[JBoss JIRA] Created: (JBWS-2565) Problems with security after moving from AS 4.2.x series to AS 5.0.x series
8:01 a.m.
Problems with security after moving from AS 4.2.x series to AS 5.0.x series
---------------------------------------------------------------------------
Key: JBWS-2565
URL: https://jira.jboss.org/jira/browse/JBWS-2565
Project: JBoss Web Services
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: jbossws-native
Affects Versions: jbossws-native-3.0.5, jbossws-native-3.1.0
Reporter: Richard Opalka
Fix For: jbossws-native-3.1.1
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
8:09 a.m.
New subject: [JBoss JIRA] Commented: (JBWS-2565) Problems with security after moving from AS 4.2.x series to AS 5.0.x series
[
https://jira.jboss.org/jira/browse/JBWS-2565?page=com.atlassian.jira.plug...
]
luke biddell commented on JBWS-2565:
------------------------------------
More than willing to help/test/feedback on this one as we need it fixed. Without it, JBoss
5.x is a no-go for our corporation.
Problems with security after moving from AS 4.2.x series to AS 5.0.x
series
---------------------------------------------------------------------------
Key: JBWS-2565
URL: https://jira.jboss.org/jira/browse/JBWS-2565
Project: JBoss Web Services
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: jbossws-native
Affects Versions: jbossws-native-3.0.5, jbossws-native-3.1.0
Reporter: Richard Opalka
Fix For: jbossws-native-3.1.1
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
8:19 a.m.
New subject: [JBoss JIRA] Commented: (JBWS-2565) Problems with security after moving from AS 4.2.x series to AS 5.0.x series
[
https://jira.jboss.org/jira/browse/JBWS-2565?page=com.atlassian.jira.plug...
]
Alessio Soldano commented on JBWS-2565:
---------------------------------------
A minimal testcase reproducing the issue would speed up the process if you have some time
for creating it. Thanks.
Problems with security after moving from AS 4.2.x series to AS 5.0.x
series
---------------------------------------------------------------------------
Key: JBWS-2565
URL: https://jira.jboss.org/jira/browse/JBWS-2565
Project: JBoss Web Services
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: jbossws-native
Affects Versions: jbossws-native-3.0.5, jbossws-native-3.1.0
Reporter: Richard Opalka
Fix For: jbossws-native-3.1.1
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
10:03 a.m.
New subject: [JBoss JIRA] Updated: (JBWS-2565) Problems with security after moving from AS 4.2.x series to AS 5.0.x series
[
https://jira.jboss.org/jira/browse/JBWS-2565?page=com.atlassian.jira.plug...
]
luke biddell updated JBWS-2565:
-------------------------------
Attachment: JBossJIRA.7z
Here's a test project to recreate the issue.
1. Unzip it and edit build.xml to point to your jboss instance.
2. Import the project into eclipse and it should autobuild an exploded ear into your jboss
instance.
3. Run com.JBWS2565.client.MyWebServiceBeanClient
I've also included my jboss-log4j.xml so that you can switch on the correct log levels
to see the trace shown in the forum.
I'm using Java6U11 and had to add the jboss lib/endorsed to the MyWebServiceBeanClient
launcher classpath ahead of the jre.
Problems with security after moving from AS 4.2.x series to AS 5.0.x
series
---------------------------------------------------------------------------
Key: JBWS-2565
URL: https://jira.jboss.org/jira/browse/JBWS-2565
Project: JBoss Web Services
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: jbossws-native
Affects Versions: jbossws-native-3.0.5, jbossws-native-3.1.0
Reporter: Richard Opalka
Fix For: jbossws-native-3.1.1
Attachments: JBossJIRA.7z
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
2:54 a.m.
New subject: [JBoss JIRA] Commented: (JBWS-2565) Problems with security after moving from AS 4.2.x series to AS 5.0.x series
[
https://jira.jboss.org/jira/browse/JBWS-2565?page=com.atlassian.jira.plug...
]
Richard Opalka commented on JBWS-2565:
--------------------------------------
According to javadoc:
/**
* The authMethod is used to configure the authentication mechanism for the web
service.
* As a prerequisite to gaining access to any web service which are protected by an
authorization
* constraint, a user must have authenticated using the configured mechanism.
*
* Legal values for this element are "BASIC", or "CLIENT-CERT".
*/
String authMethod() default "";
user is passing incorrect value to authMethod="NONE".
Problems with security after moving from AS 4.2.x series to AS 5.0.x
series
---------------------------------------------------------------------------
Key: JBWS-2565
URL: https://jira.jboss.org/jira/browse/JBWS-2565
Project: JBoss Web Services
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: jbossws-native
Affects Versions: jbossws-native-3.0.5, jbossws-native-3.1.0
Reporter: Richard Opalka
Assignee: Richard Opalka
Fix For: jbossws-native-3.1.1
Attachments: JBossJIRA.7z
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:21 a.m.
New subject: [JBoss JIRA] Commented: (JBWS-2565) Problems with security after moving from AS 4.2.x series to AS 5.0.x series
[
https://jira.jboss.org/jira/browse/JBWS-2565?page=com.atlassian.jira.plug...
]
Richard Opalka commented on JBWS-2565:
--------------------------------------
User implemented the following service:
package org.jboss.test.ws.jaxws.jbws2565;
import javax.annotation.security.PermitAll;
import javax.ejb.Stateless;
import javax.jws.WebMethod;
import javax.jws.WebService;
import javax.jws.soap.SOAPBinding;
import org.jboss.wsf.spi.annotation.TransportGuarantee;
import org.jboss.wsf.spi.annotation.WebContext;
@Stateless
@PermitAll
@WebService
(
name = "MyWebService",
targetNamespace = "http://my.services.web",
serviceName = "MyWebServiceName"
)
@WebContext
(
contextRoot = "/jaxws-jbws2565-wrong",
transportGuarantee = "NONE",
authMethod = "NONE" // this is wrong value, deployment will be rejected
)
@SOAPBinding
(
use = SOAPBinding.Use.LITERAL,
style = SOAPBinding.Style.DOCUMENT,
parameterStyle = SOAPBinding.ParameterStyle.WRAPPED
)
public final class MyWebServiceBeanWrong
{
@WebMethod
@PermitAll
public final String doStuff()
{
return "i've done stuff";
}
}
Problems with security after moving from AS 4.2.x series to AS 5.0.x
series
---------------------------------------------------------------------------
Key: JBWS-2565
URL: https://jira.jboss.org/jira/browse/JBWS-2565
Project: JBoss Web Services
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: jbossws-native
Affects Versions: jbossws-native-3.0.5, jbossws-native-3.1.0
Reporter: Richard Opalka
Assignee: Richard Opalka
Fix For: jbossws-native-3.1.1
Attachments: JBossJIRA.7z
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:21 a.m.
New subject: [JBoss JIRA] Updated: (JBWS-2565) Problems with security after moving from AS 4.2.x series to AS 5.0.x series
[
https://jira.jboss.org/jira/browse/JBWS-2565?page=com.atlassian.jira.plug...
]
Richard Opalka updated JBWS-2565:
---------------------------------
Comment: was deleted
Problems with security after moving from AS 4.2.x series to AS 5.0.x
series
---------------------------------------------------------------------------
Key: JBWS-2565
URL: https://jira.jboss.org/jira/browse/JBWS-2565
Project: JBoss Web Services
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: jbossws-native
Affects Versions: jbossws-native-3.0.5, jbossws-native-3.1.0
Reporter: Richard Opalka
Assignee: Richard Opalka
Fix For: jbossws-native-3.1.1
Attachments: JBossJIRA.7z
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:23 a.m.
New subject: [JBoss JIRA] Commented: (JBWS-2565) Problems with security after moving from AS 4.2.x series to AS 5.0.x series
[
https://jira.jboss.org/jira/browse/JBWS-2565?page=com.atlassian.jira.plug...
]
Richard Opalka commented on JBWS-2565:
--------------------------------------
User implemented this service:
package org.jboss.test.ws.jaxws.jbws2565;
import javax.annotation.security.PermitAll;
import javax.ejb.Stateless;
import javax.jws.WebMethod;
import javax.jws.WebService;
import javax.jws.soap.SOAPBinding;
import org.jboss.wsf.spi.annotation.WebContext;
@Stateless
@PermitAll
@WebService
(
name = "MyWebService",
targetNamespace = "http://my.services.web",
serviceName = "MyWebServiceName"
)
@WebContext
(
contextRoot = "/jaxws-jbws2565-wrong",
transportGuarantee = "NONE",
authMethod = "NONE" // this is wrong value, deployment will be rejected
)
@SOAPBinding
(
use = SOAPBinding.Use.LITERAL,
style = SOAPBinding.Style.DOCUMENT,
parameterStyle = SOAPBinding.ParameterStyle.WRAPPED
)
public final class MyWebServiceBeanWrong
{
@WebMethod
@PermitAll
public final String doStuff()
{
return "i've done stuff";
}
}
Problems with security after moving from AS 4.2.x series to AS 5.0.x
series
---------------------------------------------------------------------------
Key: JBWS-2565
URL: https://jira.jboss.org/jira/browse/JBWS-2565
Project: JBoss Web Services
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: jbossws-native
Affects Versions: jbossws-native-3.0.5, jbossws-native-3.1.0
Reporter: Richard Opalka
Assignee: Richard Opalka
Fix For: jbossws-native-3.1.1
Attachments: JBossJIRA.7z
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:28 a.m.
New subject: [JBoss JIRA] Commented: (JBWS-2565) Problems with security after moving from AS 4.2.x series to AS 5.0.x series
[
https://jira.jboss.org/jira/browse/JBWS-2565?page=com.atlassian.jira.plug...
]
Richard Opalka commented on JBWS-2565:
--------------------------------------
I provided the following enum classes to don't confuse our users:
org.jboss.wsf.spi.annotation.TransportGuarantee
org.jboss.wsf.spi.annotation.AuthMethod
Since now users will write:
@WebContext
(
contextRoot = "/jaxws-jbws2565",
transportGuarantee = TransportGuarantee.NONE, // using enum value instead of hardcoded
strings
authMethod = AuthMethod.BASIC // using enum value instead of hardcoded strings
)
I also implemented check in ContextRootDeploymentAspect to validate these two security
related annotation fields.
If unknown value is detected deployment will be rejected.
Problems with security after moving from AS 4.2.x series to AS 5.0.x
series
---------------------------------------------------------------------------
Key: JBWS-2565
URL: https://jira.jboss.org/jira/browse/JBWS-2565
Project: JBoss Web Services
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: jbossws-native
Affects Versions: jbossws-native-3.0.5, jbossws-native-3.1.0
Reporter: Richard Opalka
Assignee: Richard Opalka
Fix For: jbossws-native-3.1.1
Attachments: JBossJIRA.7z
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:30 a.m.
New subject: [JBoss JIRA] Updated: (JBWS-2565) Wrong WebContext authMethod or transportGuarantee annotatoin field values are not detected at deploy time
[
https://jira.jboss.org/jira/browse/JBWS-2565?page=com.atlassian.jira.plug...
]
Richard Opalka updated JBWS-2565:
---------------------------------
Summary: Wrong WebContext authMethod or transportGuarantee annotatoin field values are
not detected at deploy time (was: Problems with security after moving from AS 4.2.x
series to AS 5.0.x series)
Wrong WebContext authMethod or transportGuarantee annotatoin field
values are not detected at deploy time
---------------------------------------------------------------------------------------------------------
Key: JBWS-2565
URL: https://jira.jboss.org/jira/browse/JBWS-2565
Project: JBoss Web Services
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: jbossws-native
Affects Versions: jbossws-native-3.0.5, jbossws-native-3.1.0
Reporter: Richard Opalka
Assignee: Richard Opalka
Fix For: jbossws-native-3.1.1
Attachments: JBossJIRA.7z
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
7:26 a.m.
New subject: [JBoss JIRA] Commented: (JBWS-2565) Wrong WebContext authMethod or transportGuarantee annotatoin field values are not detected at deploy time
[
https://jira.jboss.org/jira/browse/JBWS-2565?page=com.atlassian.jira.plug...
]
luke biddell commented on JBWS-2565:
------------------------------------
Thanks for the clarification on this one Richard.
Turns out all I needed to do to get our legacy web services working was to remove the
authMethod attribute rather than set authMethod="NONE".
Is it worth mentioning that in the JavaDoc too? Ie that if the authMethod attribute is not
specified, the web service is most likely public and unsecured.
Wrong WebContext authMethod or transportGuarantee annotatoin field
values are not detected at deploy time
---------------------------------------------------------------------------------------------------------
Key: JBWS-2565
URL: https://jira.jboss.org/jira/browse/JBWS-2565
Project: JBoss Web Services
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: jbossws-native
Affects Versions: jbossws-native-3.0.5, jbossws-native-3.1.0
Reporter: Richard Opalka
Assignee: Richard Opalka
Fix For: jbossws-native-3.1.1
Attachments: JBossJIRA.7z
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
5501
days inactive
5531
days old
jbossws-issues@lists.jboss.org
10 comments
3 participants
participants (3)
-
Alessio Soldano (JIRA) -
luke biddell (JIRA)
-
Richard Opalka (JIRA)