[JBoss JIRA] (WFCORE-3825) Unify "-server" option in windows scripts (ps1, bat) for domain mode (and its servers)
by R Searls (JIRA)
[ https://issues.jboss.org/browse/WFCORE-3825?page=com.atlassian.jira.plugi... ]
R Searls reassigned WFCORE-3825:
--------------------------------
Assignee: R Searls
> Unify "-server" option in windows scripts (ps1, bat) for domain mode (and its servers)
> --------------------------------------------------------------------------------------
>
> Key: WFCORE-3825
> URL: https://issues.jboss.org/browse/WFCORE-3825
> Project: WildFly Core
> Issue Type: Bug
> Components: Scripts
> Reporter: Marek Kopecký
> Assignee: R Searls
>
> Unify "-server" option in windows scripts (ps1, bat) for domain mode (and its servers)
> Domain use "-server" option in unix, windows bat. Domain doesn't use "-server" option in windows ps1 scripts. Same for JVMs of domain servers.
> I prefer to add "-server" option to ps1 scripts.
> {noformat:title=domain.ps1 - "-server" option is missing}
> PS C:\Users\Administrator\playground\wfly.15\wildfly\bin> .\domain.ps1
> =================================================================================
> JBoss Bootstrap Environment
> JBOSS_HOME: C:\Users\Administrator\playground\wfly.15\wildfly
> JAVA: C:\Program Files\Java\jdk1.8.0_121\bin\java.exe
> MODULE_OPTS:
> JAVA_OPTS: -Xms64M -Xmx512M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -Djboss.modules.system.pkgs=org.jboss.byteman
> =================================================================================
> ...
> {noformat}
> {noformat:title=domain.bat - "-server" option is listed in JAVA_OPTS}
> C:\Users\Administrator\playground\wfly.15\wildfly\bin>domain.bat
> Calling "C:\Users\Administrator\playground\wfly.15\wildfly\bin\domain.conf.bat"
> Setting JAVA property to "C:\Program Files\Java\jdk1.8.0_121\bin\java"
> ===============================================================================
> JBoss Bootstrap Environment
> JBOSS_HOME: "C:\Users\Administrator\playground\wfly.15\wildfly"
> JAVA: "C:\Program Files\Java\jdk1.8.0_121\bin\java"
> JAVA_OPTS: "-Xms64M -Xmx512M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -Djboss.modules.system.pkgs=org.jboss.byteman -server"
> ===============================================================================
> ...
> {noformat}
> cc: [~jamezp]
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
7 years, 11 months
[JBoss JIRA] (WFLY-9892) Upgrade org.apache.santuario.xmlsec to 2.1.1. caused regression in PicketLinkSTS
by Kabir Khan (JIRA)
[ https://issues.jboss.org/browse/WFLY-9892?page=com.atlassian.jira.plugin.... ]
Kabir Khan closed WFLY-9892.
----------------------------
Resolution: Won't Fix
Closing as this will now be documented as part of JBEAP-14811
> Upgrade org.apache.santuario.xmlsec to 2.1.1. caused regression in PicketLinkSTS
> --------------------------------------------------------------------------------
>
> Key: WFLY-9892
> URL: https://issues.jboss.org/browse/WFLY-9892
> Project: WildFly
> Issue Type: Bug
> Components: Security
> Affects Versions: 12.0.0.Beta1
> Reporter: Ondrej Lukas
> Assignee: Pedro Igor
> Priority: Blocker
> Attachments: ejb-security-picketlink.zip, ejb-test.jar, picketlink-sts.war, sts-config.properties
>
>
> When token from PicketLink STS is issued and signed then it is not able to be used for authentication through Remoting in WildFly 12 (i.e. it cannot be set as {{remote.connection.main.password}} property which can be used in PicketLink {{org.picketlink.identity.federation.bindings.jboss.auth.SAML2STSLoginModule}}). It seems it is caused by upgrade of org.apache.santuario.xmlsec to version 2.1.1. [1]. When WILDFLY11_HOME/modules/system/layers/base/org/apache/santuario/xmlsec/main/xmlsec-2.0.8.jar is placed to WildFly 12 modules then it works correctly.
> We report it as a blocker since it is regression - application which works correctly on WildFly 11 stops to work on WildFly 12 - users are not able to authenticate through Remoting with signed tokens from PicketLink STS correctly.
> Remoting fails due to following exception:
> {code}
> java.lang.IllegalArgumentException: ELY05131: Invalid ASCII control "0xA"
> at org.wildfly.security.sasl.util.StringPrep.forbidAsciiControl(StringPrep.java:117)
> at org.wildfly.security.sasl.util.StringPrep.encode(StringPrep.java:295)
> at org.wildfly.security.sasl.util.StringPrep.encode(StringPrep.java:196)
> at org.wildfly.security.sasl.plain.PlainSaslClient.evaluateChallenge(PlainSaslClient.java:95)
> at org.wildfly.security.sasl.util.AbstractDelegatingSaslClient.evaluateChallenge(AbstractDelegatingSaslClient.java:54)
> at org.wildfly.security.sasl.util.PrivilegedSaslClient.lambda$evaluateChallenge$0(PrivilegedSaslClient.java:55)
> at java.security.AccessController.doPrivileged(Native Method)
> at org.wildfly.security.sasl.util.PrivilegedSaslClient.evaluateChallenge(PrivilegedSaslClient.java:55)
> at org.jboss.remoting3.remote.ClientConnectionOpenListener$Capabilities.lambda$handleEvent$1(ClientConnectionOpenListener.java:460)
> at org.jboss.remoting3.EndpointImpl$TrackingExecutor.lambda$execute$0(EndpointImpl.java:926)
> at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1979)
> at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1481)
> at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1374)
> at java.lang.Thread.run(Thread.java:748)
> {code}
> It is caused by different formating value of SignatureValue in assertion. In WildFly 11 SignatureValue looks like:
> {code}
> <dsig:SignatureValue xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">nFVkKrXTyYEQ9cwc9OOgySYebEtwzw4alVYP0viXzvqZAUAKtAXEBAfDB8xIOms78twlDdq79MiSvk8OrOdf126Kw/IR8JRn1fYyZ5tsIRcNoTXMgGaTqhrn/HKlLqqqHhVHrJURunqkSzTTxylA2AEPhEDD5Y7hS0W2ZZCeSvuri+PRDSTrRnuedz0yQuHQu1mZ0gjoEFbHh4Wkkn5Ac1R4gmewmmzPud+ZE6Ux4YpeHzQ8rAvZ4bDk6j+eQIRsSxFTLo5RSA3FWN8+lUNV/CSRqBPXsK7QxOaTdBgF+4NXWeExrNJ9SeVFcf9yelvReAtR2JNZ6DUY8u45KtXmLw==</dsig:SignatureValue>
> {code}
> In WildFly 12 it looks like (there are end of lines):
> {code}
> <dsig:SignatureValue xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">cUNpFJIZlLYrBDZtQSTDrq2K6PbnAHyg2qbx/D5FuB4XMjdQ5oxQjkMejLyelnA7s4GFusoLhahl
> qlTOT8UrOyxrR4yYAmJ/e5s+f4gys926+tbiraT/3/wG8wM/Lvcjvk5Ap69zODuRYpypsWfA4jrI
> 7TTBXVPGy8g4KUdnFviUiTuFTc2Ghgxp53AmUuLis/THyP28jE7+28//q8bi/bQrFwHC6tWX67+N
> K1duFCOcQ6IPIKeVrePZz55Ivgl+WWdkF6uYCz5IdMzurhzmeQ3K8DAMIxz/MG67VWJIOnuGNWF7
> nmdye5zd9AFcRsr1XadvZJCbGNfuc89AL5inCg==</dsig:SignatureValue>
> {code}
> [1] https://github.com/wildfly/wildfly/commit/536de514829f2187abf1126c8916a04...
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
7 years, 11 months
[JBoss JIRA] (WFLY-9892) Upgrade org.apache.santuario.xmlsec to 2.1.1. caused regression in PicketLinkSTS
by Derek Horton (JIRA)
[ https://issues.jboss.org/browse/WFLY-9892?page=com.atlassian.jira.plugin.... ]
Derek Horton commented on WFLY-9892:
------------------------------------
The workaround (removing newlines from the password/token) looks okay to me. Please make sure the workaround makes it into the documentation.
> Upgrade org.apache.santuario.xmlsec to 2.1.1. caused regression in PicketLinkSTS
> --------------------------------------------------------------------------------
>
> Key: WFLY-9892
> URL: https://issues.jboss.org/browse/WFLY-9892
> Project: WildFly
> Issue Type: Bug
> Components: Security
> Affects Versions: 12.0.0.Beta1
> Reporter: Ondrej Lukas
> Assignee: Pedro Igor
> Priority: Blocker
> Attachments: ejb-security-picketlink.zip, ejb-test.jar, picketlink-sts.war, sts-config.properties
>
>
> When token from PicketLink STS is issued and signed then it is not able to be used for authentication through Remoting in WildFly 12 (i.e. it cannot be set as {{remote.connection.main.password}} property which can be used in PicketLink {{org.picketlink.identity.federation.bindings.jboss.auth.SAML2STSLoginModule}}). It seems it is caused by upgrade of org.apache.santuario.xmlsec to version 2.1.1. [1]. When WILDFLY11_HOME/modules/system/layers/base/org/apache/santuario/xmlsec/main/xmlsec-2.0.8.jar is placed to WildFly 12 modules then it works correctly.
> We report it as a blocker since it is regression - application which works correctly on WildFly 11 stops to work on WildFly 12 - users are not able to authenticate through Remoting with signed tokens from PicketLink STS correctly.
> Remoting fails due to following exception:
> {code}
> java.lang.IllegalArgumentException: ELY05131: Invalid ASCII control "0xA"
> at org.wildfly.security.sasl.util.StringPrep.forbidAsciiControl(StringPrep.java:117)
> at org.wildfly.security.sasl.util.StringPrep.encode(StringPrep.java:295)
> at org.wildfly.security.sasl.util.StringPrep.encode(StringPrep.java:196)
> at org.wildfly.security.sasl.plain.PlainSaslClient.evaluateChallenge(PlainSaslClient.java:95)
> at org.wildfly.security.sasl.util.AbstractDelegatingSaslClient.evaluateChallenge(AbstractDelegatingSaslClient.java:54)
> at org.wildfly.security.sasl.util.PrivilegedSaslClient.lambda$evaluateChallenge$0(PrivilegedSaslClient.java:55)
> at java.security.AccessController.doPrivileged(Native Method)
> at org.wildfly.security.sasl.util.PrivilegedSaslClient.evaluateChallenge(PrivilegedSaslClient.java:55)
> at org.jboss.remoting3.remote.ClientConnectionOpenListener$Capabilities.lambda$handleEvent$1(ClientConnectionOpenListener.java:460)
> at org.jboss.remoting3.EndpointImpl$TrackingExecutor.lambda$execute$0(EndpointImpl.java:926)
> at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1979)
> at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1481)
> at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1374)
> at java.lang.Thread.run(Thread.java:748)
> {code}
> It is caused by different formating value of SignatureValue in assertion. In WildFly 11 SignatureValue looks like:
> {code}
> <dsig:SignatureValue xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">nFVkKrXTyYEQ9cwc9OOgySYebEtwzw4alVYP0viXzvqZAUAKtAXEBAfDB8xIOms78twlDdq79MiSvk8OrOdf126Kw/IR8JRn1fYyZ5tsIRcNoTXMgGaTqhrn/HKlLqqqHhVHrJURunqkSzTTxylA2AEPhEDD5Y7hS0W2ZZCeSvuri+PRDSTrRnuedz0yQuHQu1mZ0gjoEFbHh4Wkkn5Ac1R4gmewmmzPud+ZE6Ux4YpeHzQ8rAvZ4bDk6j+eQIRsSxFTLo5RSA3FWN8+lUNV/CSRqBPXsK7QxOaTdBgF+4NXWeExrNJ9SeVFcf9yelvReAtR2JNZ6DUY8u45KtXmLw==</dsig:SignatureValue>
> {code}
> In WildFly 12 it looks like (there are end of lines):
> {code}
> <dsig:SignatureValue xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">cUNpFJIZlLYrBDZtQSTDrq2K6PbnAHyg2qbx/D5FuB4XMjdQ5oxQjkMejLyelnA7s4GFusoLhahl
> qlTOT8UrOyxrR4yYAmJ/e5s+f4gys926+tbiraT/3/wG8wM/Lvcjvk5Ap69zODuRYpypsWfA4jrI
> 7TTBXVPGy8g4KUdnFviUiTuFTc2Ghgxp53AmUuLis/THyP28jE7+28//q8bi/bQrFwHC6tWX67+N
> K1duFCOcQ6IPIKeVrePZz55Ivgl+WWdkF6uYCz5IdMzurhzmeQ3K8DAMIxz/MG67VWJIOnuGNWF7
> nmdye5zd9AFcRsr1XadvZJCbGNfuc89AL5inCg==</dsig:SignatureValue>
> {code}
> [1] https://github.com/wildfly/wildfly/commit/536de514829f2187abf1126c8916a04...
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
7 years, 11 months
[JBoss JIRA] (WFLY-10411) TLDs under META-INF/resources inside the web-fragment jar is not loaded
by Tomas Hofman (JIRA)
[ https://issues.jboss.org/browse/WFLY-10411?page=com.atlassian.jira.plugin... ]
Tomas Hofman commented on WFLY-10411:
-------------------------------------
I think the reproducer doesn't conform to spec at several places.
1) Incorrect <taglib-location>
The web-fragment.xml in the reproducer jar contains:
{code}
<taglib>
<taglib-uri>/HiTag</taglib-uri>
<taglib-location>/WEB-INF/tlds/hi.tld</taglib-location>
</taglib>
{code}
but the tld file in the jar is placed in {{META-INF/resources/WEB-INF/tlds/hi.tld}}. I.e. {{<taglib-location>}} omits "resources" directory, hence the first error "WFLYUT0074: Could not find TLD".
Quote from JSP 2.1 spec:
{quote}
JSP.7.3.1 Identifying Tag Library Descriptors
When deployed inside a JAR file, the tag library descriptor files must be in the
META-INF directory, or a subdirectory of it.
When deployed directly into a web application, the tag library descriptor
files must always be in the WEB-INF directory, or some subdirectory of it.
{quote}
>From which I understand that {{META-INF}} should be taken as root, not {{META-INF/resources}}.
It would be easy to add {{META-INF/resources}} as another root in {{TldParsingDeploymentProcessor}} if we wanted to allow this to have equivalent behavior with Tomcat.
Fixing the uri in web-fragment.xml, one of the two JSPs starts to work. Taglib directive in it is:
{code}<%@ taglib uri="/HiTag" prefix="say"%>{code}
2) Incorrect taglib uri in index.jsp taglib directive
Taglib directive in index.jsp is
{code}<%@ taglib uri="/WEB-INF/tlds/hi.tld" prefix="say"%>{code}
i.e. the tld is referenced directly by it's relative location. This would work if the taglib was located directly in the WAR. The real relative location of the tld in jar from the war root is different: "/WEB-INF/lib/simple-taglib-1.0.jar/META-INF/resources/WEB-INF/tlds/hi.tld".
Fixing the uri to the latter however doesn't work either, and I'm not sure if it should.
>From the spec, mainly sections from 7.3.2 to 7.3.6, it's not clear to me if taglib uri can be path into nested JAR or not.
> TLDs under META-INF/resources inside the web-fragment jar is not loaded
> -----------------------------------------------------------------------
>
> Key: WFLY-10411
> URL: https://issues.jboss.org/browse/WFLY-10411
> Project: WildFly
> Issue Type: Bug
> Components: Web (Undertow)
> Affects Versions: 13.0.0.Beta1
> Reporter: Masafumi Miura
> Assignee: Stuart Douglas
> Attachments: jsp-taglib-jar-in-war.zip
>
>
> TLDs under META-INF/resources inside the web-fragment jar is not loaded.
> {code:title=directory structure of the web-fragment jar}
> taglib-jar
> |-- META-INF
> | |-- resources
> | | `-- WEB-INF
> | | `-- tlds
> | | `-- hi.tld
> | `-- web-fragment.xml
> `-- simple
> `-- HiTag.class
> {code}
> {code:title=web-fragment.xml}
> <?xml version="1.0" encoding="UTF-8"?>
> <web-fragment id="WebFragment_ID"
> version="3.0"
> xmlns="http://java.sun.com/xml/ns/javaee"
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
> xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-fragment_3_0.xsd">
> ...(snip)...
> <jsp-config>
> <taglib>
> <taglib-uri>/HiTag</taglib-uri>
> <taglib-location>/WEB-INF/tlds/hi.tld</taglib-location>
> </taglib>
> </jsp-config>
> </web-fragment>
> {code}
> The following ERROR is thrown at the deployment:
> {code}
> ERROR [org.wildfly.extension.undertow] (MSC service thread 1-8) WFLYUT0074: Could not find TLD /WEB-INF/tlds/hi.tld
> {code}
> JSP returns "500 Internal Server Error" and Jastow throws the following ERROR when accessing the JSP which has {{<%@ taglib uri="/HiTag" prefix="say"%>}} or {{<%@ taglib uri="/WEB-INF/tlds/hi.tld" prefix="say"%>}}:
> {code}
> ERROR [io.undertow.request] (default task-1) UT005023: Exception handling request to /taglib-jar-in-war/hi.jsp: org.apache.jasper.JasperException: JBWEB004036: File "/HiTag" not found
> at org.apache.jasper.compiler.DefaultErrorHandler.jspError(DefaultErrorHandler.java:57)
> at org.apache.jasper.compiler.ErrorDispatcher.dispatch(ErrorDispatcher.java:278)
> at org.apache.jasper.compiler.ErrorDispatcher.jspError(ErrorDispatcher.java:75)
> at org.apache.jasper.compiler.TagLibraryInfoImpl.<init>(TagLibraryInfoImpl.java:171)
> at org.apache.jasper.compiler.Parser.parseTaglibDirective(Parser.java:412)
> at org.apache.jasper.compiler.Parser.parseDirective(Parser.java:475)
> at org.apache.jasper.compiler.Parser.parseElements(Parser.java:1459)
> at org.apache.jasper.compiler.Parser.parse(Parser.java:143)
> at org.apache.jasper.compiler.ParserController.doParse(ParserController.java:223)
> at org.apache.jasper.compiler.ParserController.parse(ParserController.java:102)
> at org.apache.jasper.compiler.Compiler.generateJava(Compiler.java:200)
> at org.apache.jasper.compiler.Compiler.compile(Compiler.java:354)
> at org.apache.jasper.compiler.Compiler.compile(Compiler.java:334)
> at org.apache.jasper.compiler.Compiler.compile(Compiler.java:321)
> at org.apache.jasper.JspCompilationContext.compile(JspCompilationContext.java:652)
> at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:358)
> at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:403)
> at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:347)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
> ...(snip)...
> {code}
> {code}
> ERROR [io.undertow.request] (default task-1) UT005023: Exception handling request to /taglib-jar-in-war/index.jsp: org.apache.jasper.JasperException: JBWEB004036: File "/WEB-INF/tlds/hi.tld" not found
> at org.apache.jasper.compiler.DefaultErrorHandler.jspError(DefaultErrorHandler.java:57)
> at org.apache.jasper.compiler.ErrorDispatcher.dispatch(ErrorDispatcher.java:278)
> at org.apache.jasper.compiler.ErrorDispatcher.jspError(ErrorDispatcher.java:75)
> at org.apache.jasper.compiler.TagLibraryInfoImpl.<init>(TagLibraryInfoImpl.java:171)
> at org.apache.jasper.compiler.Parser.parseTaglibDirective(Parser.java:412)
> at org.apache.jasper.compiler.Parser.parseDirective(Parser.java:475)
> at org.apache.jasper.compiler.Parser.parseElements(Parser.java:1459)
> at org.apache.jasper.compiler.Parser.parse(Parser.java:143)
> at org.apache.jasper.compiler.ParserController.doParse(ParserController.java:223)
> at org.apache.jasper.compiler.ParserController.parse(ParserController.java:102)
> at org.apache.jasper.compiler.Compiler.generateJava(Compiler.java:200)
> at org.apache.jasper.compiler.Compiler.compile(Compiler.java:354)
> at org.apache.jasper.compiler.Compiler.compile(Compiler.java:334)
> at org.apache.jasper.compiler.Compiler.compile(Compiler.java:321)
> at org.apache.jasper.JspCompilationContext.compile(JspCompilationContext.java:652)
> at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:358)
> at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:403)
> at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:347)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
> ...(snip)...
> {code}
> Note that the same war file can be deployed and the JSPs works on Tomcat 8.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
7 years, 11 months