Loading...

XML

Word

Printable

CDW devel_ack:
CDW docs_ack:
CDW pm_ack:
CDW qa_ack:
CDW release:
Target Release:

7.1.0.GA
Git Pull Request:
https://github.com/wildfly-security/wildfly-elytron/pull/887
Steps to Reproduce:
Hide

Follow steps in documentation https://doc-stage.usersys.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.1.alpha/html-single/how_to_set_up_sso_with_kerberos/#secure_mgmt_interface_krb_elytron

But misconfigure kerberos, e.g. by principal=HTTP/wronghost@REALM

/subsystem=elytron/kerberos-security-factory=krbSF:add( \ principal="HTTP/wronghost@REALM", \ path="/path/to/http.keytab", \ mechanism-oids=[ \ 1.2.840.113554.1.2.2, \ 1.3.6.1.5.5.2 \ ] \ )
Show
Follow steps in documentation https://doc-stage.usersys.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.1.alpha/html-single/how_to_set_up_sso_with_kerberos/#secure_mgmt_interface_krb_elytron But misconfigure kerberos, e.g. by principal=HTTP/wronghost@REALM /subsystem=elytron/kerberos-security-factory=krbSF:add( \ principal= "HTTP/wronghost@REALM" , \ path= "/path/to/http.keytab" , \ mechanism-oids=[ \ 1.2.840.113554.1.2.2, \ 1.3.6.1.5.5.2 \ ] \ )

Intention on legacy security realm is tracked by ~~JBEAP-8563~~:

If this is the only mechanism enabled then 500 is the correct status code
however if a fallback mechanism was also enabled then that mechanism should be able to challenge with a HTTP 401 status code.

is cloned by

ELY-1256 Make SPNEGO mechanism fail quickly.

is incorporated by

JBEAP-11459 Upgrade WildFly Elytron to 1.1.0.Beta54

is related to

JBEAP-8563 Legacy Kerberos for management interface returns 500 instead of 401

JBEAP-10254 Elytron, SPNEGO in deployment exceptional states handling, 500 should be returned

JBEAP-12057 IBM java, 401 is returned instead of 403, when client send invalid ticket