]
Stefan Guilhen resolved SECURITY-930.
-------------------------------------
Fix Version/s: PicketBox_5_0_0.Beta1
Resolution: Done
The PicketBox side has been fixed. WildFly has been updated to use the latest PicketBox
release that includes the fix and we need to change the WildFly side to use the new API
that allows for the specification of multiple modules.
I've cloned this into WFLY-7412 to track the WildFly side of the issue.
A security-domain can only load login-modules from a single JBoss
module
--------------------------------------------------------------------------
Key: SECURITY-930
URL:
https://issues.jboss.org/browse/SECURITY-930
Project: PicketBox
Issue Type: Bug
Components: JBossSX, Security-SPI
Reporter: Derek Horton
Assignee: Stefan Guilhen
Fix For: PicketBox_5_0_0.Beta1
A security-domain can only load login-modules from a single JBoss module. Even though
the security-domain configuration will allow each login module defined within a single
security-domain to have a "module" attribute, the only module that is used to
load the login-modules is the last "module" attribute that the parsing system
locates.
For example, with the following configuration, it looks like
"org.jboss.example.CustomLoginModule" should be loaded from the
"org.jboss.example" jboss-module and
"org.jboss.example.CustomBaseCertLoginModule" should be loaded from the
"org.jboss.another.example" jboss-module:
<security-domain name="jmx-console" cache-type="default">
<authentication>
<login-module code="org.jboss.example.CustomLoginModule"
module="org.jboss.example" flag="required">
<module-option name="usersProperties"
value="${jboss.server.config.dir}/users.properties"/>
<module-option name="rolesProperties"
value="${jboss.server.config.dir}/roles.properties"/>
</login-module>
<login-module code="org.jboss.example.CustomBaseCertLoginModule"
module="org.jboss.another.example" flag="required">
<module-option name="usersProperties"
value="${jboss.server.config.dir}/users.properties"/>
<module-option name="rolesProperties"
value="${jboss.server.config.dir}/roles.properties"/>
</login-module>
</authentication>
</security-domain>
Unfortunately, it does not work like this. Only the
"org.jboss.another.example" jboss-module is used to load the custom login
modules.
There seems to be two issues. 1) The security subsystem code only "remembers"
the last module that is defined within a single security domain. 2) I think issue #1 is
happening because the JBoss authentication code
(org.jboss.security.authentication.JBossCachedAuthenticationManager.authenticate()) defers
to the JVM's login module handling code. The JVM appears to treat the login modules
as one atomic until and so a single classloader is set and then the JVM login module code
is invoked to handle the authentication requests.