Details
-
Bug
-
Resolution: Done
-
Blocker
-
7.1.0.DR7
Description
User can't achieve identity propagation scenario with elytron, so far:
- Client authenticate to web application using SPNEGO
- Web application calls another service (database, another web application, ... ) on behalf of user.
- Web applications wants to use provided gss credential, but there is no way to get associated credentials in elytron, so far
Basically use case tested in AS TS with legacy security [1]
Legacy approach using DelegationCredentialContext.getDelegCredential() return null in elytron.
Actually there exists pull request the delegated credential will be associated with the SecurityIdentity [2] . This JIRA is created mainly for tracking purpose to process it properly once pending commit gets to EAP.
[1] https://github.com/wildfly/wildfly/blob/15f9a4f2b5a10cc3acbaa2df57d5cc13db50ff43/testsuite/integration/basic/src/test/java/org/jboss/as/test/integration/security/loginmodules/negotiation/SPNEGOLoginModuleTestCase.java#L280 testIdentityPropagation
[2] https://github.com/wildfly-security/wildfly-elytron/pull/434/commits/9b5aba5ca03824f0b42f786e5663cb7c3a1524f2
Attachments
Issue Links
- is cloned by
-
ELY-712 Elytron GSSCredential propagation
- Resolved