Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-11276

Regression, kerberos + fallback ejb legacy security solution GSSAPI SASL mechanism not called

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Blocker
    • 7.1.0.CR1
    • 7.1.0.DR19
    • Security
    • None
    • Regression
    • Hide
      • Configure EAP 
            <security-realm name="TestKerberosRealm">
	<server-identities>
	    <kerberos>
	        <keytab principal="remote/localhost.localdomain@JBOSS.ORG" path="/home/mchoma/workspace/git-repositories/tests-ldap-kerberos-eap7/eap7/target/krb/krb.3883043102971544889.keytab" debug="true"/>
	    </kerberos>
	</server-identities>
	<authentication>
	    <kerberos/>
	    <jaas name="JBossTestDomain"/>
	</authentication>
    </security-realm>

	<subsystem xmlns="urn:jboss:domain:remoting:4.0">
	    <endpoint/>
	    <http-connector name="http-remoting-connector" connector-ref="default" security-realm="TestKerberosRealm"/>
	</subsystem>

	<security-domain name="JBossTestDomain">
	    <authentication>
		<login-module code="UsersRoles" flag="required">
		    <module-option name="rolesProperties" value="/home/mchoma/workspace/git-repositories/tests-ldap-kerberos-eap7/eap7/target/roles.properties"/>
		    <module-option name="usersProperties" value="/home/mchoma/workspace/git-repositories/tests-ldap-kerberos-eap7/eap7/target/users.properties"/>
		</login-module>
	    </authentication>
	</security-domain>
      Show
      Configure EAP <security-realm name= "TestKerberosRealm" > <server-identities> <kerberos> <keytab principal= "remote/localhost.localdomain@JBOSS.ORG" path= "/home/mchoma/workspace/git-repositories/tests-ldap-kerberos-eap7/eap7/target/krb/krb.3883043102971544889.keytab" debug= "true" /> </kerberos> </server-identities> <authentication> <kerberos/> <jaas name= "JBossTestDomain" /> </authentication> </security-realm> <subsystem xmlns= "urn:jboss:domain:remoting:4.0" > <endpoint/> <http-connector name= "http-remoting-connector" connector-ref= "default" security-realm= "TestKerberosRealm" /> </subsystem> <security-domain name= "JBossTestDomain" > <authentication> <login-module code= "UsersRoles" flag= "required" > <module-option name= "rolesProperties" value= "/home/mchoma/workspace/git-repositories/tests-ldap-kerberos-eap7/eap7/target/roles.properties" /> <module-option name= "usersProperties" value= "/home/mchoma/workspace/git-repositories/tests-ldap-kerberos-eap7/eap7/target/users.properties" /> </login-module> </authentication> </security-domain>

    Description

      Given EJB secured with kerberos + fallback, using legacy security solution [1]
      When I try to authenticate using correct Kerberos ticket and wrong username/password.
      Then PLAIN SASL mechanism fails and GSSAPI is not performed.

      Same scenario works correctly in

      • 7.0
      • 7.1 Elytron way

      I have attached server.log for:

      • no username password provided
      • wrong username password provided

      [1] https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.0/html-single/how_to_set_up_sso_with_kerberos/#configure-krb-remoting

      Attachments

        Issue Links

          is cloned by

          Bug - A problem that impairs or prevents the functions of the product. WFLY-8872 Regression, kerberos + fallback ejb legacy security solution GSSAPI SASL mechanism not called

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Closed
          is related to

          Bug - A problem that impairs or prevents the functions of the product. JBEAP-11293 Tests influencing issue. EJB client prefers last sucessful mechanism.

          • Critical - To be worked on immediately following BLOCKER issues.
          • Verified

          Activity

            People

              darran.lofthouse@redhat.com Darran Lofthouse
              mchoma@redhat.com Martin Choma
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: