Bug 901138 (JBPAPP6-3)
| Summary: | CLONE - LdapExtLoginModule fails with follow referral | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [JBoss] JBoss Enterprise Application Platform 6 | Reporter: | Tom Fonteyne <tfonteyn> | ||||
| Component: | Security | Assignee: | Peter Skopek <pskopek> | ||||
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Josef Cacek <jcacek> | ||||
| Severity: | high | Docs Contact: | |||||
| Priority: | high | ||||||
| Version: | 6.0.0 | CC: | atangrin, brian.stansberry, dandread, darran.lofthouse, dosoudil, jason.greene, jcacek, jdoyle, mlittle, myarboro, pskopek, tfonteyn | ||||
| Target Milestone: | ER7 | ||||||
| Target Release: | EAP 6.1.0 | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| URL: | http://jira.jboss.org/jira/browse/JBPAPP6-3 | ||||||
| Whiteboard: | activedirectory authentication authorization ldap objectfactory references | ||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | |||||||
| : | 914821 (view as bug list) | Environment: |
Probably not relevant, but Win 7 64, tried on jdk 6 and 7 64-bit.
|
||||
| Last Closed: | Type: | Bug | |||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 920992 | ||||||
| Bug Blocks: | 914821 | ||||||
| Deadline: | 2013-05-02 | ||||||
| Attachments: |
|
||||||
|
Description
Tom Fonteyne
2012-10-31 13:23:48 UTC
Link: Added: This issue Cloned from AS7-5737 Workflow: Removed: GIT Pull Request workflow Added: jira Security: Added: Public Help Desk Ticket Reference: Added: https://c.na7.visual.force.com/apex/Case_View?id=500A000000BcqbUIAR&sfdc.override=1 Steps to Reproduce: Added: Use either AD or another set of LDAP servers.
I used 2 instances of the Sun DS 7 server.
- create a user in each LDAP server
- setup a LdapExtended login-module as per usual
and add
<module-option name="throwValidateError" value="true"/>
then verify subsequently that authenticating to server 1 (user 1) and server 2 (user 2) works
- add a logger:
<logger category="org.jboss.security">
<level name="TRACE"/>
</logger>
- create a dynamic referral from server 1 to server 2
and configure the login-module to point to server 1
- Add the option
<module-option name="java.naming.referral" value="ignore"/>
- log in with user 1 => works fine
- change the option to
<module-option name="java.naming.referral" value="follow"/>
This will fail with the exceptions as described
From the logs we can see that user 1 was logged in perfectly fine, but after that the referral was trying to be followed... thereby breaking the whole login.
I did some initial investigations:
- added debugging to
org/jboss/as/naming/context/ObjectFactoryBuilder.java
=> confirmed the TCCL was null indeed
- removed in LdapExt module the line where the classloader is set to null
Now ObjectFactoryBuilder stumbled on
final String factoriesProp = (String)environment.get(Context.OBJECT_FACTORIES);
==> this was null
So: java.naming.factory.object seems that we need to set this to one or more classes. But to what ?
comparing code from 6.0.0 and 6.0.1ER3 shows that the latter specifically checks for DirObjectFactory, while 6.0.0 just tries a generic factory.
Big questions are - and basically just my guesses:
- what factory class ? There does not seem to be a factory for LdapReferralContext objects in the JDK
- is it valid to just leave the TCCL ? (I guess so, but not sure)
- am I looking in the right direction ? Or am I chasing the wrong issue ?
Attachment: Added: formlogin.war Steps to Reproduce: Removed: Use either AD or another set of LDAP servers.
I used 2 instances of the Sun DS 7 server.
- create a user in each LDAP server
- setup a LdapExtended login-module as per usual
and add
<module-option name="throwValidateError" value="true"/>
then verify subsequently that authenticating to server 1 (user 1) and server 2 (user 2) works
- add a logger:
<logger category="org.jboss.security">
<level name="TRACE"/>
</logger>
- create a dynamic referral from server 1 to server 2
and configure the login-module to point to server 1
- Add the option
<module-option name="java.naming.referral" value="ignore"/>
- log in with user 1 => works fine
- change the option to
<module-option name="java.naming.referral" value="follow"/>
This will fail with the exceptions as described
From the logs we can see that user 1 was logged in perfectly fine, but after that the referral was trying to be followed... thereby breaking the whole login.
Added: Use either AD or another set of LDAP servers.
I used 2 instances of the Sun DS 7 server.
- a simple formlogin.war was attahced to the JIRA. Name your
- create a user in each LDAP server
- setup a LdapExtended login-module as per usual
and add
<module-option name="throwValidateError" value="true"/>
then verify subsequently that authenticating to server 1 (user 1) and server 2 (user 2) works
- add a logger:
<logger category="org.jboss.security">
<level name="TRACE"/>
</logger>
- create a dynamic referral from server 1 to server 2
and configure the login-module to point to server 1
- Add the option
<module-option name="java.naming.referral" value="ignore"/>
- log in with user 1 => works fine
- change the option to
<module-option name="java.naming.referral" value="follow"/>
This will fail with the exceptions as described
From the logs we can see that user 1 was logged in perfectly fine, but after that the referral was trying to be followed... thereby breaking the whole login.
Steps to Reproduce: Removed: Use either AD or another set of LDAP servers.
I used 2 instances of the Sun DS 7 server.
- a simple formlogin.war was attahced to the JIRA. Name your
- create a user in each LDAP server
- setup a LdapExtended login-module as per usual
and add
<module-option name="throwValidateError" value="true"/>
then verify subsequently that authenticating to server 1 (user 1) and server 2 (user 2) works
- add a logger:
<logger category="org.jboss.security">
<level name="TRACE"/>
</logger>
- create a dynamic referral from server 1 to server 2
and configure the login-module to point to server 1
- Add the option
<module-option name="java.naming.referral" value="ignore"/>
- log in with user 1 => works fine
- change the option to
<module-option name="java.naming.referral" value="follow"/>
This will fail with the exceptions as described
From the logs we can see that user 1 was logged in perfectly fine, but after that the referral was trying to be followed... thereby breaking the whole login.
Added: Use either AD or another set of LDAP servers.
I used 2 instances of the Sun DS 7 server.
- a simple formlogin.war was attahced to the JIRA. Name your security domain "LdapRealm" and have a user in a group called "JBossAdmin" (or change web.xml/jboss-web.xml). The context is /fl
- create a user in each LDAP server
- setup a LdapExtended login-module as per usual
and add
<module-option name="throwValidateError" value="true"/>
then verify subsequently that authenticating to server 1 (user 1) and server 2 (user 2) works
- add a logger:
<logger category="org.jboss.security">
<level name="TRACE"/>
</logger>
- create a dynamic referral from server 1 to server 2
and configure the login-module to point to server 1
- Add the option
<module-option name="java.naming.referral" value="ignore"/>
- log in with user 1 => works fine
- change the option to
<module-option name="java.naming.referral" value="follow"/>
This will fail with the exceptions as described
From the logs we can see that user 1 was logged in perfectly fine, but after that the referral was trying to be followed... thereby breaking the whole login.
Steps to Reproduce: Removed: Use either AD or another set of LDAP servers.
I used 2 instances of the Sun DS 7 server.
- a simple formlogin.war was attahced to the JIRA. Name your security domain "LdapRealm" and have a user in a group called "JBossAdmin" (or change web.xml/jboss-web.xml). The context is /fl
- create a user in each LDAP server
- setup a LdapExtended login-module as per usual
and add
<module-option name="throwValidateError" value="true"/>
then verify subsequently that authenticating to server 1 (user 1) and server 2 (user 2) works
- add a logger:
<logger category="org.jboss.security">
<level name="TRACE"/>
</logger>
- create a dynamic referral from server 1 to server 2
and configure the login-module to point to server 1
- Add the option
<module-option name="java.naming.referral" value="ignore"/>
- log in with user 1 => works fine
- change the option to
<module-option name="java.naming.referral" value="follow"/>
This will fail with the exceptions as described
From the logs we can see that user 1 was logged in perfectly fine, but after that the referral was trying to be followed... thereby breaking the whole login.
Added: Use either AD or another set of LDAP servers.
I used 2 instances of the Sun DS 7 server.
- a simple formlogin.war was attached to the JIRA. Name your security domain "LdapRealm" and have a user in a group called "JBossAdmin" (or change web.xml/jboss-web.xml). The context is /fl
- create a user in each LDAP server
- setup a LdapExtended login-module as per usual
and add
<module-option name="throwValidateError" value="true"/>
then verify subsequently that authenticating to server 1 (user 1) and server 2 (user 2) works
- add a logger:
<logger category="org.jboss.security">
<level name="TRACE"/>
</logger>
- create a dynamic referral from server 1 to server 2
and configure the login-module to point to server 1
- Add the option
<module-option name="java.naming.referral" value="ignore"/>
- log in with user 1 => works fine
- change the option to
<module-option name="java.naming.referral" value="follow"/>
This will fail with the exceptions as described
From the logs we can see that user 1 was logged in perfectly fine, but after that the referral was trying to be followed... thereby breaking the whole login.
I think this ticket should be resolved to EAP 6.1. It seems the patch is prepared already (PR sent to upstream). Josef Cacek <jcacek> made a comment on jira AS7-5737 Sent PR with updated tests for LdapExtLoginModule and AdvancedLdapLoginModule https://github.com/jbossas/jboss-as/pull/4319 When the AS7-5737 is fixed, unignore 5 tests which are skipped now. Verification failed in 6.1.0.ER5. Both login modules (LdapExtLoginModule, AdvancedLdapLoginModule) still fail to follow referrals in role search routines. Please remove the @Ignore annotations in LdapExtLoginModuleTestCase and LdapExtLikeAdvancedLdapLMTestCase when the issue is fixed. Please review the status and target milestone of this BZ. Peter - if you have a test environment to reproduce and are working on the LdapExtLoginModule test case it may make sense for you to commit the same change to AdvancedLdapLoginModule. If they approve I can then create another JBoss Negotiation tag to include that fix. Darran, I have a test env. and once I have fix for LdapExtLoginModule I will create a fix for AdvancedLdapLoginModule and let you know. Hi Peter, let us know how this goes. The deadline is for today. Hi Dimitris, fix for LdapExtLoginModule is done. I am releasing new PicketBox with the change. I am also going to fix JBoss Negotiation and create the tag for it. I hope I have all permissions for the project since Darran is on PTO. From the pull request: https://github.com/jbossas/jboss-eap/pull/138#issuecomment-17528898 "It's a regression in https://bugzilla.redhat.com/show_bug.cgi?id=901138, Peter works on the JBoss Negotiation fix." Verified in 6.1.0.ER7 |