[JBoss JIRA] (WFWIP-288) JWT signed by 1024 bit long key is rejected
by Darran Lofthouse (Jira)
[ https://issues.redhat.com/browse/WFWIP-288?page=com.atlassian.jira.plugin... ]
Darran Lofthouse commented on WFWIP-288:
----------------------------------------
This is the underlying error: -
{noformat}
Caused by: org.jose4j.jwt.consumer.InvalidJwtException: JWT processing failed. Additional details: [[17] Unable to process JOSE object (cause: org.jose4j.lang.InvalidKeyException: An RSA key of size 2048 bits or larger MUST be used with the all JOSE RSA algorithms (given key was only 1024 bits).): JsonWebSignature{"kid":"Test Key","typ":"jwt","alg":"RS256"}->eyJraWQiOiJUZXN0IEtleSIsInR5cCI6Imp3dCIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiJ0ZXN0VXNlciIsInVwbiI6InRlc3RVc2VyIiwiaXNzIjoicXVpY2tzdGFydC1qd3QtaXNzdWVyIiwiYXVkIjoiand0LWF1ZGllbmNlIiwiZ3JvdXBzIjpbIkVjaG9lciIsIlN1YnNjcmliZXIiXSwiYmlydGhkYXRlIjoiMjAxNy0wOS0xNSIsImp0aSI6IjY3ZWJmYmY0LTlhODYtNDQxYy1iMjE2LTFhN2JlZWUwOTI0YiIsImlhdCI6MTU3NjY3NjMyNCwiZXhwIjoxNTc2NjkwNzI0fQ.fWmS8EysxuWH6Te2Jn2GW30wQwayP4ySENPqqCLoKS9XTdgbjLHOlPZwAMJ-HsXKP1m6KEvgj6TGcSRJ5PKt4dJWyIIPTuBRddHtoyvFIyJGG7USRb3TFeWFhBXcgp8SMeGfEekIOtH_tKVIcpnWkfOqqEzs1JKezi4_qra_7KI]
at org.jose4j.jwt.consumer.JwtConsumer.processContext(JwtConsumer.java:271)
at org.jose4j.jwt.consumer.JwtConsumer.process(JwtConsumer.java:433)
at io.smallrye.jwt.auth.principal.DefaultJWTTokenParser.parse(DefaultJWTTokenParser.java:88)
... 40 more
Caused by: org.jose4j.lang.InvalidKeyException: An RSA key of size 2048 bits or larger MUST be used with the all JOSE RSA algorithms (given key was only 1024 bits).
at org.jose4j.jwx.KeyValidationSupport.checkRsaKeySize(KeyValidationSupport.java:48)
at org.jose4j.jws.RsaUsingShaAlgorithm.validatePublicKey(RsaUsingShaAlgorithm.java:44)
at org.jose4j.jws.BaseSignatureAlgorithm.validateVerificationKey(BaseSignatureAlgorithm.java:189)
at org.jose4j.jws.JsonWebSignature.verifySignature(JsonWebSignature.java:185)
at org.jose4j.jwt.consumer.JwtConsumer.processContext(JwtConsumer.java:222)
... 42 more
{noformat}
> JWT signed by 1024 bit long key is rejected
> -------------------------------------------
>
> Key: WFWIP-288
> URL: https://issues.redhat.com/browse/WFWIP-288
> Project: WildFly WIP
> Issue Type: Bug
> Components: MP JWT
> Reporter: Jan Kasik
> Assignee: Darran Lofthouse
> Priority: Blocker
>
> According to MP-JWT 1.1 specification, 1024 and 2048 bit key sizes must be supported. Though when there is JWT signed by 1024 bit long key presented to the server, it is rejected and client receives "Unauthorized" (code 401) message.
> See chapter 9.2. Supported Public Key Formats:
> {quote}
> Support for RSA Public Keys of 1024 or 2048 bits in length is required. Other key sizes are allowed, but should be considered vendor-specific.
> {quote}
--
This message was sent by Atlassian Jira
(v7.13.8#713008)
6 years, 5 months
[JBoss JIRA] (DROOLS-4880) JaxB serialize DomainClassMetadata classes
by Luca Molteni (Jira)
Luca Molteni created DROOLS-4880:
------------------------------------
Summary: JaxB serialize DomainClassMetadata classes
Key: DROOLS-4880
URL: https://issues.redhat.com/browse/DROOLS-4880
Project: Drools
Issue Type: Bug
Reporter: Luca Molteni
Assignee: Luca Molteni
See
https://github.com/kiegroup/droolsjbpm-integration/pull/1864/commits/2331...
The Price class was moved from a static inner class because it was causing a JaxB problem in OptaPlannerIntegrationTest that crashed while trying to serialize DomainClassMetadata (due to the creation of the synthetic class CloudBalancingGenerator$1
Customers are still relying on static inner class so we should have this test running in the original form
run the test with
mvn -nsu -Dcontainer=wildfly -Dintegration-tests=true -Dfull=true -Dcontainer.profile=wildfly -Pwildfly clean install
--
This message was sent by Atlassian Jira
(v7.13.8#713008)
6 years, 5 months
[JBoss JIRA] (WFCORE-4482) Out of the box SSL with Wildfly Elytron
by Jeff Mesnil (Jira)
[ https://issues.redhat.com/browse/WFCORE-4482?page=com.atlassian.jira.plug... ]
Jeff Mesnil updated WFCORE-4482:
--------------------------------
Fix Version/s: 11.0.0.Beta6
(was: 11.0.0.Beta5)
> Out of the box SSL with Wildfly Elytron
> ---------------------------------------
>
> Key: WFCORE-4482
> URL: https://issues.redhat.com/browse/WFCORE-4482
> Project: WildFly Core
> Issue Type: Feature Request
> Components: Security
> Reporter: Farah Juma
> Assignee: Farah Juma
> Priority: Major
> Labels: EAP-CD19
> Fix For: 11.0.0.Beta6
>
>
> The details of this RFE will be explored within the analysis, presently Undertow depends on a security-realm that generates a self signed cert on start up so we will require an Elytron equivalent.
> There may be opportunities to tie this in in some way with the new CA integration support but that can be explored in the analysis.
--
This message was sent by Atlassian Jira
(v7.13.8#713008)
6 years, 5 months
[JBoss JIRA] (WFCORE-3376) Modules may create loggers on a deployments log context
by Jeff Mesnil (Jira)
[ https://issues.redhat.com/browse/WFCORE-3376?page=com.atlassian.jira.plug... ]
Jeff Mesnil updated WFCORE-3376:
--------------------------------
Fix Version/s: 11.0.0.Beta6
(was: 11.0.0.Beta5)
> Modules may create loggers on a deployments log context
> -------------------------------------------------------
>
> Key: WFCORE-3376
> URL: https://issues.redhat.com/browse/WFCORE-3376
> Project: WildFly Core
> Issue Type: Bug
> Components: Logging
> Reporter: James Perkins
> Assignee: James Perkins
> Priority: Critical
> Fix For: 11.0.0.Beta6
>
>
> Currently WildFly uses a {{ClassLoaderLogContextSelector}} to determine the log context to use when creating loggers. If a deployment has it's own log context, via logging-profile or per-deployment logging, and a dependency on a module, that module may create loggers on the deployments log context. This is due to the fact the the call stack is walked until it finds a log context associated with a class loader.
> What is needed is a way to short-circuit once a non-logging API class loader is found and determine if there is an associated log context with the callers class loader.
--
This message was sent by Atlassian Jira
(v7.13.8#713008)
6 years, 5 months