[JBoss JIRA] (WFCORE-2497) Convert *-authentication-factory resources to be child resources of security-domain
by Kabir Khan (JIRA)
[ https://issues.jboss.org/browse/WFCORE-2497?page=com.atlassian.jira.plugi... ]
Kabir Khan updated WFCORE-2497:
-------------------------------
Fix Version/s: 4.0.0.Beta2
(was: 4.0.0.Beta1)
> Convert *-authentication-factory resources to be child resources of security-domain
> -----------------------------------------------------------------------------------
>
> Key: WFCORE-2497
> URL: https://issues.jboss.org/browse/WFCORE-2497
> Project: WildFly Core
> Issue Type: Task
> Components: Security
> Reporter: Darran Lofthouse
> Fix For: 4.0.0.Beta2
>
>
> This is a good example of where child resources work.
> The authentication factory resources have a mandatory dependency on a single security domain.
> The configuration within the factory is related to it's security domain.
> There is only a single resource that can provide security domains.
> The behaviour of the parent is unaffected by the existence or configuration of the child.
> The parent and child manage their own services independently with the child's service depending on the parent's service.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 2 months
[JBoss JIRA] (WFCORE-3107) Allow slave hosts to ignore missing RBAC config resources
by Kabir Khan (JIRA)
[ https://issues.jboss.org/browse/WFCORE-3107?page=com.atlassian.jira.plugi... ]
Kabir Khan updated WFCORE-3107:
-------------------------------
Fix Version/s: 4.0.0.Beta2
(was: 4.0.0.Beta1)
> Allow slave hosts to ignore missing RBAC config resources
> ---------------------------------------------------------
>
> Key: WFCORE-3107
> URL: https://issues.jboss.org/browse/WFCORE-3107
> Project: WildFly Core
> Issue Type: Sub-task
> Components: Domain Management
> Reporter: Brian Stansberry
> Assignee: Brian Stansberry
> Fix For: 4.0.0.Beta2
>
>
> Part of parent issue whereby slaves can ignore missing RBAC constraint resources for write requests coming from the DC.
> If the DC sent the request, then the address is ok overall. So if it's missing on the slave that means the slave doesn't have that constraint registered and doesn't need to handle the op.
> This fix could possibly be backported to the 2.1.x and to EAP 6.4.x in lieu of adding transformers as part of the parent issue. In the case of 2.1.x it also allows slaves to ignore the related extension even if the code for it is present (which is only a minor benefit.)
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 2 months
[JBoss JIRA] (WFCORE-3181) Review CustomCredentialSecurityFactoryTestCase
by Kabir Khan (JIRA)
[ https://issues.jboss.org/browse/WFCORE-3181?page=com.atlassian.jira.plugi... ]
Kabir Khan updated WFCORE-3181:
-------------------------------
Fix Version/s: 4.0.0.Beta2
(was: 4.0.0.Beta1)
> Review CustomCredentialSecurityFactoryTestCase
> ----------------------------------------------
>
> Key: WFCORE-3181
> URL: https://issues.jboss.org/browse/WFCORE-3181
> Project: WildFly Core
> Issue Type: Bug
> Components: Security, Test Suite
> Reporter: Darran Lofthouse
> Fix For: 4.0.0.Beta2
>
>
> The test case CustomCredentialSecurityFactoryTestCase appears to be testing that the 'code does what it does' rather than testing the 'code is doing what it should'.
> The test is testing a custom credential security factory can be called but the test is using HTTP Basic authentication and relying on SPNEGO authentication being triggered as this is the only mechanism that currently uses this factory.
> Should a minor change be required to the SPNEGO authentication mechanism which affects when this credential factory is called this test case could subsequently fail.
> If possible it would be better to convert this test to be a SPNEGO test and then test the behaviour of the credential security factory affects the mechanism as expected.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 2 months
[JBoss JIRA] (WFCORE-3019) The bin/product.conf and the org.jboss.as.product:wildfly-core module should come in via an FP
by Kabir Khan (JIRA)
[ https://issues.jboss.org/browse/WFCORE-3019?page=com.atlassian.jira.plugi... ]
Kabir Khan updated WFCORE-3019:
-------------------------------
Fix Version/s: 4.0.0.Beta2
(was: 4.0.0.Beta1)
> The bin/product.conf and the org.jboss.as.product:wildfly-core module should come in via an FP
> ----------------------------------------------------------------------------------------------
>
> Key: WFCORE-3019
> URL: https://issues.jboss.org/browse/WFCORE-3019
> Project: WildFly Core
> Issue Type: Task
> Components: Server
> Reporter: Brian Stansberry
> Assignee: Brian Stansberry
> Fix For: 4.0.0.Beta2
>
>
> For WFLY-4692 we moved the "product" stuff out of core-feature-pack and into dist. But this means it doesn't end up in the skinny dist produced by the "build" module. Plus it makes the "dist" a kind of FP of its own.
> The stuff in dist/src/distribution should be its own FP. That one *perhaps* depends on core-feature-pack. Then build and dist use the new FP in addition to or instead of core-feature-pack.
> So, core-feature-pack is independently usable, in other dists, but our offiical build/dist, which has our official product module, picks up the new FP.
> Whether the new "product" FP depends on core-feature-pack depends on how we want to use it; i.e. can this bin/product.conf and module be used in some other flavor of dist.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 2 months
[JBoss JIRA] (WFCORE-3000) Allow turning the security manager on on a per jvm basis
by Kabir Khan (JIRA)
[ https://issues.jboss.org/browse/WFCORE-3000?page=com.atlassian.jira.plugi... ]
Kabir Khan updated WFCORE-3000:
-------------------------------
Fix Version/s: 4.0.0.Beta2
(was: 4.0.0.Beta1)
> Allow turning the security manager on on a per jvm basis
> --------------------------------------------------------
>
> Key: WFCORE-3000
> URL: https://issues.jboss.org/browse/WFCORE-3000
> Project: WildFly Core
> Issue Type: Feature Request
> Components: Domain Management
> Reporter: Brian Stansberry
> Labels: domain-mode
> Fix For: 4.0.0.Beta2
>
>
> Turning on the security manager in a WildFly process is done by adding the -secmgr arg to org.jboss.modules.Main. But the jvm config settings in domain mode provide no mechanism for configuring args to Main; they only provide options for args to java. So there is no way to turn on the security manager for an individual jvm config (i.e. one or more servers) or if it is on for the HC there is no way to turn it off for a particular jvm config.
> The jvm config needs an attribute for this; default is undefined which should be documented as meaning the setting is derived from the HC's settings (i.e. the way it is now.)
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 2 months
[JBoss JIRA] (WFCORE-2930) Support a socket-binding-group as a child of profile
by Kabir Khan (JIRA)
[ https://issues.jboss.org/browse/WFCORE-2930?page=com.atlassian.jira.plugi... ]
Kabir Khan updated WFCORE-2930:
-------------------------------
Fix Version/s: 4.0.0.Beta2
(was: 4.0.0.Beta1)
> Support a socket-binding-group as a child of profile
> ----------------------------------------------------
>
> Key: WFCORE-2930
> URL: https://issues.jboss.org/browse/WFCORE-2930
> Project: WildFly Core
> Issue Type: Feature Request
> Components: Domain Management
> Reporter: Brian Stansberry
> Assignee: Brian Stansberry
> Priority: Critical
> Fix For: 4.0.0.Beta2
>
>
> Allow a single socket-binding-group resource as a child of profile, such that resolution of bindings from the subsystems are limited to the s-b-g associated with the profile.
> A server-group that uses such a profile cannot reference a socket-binding-group. And a server in that server-group cannot reference an s-b-g to override the one from the server-group/profile.
> I'm not sure how the s-b-g resource will work. Perhaps the resource would go away under 'profile' with the bindings direct children of profile. The 'default-interface' attribute then becomes an attribute of profile. Or perhaps there will be an s-b-g resource, but with a fixed name that's the same as the profile. Currently I think the latter.
> This will be necessary for resolution of config elements using the upcoming provisioning tool. The tool will not be able to do correct "feature" resolution using the complex rules we currently support.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 2 months