Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-11147

Elytron AuthenticationConfiguration uses SASL mechanism from incorrect security Provider in some cases

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Blocker
    • 7.1.0.ER1
    • 7.1.0.DR18
    • Security
    • None
    • Hide

      Reproducer test code is available here: https://github.com/kwart/wildfly/blob/JBEAP-11147-reproducer/testsuite/integration/elytron/src/test/java/org/wildfly/test/integration/elytron/sasl/mgmt/ReproducerPlainClientClassTestCase.java

      Full steps to reproduce the issue:

      git clone -b JBEAP-11147-reproducer https://github.com/kwart/wildfly.git
cd wildfly
mvn clean install -DskipTests -Dcheckstyle.skip
cd testsuite/integration/elytron/
mvn clean test -Dcheckstyle.skip -Dtest=ReproducerPlainClientClassTestCase
      Show
      Reproducer test code is available here: https://github.com/kwart/wildfly/blob/JBEAP-11147-reproducer/testsuite/integration/elytron/src/test/java/org/wildfly/test/integration/elytron/sasl/mgmt/ReproducerPlainClientClassTestCase.java Full steps to reproduce the issue: git clone -b JBEAP-11147-reproducer https: //github.com/kwart/wildfly.git cd wildfly mvn clean install -DskipTests -Dcheckstyle.skip cd testsuite/integration/elytron/ mvn clean test -Dcheckstyle.skip -Dtest=ReproducerPlainClientClassTestCase

    Description

      In our tests for PLAIN SASL mechanism in the AS testsuite we realized a wrong SaslClient implementation is used. Instead of the Elytron one, the JDK provided one is used (com.sun.security.sasl.PlainClient).

      The Elytron client builds the AuthenticationContext and runs executed code in this way:

      AuthenticationConfiguration authnCfg = AuthenticationConfiguration.EMPTY.allowSaslMechanisms(MECHANISM_PLAIN)
        .useName(USERNAME).usePassword("wrongPassword")
        .useDefaultProviders();
AuthenticationContext.empty().with(MatchRule.ALL, authnCfg).run(...)

      It seems to be related to what's included on classpath. When we use the same code in elytron-client-demo the correct mechanism is used.

      Update:
      Remove following Assume row from AbstractMgmtSaslTestBase.java (currently in https://github.com/wildfly/wildfly-core/pull/2481) as part of the fix:

      Assume.assumeFalse("ELY-1203 - Skipping PLAIN mechanism.", "PLAIN".equals(mechanismName));

      Attachments

        Issue Links

          is cloned by

          Bug - A problem that impairs or prevents the functions of the product. ELY-1203 Elytron AuthenticationConfiguration uses SASL mechanism from incorrect security Provider in some cases

          • Blocker - To be worked above all other priorities. This term is chosen when the severity of the issue is very high, has no workaround, or the effort for the change is comparatively low. Issues that may be very publicly visible and could generate significant media attention may also drive a higher priority.
          • Resolved
          is incorporated by

          Component Upgrade - A task tracking an update to a bundled component or revision of component upstream of the project. JBEAP-11223 Upgrade WildFly Elytron to 1.1.0.Beta48

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Verified
          is related to

          Bug - A problem that impairs or prevents the functions of the product. JBEAP-11643 Return SASLException for PLAIN mechanism when wrong password is provided

          • Critical - To be worked on immediately following BLOCKER issues.
          • Verified

          Activity

            People

              darran.lofthouse@redhat.com Darran Lofthouse
              josef.cacek@gmail.com Josef Cacek (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: