Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-12034

Elytron - Wrong private credentials used for forwarded identity when SecurityDomain.authenticate() is used

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Blocker
    • 7.1.0.ER3
    • 7.1.0.ER2
    • Security
    • None

    Description

      Wrong Elytron private credentials are used for forwarded identity, when re-authentication is used before forwarding.

      Scenario:

      Client --calls--> EJB (EntryBean) on server 1 --calls--> EJB (WhoAmIBean) on server 2

      Both EJBs are protected. The Client uses valid username/password for the server 1.

      The EntryBean uses Elytron client API to re-authenticate as another user and then calls the WhoAmIBean on server 2.

      As a result the correct (re-authenticated) username is used for the call on server 2, but the private credential (PasswordCredential) from the original Client call is used. This is IMO not only wrong but also a security leak.

      The code of the EntryBean looks like:

      // Callable which calls WhoAmI bean on server 2
final Callable<String> callable = () -> {
    WhoAmI whoAmIBean = doRemoteJndiLookup();
    return whoAmIBean.whoAmI();
};

// Callable which uses forwardedIdentity to authenticate on server 2 - and call the action (WhoAmI)
final Callable<String> forwardIdentityCallable = () -> {
    return AuthenticationContext.empty()
            .with(MatchRule.ALL,
                    AuthenticationConfiguration.empty().useForwardedIdentity(SecurityDomain.getCurrent())
                            .setSaslMechanismSelector(SaslMechanismSelector.ALL))
            .runCallable(callable);
};

// Re-authenticate as another user and use the forwardedIdentity to call WhoAmI bean on server 2
return SecurityDomain.getCurrent().authenticate("anotherUser", new PasswordGuessEvidence("anotherPassword".toCharArray()))
        .runAs(forwardIdentityCallable);

      This issue was discovered in ER2, after the issues hiding this one (JBEAP-11377, JBEAP-11453) were fixed.

      Attachments

        Issue Links

          is caused by

          Bug - A problem that impairs or prevents the functions of the product. ELY-1281 SecurityDomain.authenticate() propagates credentials inappropriately

          • Blocker - To be worked above all other priorities. This term is chosen when the severity of the issue is very high, has no workaround, or the effort for the change is comparatively low. Issues that may be very publicly visible and could generate significant media attention may also drive a higher priority.
          • Resolved
          is incorporated by

          Component Upgrade - A task tracking an update to a bundled component or revision of component upstream of the project. JBEAP-12265 Upgrade WildFly Elytron to 1.1.0.CR3

          • Blocker - To be worked above all other priorities. This term is chosen when the severity of the issue is very high, has no workaround, or the effort for the change is comparatively low. Issues that may be very publicly visible and could generate significant media attention may also drive a higher priority.
          • Verified
          is related to

          Bug - A problem that impairs or prevents the functions of the product. JBEAP-11377 Attribute security-domain from Elytron authentication-configuration does not propagate credentials

          • Blocker - To be worked above all other priorities. This term is chosen when the severity of the issue is very high, has no workaround, or the effort for the change is comparatively low. Issues that may be very publicly visible and could generate significant media attention may also drive a higher priority.
          • Verified

          Bug - A problem that impairs or prevents the functions of the product. JBEAP-11453 Attribute security-domain from Elytron authentication-configuration does not propagate credentials with OAUTHBEARER mechanism

          • Blocker - To be worked above all other priorities. This term is chosen when the severity of the issue is very high, has no workaround, or the effort for the change is comparatively low. Issues that may be very publicly visible and could generate significant media attention may also drive a higher priority.
          • Verified

          Activity

            People

              psilva@redhat.com Pedro Igor Craveiro
              josef.cacek@gmail.com Josef Cacek (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: