[ https://jira.jboss.org/jira/browse/JBAS-7542?page=com.atlassian.jira.plug... ] Andrew Oliver updated JBAS-7542: -------------------------------- Summary: RemoteHostTrustLoginModule / Valve for allowing third party authentication (was: HostnameTrustLoginModule / Valve for allowing third party authentication ) Description: Presently Tested With 4.3.0. This login module is for the specific case of needing to pass credentials between instances without re-authenticating (diagram: http://dl.dropbox.com/u/1368565/redhat/patches/diagram_trust.png and http://dl.dropbox.com/u/1368565/redhat/patches/diagram_trust.odg). The valve puts the getRemoteHost from a request object in a thread local value. The login module checks this supplied getRemoteHost (generally an IP) against a list of trusted IPs. This should only be used behind a firewall with spoofing disabled where network security has assured the getRemoteHost call returns a valid value. No testcase is included as it requires a specific network setup and multiple instances. If there are no objections I'll commit this to the trunk with my LdapExtLoginModule patches. http://dl.dropbox.com/u/1368565/redhat/patches/HostThreadLocal.java http://dl.dropbox.com/u/1368565/redhat/patches/RemoteHostTrustLoginModule... http://dl.dropbox.com/u/1368565/redhat/patches/RemoteHostValve.java In order to use it (login-config.xml): <application-policy name = "jmx-console"> <authentication> <login-module code="org.jboss.security.auth.spi.RemoteHostTrustLoginModule" flag = "optional"> <module-option name="password-stacking">useFirstPass</module-option> <module-option name="trustedHosts">192.168.49.10</module-option> <module-option name="roles">transportAuthenticated</module-option> </login-module> .. some other login module ... </authentication> </application-policy> context.xml: <Context> <Valve className="org.jboss.web.tomcat.security.RemoteHostValve"/> </Context> was: Presently Tested With 4.3.0. This login module is for the specific case of needing to pass credentials between instances without re-authenticating (diagram: http://dl.dropbox.com/u/1368565/redhat/patches/diagram_trust.png and http://dl.dropbox.com/u/1368565/redhat/patches/diagram_trust.odg). The valve puts the getHostName from a request object in a thread local value. The login module checks this supplied hostname (generally an IP) against a list of trusted IPs. This should only be used behind a firewall with spoofing disabled where network security has assured the getHostName call returns a valid value. No testcase is included as it requires a specific network setup and multiple instances. If there are no objections I'll commit this to the trunk with my LdapExtLoginModule patches. http://dl.dropbox.com/u/1368565/redhat/patches/HostThreadLocal.java http://dl.dropbox.com/u/1368565/redhat/patches/RemoteHostTrustLoginModule... http://dl.dropbox.com/u/1368565/redhat/patches/RemoteHostValve.java In order to use it (login-config.xml): <application-policy name = "jmx-console"> <authentication> <login-module code="org.jboss.security.auth.spi.RemoteHostTrustLoginModule" flag = "optional"> <module-option name="password-stacking">useFirstPass</module-option> <module-option name="trustedHosts">192.168.49.10</module-option> <module-option name="roles">transportAuthenticated</module-option> </login-module> .. some other login module ... </authentication> </application-policy> context.xml: <Context> <Valve className="org.jboss.web.tomcat.security.RemoteHostValve"/> </Context> -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/JBAS-7542?page=com.atlassian.jira.plug... ] Brian Stansberry commented on JBAS-7542: ---------------------------------------- Andy, Sorry, I had to revert r98869 as the required HostThreadLocal class is not available on the classpath and AS trunk won't build. jbosssx is a separate library; to get classes newly added to it available to AS trunk there needs to be a jbosssx release and the AS trunk/component-matrix/pom.xml file needs to be updated to the new release number (see version.org.jboss.security in properties section). -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/JBAS-7542?page=com.atlassian.jira.plug... ] Andrew Oliver resolved JBAS-7542. --------------------------------- Resolution: Done now uses reflection to get around build/module artificial structure -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/JBAS-7542?page=com.atlassian.jira.plug... ] Dimitris Andreadis commented on JBAS-7542: ------------------------------------------ Shouldn't the solution be to update to use the correct library (or wait for that), rather than reverting to reflection? -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/JBAS-7542?page=com.atlassian.jira.plug... ] Andrew Oliver commented on JBAS-7542: ------------------------------------- Thank you Anil. Dimitris, To fix things properly there are some rather clear issues: 1. There is no obvious public contributor documentation since 2006 (read: I have no idea what either you or brian are talking about) 2. There is no public central communication forum to discuss this type of cross appserver issue 3. The modules system you've created is somewhat arbitrary, and security is a crosscutting concern. 4. You do not actually list all of the modules anywhere publicly 5. Most of the jboss.org site is inoperative most of the time. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/JBAS-7542?page=com.atlassian.jira.plug... ] Andrew Oliver commented on JBAS-7542: ------------------------------------- thanks again, Anil. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira