December 2018 - jboss-jira - Jboss List Archives

[JBoss JIRA] (WFLY-11131) @LoginToContinue.errorPage doesn't work for pages in WEB-INF (New Java EE 8 Security)

by Darran Lofthouse (Jira)

[ https://issues.jboss.org/browse/WFLY-11131?page=com.atlassian.jira.plugin... ] Darran Lofthouse commented on WFLY-11131: ----------------------------------------- Can you please try again with WildFly 15 backed by WildFly Elytron - if this issue is still present there I will take a look. > @LoginToContinue.errorPage doesn't work for pages in WEB-INF (New Java EE 8 Security) > ------------------------------------------------------------------------------------- > > Key: WFLY-11131 > URL: https://issues.jboss.org/browse/WFLY-11131 > Project: WildFly > Issue Type: Bug > Components: Security > Affects Versions: 14.0.1.Final > Reporter: Instantiation Exception > Assignee: Darran Lofthouse > Priority: Major > > I have this configuration: > {code:java} > @FormAuthenticationMechanismDefinition( > loginToContinue = @LoginToContinue( > loginPage = "/WEB-INF/account/login.xhtml", > errorPage = "/WEB-INF/account/login.xhtml?error=true")) > @ApplicationScoped > public class SecurityConfiguration {} > {code} > When I open browser and go to restricted page, I am forwarded to login page. Then I input invalid username and password and submit form (action="j_security_check"). My browser sends me redirect to http://localhost:8080/WEB-INF/account/login.xhtml?error=true. I believe it should forward request to /WEB-INF/account/login.xhtml?error=true because standard FORM login-config in web.xml worked this way. -- This message was sent by Atlassian Jira (v7.12.1#712002)

7 years, 7 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-4172) Add support for TLS 1.3

by Darran Lofthouse (Jira)

[ https://issues.jboss.org/browse/WFCORE-4172?page=com.atlassian.jira.plugi... ] Darran Lofthouse updated WFCORE-4172: ------------------------------------- Fix Version/s: 8.0.0.Beta2 > Add support for TLS 1.3 > ----------------------- > > Key: WFCORE-4172 > URL: https://issues.jboss.org/browse/WFCORE-4172 > Project: WildFly Core > Issue Type: Feature Request > Components: Security > Reporter: Farah Juma > Assignee: Farah Juma > Priority: Major > Labels: eap-7.2.0-deferred > Fix For: 8.0.0.Beta2 > > > It presently appears as though TLS 1.3 support could be available from Java 11. -- This message was sent by Atlassian Jira (v7.12.1#712002)

7 years, 7 months

1
0
0 / 0

[JBoss JIRA] (WFLY-11094) Elytron does not do RunAs identity remote propagation

by Darran Lofthouse (Jira)

[ https://issues.jboss.org/browse/WFLY-11094?page=com.atlassian.jira.plugin... ] Darran Lofthouse updated WFLY-11094: ------------------------------------ Fix Version/s: 16.0.0.Beta1 > Elytron does not do RunAs identity remote propagation > ----------------------------------------------------- > > Key: WFLY-11094 > URL: https://issues.jboss.org/browse/WFLY-11094 > Project: WildFly > Issue Type: Bug > Components: Security > Reporter: Teresa Miyar > Assignee: Teresa Miyar > Priority: Major > Labels: downstream_dependency > Fix For: 16.0.0.Beta1 > > > Elytron does not do RunAs identity remote propagation > -> EJB with @RunAs("ejbuser") -> remote EJB , where Elytron security forwarding is configured, @RunAs is not working. And caused authentication error when trying to call the 2nd server when @RunAs is added. -- This message was sent by Atlassian Jira (v7.12.1#712002)

7 years, 7 months

1
0
0 / 0

[JBoss JIRA] (WFLY-11348) EESecurityAuthMechanismTestCase fails with security manager

by Darran Lofthouse (Jira)

[ https://issues.jboss.org/browse/WFLY-11348?page=com.atlassian.jira.plugin... ] Darran Lofthouse resolved WFLY-11348. ------------------------------------- Resolution: Won't Fix Resolving as "Won't Fix" as this is within the legacy PicketBox integration. > EESecurityAuthMechanismTestCase fails with security manager > ----------------------------------------------------------- > > Key: WFLY-11348 > URL: https://issues.jboss.org/browse/WFLY-11348 > Project: WildFly > Issue Type: Bug > Components: Security, Test Suite > Affects Versions: 14.0.0.Final > Reporter: Martin Choma > Assignee: Justin Cook > Priority: Major > Labels: security-manager > > {noformat} > org.jboss.as.test.integration.security.jaspi (2) > EESecurityAuthMechanismTestCase.testAuthNotRequired > EESecurityAuthMechanismTestCase.testSuccessfulAuthentication > {noformat} > Seems to me doPrivileged block is missing in server code somewhere. > {noformat} > &amp#27;[0m&amp#27;[31m00:29:39,192 ERROR [io.undertow.request] (default task-1) UT005023: Exception handling request to /EESecurityAuthMechanismTestCase/unsecured/index.jsp: java.security.AccessControlException: WFSM000001: Permission check failed (permission "("java.lang.RuntimePermission" "org.jboss.security.plugins.JBossSecurityContext.getSubjectInfo")" in code source "(vfs:/content/EESecurityAuthMechanismTestCase.war/WEB-INF/classes <no signer certificates>)" of "ModuleClassLoader for Module "deployment.EESecurityAuthMechanismTestCase.war" from Service Module Loader") > at org.wildfly.security.manager.WildFlySecurityManager.checkPermission(WildFlySecurityManager.java:294) > at org.wildfly.security.manager.WildFlySecurityManager.checkPermission(WildFlySecurityManager.java:191) > at org.jboss.security.plugins.JBossSecurityContext.getSubjectInfo(JBossSecurityContext.java:182) > at org.jboss.security.auth.callback.JASPICallbackHandler.handleCallBack(JASPICallbackHandler.java:128) > at org.jboss.security.auth.callback.JBossCallbackHandler.handle(JBossCallbackHandler.java:87) > at org.glassfish.soteria.mechanisms.jaspic.Jaspic.handleCallbacks(Jaspic.java:196) > at org.glassfish.soteria.mechanisms.jaspic.Jaspic.notifyContainerAboutLogin(Jaspic.java:182) > at org.glassfish.soteria.mechanisms.HttpMessageContextImpl.doNothing(HttpMessageContextImpl.java:303) > at org.jboss.as.test.integration.security.jaspi.SimpleHttpAuthenticationMechanism.validateRequest(SimpleHttpAuthenticationMechanism.java:43) > at org.jboss.as.test.integration.security.jaspi.SimpleHttpAuthenticationMechanism$Proxy$_$$_WeldClientProxy.validateRequest(Unknown Source) > at org.glassfish.soteria.mechanisms.jaspic.HttpBridgeServerAuthModule.validateRequest(HttpBridgeServerAuthModule.java:114) > at org.glassfish.soteria.mechanisms.jaspic.DefaultServerAuthContext.validateRequest(DefaultServerAuthContext.java:76) > at org.jboss.security.plugins.auth.JASPIServerAuthenticationManager.isValid(JASPIServerAuthenticationManager.java:115) > at org.wildfly.extension.undertow.security.jaspi.JASPICAuthenticationMechanism.authenticate(JASPICAuthenticationMechanism.java:125) > at io.undertow.security.impl.SecurityContextImpl$AuthAttempter.transition(SecurityContextImpl.java:245) > at io.undertow.security.impl.SecurityContextImpl$AuthAttempter.access$100(SecurityContextImpl.java:231) > at io.undertow.security.impl.SecurityContextImpl.attemptAuthentication(SecurityContextImpl.java:125) > at io.undertow.security.impl.SecurityContextImpl.authTransition(SecurityContextImpl.java:99) > at io.undertow.security.impl.SecurityContextImpl.authenticate(SecurityContextImpl.java:92) > at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:55){noformat} > {noformat} > [1] https://ci.wildfly.org/viewLog.html?buildId=128138&buildTypeId=WF_MasterS... -- This message was sent by Atlassian Jira (v7.12.1#712002)

7 years, 7 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-4106) Add the ability to configure security providers using Elytron subsystem security properties

by Darran Lofthouse (Jira)

[ https://issues.jboss.org/browse/WFCORE-4106?page=com.atlassian.jira.plugi... ] Darran Lofthouse resolved WFCORE-4106. -------------------------------------- Resolution: Rejected > Add the ability to configure security providers using Elytron subsystem security properties > ------------------------------------------------------------------------------------------- > > Key: WFCORE-4106 > URL: https://issues.jboss.org/browse/WFCORE-4106 > Project: WildFly Core > Issue Type: Feature Request > Components: Security > Reporter: Farah Juma > Assignee: Farah Juma > Priority: Major > > It should be possible to configure security providers using the {{security-properties}} attribute in the Elytron subsystem. For example, it should be possible to use the following command to register custom security providers instead of needing to manually update the {{java.security}} file: > {code} > /subsystem=elytron:write-attribute(name=security-properties,value={\ > security.provider.1=PROVIDER_1,\ > security.provider.2=PROVIDER_2\ > ...\ > } > {code} -- This message was sent by Atlassian Jira (v7.12.1#712002)

7 years, 7 months

1
0
0 / 0

[JBoss JIRA] (WFLY-11073) Support hex encoding in jdbc-realm for elytron

by Darran Lofthouse (Jira)

[ https://issues.jboss.org/browse/WFLY-11073?page=com.atlassian.jira.plugin... ] Darran Lofthouse reassigned WFLY-11073: --------------------------------------- Assignee: Darran Lofthouse > Support hex encoding in jdbc-realm for elytron > ---------------------------------------------- > > Key: WFLY-11073 > URL: https://issues.jboss.org/browse/WFLY-11073 > Project: WildFly > Issue Type: Feature Request > Components: Documentation, Security > Reporter: Jan Kalina > Assignee: Darran Lofthouse > Priority: Major > Labels: elytron > Fix For: 16.0.0.Beta1 > > > Old database login-module can be configured passing the attribute {{hashEncoding}}, for example: > {code:xml} > <login-module code="Database" flag="required"> > <module-option name="dsJndiName" value="java:jboss/datasources/ExampleDS"/> > <module-option name="principalsQuery" value="SELECT password FROM User WHERE username = ?"/> > <module-option name="rolesQuery" value="SELECT role, 'Roles' FROM User WHERE username = ?"/> > <module-option name="hashAlgorithm" value="SHA-1"/> > <module-option name="hashEncoding" value="hex"/> > <module-option name="hashCharset" value="UTF-8"/> > </login-module> > {code} > Currently jdbc-realm in elytron only uses base64 encoding if hash is stored in a text column. This way the migration is more complicated cos the password hash is not valid changing from old security system to elytron. > Think also about the charset attribute. -- This message was sent by Atlassian Jira (v7.12.1#712002)

7 years, 7 months

1
0
0 / 0

[JBoss JIRA] (WFLY-11479) HTTP Basic Authentication - Silent Operation

by Darran Lofthouse (Jira)

[ https://issues.jboss.org/browse/WFLY-11479?page=com.atlassian.jira.plugin... ] Darran Lofthouse updated WFLY-11479: ------------------------------------ Fix Version/s: 16.0.0.Beta1 > HTTP Basic Authentication - Silent Operation > -------------------------------------------- > > Key: WFLY-11479 > URL: https://issues.jboss.org/browse/WFLY-11479 > Project: WildFly > Issue Type: Feature Request > Components: Security > Reporter: Darran Lofthouse > Assignee: Diana Vilkolakova > Priority: Major > Fix For: 16.0.0.Beta1 > > > Using HTTP Basic authentication with Undertow it was possible to switch into a silent mode where an incoming header could be processed but clients would not be challenged - this RFE is to support the same behaviour with WildFly Elytron. -- This message was sent by Atlassian Jira (v7.12.1#712002)

7 years, 7 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-3310) mechanism-configuration in http/sasl authentication factory in server configuration should fail when includes some attribute

by Darran Lofthouse (Jira)

[ https://issues.jboss.org/browse/WFCORE-3310?page=com.atlassian.jira.plugi... ] Darran Lofthouse updated WFCORE-3310: ------------------------------------- Component/s: Management (was: Security) > mechanism-configuration in http/sasl authentication factory in server configuration should fail when includes some attribute > ---------------------------------------------------------------------------------------------------------------------------- > > Key: WFCORE-3310 > URL: https://issues.jboss.org/browse/WFCORE-3310 > Project: WildFly Core > Issue Type: Bug > Components: Management > Affects Versions: 3.0.3.Final > Reporter: Ondrej Lukas > Assignee: Jiri Ondrusek > Priority: Major > > Based on wildfly-elytron XSD mechanism-configuration element of http-authentication-factory or sasl-authentication-factory should not contain any attribute. However when some attribute is added for this element in standalone.xml then it does not fail during server start. In correct behavior Validation error should be thrown during starting server. -- This message was sent by Atlassian Jira (v7.12.1#712002)

7 years, 7 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-3310) mechanism-configuration in http/sasl authentication factory in server configuration should fail when includes some attribute

by Darran Lofthouse (Jira)

[ https://issues.jboss.org/browse/WFCORE-3310?page=com.atlassian.jira.plugi... ] Darran Lofthouse commented on WFCORE-3310: ------------------------------------------ I have changed the component to 'management' as this has now become a general issue rather than security specific. > mechanism-configuration in http/sasl authentication factory in server configuration should fail when includes some attribute > ---------------------------------------------------------------------------------------------------------------------------- > > Key: WFCORE-3310 > URL: https://issues.jboss.org/browse/WFCORE-3310 > Project: WildFly Core > Issue Type: Bug > Components: Management > Affects Versions: 3.0.3.Final > Reporter: Ondrej Lukas > Assignee: Jiri Ondrusek > Priority: Major > > Based on wildfly-elytron XSD mechanism-configuration element of http-authentication-factory or sasl-authentication-factory should not contain any attribute. However when some attribute is added for this element in standalone.xml then it does not fail during server start. In correct behavior Validation error should be thrown during starting server. -- This message was sent by Atlassian Jira (v7.12.1#712002)

7 years, 7 months

1
0
0 / 0

[JBoss JIRA] (WFLY-11510) EarOpenTracingWithWeldProbeTestCase fails with node0/1 set

by Matej Novotny (Jira)

[ https://issues.jboss.org/browse/WFLY-11510?page=com.atlassian.jira.plugin... ] Matej Novotny commented on WFLY-11510: -------------------------------------- Changing the config for whole TS might be overkill. Simply altering the Arq. deployment of this given test by adding {{weld.properties}} file should do the trick as well. > EarOpenTracingWithWeldProbeTestCase fails with node0/1 set > ---------------------------------------------------------- > > Key: WFLY-11510 > URL: https://issues.jboss.org/browse/WFLY-11510 > Project: WildFly > Issue Type: Bug > Components: MP OpenTracing, Test Suite > Affects Versions: 16.0.0.Beta1 > Reporter: Ondrej Kotek > Assignee: Nikoleta Žiaková > Priority: Major > > {{org.jboss.as.test.integration.microprofile.opentracing.EarOpenTracingWithWeldProbeTestCase}} fails with {{node0}} and {{node1}} set: > {noformat} > WARN [org.jboss.weld.probe.Probe] (default task-1) PROBE-000017: Access to /ServiceOne/service-endpoint/app denied for <my IP> > WARN [org.jboss.weld.probe.Probe] (default task-1) PROBE-000017: Access to /ServiceOne/service-endpoint/app denied for <my IP> > ... > java.lang.AssertionError: expected:<200> but was:<403> > at org.junit.Assert.fail(Assert.java:88) > at org.junit.Assert.failNotEquals(Assert.java:834) > at org.junit.Assert.assertEquals(Assert.java:645) > at org.junit.Assert.assertEquals(Assert.java:631) > at org.jboss.as.test.integration.microprofile.opentracing.AbstractEarOpenTracingTestCase.testHttpInvokation(AbstractEarOpenTracingTestCase.java:67) > at org.jboss.as.test.integration.microprofile.opentracing.AbstractEarOpenTracingTestCase.testEarServicesUseDifferentTracersAfterReload(AbstractEarOpenTracingTestCase.java:59) > at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) > ... > {noformat} > Maybe access from remote IP addresses is blocked in development mode. -- This message was sent by Atlassian Jira (v7.12.1#712002)

7 years, 7 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-jira December 2018