[JBoss JIRA] (WFCORE-2968) Servers in a domain won't boot if local auth is disabled on the host controller
by Darran Lofthouse (JIRA)
[ https://issues.jboss.org/browse/WFCORE-2968?page=com.atlassian.jira.plugi... ]
Darran Lofthouse commented on WFCORE-2968:
------------------------------------------
I suspect the main thing we are really missing is the server side handling of the server specific secret once backed by Elytron.
> Servers in a domain won't boot if local auth is disabled on the host controller
> -------------------------------------------------------------------------------
>
> Key: WFCORE-2968
> URL: https://issues.jboss.org/browse/WFCORE-2968
> Project: WildFly Core
> Issue Type: Bug
> Components: Domain Management, Security
> Reporter: James Perkins
> Assignee: Ken Wills
> Priority: Blocker
> Fix For: 3.0.0.Beta28
>
>
> If local authentication has been disabled on the host controller servers cannot communicate with the host controller and fail to start.
> {code}
> [Server:server-one] 15:10:51,241 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 2) MSC000001: Failed to start service jboss.server-boot-operations: org.jboss.msc.service.StartException in service jboss.server-boot-operations: java.net.ConnectException: WFLYPRT0053: Could not connect to remote+http://127.0.0.1:9990. The connection failed
> [Server:server-one] at org.jboss.as.server.mgmt.domain.ServerBootOperationsService$1.run(ServerBootOperationsService.java:72)
> [Server:server-one] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> [Server:server-one] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> [Server:server-one] at java.lang.Thread.run(Thread.java:748)
> [Server:server-one] at org.jboss.threads.JBossThread.run(JBossThread.java:320)
> [Server:server-one] Caused by: java.net.ConnectException: WFLYPRT0053: Could not connect to remote+http://127.0.0.1:9990. The connection failed
> [Server:server-one] at org.jboss.as.protocol.ProtocolConnectionUtils.connectSync(ProtocolConnectionUtils.java:126)
> [Server:server-one] at org.jboss.as.protocol.ProtocolConnectionManager$EstablishingConnection.connect(ProtocolConnectionManager.java:259)
> [Server:server-one] at org.jboss.as.protocol.ProtocolConnectionManager.connect(ProtocolConnectionManager.java:70)
> [Server:server-one] at org.jboss.as.server.mgmt.domain.HostControllerConnection.openConnection(HostControllerConnection.java:128)
> [Server:server-one] at org.jboss.as.server.mgmt.domain.HostControllerClient.resolveBootUpdates(HostControllerClient.java:110)
> [Server:server-one] at org.jboss.as.server.mgmt.domain.ServerBootOperationsService$1.run(ServerBootOperationsService.java:68)
> [Server:server-one] ... 4 more
> [Server:server-one] Caused by: javax.security.sasl.SaslException: Authentication failed: none of the mechanisms presented by the server (DIGEST-MD5) are supported
> [Server:server-one] at org.jboss.remoting3.remote.ClientConnectionOpenListener$Capabilities.handleEvent(ClientConnectionOpenListener.java:438)
> [Server:server-one] at org.jboss.remoting3.remote.ClientConnectionOpenListener$Capabilities.handleEvent(ClientConnectionOpenListener.java:246)
> [Server:server-one] at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:92)
> [Server:server-one] at org.xnio.conduits.ReadReadyHandler$ChannelListenerHandler.readReady(ReadReadyHandler.java:66)
> [Server:server-one] at org.xnio.nio.NioSocketConduit.handleReady(NioSocketConduit.java:89)
> [Server:server-one] at org.xnio.nio.WorkerThread.run(WorkerThread.java:571)
> [Server:server-one] at ...asynchronous invocation...(Unknown Source)
> [Server:server-one] at org.jboss.remoting3.EndpointImpl.connect(EndpointImpl.java:545)
> [Server:server-one] at org.jboss.remoting3.EndpointImpl.connect(EndpointImpl.java:509)
> [Server:server-one] at org.jboss.remoting3.EndpointImpl.connect(EndpointImpl.java:497)
> [Server:server-one] at org.jboss.as.protocol.ProtocolConnectionUtils.connect(ProtocolConnectionUtils.java:194)
> [Server:server-one] at org.jboss.as.protocol.ProtocolConnectionUtils.connectSync(ProtocolConnectionUtils.java:118)
> [Server:server-one] ... 9 more
> [Server:server-one]
> [Server:server-one] 15:10:51,241 ERROR [org.jboss.as.server] (Controller Boot Thread) WFLYSRV0055: Caught exception during boot: org.jboss.as.controller.persistence.ConfigurationPersistenceException: java.util.concurrent.ExecutionException: Operation failed
> [Server:server-one] at org.jboss.as.server.ServerStartTask$2$1.load(ServerStartTask.java:188)
> [Server:server-one] at org.jboss.as.server.ServerService.boot(ServerService.java:387)
> [Server:server-one] at org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:370)
> [Server:server-one] at java.lang.Thread.run(Thread.java:748)
> [Server:server-one] Caused by: java.util.concurrent.ExecutionException: Operation failed
> [Server:server-one] at org.jboss.threads.AsyncFutureTask.operationFailed(AsyncFutureTask.java:74)
> [Server:server-one] at org.jboss.threads.AsyncFutureTask.get(AsyncFutureTask.java:268)
> [Server:server-one] at org.jboss.as.server.mgmt.domain.ServerBootOperationsService$2.get(ServerBootOperationsService.java:113)
> [Server:server-one] at org.jboss.as.server.mgmt.domain.ServerBootOperationsService$2.get(ServerBootOperationsService.java:95)
> [Server:server-one] at org.jboss.as.server.ServerStartTask$2$1.load(ServerStartTask.java:185)
> [Server:server-one] ... 3 more
> [Server:server-one] Caused by: java.net.ConnectException: WFLYPRT0053: Could not connect to remote+http://127.0.0.1:9990. The connection failed
> [Server:server-one] at org.jboss.as.protocol.ProtocolConnectionUtils.connectSync(ProtocolConnectionUtils.java:126)
> [Server:server-one] at org.jboss.as.protocol.ProtocolConnectionManager$EstablishingConnection.connect(ProtocolConnectionManager.java:259)
> [Server:server-one] at org.jboss.as.protocol.ProtocolConnectionManager.connect(ProtocolConnectionManager.java:70)
> [Server:server-one] at org.jboss.as.server.mgmt.domain.HostControllerConnection.openConnection(HostControllerConnection.java:128)
> [Server:server-one] at org.jboss.as.server.mgmt.domain.HostControllerClient.resolveBootUpdates(HostControllerClient.java:110)
> [Server:server-one] at org.jboss.as.server.mgmt.domain.ServerBootOperationsService$1.run(ServerBootOperationsService.java:68)
> [Server:server-one] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> [Server:server-one] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> [Server:server-one] at java.lang.Thread.run(Thread.java:748)
> [Server:server-one] at org.jboss.threads.JBossThread.run(JBossThread.java:320)
> [Server:server-one] Caused by: javax.security.sasl.SaslException: Authentication failed: none of the mechanisms presented by the server (DIGEST-MD5) are supported
> [Server:server-one] at org.jboss.remoting3.remote.ClientConnectionOpenListener$Capabilities.handleEvent(ClientConnectionOpenListener.java:438)
> [Server:server-one] at org.jboss.remoting3.remote.ClientConnectionOpenListener$Capabilities.handleEvent(ClientConnectionOpenListener.java:246)
> [Server:server-one] at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:92)
> [Server:server-one] at org.xnio.conduits.ReadReadyHandler$ChannelListenerHandler.readReady(ReadReadyHandler.java:66)
> [Server:server-one] at org.xnio.nio.NioSocketConduit.handleReady(NioSocketConduit.java:89)
> [Server:server-one] at org.xnio.nio.WorkerThread.run(WorkerThread.java:571)
> [Server:server-one] at ...asynchronous invocation...(Unknown Source)
> [Server:server-one] at org.jboss.remoting3.EndpointImpl.connect(EndpointImpl.java:545)
> [Server:server-one] at org.jboss.remoting3.EndpointImpl.connect(EndpointImpl.java:509)
> [Server:server-one] at org.jboss.remoting3.EndpointImpl.connect(EndpointImpl.java:497)
> [Server:server-one] at org.jboss.as.protocol.ProtocolConnectionUtils.connect(ProtocolConnectionUtils.java:194)
> [Server:server-one] at org.jboss.as.protocol.ProtocolConnectionUtils.connectSync(ProtocolConnectionUtils.java:118)
> [Server:server-one] ... 9 more
> [Server:server-one]
> [Server:server-one] 15:10:51,243 FATAL [org.jboss.as.server] (Controller Boot Thread) WFLYSRV0056: Server boot has failed in an unrecoverable manner; exiting. See previous messages for details.
> [Server:server-one] 15:10:51,254 INFO [org.jboss.as] (MSC service thread 1-8) WFLYSRV0050: WildFly Core 3.0.0.Beta27-SNAPSHOT "Kenny" stopped in 6ms
> {code}
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 10 months
[JBoss JIRA] (WFLY-9015) Unclear failure description when adding elytron policy resource
by Jan Kašík (JIRA)
[ https://issues.jboss.org/browse/WFLY-9015?page=com.atlassian.jira.plugin.... ]
Jan Kašík moved JBEAP-11828 to WFLY-9015:
-----------------------------------------
Project: WildFly (was: JBoss Enterprise Application Platform)
Key: WFLY-9015 (was: JBEAP-11828)
Workflow: GIT Pull Request workflow (was: CDW with loose statuses v1)
Component/s: Security
(was: Security)
Affects Version/s: 11.0.0.Alpha1
(was: 7.1.0.ER1)
> Unclear failure description when adding elytron policy resource
> ---------------------------------------------------------------
>
> Key: WFLY-9015
> URL: https://issues.jboss.org/browse/WFLY-9015
> Project: WildFly
> Issue Type: Bug
> Components: Security
> Affects Versions: 11.0.0.Alpha1
> Reporter: Jan Kašík
>
> When adding new Elytron policy resource, operation fails with [1]. In failure message there is missing "not" and for me, a user it is confusing since it says the policy provider which I am trying to add cannot be found...
> [1]
> {code}
> [standalone@localhost:9990 /] /subsystem=elytron/policy=foo:add()
> {
> "outcome" => "failed",
> "failure-description" => "Could find policy provider with name [foo]",
> "rolled-back" => true
> }
> {code}
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 10 months
[JBoss JIRA] (ELY-715) SPNEGO: missing negstat field in the first reply
by Darran Lofthouse (JIRA)
[ https://issues.jboss.org/browse/ELY-715?page=com.atlassian.jira.plugin.sy... ]
Darran Lofthouse updated ELY-715:
---------------------------------
Fix Version/s: 1.1.0.Beta56
(was: 1.1.0.Beta55)
> SPNEGO: missing negstat field in the first reply
> ------------------------------------------------
>
> Key: ELY-715
> URL: https://issues.jboss.org/browse/ELY-715
> Project: WildFly Elytron
> Issue Type: Bug
> Components: Authentication Mechanisms
> Reporter: Jan Kalina
> Assignee: Darran Lofthouse
> Fix For: 1.1.0.Beta56
>
>
> When the client sends an initial SPNEGO token with Kerberos as preferred mechanism and includes an invalid kerberos token, then client expects to see the {{WWW-Authenticate}} HTTP header with SPNEGO response {{negTokenResp[ negState = reject ]}}.
> As stated in [SPNEGO specification|https://tools.ietf.org/html/rfc4178#section-4.2.2] negstat is required in first reply:
> {code:borderStyle=dashed}
> negState
> ...
> This field is REQUIRED in the first reply from the target, and is
> OPTIONAL thereafter. When negState is absent, the actual state
> should be inferred from the state of the negotiated mechanism
> context.
> {code}
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 10 months