Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-22262

[GSS](7.3.z) WFLY-15038 - Kerberos authenticated database connections (e.g. to SQL Server) not reusable when using legacy security and remote EJBs

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Won't Do
    • Icon: Major Major
    • None
    • 7.3.8.GA
    • Security
    • None
    • False
    • False
    • Undefined
    • Hide

      Use the configuration from elytron as described in the documentation section Database Security, sub-section Secure a Datasource using Kerberos and follow the elytron points (not legacy security).

      In general elytron is the recommended setup as legacy security is deprecated in EAP 7.

      Show
      Use the configuration from elytron as described in the documentation section Database Security , sub-section Secure a Datasource using Kerberos and follow the elytron points (not legacy security). In general elytron is the recommended setup as legacy security is deprecated in EAP 7.
    • Hide

      Simple session bean method that retrieves and (automatically - using try-with-resources) returns a connection:

              public void test() {
                log.info("---> test started.");

                try {
                        log.info("------> DataSource.getConnection() ...");
                        try (Connection connection = datasource.getConnection()) {
                                log.info("------> DataSource.getConnection() returned " + connection);
                        }
                } catch (Throwable t) {
                        log.log(Level.SEVERE, t.getMessage(), t);
                } finally {
                        log.info("---> test completed.");
                }
        }

      See client code in description.

      Show
      Simple session bean method that retrieves and (automatically - using try-with-resources) returns a connection: public void test() { log.info( "---> test started." ); try { log.info( "------> DataSource.getConnection() ..." ); try (Connection connection = datasource.getConnection()) { log.info( "------> DataSource.getConnection() returned " + connection); } } catch (Throwable t) { log.log(Level.SEVERE, t.getMessage(), t); } finally { log.info( "---> test completed." ); } } See client code in description.

      Using legacy (rather than Elytron) security configuration for Kerberos connectivity to SQL Server.

      In a single session of an EJB client, repeatedly invoking a remote EJB remotely that retrieves and uses a Kerberos authenticated database connection during its execution.

              ((ISession) ctx.lookup("java:jboss-eap-test/SessionBean!support.jboss.ejb.session.remote.ISession")).test();
        ((ISession) ctx.lookup("java:jboss-eap-test/SessionBean!support.jboss.ejb.session.remote.ISession")).test();
        ((ISession) ctx.lookup("java:jboss-eap-test/SessionBean!support.jboss.ejb.session.remote.ISession")).test();

      Observed that each remote invocation results in creation of a different/new database connection (e.g. 3 are created during the 3 executions above).

      Using a Byteman rule like the below, verified that the issue relates to creation of a new sub-pool (mcpPools.keySet().size() increases) for each remote invocation.

      RULE org.jboss.jca.core.connectionmanager.pool.AbstractPool.getManagedConnectionPool
CLASS org.jboss.jca.core.connectionmanager.pool.AbstractPool
METHOD getManagedConnectionPool
AT ENTRY
IF true
DO System.out.println("[BMAN DEBG] mcpPools.get(key) [keySet.size=" + $0.mcpPools.keySet().size() + "] => " + $0.mcpPools.get($1));
ENDRULE

      Unable to reproduce the same issue when using Elytron or when using legacy security with EJB client 2.1.8 (so issue seems to have been introduced sometime between 2.1.8 and 4.0.9).

            rhn-support-rmartinc Ricardo Martin Camarero
            rhn-support-rmartinc Ricardo Martin Camarero
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: