wildfly-security/elytron-web

Integration project for integrating Elytron based HTTP authentication with web containers and clients (Initially just Undertow server)

Elytron Web

Integration project for integrating Elytron based HTTP authentication with web containers and clients (Initially just Undertow server)

An "elytron" (ĕl´·ĭ·trŏn, plural "elytra") is the hard, protective casing over a wing of certain flying insects (e.g. beetles).

Building From Source

$ git clone [email protected]:wildfly-security/elytron-web.git

Setup the JBoss Maven Repository

To use dependencies from JBoss.org, you need to add the JBoss Maven Repositories to your Maven settings.xml. For details see http://community.jboss.org/wiki/MavenGettingStarted-Users

Build with Maven

The command below builds the project and runs the embedded suite.

$ mvn clean install

Issue Tracking

Bugs and features are tracked within the Elytron Jira project at https://issues.redhat.com/projects/ELYWEB

Contributions

All new features and enhancements should be submitted to 1.x branch only.

Our contribution guide will guide you through the steps for getting started on the Elytron Web project and will go through how to format and submit your first PR.

For more details, check out our getting started guide for developers.

elytron-web's Issues

Release Elytron Web 1.0.0.Beta7

Allow the RunAs handler to be extended to allow alternative run as strategies to be plugged in.

Release Elytron Web 1.0.0.Beta13

Release 1.0.0.Alpha1

Release 1.0.0.Alpha6

Release Elytron Web 1.0.0.Beta11

Undertow Deprecated API is used

I wonder if it is possible to avoid use of Undertow API marked as deprecated.

If I try to build
[mchoma@localhost elytron-web]$ mvn test

I get:

• [WARNING] /elytron-web/undertow/src/main/java/org/wildfly/elytron/web/undertow/server/SecurityContextImpl.java:[101,28] getIdentityManager() in io.undertow.security.api.SecurityContext has been deprecated
• [WARNING] /elytron-web/undertow/src/main/java/org/wildfly/elytron/web/undertow/server/SecurityContextImpl.java:[93,42] getAuthenticationMechanisms() in io.undertow.security.api.SecurityContext has been deprecated
• [WARNING] /elytron-web/undertow/src/main/java/org/wildfly/elytron/web/undertow/server/SecurityContextImpl.java:[85,17] addAuthenticationMechanism(io.undertow.security.api.AuthenticationMechanism) in io.undertow.security.api.SecurityContext has been deprecated
• [WARNING] /elytron-web/undertow/src/main/java/org/wildfly/elytron/web/undertow/server/SecurityContextImpl.java:[67,21] setResponseCode(int) in io.undertow.server.HttpServerExchange has been deprecated
• [WARNING] /elytron-web/undertow/src/test/java/org/wildfly/elytron/web/undertow/server/DefaultServer.java:[141,32] ENABLE_CONNECTOR_STATISTICS in io.undertow.UndertowOptions has been deprecated

Release Elytron Web 1.0.0.Beta12

Enable SSO and Clustered Tests

org.wildfly.elytron.web.undertow.server.FormAuthenticationWithSessionReplicationTest-output.txt
org.wildfly.elytron.web.undertow.server.FormAuthenticationWithSessionReplicationTest.txt

org.wildfly.elytron.web.undertow.server.FormAuthenticationWithClusteredSSOTest-output.txt
org.wildfly.elytron.web.undertow.server.FormAuthenticationWithClusteredSSOTest.txt

Upgrade to WildFly Elytron 1.1.0.Beta22

Release Elytron Web 1.0.0.Beta4

Update ElytronRunAsHandler to take a Function to convert a SecurityIdentity

This can then be used for scenarios such as servlet run as handling where the SecurityIdentity needs a change of roles.

Add testing for HTTP BASIC authentication for Undertow

Removing '?' from URI when query string is empty

Release Elytron Web 1.0.0.Beta5

Release 1.0.0.Alpha4

Bring all dependency versions in-line with WildFly Core

TS: FormAuthenticationWithSessionReplicationTest is still disabled

FormAuthenticationWithSessionReplicationTest is currently ignored.
Once enabled I get test failure
FormAuthenticationWithSessionReplicationTest.testSessionInvalidation:115->AbstractHttpServerMechanismTest.assertSuccessfulResponse:82 expected:<1> but was:<0>

@pferraro ^^^

TS: WARN ELY06008: Failed to logout participant

Running testsuite
mvn clean test -Dtest=FormAuthenticationWithClusteredSSOTest -Dmaven.test.redirectTestOutputToFile=false

There are 2 WARN log message at the end of log. However that does not cause tests failure.

09:50:37,997 WARN [org.wildfly.security] (XNIO-19 task-2) ELY06008: Failed to logout participant [http://localhost:7778/7778]: java.net.ConnectException: Connection refused

@pferraro ^^

Upgrade to WildFly Elytron 1.1.0.Beta7

Release 1.0.0.Alpha5

Release Elytron Web 1.0.0.Beta8

Add integration between Elytron and Undertow for the server side of authentication

ClientCert Support

Add a test for ClientCert - also any API/SPI adjustments required to achieve it.

We need to cover two modes:
-Authentication during SSL negotiation
-Authentication in the mechanism only.

Update project after latest round of API changes to Elytron and possible Undertow

TS: ELY06012: Invalid logout message received for local session

During testsuite run
mvn clean test -Dmaven.test.redirectTestOutputToFile=false

there occures a lot of error messages:
ELY06013: Failed to invalidate local session: java.lang.IllegalStateException: ELY06012: Invalid logout message received for local session [MGgAaDPABGTDlU343a1FE8ophkLtEB8r7Gz16bPI]

@pferraro ^^

TS: Java 9, java.lang.NoClassDefFoundError: Could not initialize class org.jboss.marshalling.reflect.SerializableClass

Running TS with java 9 there is error:
06:28:32,389 SEVERE [org.jgroups.blocks.RequestCorrelator] (remote-thread-c7f0b65b-9422-416a-be64-2f52f27391fb-p2-t1) JGRP000178: failed marshalling rsp (SuccessfulResponse{responseValue=StatusResponse{cacheJoinInfo=null, cacheTopology=CacheTopology{id=2, rebalanceId=2, currentCH=ReplicatedConsistentHash{ns = 256, owners = (1)[c7f0b65b-9422-416a-be64-2f52f27391fb-58994: 256]}, pendingCH=ReplicatedConsistentHash{ns = 256, owners = (2)[c7f0b65b-9422-416a-be64-2f52f27391fb-58994: 134, d80ec1f7-7b9f-4fcf-bf60-66e80e6f3cce-52682: 122]}, unionCH=null, actualMembers=[c7f0b65b-9422-416a-be64-2f52f27391fb-58994, d80ec1f7-7b9f-4fcf-bf60-66e80e6f3cce-52682]}, stableTopology=CacheTopology{id=1, rebalanceId=1, currentCH=ReplicatedConsistentHash{ns = 256, owners = (1)[c7f0b65b-9422-416a-be64-2f52f27391fb-58994: 256]}, pendingCH=null, unionCH=null, actualMembers=[c7f0b65b-9422-416a-be64-2f52f27391fb-58994]}}} ): java.lang.NoClassDefFoundError: Could not initialize class org.jboss.marshalling.reflect.SerializableClass

ClientCertAuthenticationTest error on IBM java

java.security.NoSuchAlgorithmException: SunX509 TrustManagerFactory not available

It is probably enough to replace static algorithm specification with *ManagerFactory.getDefaultAlgorithm(). Will send PR in minute.

Release 1.0.0.Beta10

Remove use of IdentityLocator

Upgrade to WildFly Elytron 1.1.0.Beta27

Upgrade to WildFly Elytron 1.1.0.Beta23

Update tests to follow redirects

Upgrade to WildFly Elytron 1.1.0.Beta9

Upgrade WildFly Elytron to 1.1.0.Beta28

Upgrade to WildFly Elytron 1.1.0.Beta26

OutOfMemoryError in TS

@pedroigor , commit [1] introduced occurence of OutOfMemoryError. Could you have a look, what could be a problem, please? For example On IBM java ClientCertAuthenticationTest could not be run until -Xmx1024 is configured in surefire plugin.

Is just setting enough of memory (let say -Xmx1024) proper solution here? And high memory consumption is just caused by 2 Undertow server started inside TS.

Or could be code somehow optimized? Could you review if committed changes are all right?

[1] 21e2241

Release version 1.0.0.Beta3

Release Elytron Web 1.0.0.Beta2

Release Elytron Web 1.0.0.Beta1

Release 1.0.0.Beta9

Upgrade to Undertow 1.4.0.Final

Upgrade to WildFly Elytron 1.1.0.Beta18

FORM authentication is using path of target resource instead of request for redirects

If a request comes in for a folder that contains a welcome page Undertow will automatically serve the welcome page to the user, to achieve this the welcome page is resolved internally.

The FORM authentication mechanism is mistakenly sending the resolved address instead of the original request received from the client in the redirect.

Create build for elytron-web integration project.

Initial build is just Undertow focussed but at some point project will become multi-module.

Upgrade to WildFly Elytron 1.1.0.Beta25

Upgrade to WildFly Elytron 1.1.0.Beta20

Add support for programatic authentication for Undertow

i.e. The login method of the SecurityContext API

Refactor Elytron Web to make it a modular project

Release Elytron Web 1.0.0.Beta6