May 2020 - jboss-jira - Jboss List Archives

[JBoss JIRA] (WFWIP-102) SNI - hostname notation for sni-mapping element does not conform generic rules

by Darran Lofthouse (Jira)

[ https://issues.redhat.com/browse/WFWIP-102?page=com.atlassian.jira.plugin... ] Darran Lofthouse resolved WFWIP-102. ------------------------------------ Resolution: Won't Do Marking as won't do as the implementation is already in releases. > SNI - hostname notation for sni-mapping element does not conform generic rules > ------------------------------------------------------------------------------ > > Key: WFWIP-102 > URL: https://issues.redhat.com/browse/WFWIP-102 > Project: WildFly WIP > Issue Type: Bug > Environment: Wildfly build with undertow and wildfly-core modules build from following sources: > * https://github.com/stuartwdouglas/undertow/tree/sni > * https://github.com/stuartwdouglas/wildfly-core/tree/sni > Reporter: Jan Stourac > Assignee: Darran Lofthouse > Priority: Major > > Way of configuration of {{sni-mapping}} element in {{server-ssl-sni-context}} is not nice from UX and also does not conform the way it is generally used. > With current implementation administrator has to use following notation: > {code} > .*\.example\.com > {code} > This is standard reg-exp notation and is not for easy reading. I think following notation is much better and also is commonly used for this cases: > {code} > *.example.com > {code} > In other words - simple asterisk is used to match any subdomain and dot in our case does not stand for 'any single character'. Note that is the way it was described in [analysis document|https://github.com/wildfly/wildfly-proposals/pull/67/files#diff-...]. > Truth is that with this change we loose some flexibility, e.g. administrator won't be able to configure following: > {code} > www\.exa.ple\.com > {code} > But I doubt this is a common use case. WDYT? -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years, 2 months

1
0
0 / 0

[JBoss JIRA] (WFLY-13467) Issues in readme for microprofile-opentracing QS

by Martin Stefanko (Jira)

Martin Stefanko created WFLY-13467: -------------------------------------- Summary: Issues in readme for microprofile-opentracing QS Key: WFLY-13467 URL: https://issues.redhat.com/browse/WFLY-13467 Project: WildFly Issue Type: Bug Components: Quickstarts Affects Versions: 19.1.0.Final Reporter: Martin Stefanko Assignee: Martin Stefanko (1) The order of the steps at the beginning is confusing: 1. Solution section says to start EAP and deploy the QS 2. Start the JBoss EAP XP Standalone Server section says start EAP (2) Consider adding standard sections - see other (non-MP - because these were not yet tested) * Use of the EAP_HOME and QUICKSTART_HOME Variables * Run the Quickstart in Red Hat JBoss Developer Studio or Eclipse (3) Consider adding some instructions (or link to later sections of the readme) to access the app when deploying the complete example, it is only shown in the step-by-step sections. (4) pom.xml changes show WF BOM instead of EAP one: {code} <groupId>org.wildfly.bom</groupId> <artifactId>wildfly-microprofile</artifactId> <version>${version.server.bom}</version> where ${version.server.bom} is the version of your JBoss EAP XP, in our case "1.0". {code} Please notice there's no WF BOM of version 1.0. (5) WildFly used instead of EAP in: {code}   {code} The same references are used in pom.xml as well. (6) No spans are created in jaeger console as documented in sections {{Implicit tracing of REST resources}} and later. In fact, jaeger console does not show the {{microprofile-opentracing.war}} at all following the instructions in readme. This is due to missing env vars settings when starting the EAP server. -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years, 2 months

1
0
0 / 0

[JBoss JIRA] (ELY-1963) Silent Basic let me access resource without credential

by Darran Lofthouse (Jira)

[ https://issues.redhat.com/browse/ELY-1963?page=com.atlassian.jira.plugin.... ] Darran Lofthouse moved WFWIP-154 to ELY-1963: --------------------------------------------- Project: WildFly Elytron (was: WildFly WIP) Key: ELY-1963 (was: WFWIP-154) Component/s: HTTP (was: Security) > Silent Basic let me access resource without credential > ------------------------------------------------------ > > Key: ELY-1963 > URL: https://issues.redhat.com/browse/ELY-1963 > Project: WildFly Elytron > Issue Type: Bug > Components: HTTP > Reporter: Martin Choma > Priority: Major > Attachments: SilentBasicMechTestCase-web.xml > > > I use this configuration in web.xml {{<auth-method>BASIC?silent=true,FORM</auth-method>}} and I get 200 + content of protected resource when I access resource without credentials. > If I use this configuration in web.xml {{<auth-method>BASIC?silent=true</auth-method>}} I get correctly empty content with 200 status code when I access without credentials. > Zulip Chat 2019-01-04: https://wildfly.zulipchat.com/#narrow/stream/174178-eap/subject/EAP7-1154... > Test Commit: https://github.com/mchoma/wildfly/commit/e191c211c7e224f835c933c31829e597... -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years, 2 months

1
0
0 / 0

[JBoss JIRA] (WFWIP-154) Silent Basic let me access resource without credential

by Darran Lofthouse (Jira)

[ https://issues.redhat.com/browse/WFWIP-154?page=com.atlassian.jira.plugin... ] Darran Lofthouse reassigned WFWIP-154: -------------------------------------- Assignee: (was: Darran Lofthouse) > Silent Basic let me access resource without credential > ------------------------------------------------------ > > Key: WFWIP-154 > URL: https://issues.redhat.com/browse/WFWIP-154 > Project: WildFly WIP > Issue Type: Bug > Components: Security > Reporter: Martin Choma > Priority: Major > Attachments: SilentBasicMechTestCase-web.xml > > > I use this configuration in web.xml {{<auth-method>BASIC?silent=true,FORM</auth-method>}} and I get 200 + content of protected resource when I access resource without credentials. > If I use this configuration in web.xml {{<auth-method>BASIC?silent=true</auth-method>}} I get correctly empty content with 200 status code when I access without credentials. > Zulip Chat 2019-01-04: https://wildfly.zulipchat.com/#narrow/stream/174178-eap/subject/EAP7-1154... > Test Commit: https://github.com/mchoma/wildfly/commit/e191c211c7e224f835c933c31829e597... -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years, 2 months

1
0
0 / 0

[JBoss JIRA] (SECURITY-985) [JDK9+] org.jboss.security.negotiation.spnego package is exported by two jars

by Darran Lofthouse (Jira)

[ https://issues.redhat.com/browse/SECURITY-985?page=com.atlassian.jira.plu... ] Darran Lofthouse resolved SECURITY-985. --------------------------------------- Resolution: Won't Do > [JDK9+] org.jboss.security.negotiation.spnego package is exported by two jars > ----------------------------------------------------------------------------- > > Key: SECURITY-985 > URL: https://issues.redhat.com/browse/SECURITY-985 > Project: PicketBox > Issue Type: Bug > Components: Negotiation > Reporter: Tomaž Cerar > Assignee: Darran Lofthouse > Priority: Critical > > Currently if you have > jboss-negotiation-spnego-3.0.4.Final and jboss-negotiation-extras-3.0.4.Final.jar > on your module path, jvm complains as both jars export package org.jboss.security.negotiation.spnego > which violates the modules contract where only one module (jar) can provide single package. > example error that jvm prints > {noformat} > Error: Modules jboss.negotiation.extras and jboss.negotiation.spnego export package org.jboss.security.negotiation.spnego to module wildfly.clustering.common > {noformat} -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years, 2 months

1
0
0 / 0

[JBoss JIRA] (WFLY-13466) (Elytron JASPIC) Unable to log in while using custom principal in SAM

by Darran Lofthouse (Jira)

[ https://issues.redhat.com/browse/WFLY-13466?page=com.atlassian.jira.plugi... ] Darran Lofthouse reassigned WFLY-13466: --------------------------------------- Assignee: (was: Darran Lofthouse) > (Elytron JASPIC) Unable to log in while using custom principal in SAM > --------------------------------------------------------------------- > > Key: WFLY-13466 > URL: https://issues.redhat.com/browse/WFLY-13466 > Project: WildFly > Issue Type: Bug > Components: Security > Reporter: Ondrej Kotek > Priority: Major > > It should be possible to use a custom principal [1] in a custom ServerAuthModule [2]. > The related javaee7-samples test cases [3] fail [4]. > [1] https://github.com/javaee-samples/javaee7-samples/blob/master/jaspic/cust... > [2] https://github.com/javaee-samples/javaee7-samples/blob/master/jaspic/cust... > [3] https://github.com/javaee-samples/javaee7-samples/tree/master/jaspic/cust... -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years, 2 months

1
0
0 / 0

[JBoss JIRA] (WFLY-13466) (Elytron JASPIC) Unable to log in while using custom principal in SAM

by Darran Lofthouse (Jira)

[ https://issues.redhat.com/browse/WFLY-13466?page=com.atlassian.jira.plugi... ] Darran Lofthouse moved WFWIP-123 to WFLY-13466: ----------------------------------------------- Project: WildFly (was: WildFly WIP) Key: WFLY-13466 (was: WFWIP-123) Component/s: Security (was: Security) > (Elytron JASPIC) Unable to log in while using custom principal in SAM > --------------------------------------------------------------------- > > Key: WFLY-13466 > URL: https://issues.redhat.com/browse/WFLY-13466 > Project: WildFly > Issue Type: Bug > Components: Security > Reporter: Ondrej Kotek > Assignee: Darran Lofthouse > Priority: Major > > It should be possible to use a custom principal [1] in a custom ServerAuthModule [2]. > The related javaee7-samples test cases [3] fail [4]. > [1] https://github.com/javaee-samples/javaee7-samples/blob/master/jaspic/cust... > [2] https://github.com/javaee-samples/javaee7-samples/blob/master/jaspic/cust... > [3] https://github.com/javaee-samples/javaee7-samples/tree/master/jaspic/cust... -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years, 2 months

1
0
0 / 0

[JBoss JIRA] (ELYWEB-11) Review per-request object allocation for HTTP authentication

by Darran Lofthouse (Jira)

[ https://issues.redhat.com/browse/ELYWEB-11?page=com.atlassian.jira.plugin... ] Darran Lofthouse reassigned ELYWEB-11: -------------------------------------- Assignee: (was: Darran Lofthouse) > Review per-request object allocation for HTTP authentication > ------------------------------------------------------------ > > Key: ELYWEB-11 > URL: https://issues.redhat.com/browse/ELYWEB-11 > Project: Elytron Web > Issue Type: Task > Components: Undertow, Undertow Servlet > Reporter: Darran Lofthouse > Priority: Major > -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years, 2 months

1
0
0 / 0

[JBoss JIRA] (JBEE-194) PasswordValidationCallback.clearPassword() does not clear the password.

by Darran Lofthouse (Jira)

[ https://issues.redhat.com/browse/JBEE-194?page=com.atlassian.jira.plugin.... ] Darran Lofthouse reassigned JBEE-194: ------------------------------------- Assignee: (was: Darran Lofthouse) > PasswordValidationCallback.clearPassword() does not clear the password. > ----------------------------------------------------------------------- > > Key: JBEE-194 > URL: https://issues.redhat.com/browse/JBEE-194 > Project: JBoss Enterprise Spec APIs > Issue Type: Bug > Components: jboss-jaspi-api > Reporter: Darran Lofthouse > Priority: Major > > The purpose of clear() methods on classes like this is to zero out the array holding the password, the current implementation just sets the reference to null leaving it to the garbage collector to dispose of - this would happen anyway as soon as the PasswordValidationCallback is eligible for garbage collection, -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years, 2 months

1
0
0 / 0

[JBoss JIRA] (SECURITY-986) [JDK9+] org.jboss.security.negotiation package is exported by two jars

by Darran Lofthouse (Jira)

[ https://issues.redhat.com/browse/SECURITY-986?page=com.atlassian.jira.plu... ] Darran Lofthouse resolved SECURITY-986. --------------------------------------- Resolution: Done Marking as won't do as the plan is to remove JBoss Negotiation and rely on WildFly Elytron exclusively. > [JDK9+] org.jboss.security.negotiation package is exported by two jars > ---------------------------------------------------------------------- > > Key: SECURITY-986 > URL: https://issues.redhat.com/browse/SECURITY-986 > Project: PicketBox > Issue Type: Bug > Components: Negotiation > Reporter: Tomaž Cerar > Assignee: Darran Lofthouse > Priority: Major > > Currently if you have > jboss-negotiation-common-3.0.4.Final.jar and jboss-negotiation-extras-3.0.4.Final.jar > on your module path, jvm complains as both jars export package org.jboss.security.negotiation package > which violates the modules contract where only one module (jar) can provide single package. > example error that jvm prints > {noformat} > Error: Modules jboss.negotiation.common and jboss.negotiation.extras export package org.jboss.security.negotiation to module wildfly.clustering.common > {noformat} -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years, 2 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-jira May 2020