[infinispan-issues] [JBoss JIRA] (ISPN-4306) HR client auth over kerberos has wrong AccessControlContext

[Galder Zamarreño (JIRA)]

     [ https://issues.jboss.org/browse/ISPN-4306?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Galder Zamarreño updated ISPN-4306:
-----------------------------------

           Status: Resolved  (was: Pull Request Sent)
    Fix Version/s: 7.0.0.Beta1
       Resolution: Done


> HR client auth over kerberos has wrong AccessControlContext
> -----------------------------------------------------------
>
>                 Key: ISPN-4306
>                 URL: https://issues.jboss.org/browse/ISPN-4306
>             Project: Infinispan
>          Issue Type: Bug
>      Security Level: Public(Everyone can see) 
>          Components: Test Suite - Server
>            Reporter: Vojtech Juranek
>            Assignee: Tristan Tarrant
>             Fix For: 7.0.0.Beta1
>
>
> When HotRod client authneticate to HR server via kerberos, HR server obtains wrong {{AccessControlContext}}, which doesn't contain appropriate subject (to be more clear it's in [AuthorizationManagerImpl.checkPermission()|https://github.com/infinispan/infinispan/blob/master/core/src/main/java/org/infinispan/security/impl/AuthorizationManagerImpl.java#L49]). Returned subject is {{null}} and moreover this default {{AccessControlContext}} allows to do anything, so effectively the HR client can do anything, no matter what the permissions are.
> Need to mention that in this case java {{SecurityManager}} is turned off, but as the same setup works with e.g. MD5 auth, we should keep some consistency and it shouldn't work in any case (and {{SecurityManager}} to be turned on should be a hard requirement to ISPN auth works) or it should work also in case of krb auth.



--
This message was sent by Atlassian JIRA
(v6.2.6#6264)