Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-8613

EJB authorisation fails when server has an Elytron security domain mapped to EJB3 application security domain with same name as legacy security domain

    XMLWordPrintable

Details

    • Bug
    • Resolution: Can't Do
    • Critical
    • None
    • 7.1.0.DR11
    • EJB, Security
    • Documentation (Ref Guide, User Guide, etc.), Compatibility/Configuration
    • Hide

      1. add EJB3 application security domain mapping:

      /subsystem=ejb3/application-security-domain=other:add(security-domain=ApplicationDomain)

      2. deploy attached deployment
      3. add users:

      EAP7_HOME/bin/add-user.sh -a -u 'quickstartUser' -p 'quickstartPwd1!' -g 'guest'
      EAP7_HOME/bin/add-user.sh -a -u 'user1' -p 'password1!' -g 'app-user'

      4. log in to http://localhost:8080/jboss-ejb-security/ with aforementioned credentials; exception and stack trace is logged

      Show
      1. add EJB3 application security domain mapping: /subsystem=ejb3/application-security-domain=other:add(security-domain=ApplicationDomain) 2. deploy attached deployment 3. add users: EAP7_HOME/bin/add-user.sh -a -u 'quickstartUser' -p 'quickstartPwd1!' -g 'guest' EAP7_HOME/bin/add-user.sh -a -u 'user1' -p 'password1!' -g 'app-user' 4. log in to http://localhost:8080/jboss-ejb-security/ with aforementioned credentials; exception and stack trace is logged

    Description

      Attempting to receive authorisation with EJB with Elytron security domain mapped to EJB3 subsystem application security domain with same name as legacy security domain will not be successful (e.g. there are both of the /subsystem=security/security-domain=other and /subsystem=security/application-security-domain=other present):

      javax.ejb.EJBAccessException: WFLYEJB0364: Invocation on method: public java.lang.String org.jboss.as.quickstarts.ejb_security.SecuredEJB.getSecurityInfo() of bean: SecuredEJB is not allowed
      org.jboss.as.ejb3.security.RolesAllowedInterceptor.processInvocation(RolesAllowedInterceptor.java:67)
      org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:359)
      org.jboss.as.ejb3.security.PolicyContextIdInterceptor.processInvocation(PolicyContextIdInterceptor.java:46)
      org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:359)
      org.jboss.as.ejb3.security.SecurityDomainInterceptor.processInvocation(SecurityDomainInterceptor.java:44)
      org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:359)
      org.jboss.as.ejb3.deployment.processors.StartupAwaitInterceptor.processInvocation(StartupAwaitInterceptor.java:22)
      org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:359)
      org.jboss.as.ejb3.component.interceptors.ShutDownInterceptorFactory$1.processInvocation(ShutDownInterceptorFactory.java:64)
      org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:359)
      org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:67)
      org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:359)
      org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
      org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:359)
      org.jboss.as.ejb3.component.interceptors.AdditionalSetupInterceptor.processInvocation(AdditionalSetupInterceptor.java:54)
      org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:359)
      org.jboss.invocation.ContextClassLoaderInterceptor.processInvocation(ContextClassLoaderInterceptor.java:64)
      org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:359)
      org.jboss.invocation.InterceptorContext.run(InterceptorContext.java:375)
      org.wildfly.security.manager.WildFlySecurityManager.doChecked(WildFlySecurityManager.java:609)
      org.jboss.invocation.AccessCheckingInterceptor.processInvocation(AccessCheckingInterceptor.java:61)
      org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:359)
      org.jboss.invocation.InterceptorContext.run(InterceptorContext.java:375)
      org.jboss.invocation.PrivilegedWithCombinerInterceptor.processInvocation(PrivilegedWithCombinerInterceptor.java:80)
      org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:359)
      org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
      org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:198)
      org.jboss.as.ee.component.ViewDescription$1.processInvocation(ViewDescription.java:185)
      org.jboss.as.ee.component.ProxyInvocationHandler.invoke(ProxyInvocationHandler.java:74)
      org.jboss.as.quickstarts.ejb_security.SecuredEJB$$$view5.getSecurityInfo(Unknown Source)
      org.jboss.as.quickstarts.ejb_security.SecuredEJBServlet.doGet(SecuredEJBServlet.java:63)
      javax.servlet.http.HttpServlet.service(HttpServlet.java:687)
      javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
      io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
      io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
      io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
      org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
      io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
      io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
      io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
      io.undertow.server.handlers.DisableCacheHandler.handleRequest(DisableCacheHandler.java:33)
      io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
      io.undertow.security.handlers.AuthenticationConstraintHandler.handleRequest(AuthenticationConstraintHandler.java:53)
      io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
      io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
      io.undertow.servlet.handlers.security.ServletSecurityConstraintHandler.handleRequest(ServletSecurityConstraintHandler.java:59)
      io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
      io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
      io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
      io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
      io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
      org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
      io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
      org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:46)
      io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
      io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
      io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
      io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
      io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
      io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
      io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
      org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
      org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1696)
      org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1696)
      org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1696)
      org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1696)
      io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
      io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
      io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
      io.undertow.server.Connectors.executeRootHandler(Connectors.java:210)
      io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:809)
      java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
      java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
      java.lang.Thread.run(Thread.java:745)

      Server log attached.

      Attachments

        1. server.log
          21 kB
          Michal Jurc

        Activity

          People

            Unassigned Unassigned
            mjurc@redhat.com Michal Jurc
            Darran Lofthouse
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: