[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-3762) Make it possible to select password salt without overriding IdentityStore
by Nikolay Elenkov (JIRA)
Make it possible to select password salt without overriding IdentityStore
-------------------------------------------------------------------------
Key: JBSEAM-3762
URL: https://jira.jboss.org/jira/browse/JBSEAM-3762
Project: Seam
Issue Type: Feature Request
Components: Security
Environment: Seam 2.1
Reporter: Nikolay Elenkov
Currently, JpaIdentityStore uses the username as salt when hashing the user password. If you want to use a different property as salt, you need to override JpaIdentityStore.
Since the salt is usually stored together with the user principal, it would be easier to select the property used as salt by annotating it, without having to override the IdentityStore component.
Using a randomly generated salt is a generally accepted practice, so it should also be possible to generate the salt value automatically when creating the user via IdentityManager's API.
Suggestion:
A new annotation, UserPasswordSalt, to annotate property used as salt. Attributes:
* generate=true|false -- whether to generate random value
* length=salt length in bits (used when generate=true)
Example usage:
class User {
@UserPasswordSalt(generate=true, length=64)
String getSalt() {..}
@UserPassword(hash="sha1"
String getPasswordHash() {...}
}
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
15 years, 9 months
[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-3474) seamspace example throws exception while adding new user
by Marek Novotny (JIRA)
seamspace example throws exception while adding new user
--------------------------------------------------------
Key: JBSEAM-3474
URL: https://jira.jboss.org/jira/browse/JBSEAM-3474
Project: Seam
Issue Type: Bug
Components: Security
Affects Versions: 2.1.0.CR1
Environment: java6, jboss 4.2.3
Reporter: Marek Novotny
1. login as demo user
2. go to Security link in the top right menu
3. Click on Manage users and add new user
4. After filling all required form fields submit form
The following exception happens:
javax.faces.FacesException: javax.el.ELException: /userdetail.xhtml @27,136 readonly="#{identityManager.userExists(userAction.username)}": javax.persistence.PersistenceException: org.hibernate.exception.GenericJDBCException: Cannot open connection
at javax.faces.component.UIComponentBase$AttributesMap.get(UIComponentBase.java:1593)
at com.sun.faces.renderkit.RenderKitUtils.renderXHTMLStyleBooleanAttributes(RenderKitUtils.java:446)
at com.sun.faces.renderkit.html_basic.TextRenderer.getEndTextToRender(TextRenderer.java:128)
at com.sun.faces.renderkit.html_basic.HtmlBasicRenderer.encodeEnd(HtmlBasicRenderer.java:160)
at javax.faces.component.UIComponentBase.encodeEnd(UIComponentBase.java:861)
at javax.faces.component.UIComponent.encodeAll(UIComponent.java:946)
at javax.faces.render.Renderer.encodeChildren(Renderer.java:148)
at javax.faces.component.UIComponentBase.encodeChildren(UIComponentBase.java:837)
at javax.faces.component.UIComponent.encodeAll(UIComponent.java:936)
at javax.faces.component.UIComponent.encodeAll(UIComponent.java:942)
at com.sun.facelets.FaceletViewHandler.renderView(FaceletViewHandler.java:592)
at org.ajax4jsf.application.ViewHandlerWrapper.renderView(ViewHandlerWrapper.java:108)
at org.ajax4jsf.application.AjaxViewHandler.renderView(AjaxViewHandler.java:204)
at com.sun.faces.lifecycle.RenderResponsePhase.execute(RenderResponsePhase.java:109)
at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:100)
at com.sun.faces.lifecycle.LifecycleImpl.render(LifecycleImpl.java:139)
at javax.faces.webapp.FacesServlet.service(FacesServlet.java:266)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:83)
at org.jboss.seam.web.IdentityFilter.doFilter(IdentityFilter.java:38)
at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
at org.jboss.seam.web.MultipartFilter.doFilter(MultipartFilter.java:90)
at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
at org.jboss.seam.web.ExceptionFilter.doFilter(ExceptionFilter.java:64)
at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
at org.jboss.seam.web.RedirectFilter.doFilter(RedirectFilter.java:45)
at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:73)
at org.ajax4jsf.webapp.BaseXMLFilter.doXmlFilter(BaseXMLFilter.java:150)
at org.ajax4jsf.webapp.BaseFilter.handleRequest(BaseFilter.java:267)
at org.ajax4jsf.webapp.BaseFilter.processUploadsAndHandleRequest(BaseFilter.java:379)
at org.ajax4jsf.webapp.BaseFilter.doFilter(BaseFilter.java:506)
at org.jboss.seam.web.Ajax4jsfFilter.doFilter(Ajax4jsfFilter.java:56)
at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
at org.jboss.seam.web.LoggingFilter.doFilter(LoggingFilter.java:58)
at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
at org.jboss.seam.servlet.SeamFilter.doFilter(SeamFilter.java:158)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:230)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175)
at org.jboss.web.tomcat.security.SecurityAssociationValve.invoke(SecurityAssociationValve.java:182)
at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:84)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at org.jboss.web.tomcat.service.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:157)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:262)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:844)
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:446)
at java.lang.Thread.run(Thread.java:619)
Caused by: javax.el.ELException: /userdetail.xhtml @27,136 readonly="#{identityManager.userExists(userAction.username)}": javax.persistence.PersistenceException: org.hibernate.exception.GenericJDBCException: Cannot open connection
at com.sun.facelets.el.TagValueExpression.getValue(TagValueExpression.java:76)
at javax.faces.component.html.HtmlInputText.isReadonly(HtmlInputText.java:689)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at javax.faces.component.UIComponentBase$AttributesMap.get(UIComponentBase.java:1585)
... 55 more
Caused by: javax.persistence.PersistenceException: org.hibernate.exception.GenericJDBCException: Cannot open connection
at org.hibernate.ejb.AbstractEntityManagerImpl.throwPersistenceException(AbstractEntityManagerImpl.java:629)
at org.hibernate.ejb.QueryImpl.getSingleResult(QueryImpl.java:99)
at org.jboss.seam.security.management.JpaIdentityStore.lookupUser(JpaIdentityStore.java:652)
at org.jboss.seam.security.management.JpaIdentityStore.userExists(JpaIdentityStore.java:480)
at org.jboss.seam.security.management.IdentityManager.userExists(IdentityManager.java:170)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.jboss.el.util.ReflectionUtil.invokeMethod(ReflectionUtil.java:329)
at org.jboss.el.util.ReflectionUtil.invokeMethod(ReflectionUtil.java:274)
at org.jboss.el.parser.AstMethodSuffix.getValue(AstMethodSuffix.java:59)
at org.jboss.el.parser.AstValue.getValue(AstValue.java:67)
at org.jboss.el.ValueExpressionImpl.getValue(ValueExpressionImpl.java:186)
at com.sun.facelets.el.TagValueExpression.getValue(TagValueExpression.java:71)
... 61 more
Caused by: org.hibernate.exception.GenericJDBCException: Cannot open connection
at org.hibernate.exception.SQLStateConverter.handledNonSpecificException(SQLStateConverter.java:103)
at org.hibernate.exception.SQLStateConverter.convert(SQLStateConverter.java:91)
at org.hibernate.exception.JDBCExceptionHelper.convert(JDBCExceptionHelper.java:43)
at org.hibernate.exception.JDBCExceptionHelper.convert(JDBCExceptionHelper.java:29)
at org.hibernate.jdbc.ConnectionManager.openConnection(ConnectionManager.java:426)
at org.hibernate.jdbc.ConnectionManager.getConnection(ConnectionManager.java:144)
at org.hibernate.jdbc.AbstractBatcher.prepareQueryStatement(AbstractBatcher.java:139)
at org.hibernate.loader.Loader.prepareQueryStatement(Loader.java:1547)
at org.hibernate.loader.Loader.doQuery(Loader.java:673)
at org.hibernate.loader.Loader.doQueryAndInitializeNonLazyCollections(Loader.java:236)
at org.hibernate.loader.Loader.doList(Loader.java:2220)
at org.hibernate.loader.Loader.listIgnoreQueryCache(Loader.java:2104)
at org.hibernate.loader.Loader.list(Loader.java:2099)
at org.hibernate.loader.hql.QueryLoader.list(QueryLoader.java:378)
at org.hibernate.hql.ast.QueryTranslatorImpl.list(QueryTranslatorImpl.java:338)
at org.hibernate.engine.query.HQLQueryPlan.performList(HQLQueryPlan.java:172)
at org.hibernate.impl.SessionImpl.list(SessionImpl.java:1121)
at org.hibernate.impl.QueryImpl.list(QueryImpl.java:79)
at org.hibernate.ejb.QueryImpl.getSingleResult(QueryImpl.java:80)
... 74 more
Caused by: org.jboss.util.NestedSQLException: Transaction is not active: tx=TransactionImple < ac, BasicAction: 7f000101:8943:48e0f638:60 status: ActionStatus.ABORT_ONLY >; - nested throwable: (javax.resource.ResourceException: Transaction is not active: tx=TransactionImple < ac, BasicAction: 7f000101:8943:48e0f638:60 status: ActionStatus.ABORT_ONLY >)
at org.jboss.resource.adapter.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:95)
at org.hibernate.ejb.connection.InjectedDataSourceConnectionProvider.getConnection(InjectedDataSourceConnectionProvider.java:47)
at org.hibernate.jdbc.ConnectionManager.openConnection(ConnectionManager.java:423)
... 88 more
Caused by: javax.resource.ResourceException: Transaction is not active: tx=TransactionImple < ac, BasicAction: 7f000101:8943:48e0f638:60 status: ActionStatus.ABORT_ONLY >
at org.jboss.resource.connectionmanager.TxConnectionManager.getManagedConnection(TxConnectionManager.java:319)
at org.jboss.resource.connectionmanager.BaseConnectionManager2.allocateConnection(BaseConnectionManager2.java:402)
at org.jboss.resource.connectionmanager.BaseConnectionManager2$ConnectionManagerProxy.allocateConnection(BaseConnectionManager2.java:849)
at org.jboss.resource.adapter.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:89)
... 90 more
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
15 years, 9 months
[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-3748) Adopt SLF4J to avoid expensive logging
by Anthony Whitford (JIRA)
Adopt SLF4J to avoid expensive logging
--------------------------------------
Key: JBSEAM-3748
URL: https://jira.jboss.org/jira/browse/JBSEAM-3748
Project: Seam
Issue Type: Feature Request
Components: Core
Affects Versions: 2.1.1.CR1
Reporter: Anthony Whitford
Please consider adopting SLF4J as the core logging facade over Apache Commons Logging. When used properly, SLF4J provides improved performance and readability:
Using ACL, evaluation of the logging messages still occur unless they are wrapped using code guards. For example, the following statement:
log.debug("found in method context: " + name);
still fragments memory by constructing the debug message even if debug is not enabled. The developer must use a code guard like:
if ( log.isDebugEnabled() ) log.debug("found in method context: " + name);
The guard will help circumvent the evaluation of the debug message, but the developer needs to take the initiative to add the code guard and this adds cyclomatic complexity.
See: http://commons.apache.org/logging/commons-logging-1.1.1/guide.html#JCL%20...
With SLF4J, the above can be simplified to:
log.debug("found in method context: {}", name);
The framework will delay evaluation of the debug message until after it checks if debug is enabled. If it is not, the message is not constructed, saving memory, and with limited hassle on the developer.
Lazy programmers tend to avoid adding the code guards, especially when there is limited logging. SLF4J provides an opportunity to be efficient with less hassle. I would really like to see Seam adopt it as their core logging framework. (With the emphasis on performance, the 2.1 branch seems like a good opportunity.)
Note that Hibernate has already adopted SLF4J.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
15 years, 9 months