-
Bug
-
Resolution: Done
-
Blocker
-
7.1.0.DR18
-
-
-
-
-
-
Not Required
-
When I setup CLIENT_CERT authentication for an application (see Steps to Reproduce) and utilize HTTP/2 protocol, I get always 403 Forbidden even in case I use correct client certificate that should allow me access to a secured content.
I can see following TRACE messages in server.log:
2017-05-23 10:58:31,110 TRACE [org.wildfly.security] (default task-7) X500 principal [CN=client] decoded as name [client] (attribute values: [client]) 2017-05-23 10:58:31,110 TRACE [org.wildfly.security] (default task-7) Principal assigning: [CN=client], pre-realm rewritten: [client], realm name: [ksRealm], post-realm rewritten: [client], realm rewritten: [client] 2017-05-23 10:58:31,110 TRACE [org.wildfly.security] (default task-7) Role mapping: principal [client] -> decoded roles [] -> realm mapped roles [] -> domain mapped roles [gooduser] 2017-05-23 10:58:31,110 TRACE [org.wildfly.security] (default task-7) Authorizing principal client. 2017-05-23 10:58:31,110 TRACE [org.wildfly.security] (default task-7) Authorizing against the following attributes: [] => [] 2017-05-23 10:58:31,111 TRACE [org.wildfly.security] (default task-7) Permission mapping: identity [client] with roles [gooduser] implies ("org.wildfly.security.auth.permission.LoginPermission" "") = true 2017-05-23 10:58:31,111 TRACE [org.wildfly.security] (default task-7) Authorization succeed 2017-05-23 10:58:31,111 TRACE [org.wildfly.security] (default task-7) Authentication succeed for principal [CN=client] 2017-05-23 10:58:31,117 TRACE [org.wildfly.security] (default task-10) Handling MechanismInformationCallback type='HTTP' name='CLIENT_CERT' host-name='localhost' protocol='https' 2017-05-23 10:58:31,117 TRACE [org.wildfly.security] (default task-10) CLIENT-CERT no SSL session
Authentication seems that it succeed just fine. But notice the last line - CLIENT-CERT no SSL session.
When I disable 'http2' in https-listener:
/subsystem=undertow/server=default-server/https-listener=https:write-attribute(name=enable-http2,value=false) reload
I can now access secured content as expected. Also trace log contains different (more healthy) messages now.
This happens both when I utilize HTTP/2 with EAP 'alpn-hack' mechanism and also with ALPN provided by OpenSSL library.
- is cloned by
-
ELY-1191 Undertow CLIENT_CERT via Elytron and HTTP/2 does not work
- Resolved
-
WFCORE-3016 Expose principal-decoder as principal-transformer and support conversion to X500Principal
- Resolved
- is incorporated by
-
JBEAP-11223 Upgrade WildFly Elytron to 1.1.0.Beta48
- Closed
-
JBEAP-11466 (7.1.0) Upgrade to WildFly Core to 3.0.0.Beta28
- Closed
- relates to
-
JBEAP-12292 x500-principal-transformer 'convert' attribute has no effect
- Closed