Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-9059

PLAIN mechanism does not work with WildFlyElytronProvider for AuthenticationConfiguration

    XMLWordPrintable

Details

    • Hide

      1) Add user - add following line to standalone/configuration/mgmt-users.properties

      user1=pass@123

      2) Configure application server:

      /subsystem=elytron/sasl-authentication-factory=elytronSaslAuthnFactory:add(security-domain=ManagementDomain,sasl-server-factory=elytron,mechanism-configurations=[{mechanism-name=PLAIN}])
/subsystem=elytron/properties-realm=ManagementRealm:write-attribute(name=users-properties.plain-text,value=true)

      3) Change http-interface to following:

      <http-interface http-authentication-factory="management-http-authentication">
    <http-upgrade enabled="true" sasl-authentication-factory="elytronSaslAuthnFactory"/>
    <socket-binding http="management-http"/>
</http-interface>

      4) Run following code:

      AuthenticationConfiguration common = AuthenticationConfiguration.EMPTY
        .useProviders(() -> new Provider[] { new WildFlyElytronProvider() })
        .allowAllSaslMechanisms();

AuthenticationContext context = AuthenticationContext.empty();

AuthenticationConfiguration user = common.useName("user1").usePassword("pass@123");
context = context.with(MatchRule.ALL, user);

context.run(new Runnable() {

    @Override
    public void run() {
        try {
            ModelControllerClient client = ModelControllerClient.Factory
                    .create(new ModelControllerClientConfiguration.Builder()
                            .setHostName("127.0.0.1")
                            .setPort(9990)
                            .setConnectionTimeout(10000)
                            .build());

            ModelNode operation = new ModelNode();
            operation.get("operation").set("whoami");
            operation.get("verbose").set("true");

            System.out.println("Executing Operation\n");
            System.out.println(operation.toString());

            ModelNode result = client.execute(operation);

            System.out.println("\nResult\n");
            System.out.println(result.toString());
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
});

      It fails with exception mentioned in description.

      5) Remove WildFlyElytronProvider from useProviders of AuthenticationConfiguration and run again -> it passes correctly.

      Show
      1) Add user - add following line to standalone/configuration/mgmt-users.properties user1=pass@123 2) Configure application server: /subsystem=elytron/sasl-authentication-factory=elytronSaslAuthnFactory:add(security-domain=ManagementDomain,sasl-server-factory=elytron,mechanism-configurations=[{mechanism-name=PLAIN}]) /subsystem=elytron/properties-realm=ManagementRealm:write-attribute(name=users-properties.plain-text,value= true ) 3) Change http-interface to following: <http- interface http-authentication-factory= "management-http-authentication" > <http-upgrade enabled= " true " sasl-authentication-factory= "elytronSaslAuthnFactory" /> <socket-binding http= "management-http" /> </http- interface > 4) Run following code: AuthenticationConfiguration common = AuthenticationConfiguration.EMPTY .useProviders(() -> new Provider[] { new WildFlyElytronProvider() }) .allowAllSaslMechanisms(); AuthenticationContext context = AuthenticationContext.empty(); AuthenticationConfiguration user = common.useName( "user1" ).usePassword( "pass@123" ); context = context.with(MatchRule.ALL, user); context.run( new Runnable () { @Override public void run() { try { ModelControllerClient client = ModelControllerClient.Factory .create( new ModelControllerClientConfiguration.Builder() .setHostName( "127.0.0.1" ) .setPort(9990) .setConnectionTimeout(10000) .build()); ModelNode operation = new ModelNode(); operation.get( "operation" ).set( "whoami" ); operation.get( "verbose" ).set( " true " ); System .out.println( "Executing Operation\n" ); System .out.println(operation.toString()); ModelNode result = client.execute(operation); System .out.println( "\nResult\n" ); System .out.println(result.toString()); } catch (Exception e) { e.printStackTrace(); } } }); It fails with exception mentioned in description. 5) Remove WildFlyElytronProvider from useProviders of AuthenticationConfiguration and run again -> it passes correctly.

    Description

      In case when WildFlyElytronProvider is set as provider for AuthenticationConfiguration then SASL PLAIN mechanism is stopped to work (see exception below). In case when WildFlyElytronProvider is removed then PLAIN mechanism works. It seems that Elytron does not implement SASL PLAIN mechanism correctly.

      Thrown Exception:

      java.io.IOException: java.net.ConnectException: WFLYPRT0053: Could not connect to remote+http://127.0.0.1:9990. The connection failed
	at org.jboss.as.controller.client.impl.AbstractModelControllerClient.executeForResult(AbstractModelControllerClient.java:149)
	at org.jboss.as.controller.client.impl.AbstractModelControllerClient.execute(AbstractModelControllerClient.java:75)
	at org.wildfly.security.elytron.SimpleClient$1.run(SimpleClient.java:67)
	at org.wildfly.common.context.Contextual.run(Contextual.java:71)
	at org.wildfly.security.elytron.SimpleClient.main(SimpleClient.java:48)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:497)
	at org.codehaus.mojo.exec.ExecJavaMojo$1.run(ExecJavaMojo.java:297)
	at java.lang.Thread.run(Thread.java:745)
Caused by: java.net.ConnectException: WFLYPRT0053: Could not connect to remote+http://127.0.0.1:9990. The connection failed
	at org.jboss.as.protocol.ProtocolConnectionUtils.connectSync(ProtocolConnectionUtils.java:119)
	at org.jboss.as.protocol.ProtocolConnectionManager$EstablishingConnection.connect(ProtocolConnectionManager.java:259)
	at org.jboss.as.protocol.ProtocolConnectionManager.connect(ProtocolConnectionManager.java:70)
	at org.jboss.as.protocol.mgmt.ManagementClientChannelStrategy$Establishing.getChannel(ManagementClientChannelStrategy.java:162)
	at org.jboss.as.controller.client.impl.RemotingModelControllerClient.getOrCreateChannel(RemotingModelControllerClient.java:135)
	at org.jboss.as.controller.client.impl.RemotingModelControllerClient$1.getChannel(RemotingModelControllerClient.java:59)
	at org.jboss.as.protocol.mgmt.ManagementChannelHandler.executeRequest(ManagementChannelHandler.java:135)
	at org.jboss.as.protocol.mgmt.ManagementChannelHandler.executeRequest(ManagementChannelHandler.java:110)
	at org.jboss.as.controller.client.impl.AbstractModelControllerClient.executeRequest(AbstractModelControllerClient.java:263)
	at org.jboss.as.controller.client.impl.AbstractModelControllerClient.execute(AbstractModelControllerClient.java:168)
	at org.jboss.as.controller.client.impl.AbstractModelControllerClient.executeForResult(AbstractModelControllerClient.java:147)
	... 10 more
Caused by: java.io.IOException: JBREM000202: Abrupt close on Remoting connection 6900a112 to /127.0.0.1:9990 of endpoint "management-client" <7c9695fa>
	at org.jboss.remoting3.remote.ClientConnectionOpenListener$Authentication.handleEvent(ClientConnectionOpenListener.java:578)
	at org.jboss.remoting3.remote.ClientConnectionOpenListener$Authentication.handleEvent(ClientConnectionOpenListener.java:546)
	at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:92)
	at org.xnio.conduits.ReadReadyHandler$ChannelListenerHandler.readReady(ReadReadyHandler.java:66)
	at org.xnio.nio.NioSocketConduit.handleReady(NioSocketConduit.java:89)
	at org.xnio.nio.WorkerThread.run(WorkerThread.java:567)
	at ...asynchronous invocation...(Unknown Source)
	at org.jboss.remoting3.EndpointImpl.connect(EndpointImpl.java:464)
	at org.jboss.remoting3.EndpointImpl.connect(EndpointImpl.java:426)
	at org.jboss.remoting3.EndpointImpl.connect(EndpointImpl.java:414)
	at org.jboss.as.protocol.ProtocolConnectionUtils.connect(ProtocolConnectionUtils.java:164)
	at org.jboss.as.protocol.ProtocolConnectionUtils.connectSync(ProtocolConnectionUtils.java:111)
	... 20 more

      We request blocker flag because this issue blocks RFE EAP7-530. PLAIN is widely used SASL mechanism.

      Attachments

        Issue Links

          is blocked by

          Bug - A problem that impairs or prevents the functions of the product. JBEAP-9030 JBoss CLI is not able to connect to interface secured by Elytron SASL factories with PLAIN mechanism

          • Blocker - To be worked above all other priorities. This term is chosen when the severity of the issue is very high, has no workaround, or the effort for the change is comparatively low. Issues that may be very publicly visible and could generate significant media attention may also drive a higher priority.
          • Verified
          is cloned by

          Bug - A problem that impairs or prevents the functions of the product. ELY-977 PLAIN mechanism does not work with WildFlyElytronProvider for AuthenticationConfiguration

          • Blocker - To be worked above all other priorities. This term is chosen when the severity of the issue is very high, has no workaround, or the effort for the change is comparatively low. Issues that may be very publicly visible and could generate significant media attention may also drive a higher priority.
          • Closed

          Activity

            People

              jkalina@redhat.com Jan Kalina (Inactive)
              olukas Ondrej Lukas (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: