Bug 1105619

Summary: [GSS] (6.2.x) Nonexistent ldap group causes authentication to fail in security-realm
Product: [JBoss] JBoss Enterprise Application Platform 6 Reporter: Derek Horton <dehort>
Component: Domain ManagementAssignee: Carlo de Wolf <cdewolf>
Status: CLOSED WONTFIX QA Contact: Josef Cacek <jcacek>
Severity: unspecified Docs Contact: Russell Dickenson <rdickens>
Priority: unspecified    
Version: 6.2.3CC: cdewolf, emuckenh, smumford
Target Milestone: ---   
Target Release: EAP 6.2.4   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1105677 1127938 (view as bug list) Environment:
Last Closed: 2014-06-12 08:45:22 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1105677, 1128176    
Bug Blocks: 1067534, 1127938, 1143052    

Description Derek Horton 2014-06-06 14:30:32 UTC 
Description of problem:
The LdapGroupSearcher code will fail if it tries to lookup a group that 
does not exist on the local ldap server.

This can happen when the ldap systems are configured as trusted domains.  
Even though the security-realm is not configured to use the trusted domain
(it is configured to only look at a single ldap server), the 
user's entry on one ldap server could point at a group that exists on 
the other (trusted) ldap server.

The LdapGroupSearcher code attempts to lookup this role and it fails.  This 
failure is sent back to the http server which results in an HTTP 500 error
and leaves the user with no way to authenticate/login.

There is currently not a way to tell the group searcher code to ignore the 
group/role that cannot be found.


How reproducible:
Create a user in ldap that has a "bogus" group.  Log into the admin console as that user.  Once the LdapGroupSearcher code looks up the user, it will fail when it attempts to lookup the "bogus" group.
Comment 3 Carlo de Wolf 2014-06-12 08:45:39 UTC 
Missed the cut.