[JBoss JIRA] (ELY-1519) Make restore of SecurityIdentity on replicated session configurable
by Darran Lofthouse (Jira)
[ https://issues.jboss.org/browse/ELY-1519?page=com.atlassian.jira.plugin.s... ]
Darran Lofthouse updated ELY-1519:
----------------------------------
Fix Version/s: 1.9.0.CR3
(was: 1.9.0.CR2)
> Make restore of SecurityIdentity on replicated session configurable
> -------------------------------------------------------------------
>
> Key: ELY-1519
> URL: https://issues.jboss.org/browse/ELY-1519
> Project: WildFly Elytron
> Issue Type: Bug
> Components: Authentication Mechanisms
> Affects Versions: 1.2.0.Final
> Reporter: Martin Choma
> Assignee: Ilia Vassilev
> Priority: Major
> Fix For: 1.9.0.CR3
>
>
> Currently in clustered environment Security Identity is restored during
> * failover
> * load balancer change node (not sticky behaviour)
> * session passivation/activation
> This is mainly expected and good. It ensures performance gain because no additional SPNEGO negotiation is performed. But it can make troubles for kerberos ticket propagation, as kerberos ticket can't be serialized and restored.
> So idea is to have flag to turn this default behaviour off. When user authenticate to app1 on serverA and then wants to access app1 on serverB, SPNEGO authentication will be activated and kerberos ticket will be negotiated and will be available on serverB as well.
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
7 years, 1 month
[JBoss JIRA] (ELY-1440) FlexibleIdentityAssociation should runAs the known SecurityIdentity before associating itself.
by Darran Lofthouse (Jira)
[ https://issues.jboss.org/browse/ELY-1440?page=com.atlassian.jira.plugin.s... ]
Darran Lofthouse updated ELY-1440:
----------------------------------
Fix Version/s: 1.9.0.CR3
(was: 1.9.0.CR2)
> FlexibleIdentityAssociation should runAs the known SecurityIdentity before associating itself.
> ----------------------------------------------------------------------------------------------
>
> Key: ELY-1440
> URL: https://issues.jboss.org/browse/ELY-1440
> Project: WildFly Elytron
> Issue Type: Enhancement
> Components: API / SPI
> Reporter: Darran Lofthouse
> Priority: Major
> Fix For: 1.9.0.CR3
>
>
> This API was introduced to cover the case where authentication happens late in a request, generally that is quite a rare event.
> Even though the API may be popular it would likely happen once for a session and all future requests for that session the identity would be known in advance.
> At the moment by not running as the existing identity we are loosing all automatic identity outflow opportunities as calls pass from the servlet container to the EJB container.
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
7 years, 1 month
[JBoss JIRA] (ELY-816) Support for masked passwords in client XML config
by Darran Lofthouse (Jira)
[ https://issues.jboss.org/browse/ELY-816?page=com.atlassian.jira.plugin.sy... ]
Darran Lofthouse updated ELY-816:
---------------------------------
Fix Version/s: 1.9.0.CR3
(was: 1.9.0.CR2)
> Support for masked passwords in client XML config
> -------------------------------------------------
>
> Key: ELY-816
> URL: https://issues.jboss.org/browse/ELY-816
> Project: WildFly Elytron
> Issue Type: Task
> Reporter: David Lloyd
> Assignee: Darran Lofthouse
> Priority: Critical
> Fix For: 1.9.0.CR3
>
>
> We need a way to support masked passwords in the auth configuration file, either as:
> * A dedicated masked-password-type XML type
> * Adding necessary fields to hashed-password-type
> * Adding a modular crypt format
> Needs to be supported anywhere passwords are allowed.
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
7 years, 1 month