[jboss-jira] [JBoss JIRA] (WFCORE-3727) NPE in io.undertow.security.impl.BasicAuthenticationMechanism.authenticate when picketbox subsystem removed

[Ilia Vassilev (JIRA)]

     [ https://issues.jboss.org/browse/WFCORE-3727?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Ilia Vassilev updated WFCORE-3727:
----------------------------------
    Component/s: Security


> NPE in io.undertow.security.impl.BasicAuthenticationMechanism.authenticate when picketbox subsystem removed
> -----------------------------------------------------------------------------------------------------------
>
>                 Key: WFCORE-3727
>                 URL: https://issues.jboss.org/browse/WFCORE-3727
>             Project: WildFly Core
>          Issue Type: Bug
>          Components: Security
>            Reporter: Ilia Vassilev
>            Assignee: Stuart Douglas
>
> After enabling elytron, the security subsystem was removed.  The war using jboss-web.xml security-domain looks like it is not used when the picketbox security subsystem is removed.
> {code}
> java.lang.NullPointerException
> 	at io.undertow.security.impl.BasicAuthenticationMechanism.authenticate(BasicAuthenticationMechanism.java:167)
> 	at io.undertow.security.impl.SecurityContextImpl$AuthAttempter.transition(SecurityContextImpl.java:245)
> 	at io.undertow.security.impl.SecurityContextImpl$AuthAttempter.transition(SecurityContextImpl.java:263)
> 	at io.undertow.security.impl.SecurityContextImpl$AuthAttempter.access$100(SecurityContextImpl.java:231)
> 	at io.undertow.security.impl.SecurityContextImpl.attemptAuthentication(SecurityContextImpl.java:125)
> 	at io.undertow.security.impl.SecurityContextImpl.authTransition(SecurityContextImpl.java:99)
> 	at io.undertow.security.impl.SecurityContextImpl.authenticate(SecurityContextImpl.java:92)
> 	at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:55)
> 	at io.undertow.server.handlers.DisableCacheHandler.handleRequest(DisableCacheHandler.java:33)
> 	at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> 	at io.undertow.security.handlers.AuthenticationConstraintHandler.handleRequest(AuthenticationConstraintHandler.java:53)
> 	at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
> 	at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
> 	at io.undertow.servlet.handlers.security.ServletSecurityConstraintHandler.handleRequest(ServletSecurityConstraintHandler.java:59)
> 	at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
> 	at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
> 	at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
> 	at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> 	at org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
> 	at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> 	at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
> 	at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
> 	at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
> 	at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
> 	at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
> 	at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
> 	at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)
> 	at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)
> 	at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)
> 	at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)
> 	at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
> 	at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
> 	at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
> 	at io.undertow.server.Connectors.executeRootHandler(Connectors.java:330)
> 	at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:812)
> 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> 	at java.lang.Thread.run(Thread.java:745)
> {code}
> The war has jboss-web.xml: 
> {code}
> <?xml version="1.0" encoding="UTF-8"?>
> <jboss-web>
>    <security-domain>other</security-domain>
> </jboss-web>
> {code}
> {code}
>         <subsystem xmlns="urn:jboss:domain:undertow:4.0">
> ...
>             <application-security-domains>
>                 <application-security-domain name="other" http-authentication-factory="application-http-authentication"/>
>             </application-security-domains>
>         </subsystem>
>         <subsystem xmlns="urn:wildfly:elytron:1.2" final-providers="combined-providers" disallowed-providers="OracleUcrypto">
> ...
>             <http>
>                 <http-authentication-factory name="application-http-authentication" http-server-mechanism-factory="global" security-domain="ApplicationDomain">
>                     <mechanism-configuration>
>                         <mechanism mechanism-name="BASIC">
>                             <mechanism-realm realm-name="Application Realm"/>
>                         </mechanism>
>                         <mechanism mechanism-name="FORM"/>
>                     </mechanism-configuration>
>                 </http-authentication-factory>
>                 <provider-http-server-mechanism-factory name="global"/>
>             </http>
> ...
> {code}



--
This message was sent by Atlassian JIRA
(v7.5.0#75005)