Uploaded image for project: 'WildFly Core'
  1. WildFly Core
  2. WFCORE-2653

Elytron, *-authentication-factory protocol attribute should be case insensitive

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Blocker Blocker
    • 3.0.0.Beta16
    • None
    • Security
    • None
    • Hide
      • Replace creation of http-authentication-factory with this command specifying protocol HTTP 
        /subsystem=elytron/http-authentication-factory=example-krb-http-auth:add( \
  http-server-mechanism-factory=global, \
  security-domain=exampleFsSD, \
  mechanism-configurations=[ \
    { \
      mechanism-name=SPNEGO,\
      mechanism-realm-configurations= \
        [ \
          { \
            realm-name=exampleFsSD \
          } \
        ], \
      protocol=HTTP,\
      credential-security-factory=krbSF \
    } \
  ] \
)
      Show
      Follow steps for securing management interface with kerberos https://doc-stage.usersys.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.1.alpha/html-single/how_to_set_up_sso_with_kerberos/#secure_mgmt_interface_krb_elytron Replace creation of http-authentication-factory with this command specifying protocol HTTP /subsystem=elytron/http-authentication-factory=example-krb-http-auth:add( \ http-server-mechanism-factory=global, \ security-domain=exampleFsSD, \ mechanism-configurations=[ \ { \ mechanism-name=SPNEGO,\ mechanism-realm-configurations= \ [ \ { \ realm-name=exampleFsSD \ } \ ], \ protocol=HTTP,\ credential-security-factory=krbSF \ } \ ] \ )

      When I use "HTTP" in protocol attribute instead of "http", I get 403 instead of succesfull access.

      According to http://www.rfc-base.org/txt/rfc-1738.txt

      Scheme names consist of a sequence of characters. The lower case
         letters "a"--"z", digits, and the characters plus ("+"), period
         ("."), and hyphen ("-") are allowed. For resiliency, programs
         interpreting URLs should treat upper case letters as equivalent to
         lower case in scheme names (e.g., allow "HTTP" as well as "http").

              jkalina@redhat.com Jan Kalina (Inactive)
              mchoma@redhat.com Martin Choma
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: