Uploaded image for project: 'WildFly'
  1. WildFly
  2. WFLY-7143

Unsafe Elytron role/permission mapping

    XMLWordPrintable

Details

    Description

      Default Elytron configuration assigns role "All" to every user during authentication. If a deployed application uses such the role name for a resource protection, then every authenticated user can access the protected resource. So the security is bypassed then.

      The problem is caused by workaround used for mapping "LoginPermission" to all users. It maps role "All" to the users first and then maps "LoginPermission" to this role.

      <mappers>
          <simple-permission-mapper name="login-permission-mapper">
              <permission-mapping roles="All">
                  <permission class-name="org.wildfly.security.auth.permission.LoginPermission"/>
              </permission-mapping>
          </simple-permission-mapper>
          <constant-role-mapper name="constant-roles" roles="All"/>
      </mappers>
      

      We have to make the default server configuration secure for users.

      Suggestions for improvement:

      • the LoginPermission mapping should be implicit so everybody has it by default - without specifying it in the server configuration; users should only define cases when they don't want the permission to be assigned to some principals/roles
      • constant permission mapper should exist in Elytron subsystem (similar to constant-role-mapper) so the custom permission can be mapped without workarounds through role-mappings

      Attachments

        Issue Links

          Activity

            People

              jkalina@redhat.com Jan Kalina (Inactive)
              josef.cacek@gmail.com Josef Cacek (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: