[jboss-jira] [JBoss JIRA] (WFCORE-2615) Attribute allow-sasl-mechanisms is ignored in Elytron Authentication Configuration

[David Lloyd (JIRA)]

    [ https://issues.jboss.org/browse/WFCORE-2615?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13387869#comment-13387869 ] 

David Lloyd commented on WFCORE-2615:
-------------------------------------

The current definition of allow-sasl-mechanisms is to include a mechanism even if the configuration would otherwise not suggest that the mechanism is possible.  The current definition of forbid-sasl-mechanisms is to prevent a mechanism from being used, even if the configuration would suggest that it is possible.

There is presently no mechanism "whitelist" function.  If we introduce such a thing, it should be called "limit-sasl-mechanism-set" or something like that.  So I consider this "Not a bug".

> Attribute allow-sasl-mechanisms is ignored in Elytron Authentication Configuration
> ----------------------------------------------------------------------------------
>
>                 Key: WFCORE-2615
>                 URL: https://issues.jboss.org/browse/WFCORE-2615
>             Project: WildFly Core
>          Issue Type: Bug
>          Components: Security
>    Affects Versions: 3.0.0.Beta10
>            Reporter: Ondrej Lukas
>            Assignee: Darran Lofthouse
>            Priority: Blocker
>         Attachments: dep.war, wireshark.pcapng
>
>
> In case when attribute allow-sasl-mechanisms from Elytron Authentication Configuration includes some SASL mechanisms then this attribute (and mechanisms configured there) is not taken into account during choosing SASL mechanism. It means that client tries to use all of mechanisms allowed on server side even if client does not allow them. e.g. in case when server side allowed DIGEST-MD5 and JBOSS-LOCAL-USER and client side allows PLAIN, then it tries to use DIGEST-MD5 and JBOSS-LOCAL-USER mechanisms.
> See log from wireshark in attachments. This is log for server configured through "Steps to Reproduce".
> This happens also for using allow-sasl-mechanisms from wildfly config and also for programatically configured client.
> We request blocker since it allows to use some SASL mechanisms even if they are not allowed on client side.



--
This message was sent by Atlassian JIRA
(v7.2.3#72005)