/browse/WFCORE-2906?page=com.atlassian.jira.plugi... ]
Brian Stansberry commented on WFCORE-2906:
------------------------------------------
If batch works, there's no bug. The composite op is the mechanism for making multiple changes without getting a constraint violation.
> Server-identity/secret has required "value" attribute, but there is now credential-reference too and there is no way how to update existing resource to use another option.
> ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: WFCORE-2906
> URL: https://issues.jboss.org/browse/WFCORE-2906
> Project: WildFly Core
> Issue Type: Bug
> Components: Security
> Reporter: Hynek Švábek
> Assignee: ehsavoie Hugonnet
> Priority: Blocker
>
> Server-identity/secret has required "value" attribute, but there is now credential-reference too and there is no way how to update existing resource to use another option.
> "Value" and credential-reference are mutually exclusive and one of them must be set.
> *There must be a way how to update existing server-identity/secret for change "value" to credential-reference and vice versa.*
> *User is not able to do some like that:*
> {code}
> /core-service=management/security-realm=ManagementRealm/server-identity=secret:write-attribute(name=credential-reference, value={clear-text=pass123})
> {
> "outcome" => "failed",
> "failure-description" => "WFLYCTL0105: credential-reference is invalid in combination with value",
> "rolled-back" => true
> }
> [standalone@localhost:9990 /] /core-service=management/security-realm=ManagementRealm/server-identity=secret:undefine-attribute(name=value
> {
> "outcome" => "failed",
> "failure-description" => "WFLYCTL0172: value is required",
> "rolled-back" => true
> }
> {code}
> *resource-description*
> {code:collapse}
> [domain@localhost:9990 /] /host=master/core-service=management/security-realm=ManagementRealm/server-identity=secret:read-resource-description
> {
> "outcome" => "success",
> "result" => {
> "description" => "Configuration of the secret/password-based identity of a server or host controller.",
> "deprecated" => {
> "since" => "1.7.0",
> "reason" => "The security-realm configuration is deprecated and may be removed or moved in future versions."
> },
> "access-constraints" => {"sensitive" => {"security-realm" => {"type" => "core"}}},
> "attributes" => {
> "credential-reference" => {
> "type" => OBJECT,
> "description" => "The reference to credential for the secret / password stored in CredentialStore under defined alias or clear text password.",
> "expressions-allowed" => false,
> "required" => false,
> "nillable" => true,
> "alternatives" => ["value"],
> "access-constraints" => {"sensitive" => {"credential" => {"type" => "core"}}},
> "value-type" => {
> "store" => {
> "type" => STRING,
> "description" => "The name of the credential store holding the alias to credential.",
> "expressions-allowed" => false,
> "required" => false,
> "nillable" => true,
> "alternatives" => ["clear-text"],
> "requires" => ["alias"],
> "min-length" => 1L,
> "max-length" => 2147483647L
> },
> "alias" => {
> "type" => STRING,
> "description" => "The alias which denotes stored secret or credential in the store.",
> "expressions-allowed" => true,
> "required" => false,
> "nillable" => true,
> "requires" => ["store"],
> "min-length" => 1L,
> "max-length" => 2147483647L
> },
> "type" => {
> "type" => STRING,
> "description" => "The type of credential this reference is denoting.",
> "expressions-allowed" => true,
> "required" => false,
> "nillable" => true,
> "min-length" => 1L,
> "max-length" => 2147483647L
> },
> "clear-text" => {
> "type" => STRING,
> "description" => "Secret specified using clear text. Check credential store way of supplying credential/secrets to services.",
> "expressions-allowed" => true,
> "required" => false,
> "nillable" => true,
> "alternatives" => ["store"],
> "min-length" => 1L,
> "max-length" => 2147483647L
> }
> },
> "access-type" => "read-write",
> "storage" => "configuration",
> "restart-required" => "no-services"
> },
> "value" => {
> "type" => STRING,
> "description" => "The secret / password - Base64 Encoded.",
> "expressions-allowed" => true,
> "required" => true,
> "nillable" => true,
> "alternatives" => ["credential-reference"],
> "min-length" => 1L,
> "max-length" => 2147483647L,
> "access-type" => "read-write",
> "storage" => "configuration",
> "restart-required" => "no-services"
> }
> },
> "operations" => undefined,
> "notifications" => undefined,
> "children" => {}
> }
> }
> {code}
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 11 months
[JBoss JIRA] (WFCORE-2867) Credential store reload operation doesn't have effect in dependent resources.
by Hynek Švábek (JIRA)
[ https://issues.jboss.org/browse/WFCORE-2867?page=com.atlassian.jira.plugi... ]
Hynek Švábek updated WFCORE-2867:
---------------------------------
Summary: Credential store reload operation doesn't have effect in dependent resources. (was: Credential store reload operation doesn't has effect in dependent resources.)
> Credential store reload operation doesn't have effect in dependent resources.
> -----------------------------------------------------------------------------
>
> Key: WFCORE-2867
> URL: https://issues.jboss.org/browse/WFCORE-2867
> Project: WildFly Core
> Issue Type: Bug
> Components: Security
> Reporter: Hynek Švábek
> Assignee: Peter Skopek
> Priority: Blocker
>
> Credential store reload operation doesn't has effect in dependent resources.
> When we have keystore which obtains password from credential store, we change on file system backed storage file which contains wrong password to keystore and reload it. Credential store is right state, but keystore still works.
> There is expected fail.
> *How to reproduce*
> For simplifying we only update value in credential store and reload it (it should work too JBEAP-6614).
> In my opinion is there same problem and solving one will solve both problems.
> {code}
> /subsystem=elytron/credential-store=cs001:add(uri="cr-store://cs001.jceks?create=true", relative-to="jboss.server.data.dir", credential-reference={clear-text=pass123})
> /subsystem=elytron/credential-store=cs001/alias=ff:add(secret-value=Elytron)
> /subsystem=elytron/key-store=firefly:add(path=firefly.keystore,relative-to=jboss.server.data.dir,type=JKS,credential-reference= {store=cs001,alias=ff}
> this command show all aliases
> /subsystem=elytron/key-store=firefly:read-children-names(child-type=alias)
> {code}
> *Now we change keystore password to wrong and reload credential store*
> OR
> *You can replace storage file which contains wrong password to keystore and call RELOAD command only*
> {code}
> /subsystem=elytron/credential-store=cs001/alias=ff:remove
> /subsystem=elytron/credential-store=cs001/alias=ff:add(secret-value=ElytronWrong)
> /subsystem=elytron/credential-store=cs001:reload
> {code}
> *This command wrongly prints all aliases*
> {code}
> /subsystem=elytron/key-store=firefly:read-children-names(child-type=alias)
> {code}
> *We expect error message about wrong password to access to keystore*
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 11 months
[JBoss JIRA] (WFCORE-2867) Credential store reload operation doesn't have effect in dependent resources.
by Hynek Švábek (JIRA)
[ https://issues.jboss.org/browse/WFCORE-2867?page=com.atlassian.jira.plugi... ]
Hynek Švábek updated WFCORE-2867:
---------------------------------
Description:
Credential store reload operation doesn't have effect in dependent resources.
When we have keystore which obtains password from credential store, we change on file system backed storage file which contains wrong password to keystore and reload it. Credential store is right state, but keystore still works.
There is expected fail.
*How to reproduce*
For simplifying we only update value in credential store and reload it (it should work too JBEAP-6614).
In my opinion is there same problem and solving one will solve both problems.
{code}
/subsystem=elytron/credential-store=cs001:add(uri="cr-store://cs001.jceks?create=true", relative-to="jboss.server.data.dir", credential-reference={clear-text=pass123})
/subsystem=elytron/credential-store=cs001/alias=ff:add(secret-value=Elytron)
/subsystem=elytron/key-store=firefly:add(path=firefly.keystore,relative-to=jboss.server.data.dir,type=JKS,credential-reference= {store=cs001,alias=ff}
this command show all aliases
/subsystem=elytron/key-store=firefly:read-children-names(child-type=alias)
{code}
*Now we change keystore password to wrong and reload credential store*
OR
*You can replace storage file which contains wrong password to keystore and call RELOAD command only*
{code}
/subsystem=elytron/credential-store=cs001/alias=ff:remove
/subsystem=elytron/credential-store=cs001/alias=ff:add(secret-value=ElytronWrong)
/subsystem=elytron/credential-store=cs001:reload
{code}
*This command wrongly prints all aliases*
{code}
/subsystem=elytron/key-store=firefly:read-children-names(child-type=alias)
{code}
*We expect error message about wrong password to access to keystore*
was:
Credential store reload operation doesn't has effect in dependent resources.
When we have keystore which obtains password from credential store, we change on file system backed storage file which contains wrong password to keystore and reload it. Credential store is right state, but keystore still works.
There is expected fail.
*How to reproduce*
For simplifying we only update value in credential store and reload it (it should work too JBEAP-6614).
In my opinion is there same problem and solving one will solve both problems.
{code}
/subsystem=elytron/credential-store=cs001:add(uri="cr-store://cs001.jceks?create=true", relative-to="jboss.server.data.dir", credential-reference={clear-text=pass123})
/subsystem=elytron/credential-store=cs001/alias=ff:add(secret-value=Elytron)
/subsystem=elytron/key-store=firefly:add(path=firefly.keystore,relative-to=jboss.server.data.dir,type=JKS,credential-reference= {store=cs001,alias=ff}
this command show all aliases
/subsystem=elytron/key-store=firefly:read-children-names(child-type=alias)
{code}
*Now we change keystore password to wrong and reload credential store*
OR
*You can replace storage file which contains wrong password to keystore and call RELOAD command only*
{code}
/subsystem=elytron/credential-store=cs001/alias=ff:remove
/subsystem=elytron/credential-store=cs001/alias=ff:add(secret-value=ElytronWrong)
/subsystem=elytron/credential-store=cs001:reload
{code}
*This command wrongly prints all aliases*
{code}
/subsystem=elytron/key-store=firefly:read-children-names(child-type=alias)
{code}
*We expect error message about wrong password to access to keystore*
> Credential store reload operation doesn't have effect in dependent resources.
> -----------------------------------------------------------------------------
>
> Key: WFCORE-2867
> URL: https://issues.jboss.org/browse/WFCORE-2867
> Project: WildFly Core
> Issue Type: Bug
> Components: Security
> Reporter: Hynek Švábek
> Assignee: Peter Skopek
> Priority: Blocker
>
> Credential store reload operation doesn't have effect in dependent resources.
> When we have keystore which obtains password from credential store, we change on file system backed storage file which contains wrong password to keystore and reload it. Credential store is right state, but keystore still works.
> There is expected fail.
> *How to reproduce*
> For simplifying we only update value in credential store and reload it (it should work too JBEAP-6614).
> In my opinion is there same problem and solving one will solve both problems.
> {code}
> /subsystem=elytron/credential-store=cs001:add(uri="cr-store://cs001.jceks?create=true", relative-to="jboss.server.data.dir", credential-reference={clear-text=pass123})
> /subsystem=elytron/credential-store=cs001/alias=ff:add(secret-value=Elytron)
> /subsystem=elytron/key-store=firefly:add(path=firefly.keystore,relative-to=jboss.server.data.dir,type=JKS,credential-reference= {store=cs001,alias=ff}
> this command show all aliases
> /subsystem=elytron/key-store=firefly:read-children-names(child-type=alias)
> {code}
> *Now we change keystore password to wrong and reload credential store*
> OR
> *You can replace storage file which contains wrong password to keystore and call RELOAD command only*
> {code}
> /subsystem=elytron/credential-store=cs001/alias=ff:remove
> /subsystem=elytron/credential-store=cs001/alias=ff:add(secret-value=ElytronWrong)
> /subsystem=elytron/credential-store=cs001:reload
> {code}
> *This command wrongly prints all aliases*
> {code}
> /subsystem=elytron/key-store=firefly:read-children-names(child-type=alias)
> {code}
> *We expect error message about wrong password to access to keystore*
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 11 months