July 2017 - jboss-jira - Jboss List Archives

[JBoss JIRA] (WFCORE-2079) Tooling for credential store manipulation

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2079?page=com.atlassian.jira.plugi... ] Darran Lofthouse resolved WFCORE-2079. -------------------------------------- Fix Version/s: 3.0.0.Beta29 Resolution: Done > Tooling for credential store manipulation > ----------------------------------------- > > Key: WFCORE-2079 > URL: https://issues.jboss.org/browse/WFCORE-2079 > Project: WildFly Core > Issue Type: Task > Components: Security > Reporter: Peter Skopek > Assignee: Peter Skopek > Fix For: 3.0.0.Beta29 > > > Create script for credential store manipulation, conversion from PicketBox Security Vault and bulk conversion. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 11 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2146) Security-Realm Authorization over LDAP doesn't permit multiple Attribute names as filter.

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2146?page=com.atlassian.jira.plugi... ] Darran Lofthouse updated WFCORE-2146: ------------------------------------- Issue Type: Feature Request (was: Bug) > Security-Realm Authorization over LDAP doesn't permit multiple Attribute names as filter. > ------------------------------------------------------------------------------------------- > > Key: WFCORE-2146 > URL: https://issues.jboss.org/browse/WFCORE-2146 > Project: WildFly Core > Issue Type: Feature Request > Components: Security > Environment: CentOS release 6.8 (Final) > JBoss Admin Command-line Interface > JBOSS_HOME: /opt/wildfly/10.1.0 > JBoss AS release: 2.2.0.Final "Kenny" > JBoss AS product: WildFly Full 10.1.0.Final > JAVA_HOME: null > java.version: 1.8.0_40 > java.vm.vendor: Oracle Corporation > java.vm.version: 25.40-b25 > os.name: Linux > os.version: 4.6.3-1.el6.elrepo.x86_64 > Reporter: Daniel Draper > Assignee: Darran Lofthouse > > When hooking up our Wildfly Application to our SSO (CAS) for authentication and delegating Authorization to a Security Realm and then using LDAP we ran into the following problem: > *Use Case* > We want to use authorization inside a Security-Realm through LDAP. > In our LDAP setup we have a Group-To-Principal matching of the form "_member=uid=x" OR "submember=uid=x_" depending on if the user was added manually or through an autodomain. > Unfortunately as far as we could tell using two attributes in the Polish Notation (as is required by [LDAP|https://ldapwiki.com/wiki/LDAP%20filters%20Syntax%20and%20Choices]) seems to be impossible for the wildfly configuration. We tried the following in the standalone-accounting.xml (in different iterations and ways to place the parenthesis) which all lead to an 'unbalanced Parenthesis' or similar error when starting up wildfly. > {code:xml} > <management> > <security-realms> > <security-realm name="bla"> > <authorization> > <ldap connection="ldap"> > <username-to-dn> > <username-is-dn/> > </username-to-dn> > <group-search group-name="SIMPLE" iterative="false" group-dn-attribute="cn" group-name-attribute="cn"> > <group-to-principal search-by="SIMPLE" base-dn="ou=roles,***" recursive="false"> > <membership-filter principal-attribute="|(submember=uid={0})(member=uid={0})"/> > </group-to-principal> > </group-search> > </ldap> > </authorization> > </security-realm> > </security-realms> > </management> > {code} > We then found the filterString is parsed the following way: (See [LdapGroupSearcherFactory#L115|https://github.com/wildfly/wildfly-core/blo...]) > {code:java} > this.filterString = String.format("(%s={0})", principalAttribute); > {code} > which seems to make multiple attribute names as a filter impossible, which makes our use case as above impossible. > Asked in [Forums|https://developer.jboss.org/thread/273435], but since I didn't get any answers for 3 weeks opening here. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 11 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2147) Impossible to use environment variables or system properties in permissions.xml

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2147?page=com.atlassian.jira.plugi... ] Darran Lofthouse reassigned WFCORE-2147: ---------------------------------------- Assignee: (was: Darran Lofthouse) > Impossible to use environment variables or system properties in permissions.xml > ------------------------------------------------------------------------------- > > Key: WFCORE-2147 > URL: https://issues.jboss.org/browse/WFCORE-2147 > Project: WildFly Core > Issue Type: Feature Request > Components: Security > Reporter: Adrian Boangiu > > Without this feature it is impossible to migrate "variable" Java file permissions such as: > {noformat} > permission java.io.FilePermission "${java.io.tmpdir}","read"; > permission java.io.FilePermission "${jboss.home.dir}${/}bin${/}javamelody${/}-","read,write,delete"; > permission java.io.FilePermission "${app.home.dir}${/}log${/}-","read,write,delete"; > {noformat} > that were defined in Java policy file in previous verions of JBoss. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 11 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2267) Delete all legacy code from CallbackHandlerService and SubjectSupplemental implementations

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2267?page=com.atlassian.jira.plugi... ] Darran Lofthouse resolved WFCORE-2267. -------------------------------------- Fix Version/s: (was: 4.0.0.Alpha1) Resolution: Rejected Rejecting as other integrations may still use the CallbackHandlers directly > Delete all legacy code from CallbackHandlerService and SubjectSupplemental implementations > ------------------------------------------------------------------------------------------ > > Key: WFCORE-2267 > URL: https://issues.jboss.org/browse/WFCORE-2267 > Project: WildFly Core > Issue Type: Task > Components: Domain Management, Security > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > > Only the Elytron realms are now used. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 11 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2316) Introduce credential-store.sh

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2316?page=com.atlassian.jira.plugi... ] Darran Lofthouse resolved WFCORE-2316. -------------------------------------- Fix Version/s: 3.0.0.Beta29 Resolution: Rejected Although elytron-tool.sh etc has been added > Introduce credential-store.sh > ----------------------------- > > Key: WFCORE-2316 > URL: https://issues.jboss.org/browse/WFCORE-2316 > Project: WildFly Core > Issue Type: Feature Request > Components: Security > Reporter: Martin Choma > Assignee: Darran Lofthouse > Labels: credential-store, user_experience > Fix For: 3.0.0.Beta29 > > > Currently there is just delivered wildfly-elytron-tool.jar in {{$EAP_HOME/bin}} folder. I think for convenience it would be better if it will contain also credential-store.sh script, although now it will be just java -jar wildfly-elytron-tool.jar credential-store > - It saves space on command line > - It is analogous to vault.sh - so obvious when looking for credential store tool > - With such script we gain customization point for credential store. As wildfly-elytron-tool.jar will expand, it is possible some credential-store customization for starting tool will be necessary > - Once wildlfy elytron tool will be exposed with modules, script can be updated to start with modules with no change for user -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 11 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2307) Rename wildfly-elytron-tool.jar to elytron-tool.jar to be consistent with other jars in bin directory

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2307?page=com.atlassian.jira.plugi... ] Darran Lofthouse resolved WFCORE-2307. -------------------------------------- Resolution: Rejected > Rename wildfly-elytron-tool.jar to elytron-tool.jar to be consistent with other jars in bin directory > ----------------------------------------------------------------------------------------------------- > > Key: WFCORE-2307 > URL: https://issues.jboss.org/browse/WFCORE-2307 > Project: WildFly Core > Issue Type: Bug > Components: Security > Reporter: Martin Švehla > Assignee: Peter Skopek > > We should consider dropping wildfly prefix, as we're generally trying to avoid having that > See for example https://issues.jboss.org/browse/WFCORE-1302 for similar issue (the jira si related to renaming wildfly-launcher.jar to launcher.jar). -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 11 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2349) Add RemoteManagementPermission and RemoteJMXPermission checks for remote clients.

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2349?page=com.atlassian.jira.plugi... ] Darran Lofthouse updated WFCORE-2349: ------------------------------------- Fix Version/s: 4.0.0.Alpha1 > Add RemoteManagementPermission and RemoteJMXPermission checks for remote clients. > --------------------------------------------------------------------------------- > > Key: WFCORE-2349 > URL: https://issues.jboss.org/browse/WFCORE-2349 > Project: WildFly Core > Issue Type: Enhancement > Components: Domain Management, Security > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > Fix For: 4.0.0.Alpha1 > > > Other services such as EJB and transactions have a Remote*Permission to verify the remote client has the required permission to use that service - this should be repeated for the management related services to control what a remote client can and can not connect to. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 11 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2349) Add RemoteManagementPermission and RemoteJMXPermission checks for remote clients.

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2349?page=com.atlassian.jira.plugi... ] Darran Lofthouse reassigned WFCORE-2349: ---------------------------------------- Assignee: (was: Darran Lofthouse) > Add RemoteManagementPermission and RemoteJMXPermission checks for remote clients. > --------------------------------------------------------------------------------- > > Key: WFCORE-2349 > URL: https://issues.jboss.org/browse/WFCORE-2349 > Project: WildFly Core > Issue Type: Enhancement > Components: Domain Management, Security > Reporter: Darran Lofthouse > Fix For: 4.0.0.Alpha1 > > > Other services such as EJB and transactions have a Remote*Permission to verify the remote client has the required permission to use that service - this should be repeated for the management related services to control what a remote client can and can not connect to. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 11 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2365) Review custom-modifiable-realm resource in Elytron subsystem

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2365?page=com.atlassian.jira.plugi... ] Darran Lofthouse reassigned WFCORE-2365: ---------------------------------------- Assignee: (was: Darran Lofthouse) > Review custom-modifiable-realm resource in Elytron subsystem > ------------------------------------------------------------ > > Key: WFCORE-2365 > URL: https://issues.jboss.org/browse/WFCORE-2365 > Project: WildFly Core > Issue Type: Bug > Components: Security > Reporter: Ondrej Lukas > Fix For: 4.0.0.Alpha1 > > > See description of JBEAP-6100 for more details. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 11 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-2349) Add RemoteManagementPermission and RemoteJMXPermission checks for remote clients.

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/WFCORE-2349?page=com.atlassian.jira.plugi... ] Darran Lofthouse updated WFCORE-2349: ------------------------------------- Priority: Major (was: Blocker) > Add RemoteManagementPermission and RemoteJMXPermission checks for remote clients. > --------------------------------------------------------------------------------- > > Key: WFCORE-2349 > URL: https://issues.jboss.org/browse/WFCORE-2349 > Project: WildFly Core > Issue Type: Enhancement > Components: Domain Management, Security > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > Fix For: 4.0.0.Alpha1 > > > Other services such as EJB and transactions have a Remote*Permission to verify the remote client has the required permission to use that service - this should be repeated for the management related services to control what a remote client can and can not connect to. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 11 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-jira July 2017