Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-10871

Empty authorization name for Digest mechanism causes authentication fail

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Blocker
    • 7.1.0.ER1
    • 7.1.0.DR17, 7.1.0.DR19
    • Security
    • None

    Description

      SASL specification says about Authorization Identity String [1]:

      If the authorization identity string is absent, the client is requesting to act as the identity the server associates with the client's credentials. An empty string is equivalent to an absent authorization identity.

      In case when authentication configuration includes empty name for authorization name then authentication fail. In correct behavior authentication name should be used if authorization name is empty string.

      It is caused by passing empty defaultName to NameCallback constructor which results to IllegalArgumentException. Condition in [2] checks only non-null value of authorizationId but it seems it should also check empty name.

      It can be reproduced with correctly set wildfly-config.xml (i.e. configuration where authentication succeed) - in case set-authorization-name element with empty string is added to this configuration file then authentication starts to fail.

      The same issue can occurs for every supported SASL mechanism. In needs to be revisited.

      We request blocker flag since current behavior violates SASL specification.

      [1] https://tools.ietf.org/html/rfc4422#section-3.4.1
      [2] https://github.com/wildfly-security/wildfly-elytron/blob/596f25e853c8fbae088ff562708def3a43480aeb/src/main/java/org/wildfly/security/sasl/digest/DigestSaslClient.java#L223

      Attachments

        Issue Links

          Activity

            People

              jkalina@redhat.com Jan Kalina (Inactive)
              olukas Ondrej Lukas (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: