Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-19464

[GSS](7.3.z) Applying <vault-expression-sensitivity requires-write="false"></vault> fails to start EAP server

    XMLWordPrintable

Details

    • Bug
    • Resolution: Won't Do
    • Major
    • None
    • 7.2.2.GA, 7.3.0.GA, 7.2.7.GA
    • Security
    • None
    • Hide

      Simply you can reproduce the issue by using CLI as below.

      [standalone@localhost:9990 /] /core-service=management/access=authorization/constraint=vault-expression:write-attribute(name=configured-requires-write,value=false)
      {
      "outcome" => "failed",
      "failure-description" => "WFLYDM0144: Sensitivity constraint configured-requires-write contains imcompatible attrib
      ute value to other sensitive classification constraints.",
      "rolled-back" => true
      }

      Show
      Simply you can reproduce the issue by using CLI as below. [standalone@localhost:9990 /] /core-service=management/access=authorization/constraint=vault-expression:write-attribute(name=configured-requires-write,value=false) { "outcome" => "failed", "failure-description" => "WFLYDM0144: Sensitivity constraint configured-requires-write contains imcompatible attrib ute value to other sensitive classification constraints.", "rolled-back" => true }

    Description

      Vault Expression Constraints with EAP 7.2.2 instance which requires configured-requires-write set to false by modifying standalone.xml and the server is failing to start with below error :

      Config:
      ---------
      <access-control provider="rbac">
      .....
      <constraints>
      <vault-expression-sensitivity requires-read="true" requires-write="false"/>
      .......
      </constraints>
      </access-control>

      Error:
      -------
      ~~~
      ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("write-attribute") failed - address: ([
      ("core-service" => "management"),
      ("access" => "authorization"),
      ("constraint" => "vault-expression")
      ]) - failure description: "WFLYDM0144: Sensitivity constraint configured-requires-read contains imcompatible attribute value to other sensitive classification constraints."
      20:30:06,101 FATAL [org.jboss.as.server] (Controller Boot Thread) WFLYSRV0056: Server boot has failed in an unrecoverable manner; exiting. See previous messages for details.
      ~~~

      The same error is observed when setting configured-requires-write to false using CLI.

      ~~~
      [standalone@localhost:9990 /] /core-service=management/access=authorization/constraint=vault-expression:write-attribute(name=configured-requires-write,value=false)
      {
      "outcome" => "failed",
      "failure-description" => "WFLYDM0144: Sensitivity constraint configured-requires-write contains imcompatible attrib
      ute value to other sensitive classification constraints.",
      "rolled-back" => true
      }
      ~~~

      Attachments

        Activity

          People

            chaowan@redhat.com Chao Wang
            rhn-support-atiwari Ashishkumar Tiwari
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: