Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-12460

Elytron, make scope of SPNEGO authentication mechanism configurable

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Blocker
    • 7.1.0.CR1
    • 7.1.0.ER3
    • Security
    • None
    • Documentation (Ref Guide, User Guide, etc.)
    • Hide 
      git clone git@gitlab.mw.lab.eng.bos.redhat.com:mchoma/tests-ldap-kerberos.git
cd tests-ldap-kerberos
git checkout JBEAP-12460
./build-eap71.sh -Dversion.jboss.bom=7.1.0.GA -Dversion.wildfly.core=3.0.0.Beta30-redhat-1 -Dmaven.repo.local=/home/mchoma/workspace/eap-versions/7.1.0.ER3/jboss-eap-7.1.0.GA-maven-repository/maven-repository -Djboss.dist.zip=/home/mchoma/workspace/git-repositories/wildfly/build/target/wildfly-11.0.0.CR1-SNAPSHOT.zip -Dmaven.test.failure.ignore=true -Dtest=SPNEGO*TestCase,KerberosHttpInterface*TestCase
      Show
      git clone git@gitlab.mw.lab.eng.bos.redhat.com:mchoma/tests-ldap-kerberos.git cd tests-ldap-kerberos git checkout JBEAP-12460 ./build-eap71.sh -Dversion.jboss.bom=7.1.0.GA -Dversion.wildfly.core=3.0.0.Beta30-redhat-1 -Dmaven.repo.local=/home/mchoma/workspace/eap-versions/7.1.0.ER3/jboss-eap-7.1.0.GA-maven-repository/maven-repository -Djboss.dist.zip=/home/mchoma/workspace/git-repositories/wildfly/build/target/wildfly-11.0.0.CR1-SNAPSHOT.zip -Dmaven.test.failure.ignore= true -Dtest=SPNEGO*TestCase,KerberosHttpInterface*TestCase

    Description

      Currently Elytron SPNEGO authnetication is tcp connection scoped, whereas legacy SPNEGO for applications is http-session scoped.

      This different approach can bring these behaviour differences after migration from legacy to Elytron:

      • if deployment is behind reverse proxy it can lead to user "cross talk" (different http session, but same TCP connection) [1]
      • more frequent kerberos negotiation cycles
        • load balancer switches to another node (same http session, but new TCP connection)
        • new tab in browser (same http session, but new TCP connection) [2]

      [1] JBEAP-11882 - (7.1) Using a proxy and spnego on the EAP 7 management console leads to user "cross talk"
      [2] https://superuser.com/questions/1055281/do-web-browsers-use-different-outgoing-ports-for-different-tabs

      Attachments

        Issue Links

          incorporates

          Enhancement - An enhancement to or refactoring of existing functionality that is not configurable by an end user (typically a change made by an internal team that affects users) ELY-1312 Further Scoping and Caching Enhancements to the SpnegoAuthenticationMechanism

          • Blocker - To be worked above all other priorities. This term is chosen when the severity of the issue is very high, has no workaround, or the effort for the change is comparatively low. Issues that may be very publicly visible and could generate significant media attention may also drive a higher priority.
          • Resolved
          is cloned by

          Bug - A problem that impairs or prevents the functions of the product. ELY-1314 Elytron, make scope of SPNEGO authentication configurable

          • Blocker - To be worked above all other priorities. This term is chosen when the severity of the issue is very high, has no workaround, or the effort for the change is comparatively low. Issues that may be very publicly visible and could generate significant media attention may also drive a higher priority.
          • Resolved

          Documentation - JBEAP-12656 Elytron, make scope of SPNEGO authentication mechanism configurable

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Closed
          is incorporated by

          Component Upgrade - A task tracking an update to a bundled component or revision of component upstream of the project. JBEAP-12390 Upgrade WildFly Elytron to 1.1.0.CR5

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Verified
          is related to

          Bug - A problem that impairs or prevents the functions of the product. JBEAP-12432 IllegalStateException: ELY01003: No authentication is in progress

          • Blocker - To be worked above all other priorities. This term is chosen when the severity of the issue is very high, has no workaround, or the effort for the change is comparatively low. Issues that may be very publicly visible and could generate significant media attention may also drive a higher priority.
          • Verified

          Activity

            People

              darran.lofthouse@redhat.com Darran Lofthouse
              mchoma@redhat.com Martin Choma
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: