EJB Remote using elytron custom realm

[dt pham]

Dear all,

    I have a custom realm under Elytron subsystem. The custom realm is working fine for my web login and accessing my secured EJBs. However, I would like to have the remote applications to access my secured EJBs using my custom realm instead of the "ApplicationRealm". Any hints?  I went through the quickstart and developer guide, but I did not see any stuffs that I am looking for. 

   

[Farah Juma]

It sounds like you need to configure your http-remoting-connector so that it references a sasl-authentication-factory that is backed by your security-domain. 

This example might help, it shows how to update application-sasl-authentication to reference a new security-domain and then updates the http-remoting-connector configuration accordingly:

https://wildfly-security.github.io/wildfly-elytron/blog/advanced-ejb-security/

[dt pham]

Thank you so much. Yes, I am getting some ideas from the link.

[dt pham]

Dear Farah,

    I followed the link you provided and I am able to make my remote application successfully invokes my secured EJB using my custom realm. That is a big step forward for me and I am really appreciate all the helps from you and the others on this group. Now I am hitting the next issue on the remote application which is I am unable to create a connection to the ConnectionFactory so I can subscribe to a topic to get data. it fails on factory.createConnection().  Just a note here, InitialContext is fine since my remote application can talk to the secured ejbs as I said above. My active MQ has <security elytron-enable="true" /> . I do lookup the factory with jndi name "ConnectionFactory" ( also tried "java:/ConnectionFactory" ). Not sure why the name is null here since it already login/invokes successfully the secured ejbs. 

What do I miss configure here? I am using wildfly 23 final. Open Jdk 13

javax.jms.JMSSecurityException: AMQ229031: Unable to validate user from /10.1.71.163:3445. Username: null; SSL certificate subject DN: unavailable

        at org.apache.activemq.artemis.core.protocol.core.impl.ChannelImpl.sendBlocking(ChannelImpl.java:540)

        at org.apache.activemq.artemis.core.protocol.core.impl.ChannelImpl.sendBlocking(ChannelImpl.java:434)

        at org.apache.activemq.artemis.core.protocol.core.impl.ActiveMQClientProtocolManager.createSessionContext(ActiveMQClientProtocolManager.java:300)

        at org.apache.activemq.artemis.core.protocol.core.impl.ActiveMQClientProtocolManager.createSessionContext(ActiveMQClientProtocolManager.java:249)

        at org.apache.activemq.artemis.core.client.impl.ClientSessionFactoryImpl.createSessionChannel(ClientSessionFactoryImpl.java:1401)

        at org.apache.activemq.artemis.core.client.impl.ClientSessionFactoryImpl.createSessionInternal(ClientSessionFactoryImpl.java:705)

        at org.apache.activemq.artemis.core.client.impl.ClientSessionFactoryImpl.createSession(ClientSessionFactoryImpl.java:316)

        at org.apache.activemq.artemis.jms.client.ActiveMQConnection.authorize(ActiveMQConnection.java:684)

        at org.apache.activemq.artemis.jms.client.ActiveMQConnectionFactory.createConnectionInternal(ActiveMQConnectionFactory.java:920)

        at org.apache.activemq.artemis.jms.client.ActiveMQConnectionFactory.createConnection(ActiveMQConnectionFactory.java:299)

        at org.apache.activemq.artemis.jms.client.ActiveMQConnectionFactory.createConnection(ActiveMQConnectionFactory.java:294)

[dt pham]

enabled=false for the  security of activemq will work, but I am curious how to have it works when the security is  enabled.

[Farah Juma]

Are you able to share more details about the client side configuration? How are the username and password being specified?

[dt pham]

Hi Farah,

I just use the jndi.properties and here is what it looks like:

java.naming.factory.initial=org.wildfly.naming.client.WildFlyInitialContextFactory

java.naming.provider.url=http-remoting://localhost:8090

java.naming.security.principal=dtpham

java.naming.security.credentials=xxxxxxx

Note that:

1)  I do see the user was logging in my custom realm and the remote app successfully invoked my wildfly's secured ejbs

2)  On wildfly side, I have my custom sasl looks like this (where "DPhamElytron" is my custom realm and "pham" is my security domain of the custom realm:

<sasl-authentication-factory name="pham-application-sasl-authentication" sasl-server-factory="configured" security-domain="pham">

          <mechanism-configuration>

<mechanism mechanism-name="PLAIN">

                          <mechanism-realm realm-name=" DPhamElytron  "/>

                 </mechanism>

           </mechanism-configuration>

 </sasl-authentication-factory>

....

<subsystem xmlns="urn:jboss:domain:remoting:4.0">

            <http-connector name="http-remoting-connector" connector-ref="default" security-realm="ApplicationRealm" sasl-authentication-factory="pham -application-sasl-authentication"/>

</subsystem>

[dt pham]

FYI, I turn on trace on my remote app and see something interesting:

12-04-21 06:00:52:914 TRACE org.apache.commons.beanutils.BeanUtils  -   setProperty(ConnectionOptions{ha=false}, userInfo, <NULL>)

12-04-21 06:00:52:914 TRACE org.apache.commons.beanutils.BeanUtils  -     Target bean = ConnectionOptions{ha=false}

12-04-21 06:00:52:915 TRACE org.apache.commons.beanutils.BeanUtils  -     Target name = userInfo

12-04-21 06:00:52:916 TRACE org.apache.commons.beanutils.MethodUtils  - Matching name=getUserInfo on class org.apache.activemq.artemis.uri.schema.serverLocator.ConnectionOptions

12-04-21 06:00:52:916 TRACE org.apache.commons.beanutils.MethodUtils  - No match found.

12-04-21 06:00:52:917 TRACE org.apache.commons.beanutils.MethodUtils  - Matching name=isUserInfo on class org.apache.activemq.artemis.uri.schema.serverLocator.ConnectionOptions

12-04-21 06:00:52:917 TRACE org.apache.commons.beanutils.MethodUtils  - No match found.

[dt pham]

Oh my fault. I found my issue. I do have user/pass in context, but when I created factory.createConnection(), I do need to pass user/pass in : factory.createConnection(user, pass) then it works with security enabled on activemq. No wonder the user was null.