August 2017 - jboss-jira - Jboss List Archives

[JBoss JIRA] (ELY-134) Complete API JavaDoc

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/ELY-134?page=com.atlassian.jira.plugin.sy... ] Darran Lofthouse updated ELY-134: --------------------------------- Fix Version/s: 1.2.0.Beta3 (was: 1.2.0.Beta1) > Complete API JavaDoc > -------------------- > > Key: ELY-134 > URL: https://issues.jboss.org/browse/ELY-134 > Project: WildFly Elytron > Issue Type: Task > Reporter: David Lloyd > Priority: Blocker > Fix For: 1.2.0.Beta3 > > > All API components and members must be JavaDoc'd. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 8 months

1
0
0 / 0

[JBoss JIRA] (ELY-124) Java 8+ supports unbound SASL servers; GSSAPI and DIGEST-MD5 both use this value

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/ELY-124?page=com.atlassian.jira.plugin.sy... ] Darran Lofthouse updated ELY-124: --------------------------------- Fix Version/s: 1.2.0.Beta3 (was: 1.2.0.Beta1) > Java 8+ supports unbound SASL servers; GSSAPI and DIGEST-MD5 both use this value > -------------------------------------------------------------------------------- > > Key: ELY-124 > URL: https://issues.jboss.org/browse/ELY-124 > Project: WildFly Elytron > Issue Type: Task > Components: SASL > Reporter: David Lloyd > Fix For: 1.2.0.Beta3 > > > Since Java 8, the SaslServerFactory interface has been changed so that the serverName may be null. If null, the server name is considered "unbound" and the client can select what server name it wants to use. > The release notes say: > {quote} > SASL service for multiple host names: When creating a SASL server, the server name can be set to null to denote an unbound server, which means a client can request for the service using any server name. After a context is established, the server can retrieve the name as a negotiated property with the key name SASL.BOUND_SERVER_NAME. See RFE 7110803. > {quote} > The updated JavaDoc says: > {quote} > serverName - The fully qualified host name of the server to authenticate to, or null if the server is not bound to any specific host name. If the mechanism does not allow an unbound server, a SaslException will be thrown. > {quote} > The RFE link is: http://bugs.java.com/bugdatabase/view_bug.do?bug_id=7110803 > The two SASL mechanisms in Elytron that would be impacted by this are DIGEST-MD5 and GSSAPI. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 8 months

1
0
0 / 0

[JBoss JIRA] (ELY-121) Background initialization/pooling of SecureRandom

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/ELY-121?page=com.atlassian.jira.plugin.sy... ] Darran Lofthouse updated ELY-121: --------------------------------- Fix Version/s: 1.2.0.Beta3 (was: 1.2.0.Beta1) > Background initialization/pooling of SecureRandom > ------------------------------------------------- > > Key: ELY-121 > URL: https://issues.jboss.org/browse/ELY-121 > Project: WildFly Elytron > Issue Type: Feature Request > Components: Utils > Reporter: David Lloyd > Priority: Minor > Fix For: 1.2.0.Beta3 > > > Provide a facility to initialize and pool SecureRandom instances in a background thread so that when things like SSLContexts are initialized, there are ready SecureRandoms. A background daemon thread which simply feeds instances into a modestly-sized BlockingQueue is probably more than adequate. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 8 months

1
0
0 / 0

[JBoss JIRA] (ELY-97) Realm Readniess

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/ELY-97?page=com.atlassian.jira.plugin.sys... ] Darran Lofthouse updated ELY-97: -------------------------------- Fix Version/s: 1.2.0.Beta3 (was: 1.2.0.Beta1) > Realm Readniess > --------------- > > Key: ELY-97 > URL: https://issues.jboss.org/browse/ELY-97 > Project: WildFly Elytron > Issue Type: Feature Request > Components: API / SPI > Reporter: Darran Lofthouse > Fix For: 1.2.0.Beta3 > > > Needs some discussion first but this is along the lines of the following: - > 1 - Within WildFly where we currently have realms we have an ability to query them to check they are ready to handle requests - this is mainly used for out of the box where we can display an error page describing to the user additional steps they need to perform. > 2 - Realms are essentially the interface to back end stores of user information, most likely being remote with no guarantee that they are always available, from an Elytron perspective this adds an additional two options: - > i. Alter offered realms also taking into account availability, information disclosure risk but worth considering. > ii. Security status panels within admin console, view at a glance what is available and what is not allowing administrator to take action. We also have notification support - a candidate for a notification. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 8 months

1
0
0 / 0

[JBoss JIRA] (ELY-88) Command line utilities

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/ELY-88?page=com.atlassian.jira.plugin.sys... ] Darran Lofthouse updated ELY-88: -------------------------------- Fix Version/s: 1.2.0.Beta3 (was: 1.2.0.Beta1) > Command line utilities > ---------------------- > > Key: ELY-88 > URL: https://issues.jboss.org/browse/ELY-88 > Project: WildFly Elytron > Issue Type: Feature Request > Reporter: David Lloyd > Fix For: 1.2.0.Beta3 > > > We should provide easy-to-use command line tools from the Elytron JAR as a main class that provide useful functions to users like: > * Creating password hashes > * Creating certificates and certificate requests > * Creating key pairs of various types > * Managing key stores (everything keytool does) > * Get the library version -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 8 months

1
0
0 / 0

[JBoss JIRA] (ELY-303) Verify compatibility with RFC7617 "The 'Basic' HTTP Authentication Scheme"

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/ELY-303?page=com.atlassian.jira.plugin.sy... ] Darran Lofthouse updated ELY-303: --------------------------------- Fix Version/s: 1.2.0.Beta3 (was: 1.2.0.Beta1) > Verify compatibility with RFC7617 "The 'Basic' HTTP Authentication Scheme" > -------------------------------------------------------------------------- > > Key: ELY-303 > URL: https://issues.jboss.org/browse/ELY-303 > Project: WildFly Elytron > Issue Type: Task > Components: HTTP > Reporter: Darran Lofthouse > Fix For: 1.2.0.Beta3 > > > This RFC has now reached the stage of being a proposed standard. > https://www.rfc-editor.org/info/rfc7617 -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 8 months

1
0
0 / 0

[JBoss JIRA] (ELY-286) HTTP Digest Authentication

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/ELY-286?page=com.atlassian.jira.plugin.sy... ] Darran Lofthouse updated ELY-286: --------------------------------- Fix Version/s: 1.2.0.Beta3 (was: 1.2.0.Beta1) > HTTP Digest Authentication > -------------------------- > > Key: ELY-286 > URL: https://issues.jboss.org/browse/ELY-286 > Project: WildFly Elytron > Issue Type: Feature Request > Components: HTTP > Reporter: Darran Lofthouse > Fix For: 1.2.0.Beta3 > > > Original Digest RFC [https://tools.ietf.org/html/rfc2069] > Current Digest RFC [https://tools.ietf.org/html/rfc2617] > HTTP 1.1 Authentication (Updates RFC2617) [https://tools.ietf.org/html/rfc7235] > Draft currently under discussion - [https://datatracker.ietf.org/doc/draft-ietf-httpauth-digest/] > RFC7616 Now Proposed Standard > "HTTP Digest Access Authentication", September 2015 > [https://www.rfc-editor.org/info/rfc7616] -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 8 months

1
0
0 / 0

[JBoss JIRA] (ELY-262) The equivalent of wrap and unwrap for HTTP authentication mechanisms

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/ELY-262?page=com.atlassian.jira.plugin.sy... ] Darran Lofthouse updated ELY-262: --------------------------------- Fix Version/s: 1.2.0.Beta3 (was: 1.2.0.Beta1) > The equivalent of wrap and unwrap for HTTP authentication mechanisms > -------------------------------------------------------------------- > > Key: ELY-262 > URL: https://issues.jboss.org/browse/ELY-262 > Project: WildFly Elytron > Issue Type: Sub-task > Components: HTTP > Reporter: Darran Lofthouse > Fix For: 1.2.0.Beta3 > > -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 8 months

1
0
0 / 0

[JBoss JIRA] (ELY-261) Rework (and move) UsernamePasswordHashUtil

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/ELY-261?page=com.atlassian.jira.plugin.sy... ] Darran Lofthouse updated ELY-261: --------------------------------- Fix Version/s: 1.2.0.Beta3 (was: 1.2.0.Beta1) > Rework (and move) UsernamePasswordHashUtil > ------------------------------------------ > > Key: ELY-261 > URL: https://issues.jboss.org/browse/ELY-261 > Project: WildFly Elytron > Issue Type: Feature Request > Components: API / SPI, Passwords > Reporter: Darran Lofthouse > Fix For: 1.2.0.Beta3 > > > Firstly this class is not really SASL specific so should be in a general util package. > Secondly we now have password specs and a PasswordFactory - if this class still has a future then maybe it should be using those instead of it's own custom implementation. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 8 months

1
0
0 / 0

[JBoss JIRA] (ELY-252) Take into account username after failed authentication for available mechs

by Darran Lofthouse (JIRA)

[ https://issues.jboss.org/browse/ELY-252?page=com.atlassian.jira.plugin.sy... ] Darran Lofthouse updated ELY-252: --------------------------------- Fix Version/s: 1.2.0.Beta3 (was: 1.2.0.Beta1) > Take into account username after failed authentication for available mechs > -------------------------------------------------------------------------- > > Key: ELY-252 > URL: https://issues.jboss.org/browse/ELY-252 > Project: WildFly Elytron > Issue Type: Task > Components: SASL > Reporter: Darran Lofthouse > Fix For: 1.2.0.Beta3 > > > This is something we would need to be cautious about as it does risk revealing information to an attacker but after a files attempt we may have more information and be able to offer mechanisms based on this. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

8 years, 8 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-jira August 2017