[jboss-jira] [JBoss JIRA] (WFLY-3761) Security realms does not validate JAAS references to security domains

[Nicky Mølholm (JIRA)]

    [ https://issues.jboss.org/browse/WFLY-3761?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12995379#comment-12995379 ] 

Nicky Mølholm commented on WFLY-3761:
-------------------------------------

Hi [~dlofthouse] - I recently created a security related community discussion regarding JMS's authentication in Wildfly (https://community.jboss.org/thread/248235)

It turned out i needed to send a certain plaintext property from the client before it began to work successfully. Again here the behavior was utterly complete silence.

Also, in my company's real-world codebase we faced the same complete silence because the "Custom Login module in our security domain" had classloading issues when used from the remoting subsystem (through a jaas based security realm).

I mention these "war stories" too - to supply with my personal perspective that: 
* the silent security behavior in Wildly is making it really difficult for us to get "customized security mechanisms" right.

It is by no means a show stopper. But it is really really troublesome from time to time when one doesn't get the entire end-to-end security configuration correct the first time.

> Security realms does not validate JAAS references to security domains
> ---------------------------------------------------------------------
>
>                 Key: WFLY-3761
>                 URL: https://issues.jboss.org/browse/WFLY-3761
>             Project: WildFly
>          Issue Type: Bug
>      Security Level: Public(Everyone can see) 
>          Components: Domain Management, Security
>    Affects Versions: 8.1.0.Final
>         Environment: Development Mac
> Test Linux (Debian)
>            Reporter: Nicky Mølholm
>              Labels: jaas, logging, security, trace
>             Fix For: Awaiting Volunteers
>
>
> *Problem*
> In the server configuration file (standalone.xml) it is possible to define a security realm that points to a security domain that does not exist - and there is no error reporting of this at all. There is no trace information of this at all, either.
> *Example*
> * Download a stock Wildfly 8.1.0.Final
> * Replace standalone.xml with this gist: https://gist.githubusercontent.com/nickymoelholm/4908092afdcd519361df/raw/standalone.xml
> Run it and you will see now errors at all. Despite the fact that the _FlawedRealm_ points to a bogus security domain called _ThisDomainDoesntExistAtAll_ . I have captured my logoutput too. Find it here: https://gist.githubusercontent.com/nickymoelholm/4908092afdcd519361df/raw/server.log
> *What is wrong with this behavior?*
> The bootstrapping process must validate that the configuration is valid indeed. It really doesn't - not semantically that is. Only XSD compliance / XML syntax wise. And if, for some weird reason, that silence is "security" - then at least let us know of the errors on loglevel = TRACE.
> *Why is this issue created?*
> The silent behavior makes security configuration in Wildfly an _extremely expensive operation_ in terms of time spent by the average Java EE developer / administrator. I have created this issue because I want wildfly to help developers/administrators become better at spotting our errors - because, in the end, that is a tangible productivity booster. 



--
This message was sent by Atlassian JIRA
(v6.3.1#6329)