jakarta.security.jacc.URLPatternSpec fails for jolokia request

[Mike Douglass]

Running wildfly 36.1 with Java 21 and jolokia 2.3.0 

Since i upgraded from pre-jakarta and wildfly 26.1.3 jolokia stopped working.

The request that is sent is 

/jolokia/exec/org.bedework.bwengine:service=indexing/listIndexes

I thought at first this was the jolokia client failing to url encode the request so I tried it in the browser.  I tried 

http://localhost:8080/jolokia/exec/org.bedework.bwengine%3Aservice%3Dindexing/listIndexes

what I saw in the console was the error below which seems to suggest that maybe wildfly is passing the decoded url to jakarta.security.jacc.URLPatternSpec :

12:27:56,963 ERROR [io.undertow.request] (default task-8) UT005023: Exception handling request to /jolokia/exec/org.bedework.bwengine:service=indexing/listIndexes: java.lang.IllegalArgumentException: invalid URLPatternSpec
at jakarta.secu...@2.1.0//jakarta.security.jacc.URLPatternSpec.setURLPatternArray(URLPatternSpec.java:326)
at jakarta.secu...@2.1.0//jakarta.security.jacc.URLPatternSpec.<init>(URLPatternSpec.java:79)
at jakarta.secu...@2.1.0//jakarta.security.jacc.WebResourcePermission.<init>(WebResourcePermission.java:141)
at org.wildfly.security.elytron...@4.1.2.Final//org.wildfly.elytron.web.undertow.server.servlet.ElytronAuthorizationManager.canAccessResource(ElytronAuthorizationManager.java:69)
at io.undert...@2.3.18.Final//io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:55)
at io.undert...@2.3.18.Final//io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
at io.undert...@2.3.18.Final//io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
at org.wildfly.security.ely...@4.1.2.Final//org.wildfly.elytron.web.undertow.server.ElytronRunAsHandler.lambda$handleRequest$1(ElytronRunAsHandler.java:68)
at org.wildfly.secu...@2.6.4.Final//org.wildfly.security.auth.server.FlexibleIdentityAssociation.runAsFunctionEx(FlexibleIdentityAssociation.java:103)
at org.wildfly.secu...@2.6.4.Final//org.wildfly.security.auth.server.Scoped.runAsFunctionEx(Scoped.java:161)
at org.wildfly.secu...@2.6.4.Final//org.wildfly.security.auth.server.Scoped.runAs(Scoped.java:73)
at org.wildfly.security.ely...@4.1.2.Final//org.wildfly.elytron.web.undertow.server.ElytronRunAsHandler.handleRequest(ElytronRunAsHandler.java:67)
at io.undert...@2.3.18.Final//io.undertow.servlet.handlers.RedirectDirHandler.handleRequest(RedirectDirHandler.java:68)
at io.undert...@2.3.18.Final//io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:117)
at io.undert...@2.3.18.Final//io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
at io.under...@2.3.18.Final//io.undertow.server.handlers.DisableCacheHandler.handleRequest(DisableCacheHandler.java:33)
at io.under...@2.3.18.Final//io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at io.under...@2.3.18.Final//io.undertow.security.handlers.AuthenticationConstraintHandler.handleRequest(AuthenticationConstraintHandler.java:53)
at io.under...@2.3.18.Final//io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
at io.undert...@2.3.18.Final//io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
at io.undert...@2.3.18.Final//io.undertow.servlet.handlers.security.ServletSecurityConstraintHandler.handleRequest(ServletSecurityConstraintHandler.java:60)
at io.under...@2.3.18.Final//io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
at org.wildfly.security.elytron...@4.1.2.Final//org.wildfly.elytron.web.undertow.server.servlet.CleanUpHandler.handleRequest(CleanUpHandler.java:38)
at io.under...@2.3.18.Final//io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at org.wildfly.ext...@36.0.1.Final//org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:44)
at io.under...@2.3.18.Final//io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at org.wildfly.ext...@36.0.1.Final//org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:51)
at io.undert...@2.3.18.Final//io.undertow.servlet.handlers.SendErrorPageHandler.handleRequest(SendErrorPageHandler.java:52)
at io.under...@2.3.18.Final//io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at io.undert...@2.3.18.Final//io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:276)
at io.undert...@2.3.18.Final//io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
at io.undert...@2.3.18.Final//io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:132)
at io.undert...@2.3.18.Final//io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
at io.undert...@2.3.18.Final//io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
at org.wildfly.ext...@36.0.1.Final//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1421)
at org.wildfly.ext...@36.0.1.Final//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1421)
at org.wildfly.ext...@36.0.1.Final//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1421)
at org.wildfly.ext...@36.0.1.Final//org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1421)
at io.undert...@2.3.18.Final//io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:256)
at io.undert...@2.3.18.Final//io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:101)
at io.under...@2.3.18.Final//io.undertow.server.Connectors.executeRootHandler(Connectors.java:395)
at io.under...@2.3.18.Final//io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:861)
at org.jbos...@2.4.0.Final//org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
at org.jbos...@2.4.0.Final//org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1990)
at org.jbos...@2.4.0.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486)
at org.jbos...@2.4.0.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377)
at org.jbo...@3.8.16.Final//org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282)
at java.base/java.lang.Thread.run(Thread.java:1583)

[Bartosz Baranowski]

Could you verify your suspicion? There were quite few fixes sparked by https://issues.redhat.com/browse/UNDERTOW-2312  - this might be affecting you as well in some way.
Also you might want to follow: https://issues.redhat.com/browse/UNDERTOW-2609

[Michael Douglass]

I guess I could try setting breakpoints in wildfly but my test was just pasting the escaped url below into wildfly.

So I just tried again and this time it worked ok. I believe I've only made one change - the jolokia agent is authenticating using as shown here:

<application-security-domain name="jolokia" http-authentication-factory="management-http-authentication"/>

and it's using the default 

<properties-realm name="ManagementRealm">
    <users-properties path="mgmt-users.properties" relative-to="jboss.server.config.dir" digest-realm-name="ManagementRealm"/>
    <groups-properties path="mgmt-groups.properties" relative-to="jboss.server.config.dir"/>
</properties-realm>

Authentication seemed to work OK but the actual failure occurs if there is no configured role. The agent expects the role "jolokia" which was missing from mgmt-groups.properties

In that file, if I have this entry:

hawtadmin=admin,jolokia

everything works. If I remove "jolokia" or add some trailing junk I get the exception below. In all cases the url in the browser is the correctly escaped url.

I discovered the role was missing because the jolokia client can be configured to use POST instead of GET. When I did that I got a "Forbidden" status back

So in summary - if you have a properly configured app you won't see the error, but get the roles wrong and you get a misleading error.

--
You received this message because you are subscribed to the Google Groups "WildFly" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wildfly+u...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/wildfly/30c327ce-c10d-488c-a72a-19bb923789bbn%40googlegroups.com.