Uploaded image for project: 'WildFly Elytron'
  1. WildFly Elytron
  2. ELY-1822

security domain with multiple realms

XMLWordPrintable

    • Icon: Clarification Clarification
    • Resolution: Unresolved
    • Icon: Optional Optional
    • None
    • 1.8.0.Final
    • Authentication Server
    • None

      we have an ear file with 2 war files and one ejb jar . Purpose of the war files is to allow for different authentication mechanisms, one for jwt (BEARER_TOKEN) the other one jdbc (BASIC) .
      After the authentication we have a call to the ejb layer which we expect to have the principal of the authentication.

      Everything works fine for one realm, the default realm. The other realm will return unauthorized . With no default nothing works. The relevant information from the standalone xml is pasted below and others are attached.

      <subsystem xmlns="urn:jboss:domain:ejb3:5.0">
      <default-security-domain value="other"/>
      <application-security-domains>
      <application-security-domain name="war-domain" security-domain="war-domain"/>
      </application-security-domains>
      <default-missing-method-permissions-deny-access value="false"/>

      <subsystem xmlns="urn:wildfly:elytron:6.0"

      <security-domain name="war-domain" default-realm="jdbc-realm" permission-mapper="default-permission-mapper" outflow-security-domains="ApplicationDomain">
      <realm name="jdbc-realm"/>
      <realm name="jwt-realm"/>
      </security-domain>

      <http-authentication-factory name="war-http-authentication" security-domain="war-domain" http-server-mechanism-factory="global">
      <mechanism-configuration>
      <mechanism mechanism-name="BEARER_TOKEN">
      <mechanism-realm realm-name="jwt-realm"/>
      </mechanism>
      <mechanism mechanism-name="BASIC">
      <mechanism-realm realm-name="jdbc-realm"/>
      </mechanism>
      </mechanism-configuration>
      </http-authentication-factory>

      below the exert from the log on using the jdbc realm when jwt is the default

      2019-05-30 15:28:05,290 TRACE [org.wildfly.security.http.servlet] (default task-1) No AuthConfigProvider for layer=HttpServlet, appContext=default-host /veri95web
      2019-05-30 15:28:05,290 TRACE [org.wildfly.security.http.servlet] (default task-1) JASPIC Unavailable, using HTTP authentication.
      2019-05-30 15:28:05,290 TRACE [org.wildfly.security] (default task-1) No CachedIdentity to restore.
      2019-05-30 15:28:05,290 TRACE [org.wildfly.security] (default task-1) Created HttpServerAuthenticationMechanism [org.wildfly.security.http.util.SecurityIdentityServerMechanismFactory$1@1505d380] for mechanism [BASIC]
      2019-05-30 15:28:05,290 TRACE [org.wildfly.security] (default task-1) Handling MechanismInformationCallback type='HTTP' name='BASIC' host-name='localhost' protocol='http'
      2019-05-30 15:28:05,290 TRACE [org.wildfly.security] (default task-1) Handling AvailableRealmsCallback: realms = [jdbc-realm]
      2019-05-30 15:28:05,290 DEBUG [org.wildfly.security.http.password] (default task-1) Username authentication. Realm: [jdbc-realm], Username: [user1].
      2019-05-30 15:28:05,290 TRACE [org.wildfly.security] (default task-1) Handling RealmCallback: selected = [jdbc-realm]
      2019-05-30 15:28:05,291 TRACE [org.wildfly.security] (default task-1) Handling NameCallback: authenticationName = user1
      2019-05-30 15:28:05,291 TRACE [org.wildfly.security] (default task-1) Principal assigning: [user1], pre-realm rewritten: [user1], realm name: [jwt-realm], post-realm rewritten: [user1], realm rewritten: [user1]
      2019-05-30 15:28:05,291 DEBUG [org.wildfly.security.http.basic] (default task-1) User user1 authentication failed.
      2019-05-30 15:28:05,291 TRACE [org.wildfly.security] (default task-1) Handling AuthenticationCompleteCallback: fail
      2019-05-30 15:28:05,291 DEBUG [io.undertow.request.security] (default task-1) Authentication failed with message ELY06002: An authentication attempt for user 'user1' failed validation using mechanism 'BASIC'. and mechanism BASIC for HttpServerExchange{ POST /veri95web/rest/Xml/process/Equipment request {Accept=[*/*], Postman-Token=[9bba6216-81a7-4048-aa24-ec110d677e4a], Cache-Control=[no-cache], accept-encoding=[gzip, deflate], User-Agent=[PostmanRuntime/7.13.0], Connection=[keep-alive], Authorization=[Basic dXNlcjE6MGZmZDkzNDkyNzgzNzE5YQ==], Content-Type=[applicati

      server.log

        1. standalone.xml
          36 kB
          Christopher Willems
        2. jboss-ejb3.xml
          0.8 kB
          Christopher Willems
        3. jboss-web.xml
          0.4 kB
          Christopher Willems
        4. config-jwt-elytron.cli
          1 kB
          Christopher Willems
        5. config-jwtnw-elytron.cli
          2 kB
          Christopher Willems
        6. config-jwtnw-elytron.cli.txt
          1 kB
          Christopher Willems
        7. D95_J00_VM-DEV95-LS01
          3 kB
          Christopher Willems
        8. D95_J00_VM-DEV95-LS01.1
          3 kB
          Christopher Willems
        9. D95_J00_VM-DEV95-LS01.2
          3 kB
          Christopher Willems
        10. D95_SCS01_VM-DEV95-LS01
          3 kB
          Christopher Willems
        11. DEFAULT.PFL
          0.7 kB
          Christopher Willems
        12. defaultTrace_00.8
          9 kB
          Christopher Willems
        13. HistorianMIIActionBlock - Shortcut.lnk
          1 kB
          Christopher Willems
        14. jboss-ejb-client.properties
          0.5 kB
          Christopher Willems
        15. defaultTracehana.txt
          9 kB
          Christopher Willems
        16. jboss-ejb3.xml
          0.8 kB
          Christopher Willems
        17. jboss-web.xml
          0.4 kB
          Christopher Willems
        18. public.txt
          0.5 kB
          Christopher Willems
        19. MaterialLotServicesMII.java
          84 kB
          Christopher Willems
        20. demofile.txt
          264 kB
          Christopher Willems
        21. editingactivitieswithnestedactivities.txt
          376 kB
          Christopher Willems
        22. server.log
          638 kB
          Christopher Willems
        23. defaultTrace_00.8.trc
          3.80 MB
          Christopher Willems

            Unassigned Unassigned
            i015101 Christopher Willems (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: