Loading...

Details

Type: Bug
Resolution: Won't Do
Priority: Major
Fix Version/s: None
Affects Version/s: 7.1.0.ER1
Component/s: Security
Labels:
None

Affects:

User Experience
Target Release:

7.1.0.GA
Steps to Reproduce:
Hide

Unsecure EAP:

sed "s/http-interface security-realm=\"ManagementRealm\"/http-interface/g" -i "$EAP_HOME/standalone/configuration/standalone-full-ha.xml"

Start EAP

Run following in CLI:

[standalone@localhost:9990 /] /subsystem=elytron/policy=jacc:add(jacc-policy=[{name => jacc}]) { "outcome" => "success", "response-headers" => { "process-state" => "reload-required" } } [standalone@localhost:9990 /] reload [standalone@localhost:9990 /] /subsystem=elytron/policy=jacc:list-add(name=custom-policy, value={name=foo, class-name=bar}) { "outcome" => "success", "operation-requires-reload" => true, "process-state" => "reload-required" } } [standalone@localhost:9990 /] reload [standalone@localhost:9990 /] /subsystem=elytron/policy=jacc:list-remove(name=custom-policy, index=0) { "outcome" => "success", "response-headers" => { "operation-requires-reload" => true, "process-state" => "reload-required" } } [standalone@localhost:9990 /] reload [standalone@localhost:9990 /] /subsystem=elytron/policy=jacc:remove() { "outcome" => "success", "response-headers" => { "operation-requires-reload" => true, "process-state" => "reload-required" } } [standalone@localhost:9990 /] reload [standalone@localhost:9990 /] /subsystem=elytron/policy=jacc:add(jacc-policy=[{name => jacc}]) { "outcome" => "failed", "response-headers" => { "operation-requires-reload" => true, "process-state" => "reload-required" }, "failure-description" => {"WFLYCTL0080: Failed services" => {"org.wildfly.security.policy" => "Failed to start service Caused by: java.lang.RuntimeException: Failed to set policy [org.wildfly.security.authz.jacc.JaccDelegatingPolicy@502d9a84] Caused by: java.lang.SecurityException: ELY03018: Cannot add permissions to a read-only permission collection"}}, "rolled-back" => true }
Show
Unsecure EAP: sed "s/http- interface security-realm=\" ManagementRealm\ "/http- interface /g" -i "$EAP_HOME/standalone/configuration/standalone-full-ha.xml" Start EAP Run following in CLI: [standalone@localhost:9990 /] /subsystem=elytron/policy=jacc:add(jacc-policy=[{name => jacc}]) { "outcome" => "success" , "response-headers" => { "process-state" => "reload-required" } } [standalone@localhost:9990 /] reload [standalone@localhost:9990 /] /subsystem=elytron/policy=jacc:list-add(name=custom-policy, value={name=foo, class- name=bar}) { "outcome" => "success" , "operation-requires-reload" => true , "process-state" => "reload-required" } } [standalone@localhost:9990 /] reload [standalone@localhost:9990 /] /subsystem=elytron/policy=jacc:list-remove(name=custom-policy, index=0) { "outcome" => "success" , "response-headers" => { "operation-requires-reload" => true , "process-state" => "reload-required" } } [standalone@localhost:9990 /] reload [standalone@localhost:9990 /] /subsystem=elytron/policy=jacc:remove() { "outcome" => "success" , "response-headers" => { "operation-requires-reload" => true , "process-state" => "reload-required" } } [standalone@localhost:9990 /] reload [standalone@localhost:9990 /] /subsystem=elytron/policy=jacc:add(jacc-policy=[{name => jacc}]) { "outcome" => "failed" , "response-headers" => { "operation-requires-reload" => true , "process-state" => "reload-required" }, "failure-description" => { "WFLYCTL0080: Failed services" => { "org.wildfly.security.policy" => "Failed to start service Caused by: java.lang.RuntimeException: Failed to set policy [org.wildfly.security.authz.jacc.JaccDelegatingPolicy@502d9a84] Caused by: java.lang.SecurityException: ELY03018: Cannot add permissions to a read-only permission collection"}}, "rolled-back" => true }

SFDC Cases Counter:
SFDC Cases Links:

Description

Adding new Elytron policy fails if it was previously added and then removed and server is unsecured. Next adding fails [1] and with exception [2] in server.log.

[1]

[standalone@localhost:9990 /] /subsystem=elytron/policy=jacc:add(jacc-policy=[{name => jacc}])
{
    "outcome" => "failed",
    "response-headers" => {
        "operation-requires-reload" => true,
        "process-state" => "reload-required"
    },
    "failure-description" => {"WFLYCTL0080: Failed services" => {"org.wildfly.security.policy" => "Failed to start service
    Caused by: java.lang.RuntimeException: Failed to set policy [org.wildfly.security.authz.jacc.JaccDelegatingPolicy@502d9a84]
    Caused by: java.lang.SecurityException: ELY03018: Cannot add permissions to a read-only permission collection"}},
    "rolled-back" => true
}

[2]

2017-06-29 11:08:35,700 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-4) MSC000001: Failed to start service org.wildfly.security.policy: org.jboss.msc.service.StartException in service org.wildfly.security.policy: Failed to start service
        at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1978)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:748)
Caused by: java.lang.RuntimeException: Failed to set policy [org.wildfly.security.authz.jacc.JaccDelegatingPolicy@502d9a84]
        at org.wildfly.extension.elytron.PolicyDefinitions$1$1.start(PolicyDefinitions.java:177)
        at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:2032)
        at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1955)
        ... 3 more
Caused by: java.lang.SecurityException: ELY03018: Cannot add permissions to a read-only permission collection
        at org.wildfly.security.authz.jacc.JaccDelegatingPolicy$1.add(JaccDelegatingPolicy.java:126)
        at java.security.Policy.addStaticPerms(Policy.java:686)
        at java.security.Policy.getPermissions(Policy.java:673)
        at org.jboss.security.jacc.DelegatingPolicy.getPermissions(DelegatingPolicy.java:125)
        at java.security.Policy.initPolicy(Policy.java:327)
        at java.security.Policy.setPolicy(Policy.java:270)
        at org.wildfly.extension.elytron.PolicyDefinitions$1$1.lambda$setPolicyAction$0(PolicyDefinitions.java:201)
        at org.wildfly.extension.elytron.PolicyDefinitions$1$1.setPolicy(PolicyDefinitions.java:195)
        at org.wildfly.extension.elytron.PolicyDefinitions$1$1.start(PolicyDefinitions.java:173)
        ... 5 more

2017-06-29 11:08:35,701 ERROR [org.jboss.as.controller.management-operation] (management-handler-thread - 3) WFLYCTL0013: Operation ("add") failed - address: ([
    ("subsystem" => "elytron"),
    ("policy" => "jacc")
]) - failure description: {"WFLYCTL0080: Failed services" => {"org.wildfly.security.policy" => "Failed to start service
    Caused by: java.lang.RuntimeException: Failed to set policy [org.wildfly.security.authz.jacc.JaccDelegatingPolicy@502d9a84]
    Caused by: java.lang.SecurityException: ELY03018: Cannot add permissions to a read-only permission collection"}}

Attachments

Issue Links

is cloned by

WFCORE-3042 It is not possible to add new Elytron policy after adding and removing it first

Resolved

relates to

JBEAP-12434 StackOverflowError when adding and removing jacc policy in the elytron subsystem

Closed

It is not possible to add new Elytron policy after adding and removing it first

Details

Description

Attachments

Issue Links

Activity

People

Dates