Uploaded image for project: 'WildFly Core'
  1. WildFly Core
  2. WFCORE-2646

Elytron, management interface, legacy authentication is "checked" even if Elytron authentication is configured

    XMLWordPrintable

Details

    Description

      Regression against DR15.
      Authentication by legacy security realm is taken in account even if just Elytron authentication should be used. I don't say legacy authentication is used in priority before Elytron (that works as expected). Just that legacy authentication is somehow "initialized". In this case check "There are no user in mngmt-user.properties file" is performed

      Reproducer:

      • Configure Elytron authentication for management interface
        /subsystem=elytron/filesystem-realm=exampleFsRealm:add(path=fs-realm-users,relative-to=jboss.server.config.dir)
        /subsystem=elytron/filesystem-realm=exampleFsRealm/identity=user1:add()
        /subsystem=elytron/filesystem-realm=exampleFsRealm/identity=user1:set-password( clear={password="password123"})
        /subsystem=elytron/simple-role-decoder=from-roles-attribute:add(attribute=Roles)
        /subsystem=elytron/security-domain=exampleFsSD:add(realms=[{realm=exampleFsRealm,role-decoder=from-roles-attribute}],default-realm=exampleFsRealm,permission-mapper=default-permission-mapper)
        /subsystem=elytron/http-authentication-factory=example-fs-http-auth:add(http-server-mechanism-factory=global,security-domain=exampleFsSD,mechanism-configurations=[{mechanism-name=BASIC,mechanism-realm-configurations=[{realm-name=exampleApplicationDomain}]}])
        /core-service=management/management-interface=http-interface:write-attribute(name=http-authentication-factory, value=example-fs-http-auth)
        
      • impossible to acces management interface
        curl --user user1:password123 http://localhost.localdomain:9990/management?operation=attribute\&name=server-state
        {
            "outcome" : "failed",
            "failure-description" : "WFLYDMHTTP0006: The security realm is not ready to process requests, see http://localhost.localdomain:9990/error",
            "rolled-back" : "true"
        }
        

      Access is granted once

      • security realm is undefined from management interface
        /core-service=management/management-interface=http-interface:undefine-attribute(name=security-realm)
        
      • Or user is added into ManagementRealm
        ./add-user.sh -u admin -p admin -r ManagementRealm
        
      curl --user user1:password123 http://localhost.localdomain:9990/management?operation=attribute\&name=server-state
      "running"
      

      Attachments

        Issue Links

          Activity

            People

              darran.lofthouse@redhat.com Darran Lofthouse
              mchoma@redhat.com Martin Choma
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: