Uploaded image for project: 'WildFly'
  1. WildFly
  2. WFLY-3593

Empty username login attempt with BASIC authentication throws Exception and blocks gui

    XMLWordPrintable

    Details

      Description

      I exchanged the security realm 'ManagementRealm' for the management-interfaces with a custom one (which I wrote) like this:

      <management-interfaces>
                  <http-interface security-realm="SaltAndPepperRealm" http-upgrade-enabled="true" >
                      <socket-binding http="management-http"/>
                  </http-interface>
      </management-interfaces>
      

      My custom security realm is using the "PLAIN" mechanism, because I need the ValidatePasswordCredential interface.

      It is all working fine as long as you do not try to log into the wildfly management (http://localhost:9990/console/App.html) with an empty username.

      Here is the stacktrace, which an empty username login attempt creates:

      22:20:34,722 ERROR [io.undertow.request] (XNIO-1 task-9) Blocking request failed HttpServerExchange{ POST /management}: java.lang.IllegalArgumentException
      	at javax.security.auth.callback.NameCallback.<init>(NameCallback.java:90) [rt.jar:1.8.0]
      	at org.jboss.as.domain.http.server.security.RealmIdentityManager.verify(RealmIdentityManager.java:137) [wildfly-domain-http-interface-8.1.0.Final.jar:8.1.0.Final]
      	at org.jboss.as.domain.http.server.security.RealmIdentityManager.verify(RealmIdentityManager.java:120) [wildfly-domain-http-interface-8.1.0.Final.jar:8.1.0.Final]
      	at io.undertow.security.impl.BasicAuthenticationMechanism.authenticate(BasicAuthenticationMechanism.java:110) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
      	at org.jboss.as.domain.http.server.security.AuthenticationMechanismWrapper.authenticate(AuthenticationMechanismWrapper.java:57) [wildfly-domain-http-interface-8.1.0.Final.jar:8.1.0.Final]
      	at io.undertow.security.impl.SecurityContextImpl$AuthAttempter.transition(SecurityContextImpl.java:281) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
      	at io.undertow.security.impl.SecurityContextImpl$AuthAttempter.transition(SecurityContextImpl.java:298) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
      	at io.undertow.security.impl.SecurityContextImpl$AuthAttempter.access$100(SecurityContextImpl.java:268) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
      	at io.undertow.security.impl.SecurityContextImpl.attemptAuthentication(SecurityContextImpl.java:131) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
      	at io.undertow.security.impl.SecurityContextImpl.authTransition(SecurityContextImpl.java:106) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
      	at io.undertow.security.impl.SecurityContextImpl.authenticate(SecurityContextImpl.java:99) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
      	at io.undertow.security.handlers.AuthenticationCallHandler.handleRequest(AuthenticationCallHandler.java:50) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
      	at io.undertow.server.Connectors.executeRootHandler(Connectors.java:177) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
      	at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:727) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
      	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [rt.jar:1.8.0]
      	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [rt.jar:1.8.0]
      	at java.lang.Thread.run(Thread.java:744) [rt.jar:1.8.0]

      I then debugged the wildfly and undertow code and found out that in
      BasicAuthenticationMechanism.java at line 102 the variable 'plainChallenge' had the value ":" (just a colon) and the if-condition is nevertheless fulfilled. Maybe this is correct behavior (I do not know), but then in RealmIdentityManager.java at line 137 the upper exception gets thrown.

      The problem is that the user will not get any feedback in his browser and just stares at the "Loading ..." text and gif. Also with reloading the page or open it again in a new tab the site will still show the loading message. One needs to restart the browser, clear the cache or do it in a private tab to get it work.

        Gliffy Diagrams

          Attachments

            Activity

              People

              • Assignee:
                dlofthouse Darran Lofthouse
                Reporter:
                phe_nix Marcel Carlé
              • Votes:
                0 Vote for this issue
                Watchers:
                4 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: