[JBoss JIRA] (WFLY-11137) Make undertow extension module's dependency on org.jboss.as.security module optional
1:59 a.m.
[
https://issues.jboss.org/browse/WFLY-11137?page=com.atlassian.jira.plugin...
]
Yeray Borges edited comment on WFLY-11137 at 10/18/18 2:58 AM:
---------------------------------------------------------------
[~brian.stansberry] Yes, the mechanism is always added independently wether the security
subsystem is present, indeed the mechanism is added in the handler that adds all container
configuration, it is executed always.
Initially I thought if we had those mechanisms configurable via the undertow servlet
container, then we could have the negotation dependency optional, so if they are not
configured, we would not need the negotiation dependency. However, does make sense add
SPNEGO and DIGEST mechanisms in
[ServletContainerAdd|https://github.com/yersan/wildfly/blob/master/underto...]
if we have the security subsystem disabled? Maybe [~dlofthouse] has an accurate
information about that, I'm going to investigate it further.
If security subsystem is disabled and we are using Elytron for
Authentication/Authorization I understand those mechanisms are added/managed by Elytron
and then could not be necesary there
was (Author: yersan):
[~brian.stansberry] Yes, the mechanism is always added independently wether the security
subsystem is present, indeed the mechanism is added in the handler that adds all container
configuration, it is executed always.
Initially I thought if we had those mechanisms configurable via the undertow servlet
container, then we could have the negotation dependency optional, so if they are not
configured, we would not need the negotiation dependency. However, does make sense add
SPNEGO and DIGEST mechanisms in
[ServletContainerAdd|https://github.com/yersan/wildfly/blob/master/underto...]
if we have the security subsystem disabled? Maybe [~dlofthouse] have an accurate
information about that, I'm going to investigate it further.
If security subsystem is disabled and we are using Elytron for
Authentication/Authorization I understand those mechanisms are added/managed by Elytron
and then could not be necesary there
Make undertow extension module's dependency on
org.jboss.as.security module optional
------------------------------------------------------------------------------------
Key: WFLY-11137
URL: https://issues.jboss.org/browse/WFLY-11137
Project: WildFly
Issue Type: Task
Components: Security, Web (Undertow)
Reporter: Brian Stansberry
Assignee: Yeray Borges
Priority: Major
Fix For: 15.0.0.Alpha1
Don't require the legacy security subsystem module if it's not actually used.
Usage looks like this:
{code}
wildfly bstansberry$ cd undertow/
undertow bstansberry$ git grep org.jboss.as.security
src/main/java/org/wildfly/extension/undertow/deployment/UndertowDeploymentInfoService.java:import
org.jboss.as.security.plugins.SecurityDomainContext;
src/main/java/org/wildfly/extension/undertow/deployment/UndertowDeploymentProcessor.java:import
org.jboss.as.security.deployment.AbstractSecurityDeployer;
src/main/java/org/wildfly/extension/undertow/deployment/UndertowDeploymentProcessor.java:import
org.jboss.as.security.deployment.SecurityAttachments;
src/main/java/org/wildfly/extension/undertow/deployment/UndertowDeploymentProcessor.java:import
org.jboss.as.security.plugins.SecurityDomainContext;
src/main/java/org/wildfly/extension/undertow/deployment/UndertowDeploymentProcessor.java:import
org.jboss.as.security.service.JaccService;
src/main/java/org/wildfly/extension/undertow/deployment/UndertowDeploymentProcessor.java:import
org.jboss.as.security.service.SecurityDomainService;
src/main/java/org/wildfly/extension/undertow/security/DigestCredentialImpl.java:import
org.jboss.as.security.DigestCredential;
src/main/java/org/wildfly/extension/undertow/security/JAASIdentityManagerImpl.java:import
org.jboss.as.security.plugins.SecurityDomainContext;
src/main/java/org/wildfly/extension/undertow/security/SecurityContextThreadSetupAction.java:import
org.jboss.as.security.plugins.SecurityDomainContext;
src/main/java/org/wildfly/extension/undertow/security/jacc/WarJACCDeployer.java:import
org.jboss.as.security.deployment.AbstractSecurityDeployer;
src/main/java/org/wildfly/extension/undertow/security/jacc/WarJACCDeployer.java:import
org.jboss.as.security.service.JaccService;
src/main/java/org/wildfly/extension/undertow/security/jacc/WarJACCService.java:import
org.jboss.as.security.service.JaccService;
{code}
Dropping the use of SecurityAttachments from UndertowDeploymentProcessor and instead
having it check for the presence of the org.wildfly.legacy-security capability will go a
long way here. After that, most if not all of the other uses only get called either as a
result of that check being true, or some config attribute that directly or indirectly
references a security domain. IOW the other uses are only needed if the security subsystem
is known to be configured.
Per Intellij, DigestCredentialImpl is unused.
--
This message was sent by Atlassian Jira
(v7.12.1#712002)
2834
days inactive
2834
days old
0 comments
1 participants
participants (1)
-
Yeray Borges (Jira)