Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-11276

Regression, kerberos + fallback ejb legacy security solution GSSAPI SASL mechanism not called

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Blocker Blocker
    • 7.1.0.CR1
    • 7.1.0.DR19
    • Security
    • None
    • Regression
    • Hide
      • Configure EAP 
            <security-realm name="TestKerberosRealm">
	<server-identities>
	    <kerberos>
	        <keytab principal="remote/localhost.localdomain@JBOSS.ORG" path="/home/mchoma/workspace/git-repositories/tests-ldap-kerberos-eap7/eap7/target/krb/krb.3883043102971544889.keytab" debug="true"/>
	    </kerberos>
	</server-identities>
	<authentication>
	    <kerberos/>
	    <jaas name="JBossTestDomain"/>
	</authentication>
    </security-realm>

	<subsystem xmlns="urn:jboss:domain:remoting:4.0">
	    <endpoint/>
	    <http-connector name="http-remoting-connector" connector-ref="default" security-realm="TestKerberosRealm"/>
	</subsystem>

	<security-domain name="JBossTestDomain">
	    <authentication>
		<login-module code="UsersRoles" flag="required">
		    <module-option name="rolesProperties" value="/home/mchoma/workspace/git-repositories/tests-ldap-kerberos-eap7/eap7/target/roles.properties"/>
		    <module-option name="usersProperties" value="/home/mchoma/workspace/git-repositories/tests-ldap-kerberos-eap7/eap7/target/users.properties"/>
		</login-module>
	    </authentication>
	</security-domain>
      Show
      Configure EAP <security-realm name= "TestKerberosRealm" > <server-identities> <kerberos> <keytab principal= "remote/localhost.localdomain@JBOSS.ORG" path= "/home/mchoma/workspace/git-repositories/tests-ldap-kerberos-eap7/eap7/target/krb/krb.3883043102971544889.keytab" debug= "true" /> </kerberos> </server-identities> <authentication> <kerberos/> <jaas name= "JBossTestDomain" /> </authentication> </security-realm> <subsystem xmlns= "urn:jboss:domain:remoting:4.0" > <endpoint/> <http-connector name= "http-remoting-connector" connector-ref= "default" security-realm= "TestKerberosRealm" /> </subsystem> <security-domain name= "JBossTestDomain" > <authentication> <login-module code= "UsersRoles" flag= "required" > <module-option name= "rolesProperties" value= "/home/mchoma/workspace/git-repositories/tests-ldap-kerberos-eap7/eap7/target/roles.properties" /> <module-option name= "usersProperties" value= "/home/mchoma/workspace/git-repositories/tests-ldap-kerberos-eap7/eap7/target/users.properties" /> </login-module> </authentication> </security-domain>

      Given EJB secured with kerberos + fallback, using legacy security solution [1]
      When I try to authenticate using correct Kerberos ticket and wrong username/password.
      Then PLAIN SASL mechanism fails and GSSAPI is not performed.

      Same scenario works correctly in

      • 7.0
      • 7.1 Elytron way

      I have attached server.log for:

      • no username password provided
      • wrong username password provided

      [1] https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.0/html-single/how_to_set_up_sso_with_kerberos/#configure-krb-remoting

        1. no_username_password.log
          15 kB
          Martin Choma
        2. standalone.xml
          33 kB
          Martin Choma
        3. wrong_username_password.log
          44 kB
          Martin Choma

              darran.lofthouse@redhat.com Darran Lofthouse
              mchoma@redhat.com Martin Choma
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: