Darran Lofthouse created WFCORE-5081:
----------------------------------------
Summary: Misleading warnings when management interfaces not secured.
Key: WFCORE-5081
URL: https://issues.redhat.com/browse/WFCORE-5081
Project: WildFly Core
Issue Type: Bug
Components: Management, Remoting
Reporter: Darran Lofthouse
Where the following configuration exists in a standlone.xml:
{code:xml}
<management-interfaces>
<http-interface>
<http-upgrade enabled="true"/>
<socket-binding http="management-http"/>
</http-interface>
</management-interfaces>
{code}
{code:xml}
<subsystem xmlns="urn:jboss:domain:remoting:4.0">
<endpoint worker="default"/>
<http-connector name="http-remoting-connector" connector-ref="default" sasl-authentication-factory="application-sasl-authentication"/>
</subsystem>
{code}
We can see the following two warnings logged:
{code}
10:31:47,775 WARN [org.jboss.as.server] (Controller Boot Thread) WFLYSRV0035: No security realm or http server authentication defined for http management service; all access will be unrestricted.
{code}
{code}
10:31:47,852 WARN [org.jboss.as.remoting] (MSC service thread 1-7) ****** All authentication is ANONYMOUS for org.jboss.as.remoting.RemotingHttpUpgradeService
{code}
They appear quite a few messages apart in the console, it gives the impression by the time the second is logged start up has moved on from management and is now deploying the subsystems.
For the first message, when using Elytron security there is a http-authentication-factory and a sasl-authentication-factory, there is no mention of the second - both are important.
The second message is very generic as it reports itself in the context of a class which could be reused in a couple of different situations, it was originally added as a final catch all to be 100% sure we logged something but now this should be cleaned up.
The messages should be in the context of both resources i.e. make it very clear which resource is not secured rather than which class. They should also be clearer about which attributes are missing and check the permutations.
--
This message was sent by Atlassian Jira
(v7.13.8#713008)