Uploaded image for project: 'WildFly Core'
  1. WildFly Core
  2. WFCORE-2434

Elytron, log cause of LoginException during obraining ticket

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Duplicate
    • Icon: Critical Critical
    • 3.0.0.Beta23
    • None
    • Security
    • None
    • Hide

      This can be reprodueced by setting obtain-kerberos-ticket = true with IBM java

      Show
      This can be reprodueced by setting obtain-kerberos-ticket = true with IBM java

      I get to situation where in method GSSCredentialSecurityFactory.createGSSCredential() the cause of LoginException is hide from user.

      In log there is

      server.log
      14:26:07,751 TRACE [org.wildfly.security] (default task-1) java.security.GeneralSecurityException: ELY01121: Unable to perform initial JAAS login.
      

      But with debugger I get to obvious cause javax.security.auth.login.LoginException: Bad JAAS configuration: credsType and keytab values are not compatible, but this is not logged into log.

      Setting to high priority, because logging useful information is esential for troubleshooting fragile Kerberos setup.

      Mesage

      ElytronMessages
          @Message(id = 1121, value = "Unable to perform initial JAAS login.")
          GeneralSecurityException unableToPerformInitialLogin(@Cause LoginException cause);
      

      is created in

      GSSCredentialSecurityFactory.java#L283
      	    } catch (LoginException e) {
                      throw log.unableToPerformInitialLogin(e);
                  }
      

      and logged into log by

      ServerAuthenticationContext.java#L847
                              } catch (GeneralSecurityException e) {
                                  // skip this credential
                                  log.trace(e);
                              }
      

      An more importantly. Question here is if some global issue should follow up? Because problem is in usage of log.trace(e) where although cause exception is avalaible, effectivelly is called log.trace(e.toString()) and cause is hidden; So probably some global check should be performed in elytron codebase if other such occurences aren't also problematic.

            darran.lofthouse@redhat.com Darran Lofthouse
            mchoma@redhat.com Martin Choma
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: