Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-9059

PLAIN mechanism does not work with WildFlyElytronProvider for AuthenticationConfiguration

XMLWordPrintable

    • Hide

      1) Add user - add following line to standalone/configuration/mgmt-users.properties

      user1=pass@123

      2) Configure application server:

      /subsystem=elytron/sasl-authentication-factory=elytronSaslAuthnFactory:add(security-domain=ManagementDomain,sasl-server-factory=elytron,mechanism-configurations=[{mechanism-name=PLAIN}])
/subsystem=elytron/properties-realm=ManagementRealm:write-attribute(name=users-properties.plain-text,value=true)

      3) Change http-interface to following:

      <http-interface http-authentication-factory="management-http-authentication">
    <http-upgrade enabled="true" sasl-authentication-factory="elytronSaslAuthnFactory"/>
    <socket-binding http="management-http"/>
</http-interface>

      4) Run following code:

      AuthenticationConfiguration common = AuthenticationConfiguration.EMPTY
        .useProviders(() -> new Provider[] { new WildFlyElytronProvider() })
        .allowAllSaslMechanisms();

AuthenticationContext context = AuthenticationContext.empty();

AuthenticationConfiguration user = common.useName("user1").usePassword("pass@123");
context = context.with(MatchRule.ALL, user);

context.run(new Runnable() {

    @Override
    public void run() {
        try {
            ModelControllerClient client = ModelControllerClient.Factory
                    .create(new ModelControllerClientConfiguration.Builder()
                            .setHostName("127.0.0.1")
                            .setPort(9990)
                            .setConnectionTimeout(10000)
                            .build());

            ModelNode operation = new ModelNode();
            operation.get("operation").set("whoami");
            operation.get("verbose").set("true");

            System.out.println("Executing Operation\n");
            System.out.println(operation.toString());

            ModelNode result = client.execute(operation);

            System.out.println("\nResult\n");
            System.out.println(result.toString());
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
});

      It fails with exception mentioned in description.

      5) Remove WildFlyElytronProvider from useProviders of AuthenticationConfiguration and run again -> it passes correctly.

      Show
      1) Add user - add following line to standalone/configuration/mgmt-users.properties user1=pass@123 2) Configure application server: /subsystem=elytron/sasl-authentication-factory=elytronSaslAuthnFactory:add(security-domain=ManagementDomain,sasl-server-factory=elytron,mechanism-configurations=[{mechanism-name=PLAIN}]) /subsystem=elytron/properties-realm=ManagementRealm:write-attribute(name=users-properties.plain-text,value= true ) 3) Change http-interface to following: <http- interface http-authentication-factory= "management-http-authentication" > <http-upgrade enabled= " true " sasl-authentication-factory= "elytronSaslAuthnFactory" /> <socket-binding http= "management-http" /> </http- interface > 4) Run following code: AuthenticationConfiguration common = AuthenticationConfiguration.EMPTY .useProviders(() -> new Provider[] { new WildFlyElytronProvider() }) .allowAllSaslMechanisms(); AuthenticationContext context = AuthenticationContext.empty(); AuthenticationConfiguration user = common.useName( "user1" ).usePassword( "pass@123" ); context = context.with(MatchRule.ALL, user); context.run( new Runnable () { @Override public void run() { try { ModelControllerClient client = ModelControllerClient.Factory .create( new ModelControllerClientConfiguration.Builder() .setHostName( "127.0.0.1" ) .setPort(9990) .setConnectionTimeout(10000) .build()); ModelNode operation = new ModelNode(); operation.get( "operation" ).set( "whoami" ); operation.get( "verbose" ).set( " true " ); System .out.println( "Executing Operation\n" ); System .out.println(operation.toString()); ModelNode result = client.execute(operation); System .out.println( "\nResult\n" ); System .out.println(result.toString()); } catch (Exception e) { e.printStackTrace(); } } }); It fails with exception mentioned in description. 5) Remove WildFlyElytronProvider from useProviders of AuthenticationConfiguration and run again -> it passes correctly.

      In case when WildFlyElytronProvider is set as provider for AuthenticationConfiguration then SASL PLAIN mechanism is stopped to work (see exception below). In case when WildFlyElytronProvider is removed then PLAIN mechanism works. It seems that Elytron does not implement SASL PLAIN mechanism correctly.

      Thrown Exception:

      java.io.IOException: java.net.ConnectException: WFLYPRT0053: Could not connect to remote+http://127.0.0.1:9990. The connection failed
	at org.jboss.as.controller.client.impl.AbstractModelControllerClient.executeForResult(AbstractModelControllerClient.java:149)
	at org.jboss.as.controller.client.impl.AbstractModelControllerClient.execute(AbstractModelControllerClient.java:75)
	at org.wildfly.security.elytron.SimpleClient$1.run(SimpleClient.java:67)
	at org.wildfly.common.context.Contextual.run(Contextual.java:71)
	at org.wildfly.security.elytron.SimpleClient.main(SimpleClient.java:48)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:497)
	at org.codehaus.mojo.exec.ExecJavaMojo$1.run(ExecJavaMojo.java:297)
	at java.lang.Thread.run(Thread.java:745)
Caused by: java.net.ConnectException: WFLYPRT0053: Could not connect to remote+http://127.0.0.1:9990. The connection failed
	at org.jboss.as.protocol.ProtocolConnectionUtils.connectSync(ProtocolConnectionUtils.java:119)
	at org.jboss.as.protocol.ProtocolConnectionManager$EstablishingConnection.connect(ProtocolConnectionManager.java:259)
	at org.jboss.as.protocol.ProtocolConnectionManager.connect(ProtocolConnectionManager.java:70)
	at org.jboss.as.protocol.mgmt.ManagementClientChannelStrategy$Establishing.getChannel(ManagementClientChannelStrategy.java:162)
	at org.jboss.as.controller.client.impl.RemotingModelControllerClient.getOrCreateChannel(RemotingModelControllerClient.java:135)
	at org.jboss.as.controller.client.impl.RemotingModelControllerClient$1.getChannel(RemotingModelControllerClient.java:59)
	at org.jboss.as.protocol.mgmt.ManagementChannelHandler.executeRequest(ManagementChannelHandler.java:135)
	at org.jboss.as.protocol.mgmt.ManagementChannelHandler.executeRequest(ManagementChannelHandler.java:110)
	at org.jboss.as.controller.client.impl.AbstractModelControllerClient.executeRequest(AbstractModelControllerClient.java:263)
	at org.jboss.as.controller.client.impl.AbstractModelControllerClient.execute(AbstractModelControllerClient.java:168)
	at org.jboss.as.controller.client.impl.AbstractModelControllerClient.executeForResult(AbstractModelControllerClient.java:147)
	... 10 more
Caused by: java.io.IOException: JBREM000202: Abrupt close on Remoting connection 6900a112 to /127.0.0.1:9990 of endpoint "management-client" <7c9695fa>
	at org.jboss.remoting3.remote.ClientConnectionOpenListener$Authentication.handleEvent(ClientConnectionOpenListener.java:578)
	at org.jboss.remoting3.remote.ClientConnectionOpenListener$Authentication.handleEvent(ClientConnectionOpenListener.java:546)
	at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:92)
	at org.xnio.conduits.ReadReadyHandler$ChannelListenerHandler.readReady(ReadReadyHandler.java:66)
	at org.xnio.nio.NioSocketConduit.handleReady(NioSocketConduit.java:89)
	at org.xnio.nio.WorkerThread.run(WorkerThread.java:567)
	at ...asynchronous invocation...(Unknown Source)
	at org.jboss.remoting3.EndpointImpl.connect(EndpointImpl.java:464)
	at org.jboss.remoting3.EndpointImpl.connect(EndpointImpl.java:426)
	at org.jboss.remoting3.EndpointImpl.connect(EndpointImpl.java:414)
	at org.jboss.as.protocol.ProtocolConnectionUtils.connect(ProtocolConnectionUtils.java:164)
	at org.jboss.as.protocol.ProtocolConnectionUtils.connectSync(ProtocolConnectionUtils.java:111)
	... 20 more

      We request blocker flag because this issue blocks RFE EAP7-530. PLAIN is widely used SASL mechanism.

              jkalina@redhat.com Jan Kalina (Inactive)
              olukas Ondrej Lukas (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: