Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-10226

Elytron, management interface, legacy authentication is "checked" even if Elytron authentication is configured

XMLWordPrintable

      Regression against DR15.
      Authentication by legacy security realm is taken in account even if just Elytron authentication should be used. I don't say legacy authentication is used in priority before Elytron (that works as expected). Just that legacy authentication is somehow "initialized". In this case check "There are no user in mngmt-user.properties file" is performed

      Reproducer:

      • Configure Elytron authentication for management interface
        /subsystem=elytron/filesystem-realm=exampleFsRealm:add(path=fs-realm-users,relative-to=jboss.server.config.dir)
        /subsystem=elytron/filesystem-realm=exampleFsRealm/identity=user1:add()
        /subsystem=elytron/filesystem-realm=exampleFsRealm/identity=user1:set-password( clear={password="password123"})
        /subsystem=elytron/simple-role-decoder=from-roles-attribute:add(attribute=Roles)
        /subsystem=elytron/security-domain=exampleFsSD:add(realms=[{realm=exampleFsRealm,role-decoder=from-roles-attribute}],default-realm=exampleFsRealm,permission-mapper=default-permission-mapper)
        /subsystem=elytron/http-authentication-factory=example-fs-http-auth:add(http-server-mechanism-factory=global,security-domain=exampleFsSD,mechanism-configurations=[{mechanism-name=BASIC,mechanism-realm-configurations=[{realm-name=exampleApplicationDomain}]}])
        /core-service=management/management-interface=http-interface:write-attribute(name=http-authentication-factory, value=example-fs-http-auth)
        
      • impossible to acces management interface
        curl --user user1:password123 http://localhost.localdomain:9990/management?operation=attribute\&name=server-state
        {
            "outcome" : "failed",
            "failure-description" : "WFLYDMHTTP0006: The security realm is not ready to process requests, see http://localhost.localdomain:9990/error",
            "rolled-back" : "true"
        }
        

      Access is granted once

      • security realm is undefined from management interface
        /core-service=management/management-interface=http-interface:undefine-attribute(name=security-realm)
        
      • Or user is added into ManagementRealm
        ./add-user.sh -u admin -p admin -r ManagementRealm
        
      curl --user user1:password123 http://localhost.localdomain:9990/management?operation=attribute\&name=server-state
      "running"
      

            darran.lofthouse@redhat.com Darran Lofthouse
            mchoma@redhat.com Martin Choma
            Ondrej Lukas Ondrej Lukas (Inactive)
            Ondrej Lukas Ondrej Lukas (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: