Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-12034

Elytron - Wrong private credentials used for forwarded identity when SecurityDomain.authenticate() is used

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Blocker Blocker
    • 7.1.0.ER3
    • 7.1.0.ER2
    • Security
    • None

      Wrong Elytron private credentials are used for forwarded identity, when re-authentication is used before forwarding.

      Scenario:

      Client --calls--> EJB (EntryBean) on server 1 --calls--> EJB (WhoAmIBean) on server 2

      Both EJBs are protected. The Client uses valid username/password for the server 1.

      The EntryBean uses Elytron client API to re-authenticate as another user and then calls the WhoAmIBean on server 2.

      As a result the correct (re-authenticated) username is used for the call on server 2, but the private credential (PasswordCredential) from the original Client call is used. This is IMO not only wrong but also a security leak.

      The code of the EntryBean looks like:

      // Callable which calls WhoAmI bean on server 2
final Callable<String> callable = () -> {
    WhoAmI whoAmIBean = doRemoteJndiLookup();
    return whoAmIBean.whoAmI();
};

// Callable which uses forwardedIdentity to authenticate on server 2 - and call the action (WhoAmI)
final Callable<String> forwardIdentityCallable = () -> {
    return AuthenticationContext.empty()
            .with(MatchRule.ALL,
                    AuthenticationConfiguration.empty().useForwardedIdentity(SecurityDomain.getCurrent())
                            .setSaslMechanismSelector(SaslMechanismSelector.ALL))
            .runCallable(callable);
};

// Re-authenticate as another user and use the forwardedIdentity to call WhoAmI bean on server 2
return SecurityDomain.getCurrent().authenticate("anotherUser", new PasswordGuessEvidence("anotherPassword".toCharArray()))
        .runAs(forwardIdentityCallable);

      This issue was discovered in ER2, after the issues hiding this one (JBEAP-11377, JBEAP-11453) were fixed.

              psilva@redhat.com Pedro Igor Craveiro
              josef.cacek@gmail.com Josef Cacek (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: