[JBoss JIRA] (WFLY-9892) Upgrade org.apache.santuario.xmlsec to 2.1.1. caused regression in PicketLinkSTS
1:50 p.m.
[
https://issues.jboss.org/browse/WFLY-9892?page=com.atlassian.jira.plugin....
]
Sande Gilda commented on WFLY-9892:
-----------------------------------
[~pcraveiro] or [~olukas]:
I know this JIRA is closed, but I am trying to confirm that the _picketlink-sts_
quickstart does not exhibit any problems as a result of this upgrade. I tested it against
the latest WildFly without any problems. This is what I did:
# I built the current WildFly server from source.
# I configured the server using the quickstart CLI file.
# I built and deployed the quickstart.
# I then successfully ran "mvn exec:java" with the following results:
{code}
sgilda@unknownC85B76AAB5B8 ~/GitRepos/eap-quickstarts/picketlink-sts (7.x) $ mvn
exec:java
[INFO] Scanning for projects...
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] Building JBoss EAP Quickstart: picketlink-sts 7.2.0-SNAPSHOT
[INFO] ------------------------------------------------------------------------
[INFO]
[INFO] --- exec-maven-plugin:1.6.0:java (default-cli) @ picketlink-sts ---
Invoking token service to get SAML assertion for user:UserA with password:PassA
SAML assertion for user:UserA successfully obtained!
<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
ID="ID_c9267231-5143-40e7-b769-37e686137ba3"
IssueInstant="2018-05-29T18:42:35.466Z"
Version="2.0"><saml:Issuer>PicketLinkSTS</saml:Issuer><dsig:Signature
xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Sig...
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#WithComments"...
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><...
URI="#ID_c9267231-5143-40e7-b769-37e686137ba3"><dsig:Transforms><dsig:Transform
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature&quo...
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds...
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><dsig...;
DbtyI9ojnL193oDKZwGlV6pdPtNx+oTQrnXEXzncFqzlaLRdvqaIGokoOU2JD808NSEYuMC9EFpM
xdJ9bm6WLWKNGgIusFU=</dsig:SignatureValue><dsig:KeyInfo><dsig:KeyValue><dsig:RSAKeyValue><dsig:Modulus>suGIyhVTbFvDwZdx8Av62zmP+aGOlsBN8WUE3eEEcDtOIZgO78SImMQGwB2C0eIVMhiLRzVPqoW1
dCPAveTm653zHOmubaps1fY0lLJDSZbTbhjeYhoQmmaBro/tDpVw5lKJns2qVnMuRK19ju2dxpKw
lYGGtrP5VQv00dfNPbs=</dsig:Modulus><dsig:Exponent>AQAB</dsig:Exponent></dsig:RSAKeyValue></dsig:KeyValue></dsig:KeyInfo></dsig:Signature><saml:Subject><saml:NameID
NameQualifier="urn:picketlink:identity-federation">UserA</saml:NameID><saml:SubjectConfirmation
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"/></saml:Subject><saml:Conditions
NotBefore="2018-05-29T18:42:35.466Z"
NotOnOrAfter="2018-05-29T20:42:39.466Z"/><saml:AuthnStatement
AuthnInstant="2018-05-29T18:42:35.466Z"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:cm:bearer</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion>
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 1.607 s
[INFO] Finished at: 2018-05-29T14:42:37-04:00
[INFO] Final Memory: 16M/619M
[INFO] ------------------------------------------------------------------------
{code}
Can you confirm that there is no quickstart issue?
cc: [~emmartins]
Upgrade org.apache.santuario.xmlsec to 2.1.1. caused regression in
PicketLinkSTS
--------------------------------------------------------------------------------
Key: WFLY-9892
URL: https://issues.jboss.org/browse/WFLY-9892
Project: WildFly
Issue Type: Bug
Components: Security
Affects Versions: 12.0.0.Beta1
Reporter: Ondrej Lukas
Assignee: Pedro Igor
Priority: Blocker
Attachments: ejb-security-picketlink.zip, ejb-test.jar, picketlink-sts.war,
sts-config.properties
When token from PicketLink STS is issued and signed then it is not able to be used for
authentication through Remoting in WildFly 12 (i.e. it cannot be set as
{{remote.connection.main.password}} property which can be used in PicketLink
{{org.picketlink.identity.federation.bindings.jboss.auth.SAML2STSLoginModule}}). It seems
it is caused by upgrade of org.apache.santuario.xmlsec to version 2.1.1. [1]. When
WILDFLY11_HOME/modules/system/layers/base/org/apache/santuario/xmlsec/main/xmlsec-2.0.8.jar
is placed to WildFly 12 modules then it works correctly.
We report it as a blocker since it is regression - application which works correctly on
WildFly 11 stops to work on WildFly 12 - users are not able to authenticate through
Remoting with signed tokens from PicketLink STS correctly.
Remoting fails due to following exception:
{code}
java.lang.IllegalArgumentException: ELY05131: Invalid ASCII control "0xA"
at
org.wildfly.security.sasl.util.StringPrep.forbidAsciiControl(StringPrep.java:117)
at org.wildfly.security.sasl.util.StringPrep.encode(StringPrep.java:295)
at org.wildfly.security.sasl.util.StringPrep.encode(StringPrep.java:196)
at
org.wildfly.security.sasl.plain.PlainSaslClient.evaluateChallenge(PlainSaslClient.java:95)
at
org.wildfly.security.sasl.util.AbstractDelegatingSaslClient.evaluateChallenge(AbstractDelegatingSaslClient.java:54)
at
org.wildfly.security.sasl.util.PrivilegedSaslClient.lambda$evaluateChallenge$0(PrivilegedSaslClient.java:55)
at java.security.AccessController.doPrivileged(Native Method)
at
org.wildfly.security.sasl.util.PrivilegedSaslClient.evaluateChallenge(PrivilegedSaslClient.java:55)
at
org.jboss.remoting3.remote.ClientConnectionOpenListener$Capabilities.lambda$handleEvent$1(ClientConnectionOpenListener.java:460)
at
org.jboss.remoting3.EndpointImpl$TrackingExecutor.lambda$execute$0(EndpointImpl.java:926)
at
org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1979)
at
org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1481)
at
org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1374)
at java.lang.Thread.run(Thread.java:748)
{code}
It is caused by different formating value of SignatureValue in assertion. In WildFly 11
SignatureValue looks like:
{code}
<dsig:SignatureValue
xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">nFVkKrXTyYEQ...
{code}
In WildFly 12 it looks like (there are end of lines):
{code}
<dsig:SignatureValue
xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">cUNpFJIZlLYr...;
qlTOT8UrOyxrR4yYAmJ/e5s+f4gys926+tbiraT/3/wG8wM/Lvcjvk5Ap69zODuRYpypsWfA4jrI
7TTBXVPGy8g4KUdnFviUiTuFTc2Ghgxp53AmUuLis/THyP28jE7+28//q8bi/bQrFwHC6tWX67+N
K1duFCOcQ6IPIKeVrePZz55Ivgl+WWdkF6uYCz5IdMzurhzmeQ3K8DAMIxz/MG67VWJIOnuGNWF7
nmdye5zd9AFcRsr1XadvZJCbGNfuc89AL5inCg==</dsig:SignatureValue>
{code}
[1] https://github.com/wildfly/wildfly/commit/536de514829f2187abf1126c8916a04...
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
2974
days inactive
2974
days old
0 comments
1 participants
participants (1)
-
Sande Gilda (JIRA)