Uploaded image for project: 'WildFly'
  1. WildFly
  2. WFLY-10282

NPE in io.undertow.security.impl.BasicAuthenticationMechanism.authenticate when picketbox subsystem removed

    Details

    • Steps to Reproduce:
      Hide

      ./bin/jboss-cli.sh --file=docs/examples/enable-elytron.cli
      ./bin/jboss-cli.sh --file=docs/examples/remove-picketbox.cli
      cp wildfly-ejb-security.war standalone/deployments

      ./bin/standalone.sh -c standalone.xml
      http://localhost:8080/wildfly-ejb-security/

      Show
      ./bin/jboss-cli.sh --file=docs/examples/enable-elytron.cli ./bin/jboss-cli.sh --file=docs/examples/remove-picketbox.cli cp wildfly-ejb-security.war standalone/deployments ./bin/standalone.sh -c standalone.xml http://localhost:8080/wildfly-ejb-security/
    • Workaround:
      Workaround Exists
    • Workaround Description:
      Hide

      Add the picketbox security subsystem back in empty:

      <subsystem xmlns="urn:jboss:domain:security:2.0">
      </subsystem>
      

      Show
      Add the picketbox security subsystem back in empty: <subsystem xmlns="urn:jboss:domain:security:2.0"> </subsystem>

      Description

      After enabling elytron, the security subsystem was removed. The war using jboss-web.xml security-domain looks like it is not used when the picketbox security subsystem is removed.

      java.lang.NullPointerException
      	at io.undertow.security.impl.BasicAuthenticationMechanism.authenticate(BasicAuthenticationMechanism.java:167)
      	at io.undertow.security.impl.SecurityContextImpl$AuthAttempter.transition(SecurityContextImpl.java:245)
      	at io.undertow.security.impl.SecurityContextImpl$AuthAttempter.transition(SecurityContextImpl.java:263)
      	at io.undertow.security.impl.SecurityContextImpl$AuthAttempter.access$100(SecurityContextImpl.java:231)
      	at io.undertow.security.impl.SecurityContextImpl.attemptAuthentication(SecurityContextImpl.java:125)
      	at io.undertow.security.impl.SecurityContextImpl.authTransition(SecurityContextImpl.java:99)
      	at io.undertow.security.impl.SecurityContextImpl.authenticate(SecurityContextImpl.java:92)
      	at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:55)
      	at io.undertow.server.handlers.DisableCacheHandler.handleRequest(DisableCacheHandler.java:33)
      	at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
      	at io.undertow.security.handlers.AuthenticationConstraintHandler.handleRequest(AuthenticationConstraintHandler.java:53)
      	at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
      	at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
      	at io.undertow.servlet.handlers.security.ServletSecurityConstraintHandler.handleRequest(ServletSecurityConstraintHandler.java:59)
      	at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
      	at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
      	at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
      	at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
      	at org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
      	at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
      	at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
      	at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
      	at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
      	at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
      	at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
      	at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
      	at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)
      	at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)
      	at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)
      	at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)
      	at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
      	at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
      	at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
      	at io.undertow.server.Connectors.executeRootHandler(Connectors.java:330)
      	at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:812)
      	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
      	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
      	at java.lang.Thread.run(Thread.java:745)
      

      The war has jboss-web.xml:

      <?xml version="1.0" encoding="UTF-8"?>
      <jboss-web>
         <security-domain>other</security-domain>
      </jboss-web>
      

              <subsystem xmlns="urn:jboss:domain:undertow:4.0">
      ...
                  <application-security-domains>
                      <application-security-domain name="other" http-authentication-factory="application-http-authentication"/>
                  </application-security-domains>
              </subsystem>
       
              <subsystem xmlns="urn:wildfly:elytron:1.2" final-providers="combined-providers" disallowed-providers="OracleUcrypto">
      ...
                  <http>
                      <http-authentication-factory name="application-http-authentication" http-server-mechanism-factory="global" security-domain="ApplicationDomain">
                          <mechanism-configuration>
                              <mechanism mechanism-name="BASIC">
                                  <mechanism-realm realm-name="Application Realm"/>
                              </mechanism>
                              <mechanism mechanism-name="FORM"/>
                          </mechanism-configuration>
                      </http-authentication-factory>
                      <provider-http-server-mechanism-factory name="global"/>
                  </http>
      ...
      

        Gliffy Diagrams

          Attachments

            Issue Links

              Activity

                People

                • Assignee:
                  dlofthouse Darran Lofthouse
                  Reporter:
                  ivassile Ilia Vassilev
                • Votes:
                  0 Vote for this issue
                  Watchers:
                  3 Start watching this issue

                  Dates

                  • Created:
                    Updated:
                    Resolved: