Bug 901248 (JBPAPP6-1699) - [GSS](6.4.z) SaslException connecting to server, but actual EJB invocations are fine
Summary: [GSS](6.4.z) SaslException connecting to server, but actual EJB invocations a...
Keywords:
Status: CLOSED NOTABUG
Alias: JBPAPP6-1699
Product: JBoss Enterprise Application Platform 6
Classification: JBoss
Component: Remoting
Version: 6.1.1
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: ---
Assignee: Enrique Gonzalez Martinez
QA Contact:
URL: http://jira.jboss.org/jira/browse/JBP...
Whiteboard:
: 996897 (view as bug list)
Depends On:
Blocks: eap6411-payload 1375357
TreeView+ depends on / blocked
 
Reported: 2012-12-06 12:15 UTC by Ladislav Thon
Modified: 2018-12-02 15:56 UTC (History)
12 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2017-01-03 12:25:00 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker JBPAPP6-1699 0 Major Closed SaslException connecting to server, but actual EJB invocations are fine 2018-12-03 18:26:09 UTC
Red Hat Issue Tracker WFLY-4376 0 Major Closed Incorrect callback handler used during authentication (SASL) 2018-12-03 18:26:09 UTC

Description Ladislav Thon 2012-12-06 12:15:34 UTC
project_key: JBPAPP6

Our failover tests for remote stateful EJBs start with a set of these exceptions:

{code}
06:59:44,609 ERROR [org.jboss.remoting.remote.connection] (Remoting "config-based-ejb-client-endpoint" read-1) JBREM000200: Remote connection failed: javax.security.sasl.SaslException: Authentication failed: all available authentication mechanisms failed
06:59:44,611 INFO  [org.jboss.ejb.client.remoting.RemotingConnectionClusterNodeManager] (ejb-client-cluster-node-connection-creation-2-thread-2) Could not create a connection for cluster node ClusterNode{clusterName='ejb', nodeName='perf18', clientMappings=[ClientMapping{sourceNetworkAddress=/0:0:0:0:0:0:0:0, sourceNetworkMaskBits=0, destinationAddress='10.16.90.54', destinationPort=4447}], resolvedDestination=[Destination address=10.16.90.54, destination port=4447]} in cluster ejb
java.lang.RuntimeException: javax.security.sasl.SaslException: Authentication failed: all available authentication mechanisms failed
	at org.jboss.ejb.client.remoting.IoFutureHelper.get(IoFutureHelper.java:91)
	at org.jboss.ejb.client.remoting.RemotingConnectionClusterNodeManager.getEJBReceiver(RemotingConnectionClusterNodeManager.java:89)
	at org.jboss.ejb.client.ClusterContext$EJBReceiverAssociationTask.call(ClusterContext.java:406)
	at org.jboss.ejb.client.ClusterContext$EJBReceiverAssociationTask.call(ClusterContext.java:380)
	at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
	at java.util.concurrent.FutureTask.run(FutureTask.java:138)
	at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
	at java.lang.Thread.run(Thread.java:662)
Caused by: javax.security.sasl.SaslException: Authentication failed: all available authentication mechanisms failed
	at org.jboss.remoting3.remote.ClientConnectionOpenListener$Capabilities.handleEvent(ClientConnectionOpenListener.java:382)
	at org.jboss.remoting3.remote.ClientConnectionOpenListener$Capabilities.handleEvent(ClientConnectionOpenListener.java:225)
	at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:72)
	at org.xnio.channels.TranslatingSuspendableChannel.handleReadable(TranslatingSuspendableChannel.java:189)
	at org.xnio.channels.TranslatingSuspendableChannel$1.handleEvent(TranslatingSuspendableChannel.java:103)
	at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:72)
	at org.xnio.nio.NioHandle.run(NioHandle.java:90)
	at org.xnio.nio.WorkerThread.run(WorkerThread.java:187)
	at ...asynchronous invocation...(Unknown Source)
	at org.jboss.remoting3.EndpointImpl.doConnect(EndpointImpl.java:270)
	at org.jboss.remoting3.EndpointImpl.connect(EndpointImpl.java:386)
	at org.jboss.ejb.client.remoting.NetworkUtil.connect(NetworkUtil.java:151)
	at org.jboss.ejb.client.remoting.NetworkUtil.connect(NetworkUtil.java:132)
	at org.jboss.ejb.client.remoting.RemotingConnectionClusterNodeManager.getEJBReceiver(RemotingConnectionClusterNodeManager.java:87)
	... 7 more
{code}

As seen in https://jenkins.mw.lab.eng.bos.redhat.com/hudson/view/EAP6/view/EAP6-Failover/job/eap-6x-failover-ejb-ejbremote-jvmkill-repl-sync/15/console-perf17/

This is unexpected, since we don't use any auth -- the remoting subsystem is configured like this:

{code}
<subsystem xmlns="urn:jboss:domain:remoting:1.1">
    <connector name="remoting-connector" socket-binding="remoting"/>
</subsystem>
{code}

As can be seen in https://jenkins.mw.lab.eng.bos.redhat.com/hudson/view/EAP6/view/EAP6-Failover/job/eap-6x-failover-ejb-ejbremote-jvmkill-repl-sync/15/artifact/report/config/jboss-perf18/standalone-ha.xml

The exceptions do no (perceived) harm, but they really shouldn't be there in the first place.

EJB client configration looks like:

{code}

remote.connectionprovider.create.options.org.xnio.Options.SSL_ENABLED=false

remote.connections=perf18,perf19,perf20,perf21

invocation.timeout=120000

remote.connection.perf18.host=perf18
remote.connection.perf18.port=4447
remote.connection.perf18.connect.options.org.xnio.Options.SASL_POLICY_NOANONYMOUS=false
remote.connection.perf18.channel.options.org.jboss.remoting3.RemotingOptions.MAX_OUTBOUND_MESSAGES=30000

remote.connection.perf19.host=perf19
remote.connection.perf19.port=4447
remote.connection.perf19.connect.options.org.xnio.Options.SASL_POLICY_NOANONYMOUS=false
remote.connection.perf19.channel.options.org.jboss.remoting3.RemotingOptions.MAX_OUTBOUND_MESSAGES=30000

remote.connection.perf20.host=perf20
remote.connection.perf20.port=4447
remote.connection.perf20.connect.options.org.xnio.Options.SASL_POLICY_NOANONYMOUS=false
remote.connection.perf20.channel.options.org.jboss.remoting3.RemotingOptions.MAX_OUTBOUND_MESSAGES=30000

remote.connection.perf21.host=perf21
remote.connection.perf21.port=4447
remote.connection.perf21.connect.options.org.xnio.Options.SASL_POLICY_NOANONYMOUS=false
remote.connection.perf21.channel.options.org.jboss.remoting3.RemotingOptions.MAX_OUTBOUND_MESSAGES=30000
{code}

As can be seen in https://svn.devel.redhat.com/repos/jboss-qa/load-testing/sf-components/project-clustering-ejb3/trunk/src/main/resources/jboss-ejb-client.properties

Note that I only provided links to one job in Jenkins, but this happens in a _lot_ of other jobs.

Comment 1 Ladislav Thon 2013-02-14 07:30:12 UTC
Maybe this is not a bug: https://issues.jboss.org/browse/JBPAPP-9233

We'll have to try to configure the 'ejb' cluster in the client and see.

Comment 2 Jitka Kozana 2013-02-14 14:21:03 UTC
Seen during 6.1.DR4 testing.

Comment 3 David M. Lloyd 2013-03-13 12:32:31 UTC
Upstream bug ID?

Comment 4 Jitka Kozana 2013-03-13 13:01:44 UTC
I do not know of any upstream bug.

Comment 8 Enrique Gonzalez Martinez 2015-02-19 16:20:07 UTC
I can reproduce the problem with EAP 6.4

During EJBClientContext creation through the InitialContextFactory in jboss-remoting-naming component, the EJBClientContext is created without the configuration passed as parameter to the InitialContext.

https://github.com/jbossas/jboss-remote-naming/blob/1.0.10.Final/src/main/java/org/jboss/naming/remote/client/ejb/RemoteNamingStoreEJBClientHandler.java#L59

When a new cluster node is added the system checks whether the ejb client configuration is set or not, creating a callback based on that setup. Due to the lack of ejb client configuration the system creates a org.jboss.ejb.client.DefaultCallbackHandler. This callback handler does not support PasswordCallback which is the one being used and the one throwing the exception during cluster connection (DigestMD5Client::evaluateChallenge)

https://github.com/jbossas/jboss-ejb-client/blob/1.0.26.Final/src/main/java/org/jboss/ejb/client/remoting/RemotingConnectionClusterNodeManager.java#L93

Comment 9 JBoss JIRA Server 2015-02-20 09:42:16 UTC
Enrique González Martínez <elguardian> updated the status of jira JBNAME-62 to Coding In Progress

Comment 10 Enrique Gonzalez Martinez 2015-03-20 09:03:49 UTC
*** Bug 996897 has been marked as a duplicate of this bug. ***

Comment 11 Enrique Gonzalez Martinez 2016-09-01 11:37:37 UTC
This was merged upstream:

https://github.com/jbossas/jboss-remote-naming/commit/4a439c2acf04947f64b6bfbe14de60c84bd57b40

lacks backport and upgrade for naming component.

Comment 12 Enrique Gonzalez Martinez 2016-09-01 13:30:23 UTC
PR up 6.4.z :https://github.com/jbossas/jboss-remote-naming/pull/29
no upstream required.

Comment 14 Jiří Bílek 2016-10-06 14:01:03 UTC
Reopened because still seeing this with EAP 6.4.11.CP.CR1

On perf17 output (sfDaemon - perf17) in job https://jenkins.mw.lab.eng.bos.redhat.com/hudson/job/eap-6x-failover-ejb-ejbremote-undeploy-repl-sync/76/ you can still see the error message. But now it looks as follows:

javax.security.sasl.SaslException: Authentication failed: all available authentication mechanisms failed:
	at org.jboss.remoting3.remote.ClientConnectionOpenListener.allMechanismsFailed(ClientConnectionOpenListener.java:114)
	at org.jboss.remoting3.remote.ClientConnectionOpenListener$Capabilities.handleEvent(ClientConnectionOpenListener.java:448)
	at org.jboss.remoting3.remote.ClientConnectionOpenListener$Capabilities.handleEvent(ClientConnectionOpenListener.java:243)
	at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:72)
	at org.xnio.channels.TranslatingSuspendableChannel.handleReadable(TranslatingSuspendableChannel.java:189)
	at org.xnio.channels.TranslatingSuspendableChannel$1.handleEvent(TranslatingSuspendableChannel.java:103)
	at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:72)
	at org.xnio.nio.NioHandle.run(NioHandle.java:90)
	at org.xnio.nio.WorkerThread.run(WorkerThread.java:198)
	at ...asynchronous invocation...(Unknown Source)
	at org.jboss.remoting3.EndpointImpl.doConnect(EndpointImpl.java:293)
	at org.jboss.remoting3.EndpointImpl.connect(EndpointImpl.java:423)
	at org.jboss.ejb.client.remoting.NetworkUtil.connect(NetworkUtil.java:152)
	at org.jboss.ejb.client.remoting.NetworkUtil.connect(NetworkUtil.java:133)
	at org.jboss.ejb.client.remoting.ConnectionPool.getConnection(ConnectionPool.java:78)
	at org.jboss.ejb.client.remoting.RemotingConnectionManager.getConnection(RemotingConnectionManager.java:51)
	at org.jboss.ejb.client.remoting.RemotingConnectionClusterNodeManager.getEJBReceiver(RemotingConnectionClusterNodeManager.java:77)
	at org.jboss.ejb.client.ClusterContext$EJBReceiverAssociationTask.call(ClusterContext.java:475)
	at org.jboss.ejb.client.ClusterContext$EJBReceiverAssociationTask.call(ClusterContext.java:449)
	at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
	at java.util.concurrent.FutureTask.run(FutureTask.java:138)
	at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:895)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:918)
	at java.lang.Thread.run(Thread.java:662)

Comment 15 Enrique Gonzalez Martinez 2016-10-07 10:54:27 UTC
Hi Jiří Bílek

is it possible to run the job with different parameters/file jboss-ejb-client.properties ?

Comment 17 Enrique Gonzalez Martinez 2017-01-03 12:25:00 UTC
Hi:

The new error is due to a missconfiguration in the ejb-client-properties. When you are working as anonymous you need to setup the property SASL_POLICY_NOANONYMOUS for the cluster. by default SASL_POLICY_NOANONYMOUS is true so it needs credentials.

You need to add the next two lines to your jboss-ejb-client.properties

remote.clusters=ejb
remote.cluster.ejb.connect.options.org.xnio.Options.SASL_POLICY_NOANONYMOUS=false

This is not a bug but a missconfiguration. closing it.


Note You need to log in before you can comment on or make changes to this bug.