Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-9332

Elytron SecurityRealm included more times in a SecurityDomain breaks the domain service

XMLWordPrintable

    • Hide 
      # use attached enable-elytron.cli script to switch to Elytron configuration
bin/jboss-cli.sh --file=enable-elytron.xml

# start the server
bin/standalone.sh

# after the full server start, add the "local" realm to ManagementDomain, which already contains it
bin/jboss-cli.sh -c << EOT
/subsystem=elytron/security-domain=ManagementDomain:list-add(name=realms, value={realm => "local"})
reload
EOT

      After the reload the server start fails.

      Show
      # use attached enable-elytron.cli script to switch to Elytron configuration bin/jboss-cli.sh --file=enable-elytron.xml # start the server bin/standalone.sh # after the full server start, add the "local" realm to ManagementDomain, which already contains it bin/jboss-cli.sh -c << EOT /subsystem=elytron/security-domain=ManagementDomain:list-add(name=realms, value={realm => "local" }) reload EOT After the reload the server start fails.

      Elytron subsystem allows to add the same realm more times into a single security domain. Nevertheless in such case domain stops to work with following error message:

      16:14:17,411 ERROR [org.jboss.as.controller.management-operation] (ServerService Thread Pool -- 54) WFLYCTL0013: Operation ("add") failed - address: ([
    ("subsystem" => "elytron"),
    ("security-domain" => "ManagementDomain")
]) - failure description: "WFLYELY00002: Can not inject the same realm 'local' in a single security domain."

      If such the changed domain is ManagementDomain, then the server stops to start at all.

      Suggested fix

      • either allow to have the same realm in a security domain more times
      • or check for duplicate realms already when adding/changing the domain

        1. enable-elytron.cli
          6 kB

            darran.lofthouse@redhat.com Darran Lofthouse
            josef.cacek@gmail.com Josef Cacek (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: