Uploaded image for project: 'WildFly Elytron'
  1. WildFly Elytron
  2. ELY-1822

security domain with multiple realms

XMLWordPrintable

    • Icon: Clarification Clarification
    • Resolution: Unresolved
    • Icon: Optional Optional
    • None
    • 1.8.0.Final
    • Authentication Server
    • None

      we have an ear file with 2 war files and one ejb jar . Purpose of the war files is to allow for different authentication mechanisms, one for jwt (BEARER_TOKEN) the other one jdbc (BASIC) .
      After the authentication we have a call to the ejb layer which we expect to have the principal of the authentication.

      Everything works fine for one realm, the default realm. The other realm will return unauthorized . With no default nothing works. The relevant information from the standalone xml is pasted below and others are attached.

      <subsystem xmlns="urn:jboss:domain:ejb3:5.0">
      <default-security-domain value="other"/>
      <application-security-domains>
      <application-security-domain name="war-domain" security-domain="war-domain"/>
      </application-security-domains>
      <default-missing-method-permissions-deny-access value="false"/>

      <subsystem xmlns="urn:wildfly:elytron:6.0"

      <security-domain name="war-domain" default-realm="jdbc-realm" permission-mapper="default-permission-mapper" outflow-security-domains="ApplicationDomain">
      <realm name="jdbc-realm"/>
      <realm name="jwt-realm"/>
      </security-domain>

      <http-authentication-factory name="war-http-authentication" security-domain="war-domain" http-server-mechanism-factory="global">
      <mechanism-configuration>
      <mechanism mechanism-name="BEARER_TOKEN">
      <mechanism-realm realm-name="jwt-realm"/>
      </mechanism>
      <mechanism mechanism-name="BASIC">
      <mechanism-realm realm-name="jdbc-realm"/>
      </mechanism>
      </mechanism-configuration>
      </http-authentication-factory>

      below the exert from the log on using the jdbc realm when jwt is the default

      2019-05-30 15:28:05,290 TRACE [org.wildfly.security.http.servlet] (default task-1) No AuthConfigProvider for layer=HttpServlet, appContext=default-host /veri95web
      2019-05-30 15:28:05,290 TRACE [org.wildfly.security.http.servlet] (default task-1) JASPIC Unavailable, using HTTP authentication.
      2019-05-30 15:28:05,290 TRACE [org.wildfly.security] (default task-1) No CachedIdentity to restore.
      2019-05-30 15:28:05,290 TRACE [org.wildfly.security] (default task-1) Created HttpServerAuthenticationMechanism [org.wildfly.security.http.util.SecurityIdentityServerMechanismFactory$1@1505d380] for mechanism [BASIC]
      2019-05-30 15:28:05,290 TRACE [org.wildfly.security] (default task-1) Handling MechanismInformationCallback type='HTTP' name='BASIC' host-name='localhost' protocol='http'
      2019-05-30 15:28:05,290 TRACE [org.wildfly.security] (default task-1) Handling AvailableRealmsCallback: realms = [jdbc-realm]
      2019-05-30 15:28:05,290 DEBUG [org.wildfly.security.http.password] (default task-1) Username authentication. Realm: [jdbc-realm], Username: [user1].
      2019-05-30 15:28:05,290 TRACE [org.wildfly.security] (default task-1) Handling RealmCallback: selected = [jdbc-realm]
      2019-05-30 15:28:05,291 TRACE [org.wildfly.security] (default task-1) Handling NameCallback: authenticationName = user1
      2019-05-30 15:28:05,291 TRACE [org.wildfly.security] (default task-1) Principal assigning: [user1], pre-realm rewritten: [user1], realm name: [jwt-realm], post-realm rewritten: [user1], realm rewritten: [user1]
      2019-05-30 15:28:05,291 DEBUG [org.wildfly.security.http.basic] (default task-1) User user1 authentication failed.
      2019-05-30 15:28:05,291 TRACE [org.wildfly.security] (default task-1) Handling AuthenticationCompleteCallback: fail
      2019-05-30 15:28:05,291 DEBUG [io.undertow.request.security] (default task-1) Authentication failed with message ELY06002: An authentication attempt for user 'user1' failed validation using mechanism 'BASIC'. and mechanism BASIC for HttpServerExchange{ POST /veri95web/rest/Xml/process/Equipment request {Accept=[*/*], Postman-Token=[9bba6216-81a7-4048-aa24-ec110d677e4a], Cache-Control=[no-cache], accept-encoding=[gzip, deflate], User-Agent=[PostmanRuntime/7.13.0], Connection=[keep-alive], Authorization=[Basic dXNlcjE6MGZmZDkzNDkyNzgzNzE5YQ==], Content-Type=[applicati

      server.log

        1. config-jwt-elytron.cli
          1 kB
        2. config-jwtnw-elytron.cli
          2 kB
        3. config-jwtnw-elytron.cli.txt
          1 kB
        4. D95_J00_VM-DEV95-LS01
          3 kB
        5. D95_J00_VM-DEV95-LS01.1
          3 kB
        6. D95_J00_VM-DEV95-LS01.2
          3 kB
        7. D95_SCS01_VM-DEV95-LS01
          3 kB
        8. DEFAULT.PFL
          0.7 kB
        9. defaultTrace_00.8
          9 kB
        10. defaultTrace_00.8.trc
          3.80 MB
        11. defaultTracehana.txt
          9 kB
        12. demofile.txt
          264 kB
        13. editingactivitieswithnestedactivities.txt
          376 kB
        14. HistorianMIIActionBlock.zip
          39 kB
        15. HistorianMIIActionBlock - Shortcut.lnk
          1 kB
        16. inxites.be~inx~veri95.ejb.jar
          4.62 MB
        17. jboss-ejb3.xml
          0.8 kB
        18. jboss-ejb3.xml
          0.8 kB
        19. jboss-ejb-client.properties
          0.5 kB
        20. jboss-web.xml
          0.4 kB
        21. jboss-web.xml
          0.4 kB
        22. MaterialLotServicesMII.java
          84 kB
        23. MovilitasFileHandling.zip
          23 kB
        24. public.txt
          0.5 kB
        25. server.log
          638 kB
        26. standalone.xml
          36 kB

            Unassigned Unassigned
            i015101 Christopher Willems (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: