Bug 1168918 - Kerberos authentication for Management CLI does not work with OracleJDK 1.6
Summary: Kerberos authentication for Management CLI does not work with OracleJDK 1.6
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: JBoss Enterprise Application Platform 6
Classification: JBoss
Component: Domain Management
Version: 6.4.0
Hardware: Unspecified
OS: Unspecified
unspecified
urgent
Target Milestone: DR13
: EAP 6.4.0
Assignee: Darran Lofthouse
QA Contact: Pavel Slavicek
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-11-28 12:18 UTC by Ondrej Lukas
Modified: 2019-08-19 12:43 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-08-19 12:43:00 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker EAP6-174 0 Major Closed Kerberos based authentication for Remoting 2015-11-25 01:05:26 UTC
Red Hat Issue Tracker WFCORE-445 0 Major Resolved Add support for some default JAAS configs for use by GSSAPI in the CLI 2015-11-25 01:05:26 UTC

Description Ondrej Lukas 2014-11-28 12:18:50 UTC
In case when kerberos authentication is correctly configured in security realm [1] and Management CLI which runs with JDK 1.6 tries to connected then following exception is thrown:

Exception in thread "Remoting "cli-client" task-1" java.lang.SecurityException: Unable to locate a login configuration
	at com.sun.security.auth.login.ConfigFile.<init>(ConfigFile.java:93)
	at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
	at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:39)
	at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:27)
	at java.lang.reflect.Constructor.newInstance(Constructor.java:513)
	at java.lang.Class.newInstance0(Class.java:357)
	at java.lang.Class.newInstance(Class.java:310)
	at javax.security.auth.login.Configuration$3.run(Configuration.java:247)
	at java.security.AccessController.doPrivileged(Native Method)
	at javax.security.auth.login.Configuration.getConfiguration(Configuration.java:242)
	at sun.security.jgss.LoginConfigImpl$1.run(LoginConfigImpl.java:47)
	at sun.security.jgss.LoginConfigImpl$1.run(LoginConfigImpl.java:45)
	at java.security.AccessController.doPrivileged(Native Method)
	at sun.security.jgss.LoginConfigImpl.<init>(LoginConfigImpl.java:44)
	at sun.security.jgss.GSSUtil.login(GSSUtil.java:244)
	at sun.security.jgss.krb5.Krb5Util.getTicket(Krb5Util.java:136)
	at sun.security.jgss.krb5.Krb5InitCredential$1.run(Krb5InitCredential.java:328)
	at java.security.AccessController.doPrivileged(Native Method)
	at sun.security.jgss.krb5.Krb5InitCredential.getTgt(Krb5InitCredential.java:325)
	at sun.security.jgss.krb5.Krb5InitCredential.getInstance(Krb5InitCredential.java:128)
	at sun.security.jgss.krb5.Krb5MechFactory.getCredentialElement(Krb5MechFactory.java:106)
	at sun.security.jgss.krb5.Krb5MechFactory.getMechanismContext(Krb5MechFactory.java:172)
	at sun.security.jgss.GSSManagerImpl.getMechanismContext(GSSManagerImpl.java:209)
	at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:195)
	at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:162)
	at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:175)
	at org.jboss.remoting3.remote.ClientConnectionOpenListener$Capabilities$2$1.run(ClientConnectionOpenListener.java:463)
	at org.jboss.remoting3.remote.ClientConnectionOpenListener$Capabilities$2$1.run(ClientConnectionOpenListener.java:459)
	at java.security.AccessController.doPrivileged(Native Method)
	at org.jboss.remoting3.remote.ClientConnectionOpenListener$Capabilities$2.run(ClientConnectionOpenListener.java:459)
	at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:895)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:918)
	at java.lang.Thread.run(Thread.java:662)
Caused by: java.io.IOException: Unable to locate a login configuration
	at com.sun.security.auth.login.ConfigFile.init(ConfigFile.java:250)
	at com.sun.security.auth.login.ConfigFile.<init>(ConfigFile.java:91)
	... 32 more

How to reproduce:
1) configure kerberos authentication for Management Realm with wrong configured principal
2) start Kerberos server and EAP, try to authenticate into Management CLI with JDK 1.7 - works fine
3) disconnect from Management CLI
4) try to authenticate into Management CLI with JDK 1.6 - mentioned above exception is thrown

I request blocker flag since this issue is blocking certification [1] for JDK6. 

[1] http://darranl.blogspot.cz/2014/11/wildfly-9-kerberos-authentication-with.html
[2] https://mojo.redhat.com/docs/DOC-48621

Comment 1 baranowb 2014-12-01 05:58:12 UTC
*** Bug 1168921 has been marked as a duplicate of this bug. ***

Comment 2 Darran Lofthouse 2014-12-03 13:55:14 UTC
What is the exact Java version this error is being reported from?

Reviewing some of the source for Java 6 the error reported here should actually not be reported but that may only be in a later version.

Comment 3 Ondrej Lukas 2014-12-03 14:22:30 UTC
java -version
>>>
java version "1.6.0_45"
Java(TM) SE Runtime Environment (build 1.6.0_45-b06)
Java HotSpot(TM) 64-Bit Server VM (build 20.45-b01, mixed mode)

Comment 4 Darran Lofthouse 2014-12-04 19:06:45 UTC
I have a change in WildFly that should cover this but I can not run WildFly on Java 6 so will need to test a backport.

Comment 6 Ondrej Lukas 2014-12-12 13:41:06 UTC
Verified in EAP 6.4.0.DR13.

Comment 7 JBoss JIRA Server 2015-04-28 15:05:33 UTC
John Doyle <jdoyle> updated the status of jira EAP6-174 to Closed


Note You need to log in before you can comment on or make changes to this bug.