Clone Tools
  • last updated a few minutes ago
Constraints: committers
Constraints: files
Constraints: dates
[WFLY-490] / [WFLY-1864] Update the protocol so that servers receiving management requests from a trusted master can request a Subject to use when executing the operation.

For host controller to managed server interactions the two are always kept in sync version wise.

For master to slave communication the master must be the same version as the slave or higher i.e. a slave sending this new request will not cause an interop issue as the master must be at least a version that understands it.

was: eaff432fd8b51b875e5bf435fd48e63c82ccac91

  1. … 8 more files in changeset.
[WFLY-490] Use own inet address principal so we don't have to pull remoting into the http management server module

was: 247b843951645384fe6e9ad6938af76092d6e978

  1. … 3 more files in changeset.
[WFLY-456] More fixes from code review

TODO to populate the subject higher up the chain

Missing copyright notices

Implement MBeanServerAuditLogger.shouldLog()

was: 1afe4d89805b82f60ba4b58875e5ac5fbfbaff2e

  1. … 11 more files in changeset.
[WFLY-456] Audit Logging - squashed the below commits since master has changed so much

[WFLY-456] Minor OperationContext impl cleanups

[WFLY-456] Bring in John Bailey's audit log classes

[WFLY-456] Add real audit loggers into the model controllers; integrate management handlers

[WFLY-456] Log the full set of information

[WFLY-456] Fix problems from rebase

[WFLY-456] Use SecurityContext when invoking JMX methods via remoting

[WFLY-456] Move core security classes into own module

[WFLY-456] Rework things and make the controller logger work

[WFLY-456] Include the access mechanism in the log, move some more classes to core-security

[WFLY-456] Make audit logger available to JMX

[WFLY-456] Pluggable MBeanServer delegate to audit logger, and loads of exception handling

[WFLY-456] Jmx audit log proxy

[WFLY-456] Separate the configuration for the core controller and jmx audit logs

[WFLY-456] Set the booting flag in the jmx layer

[WFLY-456] Integrate audit logging resource and ops into JMX extension so it can be configured there

[WFLY-456] Correct copyright notices in my new files

[WFLY-456] fix problems from rebase

[WFLY-456] Get rid of the original hashing implementation

[WFLY-456] Add missing originalResultTxControl from rebase

[WFLY-456] Add config for appenders

[WFLY-456] Basic file appender and json formatter. The output needs cleaning up and everything is currently hardcoded

[WFLY-456] Back up the previous log file. Basic syslog appender (awaiting the improved logmanager SyslogHandler)

[WFLY-456] Use the org.wildfly:wildfly-xxx names. Start configuring file appenders

[WFLY-456] Configure model for syslog appender

[WFLY-456] Log audit log records for ParallelBootOperationContext and ReadOnlyContext

[WFLY-456] Make whether to log on boot configurable

[WFLY-456] Be able to add/remove appender references at runtime and update the appenders at runtime

[WFLY-456] Add boot-log to jmx audit-log as well and update xsd's for both core and jmx

[WFLY-456] Make additive changes to appenders take effect right away, and delay changes/removals until the current audit record has been written

[WFLY-456] Add schema support and parsing for managed server path overrides, and clean up the handlers

[WFLY-456] Use 'handler' rather than 'appender'

[WFLY-456] Pass in audit log operations to managed servers on boot

[WFLY-456] Separate handler chains for host and managed server audit logs

[WFLY-456] i18n and get rid of code no longer needed

[WFLY-456] Fix problems from rebase, revisit security after moved WildFlySecurityManager

[WFLY-456] Flesh out the syslog handler, tried with UDP

[WFLY-456] Start testing the handlers and ops

[WFLY-456] Set up proper syslog host and app names

[WFLY-456] More tests

[WFLY-456] Complete renaming appender->handler. Really

[WFLY-456] Nicer separate configuration for JMX

[WFLY-456] Better testing for enabled and log-read-only audit log write attribute handlers

[WFLY-456] Separate handlers for JMX subsystem audit logging, and tests

[WFLY-456] Maintan a failure count per appender

[WFLY-456] Configure the json formatter and reference from the audit log handlers

Expose 'max-length' and 'truncate' for the syslog handler

[WFLY-456] Make audit logging work in admin-only mode

Fix bug not enabling the appender in domain mode

[WFLY-456] Fixes to tls syslog handler having tried it out against rsyslog

[WFLY-456] don't enable log by default

[WFLY-456] Test jmx audit log transformation

[WFLY-456] Test audit logging in testsuite

[WFLY-456] Move new i18n bits into domain-management, rather than using the ones from controller

[WFLY-456] Recycle handler operation, make max-failure-count configurable per handler, expose runtime attributes for handler failure counts

[WFLY-456] Use strings instead of byte[] for the formatters for now. We can revisit the byte[] part if more tamper detecting formatters are used in the future

[WFLY-456] Use platform independent line terminator

[WFLY-456] Changes to work with latest logmanager following a squash

was: d94ab0354f5c9e2112985e03b448073ecae05d81

    • -0
    • +88
    • -0
    • +87
  1. … 154 more files in changeset.
[WFLY-1618] / [WFLY-490] Addition of the runtime role mapping implementation.

Also Switch identity association over to use an AccessControlContext instead of ThreadLocal.

Expose Caller from OperationContext and initialise based on the currently associated Subject.

As the role mapping is happening within controller additional Principal types are created that controller can expect to present in the Subject of the authenticated user.

Added a new is-caller-in-role operation, this allows a quick check that the currently authenticated user has the expected role.

The Subject is now marked as readOnly so we do need to deal with the contents changing.

Added a test case to test various permutations of role mapping and also minor fixes for issues detected by the test.

was: ebf893b23aac6ed1e83875c227f27f45fead73fc

    • -0
    • +34
    • -0
    • +34
    • -0
    • +36
    • -0
    • +34
  1. … 39 more files in changeset.
[AS7-6730] Modification to the security interceptors so that the push of the SecurityContext is separated from the authentication step.

Also wrap the Remoting Connection in the Credential so that it can reach the LoginModule instead of relyign on the ThreadLocal, this

means that the Credential will remain available until any intermediate bean sets an alternative.

was: 9f6a8c75700ee942ae622f56dc0c9eff70ae9267

  1. … 1 more file in changeset.
AS7-5114 Fix the EJB JACC workflow.

was: 7edc3b71e22f64debf07f2ce1fc7d4dfc8666a5b

  1. … 1 more file in changeset.
[AS7-4312] Add a registry for the security realms so that they can subsequently be accessed from outside the service dependency mechanisms.

was: 4fe250cfed11a9dcd8a16e0b73c279aa5b75706d

  1. … 2 more files in changeset.
[AS7-4218] When an authentication is handled first using pure SASL we need to make better use of the JAAS based authentication cache - we don't have access to a genuine credential to use in the cache so we use one specific to the connection of the user.

was: 0af6108304784a8b30c1605429a8983b60faf186

    • -0
    • +38
  1. … 1 more file in changeset.
[AS7-3525] Don't bring an EJB metadata dependency into the controller module.

was: 194487b8d15a3e5e77740a56020ddb029f350446

  1. … 1 more file in changeset.
[AS7-3525] Update to the JAAS authentication process within the realms to make use of the same security service as used by EJB3.

This change now means that the same authentication cache is used for all JAAS authentication so regardless of the entry point

or the point of the authentication a user will only be authenticated once and the cached value subsequently used whilst the

cache entry is present.

was: 9ec88df402c6a7b09d568159caa0cfc60e675011

    • -0
    • +56
  1. … 3 more files in changeset.
[AS7-1383] Follow on from the current thread association to allow for a SecurityManager to restrict access to update the association.

Also added SecurityAction classes for each location access to the association is needed either to read or to modify.

was: 2fd9700315d1386781fcadfb20a559354814bb62

  1. … 9 more files in changeset.
[AS7-1383] Associate the Subject of the current user with the current request.

was: 6d4f5e29f083f82ab5b24f0e94f6ee65ea858f87

    • -0
    • +48
  1. … 14 more files in changeset.