[JBoss JIRA] (TEIID-2260) Teiid 8.X ODBC port does not follow security settings
by Graeme Gillies (JIRA)
Graeme Gillies created TEIID-2260:
-------------------------------------
Summary: Teiid 8.X ODBC port does not follow security settings
Key: TEIID-2260
URL: https://issues.jboss.org/browse/TEIID-2260
Project: Teiid
Issue Type: Bug
Components: ODBC
Affects Versions: 8.2
Environment: Red Hat Enterprise Linux Server release 6.3 (Santiago)
java version "1.7.0_05-icedtea"
OpenJDK Runtime Environment (rhel-2.2.1.el6_3.3-x86_64)
OpenJDK 64-Bit Server VM (build 23.0-b21, mixed mode)
jbossas-standalone-7.1.2-8.Final_redhat_1.ep6.el6.noarch (JBoss EAP 6)
Reporter: Graeme Gillies
Assignee: Steven Hawkins
Hi,
We have the following configuration setup in our teiid 8.2 aplha 2 environment running on eap6
{noformat}
<transport name="jdbc" socket-binding="teiid-jdbc">
<authentication security-domain="REDHAT.COM"/>
<ssl mode="enabled" ssl-protocol="SSLv3" keymanagement-algorithm="SunX509">
<keystore name="/etc/jbossas/standalone/jboss.keystore" password="changeit"/>
</ssl>
</transport>
<transport name="odbc" socket-binding="teiid-odbc" protocol="pg">
<authentication security-domain="REDHAT.COM"/>
<ssl mode="enabled" ssl-protocol="SSLv3" keymanagement-algorithm="SunX509">
<keystore name="/etc/jbossas/standalone/jboss.keystore" password="changeit"/>
</ssl>
</transport>
{noformat}
With out security configuration looking like
{noformat}
<security-domain name="host" cache-type="default">
<authentication>
<login-module code="Kerberos" flag="required">
<module-option name="storeKey" value="true"/>
<module-option name="useKeyTab" value="true"/>
<module-option name="principal" value="HTTP/REMOVED_HOSTNAME(a)REDHAT.COM"/>
<module-option name="keyTab" value="/etc/jbossas/standalone/jboss.keytab"/>
<module-option name="doNotPrompt" value="true"/>
<module-option name="debug" value="true"/>
</login-module>
</authentication>
</security-domain>
<security-domain name="fallback" cache-type="default">
<authentication>
<login-module code="Kerberos" flag="required">
<module-option name="useTicketCache" value="true"/>
<module-option name="useKeyTab" value="false"/>
<module-option name="doNotPrompt" value="true"/>
<module-option name="debug" value="true"/>
</login-module>
</authentication>
</security-domain>
<security-domain name="REDHAT.COM" cache-type="default">
<authentication>
<login-module code="SPNEGO" flag="requisite">
<module-option name="password-stacking" value="useFirstPass"/>
<module-option name="serverSecurityDomain" value="host"/>
<module-option name="removeRealmFromPrincipal" value="true"/>
<module-option name="usernamePasswordDomain" value="fallback"/>
</login-module>
</authentication>
</security-domain>
{noformat}
And the security seems to work as expected for the JDBC connection, but when we try to connect via ODBC to port 35432 it simply allows us to connect regardless of any username/password combination we use. We tried even switching back to just basic username/password login module (against flat files) with same results.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 1 month
[JBoss JIRA] (TEIID-2261) Errors importing VDBs more than 2 layers deep
by Samier Nadji (JIRA)
Samier Nadji created TEIID-2261:
-----------------------------------
Summary: Errors importing VDBs more than 2 layers deep
Key: TEIID-2261
URL: https://issues.jboss.org/browse/TEIID-2261
Project: Teiid
Issue Type: Bug
Components: Common
Affects Versions: 8.1
Reporter: Samier Nadji
Assignee: Steven Hawkins
Get exceptions when trying to import VDBs more than 2 layers deep
I have 3 VDBs: Base, Staging, and Final.
The "Final" VDB imports "Staging" and Staging imports "Base". Each VDB uses views defined in the VDB it imports.
All VDBs get deployed successfully, but when I try to access a view from the Final VDB, I get the following exception:
17:33:08,134 ERROR [org.teiid.PROCESSOR] (Worker11_QueryProcessorQueue229) TEIID30019 Unexpected exception for request U/T6mBDX25Mp.5: org.teiid.core.TeiidComponentException: TEIID30497 org.teiid.translator.TranslatorException: TEIID30497 No connector with jndi-name BaseDataSource found for Model BaseDataSource with source name BaseDataSource
at org.teiid.dqp.internal.process.CachedFinder.findCapabilities(CachedFinder.java:106) [teiid-engine-8.2.0.Beta1-SNAPSHOT.jar:8.2.0.Beta1-SNAPSHOT]
at org.teiid.query.metadata.TempCapabilitiesFinder.findCapabilities(TempCapabilitiesFinder.java:66) [teiid-engine-8.2.0.Beta1-SNAPSHOT.jar:8.2.0.Beta1-SNAPSHOT]
at org.teiid.query.optimizer.relational.rules.CapabilitiesUtil.getCapabilities(CapabilitiesUtil.java:426) [teiid-engine-8.2.0.Beta1-SNAPSHOT.jar:8.2.0.Beta1-SNAPSHOT]
at org.teiid.query.optimizer.relational.rules.CapabilitiesUtil.supports(CapabilitiesUtil.java:446) [teiid-engine-8.2.0.Beta1-SNAPSHOT.jar:8.2.0.Beta1-SNAPSHOT]
at org.teiid.query.optimizer.relational.rules.CapabilitiesUtil.requiresCriteria(CapabilitiesUtil.java:431) [teiid-engine-8.2.0.Beta1-SNAPSHOT.jar:8.2.0.Beta1-SNAPSHOT]
at org.teiid.query.optimizer.relational.rules.RulePlaceAccess.addAccessNode(RulePlaceAccess.java:147) [teiid-engine-8.2.0.Beta1-SNAPSHOT.jar:8.2.0.Beta1-SNAPSHOT]
at org.teiid.query.optimizer.relational.rules.RulePlaceAccess.execute(RulePlaceAccess.java:76) [teiid-engine-8.2.0.Beta1-SNAPSHOT.jar:8.2.0.Beta1-SNAPSHOT]
at org.teiid.query.optimizer.relational.RelationalPlanner.executeRules(RelationalPlanner.java:490) [teiid-engine-8.2.0.Beta1-SNAPSHOT.jar:8.2.0.Beta1-SNAPSHOT]
at org.teiid.query.optimizer.relational.RelationalPlanner.optimize(RelationalPlanner.java:229) [teiid-engine-8.2.0.Beta1-SNAPSHOT.jar:8.2.0.Beta1-SNAPSHOT]
at org.teiid.query.optimizer.QueryOptimizer.optimizePlan(QueryOptimizer.java:156) [teiid-engine-8.2.0.Beta1-SNAPSHOT.jar:8.2.0.Beta1-SNAPSHOT]
at org.teiid.dqp.internal.process.Request.generatePlan(Request.java:446) [teiid-engine-8.2.0.Beta1-SNAPSHOT.jar:8.2.0.Beta1-SNAPSHOT]
at org.teiid.dqp.internal.process.Request.processRequest(Request.java:466) [teiid-engine-8.2.0.Beta1-SNAPSHOT.jar:8.2.0.Beta1-SNAPSHOT]
at org.teiid.dqp.internal.process.RequestWorkItem.processNew(RequestWorkItem.java:542) [teiid-engine-8.2.0.Beta1-SNAPSHOT.jar:8.2.0.Beta1-SNAPSHOT]
at org.teiid.dqp.internal.process.RequestWorkItem.process(RequestWorkItem.java:277) [teiid-engine-8.2.0.Beta1-SNAPSHOT.jar:8.2.0.Beta1-SNAPSHOT]
at org.teiid.dqp.internal.process.AbstractWorkItem.run(AbstractWorkItem.java:49) [teiid-engine-8.2.0.Beta1-SNAPSHOT.jar:8.2.0.Beta1-SNAPSHOT]
at org.teiid.dqp.internal.process.RequestWorkItem.run(RequestWorkItem.java:216) [teiid-engine-8.2.0.Beta1-SNAPSHOT.jar:8.2.0.Beta1-SNAPSHOT]
at org.teiid.dqp.internal.process.DQPWorkContext.runInContext(DQPWorkContext.java:250) [teiid-engine-8.2.0.Beta1-SNAPSHOT.jar:8.2.0.Beta1-SNAPSHOT]
at org.teiid.dqp.internal.process.ThreadReuseExecutor$RunnableWrapper.run(ThreadReuseExecutor.java:123) [teiid-engine-8.2.0.Beta1-SNAPSHOT.jar:8.2.0.Beta1-SNAPSHOT]
at org.teiid.dqp.internal.process.ThreadReuseExecutor$3.run(ThreadReuseExecutor.java:298) [teiid-engine-8.2.0.Beta1-SNAPSHOT.jar:8.2.0.Beta1-SNAPSHOT]
at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886) [rt.jar:1.6.0_23]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908) [rt.jar:1.6.0_23]
at java.lang.Thread.run(Thread.java:662) [rt.jar:1.6.0_23]
Caused by: org.teiid.translator.TranslatorException: TEIID30497 No connector with jndi-name BaseDataSource found for Model BaseDataSource with source name BaseDataSource
at org.teiid.dqp.internal.process.CachedFinder.findCapabilities(CachedFinder.java:94) [teiid-engine-8.2.0.Beta1-SNAPSHOT.jar:8.2.0.Beta1-SNAPSHOT]
... 21 more
Running queries against the specific VDB works fine. It also works when I move the BaseViewModel and source to the "Staging" VDB then access it from "Final".
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 1 month
[JBoss JIRA] Created: (TEIID-1241) Create a WSDL based WS Resource Adapter
by Steven Hawkins (JIRA)
Create a WSDL based WS Resource Adapter
---------------------------------------
Key: TEIID-1241
URL: https://jira.jboss.org/browse/TEIID-1241
Project: Teiid
Issue Type: Feature Request
Components: Misc. Connectors
Affects Versions: 7.2
Reporter: Steven Hawkins
Assignee: Steven Hawkins
Fix For: 7.2
The current WS resource adapter was designed for low-level usage, which doesn't even consult a WSDL. It would be good though to update the existing adapter (or introduce a new) to utilize a WSDL. The WSDL would be used to expose the operations through connector metadata, so that the translator could create the corresponding procedures model.service.port.binding.operation(arg...). Import options could be used to limit the import to only particular services/ports.
The WSDL based approach would also allow for the CXF configuration to apply to more than a single port and to more easily allow the policy definition for WS security.
Additional semantic support for RPC could be considered, but would need to use JAX-RPC
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 1 month
[JBoss JIRA] (TEIID-2247) API changes in point release
by Paul Richardson (JIRA)
Paul Richardson created TEIID-2247:
--------------------------------------
Summary: API changes in point release
Key: TEIID-2247
URL: https://issues.jboss.org/browse/TEIID-2247
Project: Teiid
Issue Type: Bug
Affects Versions: 8.2
Reporter: Paul Richardson
Assignee: Steven Hawkins
Fix For: 8.2
Updated teiid designer 8.0 (unreleased) to 8.2.Alpha2 jars.
API changes have occurred between 8.1 and 8.2. Are the following changes essential and could they be reverted and deprecated until 9.0?
* org.teiid.query.sql.proc.RaiseErrorStatement renamed to org.teiid.query.sql.proc.RaiseStatement
* org.teiid.core.TeiidRuntimeException
** Constructor(String, String) visibility narrowed
** Constructor(Exception, String) removed
* org.teiid.query.sql.proc.CreateProcedureCommand
* Removal of getResultsCommand() method
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 1 month
[JBoss JIRA] (TEIID-2269) Support securing ssl keystore password via VAULT at jdbc/odbc transport
by Jack Ma (JIRA)
Jack Ma created TEIID-2269:
------------------------------
Summary: Support securing ssl keystore password via VAULT at jdbc/odbc transport
Key: TEIID-2269
URL: https://issues.jboss.org/browse/TEIID-2269
Project: Teiid
Issue Type: Feature Request
Components: JDBC Connector, ODBC
Affects Versions: 8.1
Reporter: Jack Ma
Assignee: Steven Hawkins
Failed to set up the ssl at teiid jdbc transport layer by using JBOSS vault to secure ssl keystore password:
Here is the detail I did at my failure tests:
At first, create my vault and ading folowing section into standalone-teiid.xmlt:
<vault>
<vault-option name="KEYSTORE_URL" value="c:\\vault\\vault.keystore"/>
<vault-option name="KEYSTORE_PASSWORD" value="MASK-CGClE.QFRs1"/>
<vault-option name="KEYSTORE_ALIAS" value="vault"/>
<vault-option name="SALT" value="12345678"/>
<vault-option name="ITERATION_COUNT" value="50"/>
<vault-option name="ENC_FILE_DIR" value="c:\\vault\\"/>
</vault>
Here is the SSL definition for teiid JDBC tranport at standalone-teiid.xml
<transport name="jdbc" socket-binding="teiid-jdbc">
<ssl mode="enabled" keymanagement-algorithm="SunX509">
<keystore name="c:\\vault\\test.keystore" password="${VAULT::keystore_pw::PASSWORD::ZWQxMWNiMzktOThmNS00NWIyLWFjZTUtNmExYWFiNzUyOTk5TElORV9CUkVBS3ZhdWx0}"/>
</ssl>
</transport>
Here is the error log:
09:40:55,750 WARNING [org.jboss.netty.channel.socket.nio.NioServerSocketPipelineSink] (New I/O server boss #1 ([id: 0x00175b9a, /0.0.0.0:31050])) Failed to initialize an accepted socket.: java.io.IOException: Keystore was tampered with, or password was incorrect
at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:771) [rt.jar:1.6.0_34]
at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:38) [rt.jar:1.6.0_34]
at java.security.KeyStore.load(KeyStore.java:1185) [rt.jar:1.6.0_34]
at org.teiid.net.socket.SocketUtil.loadKeyStore(SocketUtil.java:221) [teiid-client-8.2.0.Beta1.jar:8.2.0.Beta1]
at org.teiid.net.socket.SocketUtil.getSSLContext(SocketUtil.java:171) [teiid-client-8.2.0.Beta1.jar:8.2.0.Beta1]
at org.teiid.transport.SSLConfiguration.getServerSSLEngine(SSLConfiguration.java:76) [teiid-runtime-8.2.0.Beta1.jar:8.2.0.Beta1]
at org.teiid.transport.SSLAwareChannelHandler.getPipeline(SSLAwareChannelHandler.java:228) [teiid-runtime-8.2.0.Beta1.jar:8.2.0.Beta1]
at org.jboss.netty.channel.socket.nio.NioServerSocketPipelineSink$Boss.registerAcceptedChannel(NioServerSocketPipelineSink.java:276) [netty-3.2.6.Final.jar:]
at org.jboss.netty.channel.socket.nio.NioServerSocketPipelineSink$Boss.run(NioServerSocketPipelineSink.java:246) [netty-3.2.6.Final.jar:]
at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886) [rt.jar:1.6.0_34]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908) [rt.jar:1.6.0_34]
at java.lang.Thread.run(Thread.java:662) [rt.jar:1.6.0_34]
Caused by: java.security.UnrecoverableKeyException: Password verification failed
at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:769) [rt.jar:1.6.0_34]
... 11 more
In side the debug, it looks like teiid did not substitude password from the vault keystore at all. It uses password string "${VAULT::keystore_pw::PASSWORD::ZWQxMWNiMzktOThmNS00NWIyLWFjZTUtNmExYWFiNzUyOTk5TElORV9CUkVBS3ZhdWx0}" to access keystore directly.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 1 month
[JBoss JIRA] (TEIID-2217) Create metadata processor to expose the object metadata for dynamic vdbs
by Van Halbert (JIRA)
Van Halbert created TEIID-2217:
----------------------------------
Summary: Create metadata processor to expose the object metadata for dynamic vdbs
Key: TEIID-2217
URL: https://issues.jboss.org/browse/TEIID-2217
Project: Teiid
Issue Type: Sub-task
Components: Misc. Connectors
Affects Versions: 8.2
Reporter: Van Halbert
Assignee: Steven Hawkins
A metadata processor needs to be created to expose the object metadata based on the class or classes indicated that are accessible by querying the cache. There will be 2 processors created based on: 1) the getters (when annotations is not being used) and 2) based on annotations. The result of the metadata will be a view that uses the OBECTABLE.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 1 month