Bug 1157472

Summary:	[GSS] (6.3.z) EJB3 Web Service returns Invalid User on parallel invocations
Product:	[JBoss] JBoss Enterprise Application Platform 6	Reporter:	Mustafa Musaji <mmusaji>
Component:	Web Services	Assignee:	baranowb <bbaranow>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Rostislav Svoboda <rsvoboda>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	6.3.1	CC:	asoldano, bbaranow, cdewolf, ema, jochen.riedlinger, klape
Target Milestone:	CR1
Target Release:	EAP 6.3.3
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:
Clones:	1157482 (view as bug list)		Environment:
Last Closed:	2019-08-19 12:42:56 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1157482
Bug Blocks:	1151405, 1157539, 1173484

Description Mustafa Musaji 2014-10-27 10:14:24 UTC

Description of problem:

EJB3 Web Service using username token for authentication fails when you load test it with parallel invocations. See attached reproducer.

See upstream JIRA https://issues.jboss.org/browse/JBWS-3843

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 2 JBoss JIRA Server 2014-10-30 16:13:24 UTC

Alessio Soldano <asoldano> updated the status of jira JBWS-3843 to Resolved

Comment 7 Rostislav Svoboda 2014-12-16 12:54:49 UTC

Nacking because this fix need upgraded PicketBox with 2 fixes tracked in BZ 1173493 and BZ 1173492. Both these BZs are DEV NACKED.
For this reason I must nack this BZ.

Comment 8 Rostislav Svoboda 2014-12-18 11:22:02 UTC

Acking - based on https://bugzilla.redhat.com/show_bug.cgi?id=1157479#c18
Jim Ma has workaround in WS codebase to be safe even without PicketBox upgrade.

Comment 13 Dominik Pospisil 2015-01-07 14:53:00 UTC

Both

https://issues.jboss.org/browse/SECURITY-868 https://issues.jboss.org/browse/SECURITY-866

are fixed in Picketbox 4.0.19.SP9.

Comment 14 Rostislav Svoboda 2015-01-19 13:03:03 UTC

Verified on EAP 6.3.3 ER1.

Endpoint tested with 130 threads.

Comment 15 JBoss JIRA Server 2015-04-25 20:26:48 UTC

Alessio Soldano <asoldano> updated the status of jira JBWS-3843 to Closed