[JBoss JIRA] (ELY-609) Unguarded read in ElytronPolicyConfiguration
by Darran Lofthouse (JIRA)
[ https://issues.jboss.org/browse/ELY-609?page=com.atlassian.jira.plugin.sy... ]
Darran Lofthouse updated ELY-609:
---------------------------------
Fix Version/s: 1.2.0.Beta1
(was: 1.1.0.CR2)
> Unguarded read in ElytronPolicyConfiguration
> --------------------------------------------
>
> Key: ELY-609
> URL: https://issues.jboss.org/browse/ELY-609
> Project: WildFly Elytron
> Issue Type: …
[View More]Bug
> Affects Versions: 1.1.0.Beta7
> Reporter: Ondrej Lukas
> Assignee: Darran Lofthouse
> Labels: static_analysis
> Fix For: 1.2.0.Beta1
>
>
> Access to fields {{uncheckedPermissions}}, {{excludedPermissions}} and {{rolePermissions}} in {{org.wildfly.security.authz.jacc.ElytronPolicyConfiguration}} is holded by lock. However lock is not used in their getter methods. Getters should be also handled by locks to avoid unguarded read of those fields.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
[View Less]
7 years, 9 months
[JBoss JIRA] (ELY-613) Some nested classes should be considered to be static nested in Elytron
by Darran Lofthouse (JIRA)
[ https://issues.jboss.org/browse/ELY-613?page=com.atlassian.jira.plugin.sy... ]
Darran Lofthouse updated ELY-613:
---------------------------------
Fix Version/s: 1.2.0.Beta1
(was: 1.1.0.CR2)
> Some nested classes should be considered to be static nested in Elytron
> -----------------------------------------------------------------------
>
> Key: ELY-613
> URL: https://issues.jboss.org/browse/ELY-613
> …
[View More]Project: WildFly Elytron
> Issue Type: Bug
> Affects Versions: 1.1.0.Beta7
> Reporter: Ondrej Lukas
> Assignee: Darran Lofthouse
> Labels: static_analysis
> Fix For: 1.2.0.Beta1
>
>
> There are some inner classes in Elytron which should be considered to be static nested to avoid dependency on their outer class. Following nested classes should be considered:
> * LoadedIdentity and Identity from org.wildfly.security.auth.realm.FileSystemSecurityRealm
> * DecoderState from org.wildfly.security.asn1.DERDecoder
> * AccountEntry from org.wildfly.security.auth.realm.LegacyPropertiesSecurityRealm
> * JaasAuthorizationIdentity and DefaultCallbackHandler from org.wildfly.security.auth.realm.JaasSecurityRealm
> * LoadKey from org.wildfly.security.keystore.AtomicLoadKeyStore
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
[View Less]
7 years, 9 months
[JBoss JIRA] (ELY-726) Default Mechanism Ordering Implementation
by Darran Lofthouse (JIRA)
[ https://issues.jboss.org/browse/ELY-726?page=com.atlassian.jira.plugin.sy... ]
Darran Lofthouse resolved ELY-726.
----------------------------------
Resolution: Won't Fix
> Default Mechanism Ordering Implementation
> -----------------------------------------
>
> Key: ELY-726
> URL: https://issues.jboss.org/browse/ELY-726
> Project: WildFly Elytron
> Issue Type: Task
> Components: SASL
> …
[View More]Reporter: Darran Lofthouse
> Fix For: 1.1.0.CR2
>
>
> We have to have some form of mechanism ordering anyway to get silent mechanisms to the front of the queue.
> SaslMechanismInformation may need some updates but we have plenty of information about the mechanisms so we should be able to put together a reasonable documented ordering.
> Stronger mechanisms that can complete without interaction with the client can be pulled up the list as they can quickly silently fail where AuthenticationClient does not have enough information to handle them. This set probably includes JBOSS_LOCAL_USER, EXTERNAL, GSSAPI, GS2, and the token mechs.
> For username / password mechanisms we can ensure PLAIN goes last.
> Of the CRAM, Digest, and SCRAM set I would suggest first order by digest algorithm and then SCRAM -> Digest -> CRAM.
> There will be the opportunity for plenty of discussions on is X really better than Y but I think a reasonable default implementation that is documented will be much better than today's current random ordering. Once filtering has been applied to take into account things like available credentials in the realms etc.
> I would expect most lists to be very small, maybe some silent mechs a token mech and one or two username / password mechs depending on consistency of an identity store.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
[View Less]
7 years, 9 months