Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-10226

Elytron, management interface, legacy authentication is "checked" even if Elytron authentication is configured

    Details

      Description

      Regression against DR15.
      Authentication by legacy security realm is taken in account even if just Elytron authentication should be used. I don't say legacy authentication is used in priority before Elytron (that works as expected). Just that legacy authentication is somehow "initialized". In this case check "There are no user in mngmt-user.properties file" is performed

      Reproducer:

      • Configure Elytron authentication for management interface
        /subsystem=elytron/filesystem-realm=exampleFsRealm:add(path=fs-realm-users,relative-to=jboss.server.config.dir)
        /subsystem=elytron/filesystem-realm=exampleFsRealm/identity=user1:add()
        /subsystem=elytron/filesystem-realm=exampleFsRealm/identity=user1:set-password( clear={password="password123"})
        /subsystem=elytron/simple-role-decoder=from-roles-attribute:add(attribute=Roles)
        /subsystem=elytron/security-domain=exampleFsSD:add(realms=[{realm=exampleFsRealm,role-decoder=from-roles-attribute}],default-realm=exampleFsRealm,permission-mapper=default-permission-mapper)
        /subsystem=elytron/http-authentication-factory=example-fs-http-auth:add(http-server-mechanism-factory=global,security-domain=exampleFsSD,mechanism-configurations=[{mechanism-name=BASIC,mechanism-realm-configurations=[{realm-name=exampleApplicationDomain}]}])
        /core-service=management/management-interface=http-interface:write-attribute(name=http-authentication-factory, value=example-fs-http-auth)
        
      • impossible to acces management interface
        curl --user user1:password123 http://localhost.localdomain:9990/management?operation=attribute\&name=server-state
        {
            "outcome" : "failed",
            "failure-description" : "WFLYDMHTTP0006: The security realm is not ready to process requests, see http://localhost.localdomain:9990/error",
            "rolled-back" : "true"
        }
        

      Access is granted once

      • security realm is undefined from management interface
        /core-service=management/management-interface=http-interface:undefine-attribute(name=security-realm)
        
      • Or user is added into ManagementRealm
        ./add-user.sh -u admin -p admin -r ManagementRealm
        
      curl --user user1:password123 http://localhost.localdomain:9990/management?operation=attribute\&name=server-state
      "running"
      

        Gliffy Diagrams

          Attachments

            Issue Links

              Activity

                People

                • Assignee:
                  dlofthouse Darran Lofthouse
                  Reporter:
                  mchoma Martin Choma
                  Tester:
                  Ondrej Lukas
                • Votes:
                  0 Vote for this issue
                  Watchers:
                  4 Start watching this issue

                  Dates

                  • Created:
                    Updated:
                    Resolved: