Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fixed JmacHttpsTest - certificate authentication #24877

Merged
merged 4 commits into from Mar 28, 2024
Merged

Fixed JmacHttpsTest - certificate authentication #24877

merged 4 commits into from Mar 28, 2024

Conversation

dmatej
Copy link
Contributor

@dmatej dmatej commented Mar 26, 2024 •
edited

  • created DescriptorPrincipalName class
  • Note that the equals method is not symmetric here
  • Exousia uses Set.contains -> equals to check the authorization.
  • I had to improve logs and code on several places to find out what is happening, later I partially separated that to standalone commit.

@dmatej dmatej added bug Something isn't working code cleaning labels Mar 26, 2024
@dmatej dmatej added this to the 7.0.14 milestone Mar 26, 2024
@dmatej dmatej self-assigned this Mar 26, 2024
avpinchuk
avpinchuk reviewed Mar 26, 2024
View reviewed changes
...s/security/core/src/main/java/com/sun/enterprise/security/auth/login/LoginContextDriver.java Outdated Show resolved Hide resolved
...s/security/core/src/main/java/com/sun/enterprise/security/auth/login/LoginContextDriver.java Outdated Show resolved Hide resolved
...s/security/core/src/main/java/com/sun/enterprise/security/auth/login/LoginContextDriver.java Outdated Show resolved Hide resolved
...s/security/core/src/main/java/com/sun/enterprise/security/auth/login/LoginContextDriver.java Outdated Show resolved Hide resolved
...s/security/core/src/main/java/com/sun/enterprise/security/auth/login/LoginContextDriver.java Outdated Show resolved Hide resolved
...s/security/core/src/main/java/com/sun/enterprise/security/auth/login/LoginContextDriver.java Outdated Show resolved Hide resolved
nucleus/security/core/src/main/java/com/sun/enterprise/security/ssl/GlassfishSSLSupport.java Outdated Show resolved Hide resolved
@avpinchuk
Copy link
Contributor

avpinchuk commented Mar 26, 2024 •
edited

Local mvn clean install -Pstaging of your branch successful.

Perhaps some problems with k8s.

@dmatej dmatej marked this pull request as draft March 26, 2024 21:10
@dmatej
Copy link
Contributor Author

dmatej commented Mar 26, 2024

Local mvn clean install -Pstaging of your branch successful.

Perhaps some problems with k8s.

Hmmmm ...

22:10:54  io.fabric8.kubernetes.client.http.WebSocketHandshakeException
22:10:54  	at io.fabric8.kubernetes.client.http.StandardHttpClient.lambda$buildWebSocket$17(StandardHttpClient.java:243)
22:10:54  	at java.base/java.util.concurrent.CompletableFuture.uniWhenComplete(CompletableFuture.java:859)
22:10:54  	at java.base/java.util.concurrent.CompletableFuture$UniWhenComplete.tryFire(CompletableFuture.java:837)
22:10:54  	at java.base/java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:506)
22:10:54  	at java.base/java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:2079)
22:10:54  	at io.fabric8.kubernetes.client.utils.AsyncUtils.lambda$retryWithExponentialBackoff$3(AsyncUtils.java:90)
22:10:54  	at java.base/java.util.concurrent.CompletableFuture.uniWhenComplete(CompletableFuture.java:859)
22:10:54  	at java.base/java.util.concurrent.CompletableFuture$UniWhenComplete.tryFire(CompletableFuture.java:837)
22:10:54  	at java.base/java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:506)
22:10:54  	at java.base/java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:2079)
22:10:54  	at io.fabric8.kubernetes.client.okhttp.OkHttpWebSocketImpl$1.onFailure(OkHttpWebSocketImpl.java:88)
22:10:54  	at okhttp3.internal.ws.RealWebSocket.failWebSocket(RealWebSocket.kt:592)
22:10:54  	at okhttp3.internal.ws.RealWebSocket$connect$1.onResponse(RealWebSocket.kt:174)
22:10:54  	at okhttp3.internal.connection.RealCall$AsyncCall.run(RealCall.kt:519)
22:10:54  	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
22:10:54  	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
22:10:54  	at java.base/java.lang.Thread.run(Thread.java:839)
22:10:54  Caused by: java.net.ProtocolException: Expected HTTP 101 response but was '500 Internal Server Error'
22:10:54  	at okhttp3.internal.ws.RealWebSocket.checkUpgradeSuccess$okhttp(RealWebSocket.kt:224)
22:10:54  	at okhttp3.internal.ws.RealWebSocket$connect$1.onResponse(RealWebSocket.kt:170)
22:10:54  	... 4 more

@avpinchuk
Copy link
Contributor

Yes, same error on other branch's build...

@dmatej
Copy link
Contributor Author

dmatej commented Mar 27, 2024

The problem was reported to GitLab: https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/issues/4475

@dmatej
Fixed JmacHttpsTest - created DescriptorPrincipalName with more toler…
6e6e017 
…ant equals

- Note that the equals method is not symmetric here
- Exousia uses Set.contains -> equals to check the authorization.

Signed-off-by: David Matějček <david.matejcek@omnifish.ee>
@dmatej dmatej changed the title Fixed JmacHttpsTest - created XmlPrincipalName with more tolerant equals Fixed JmacHttpsTest - certificate authentication Mar 27, 2024
@dmatej
Cleanups in logs and javadocs around realms
c52f3a5 
Signed-off-by: David Matějček <david.matejcek@omnifish.ee>
@dmatej
More reliable file removal in tests
20bf90b 
- throws an exception if it was not possible to delete some files.

Signed-off-by: David Matějček <david.matejcek@omnifish.ee>
@dmatej
Copy link
Contributor Author

dmatej commented Mar 27, 2024 •
edited

Meh, aha. I got it. The file is the same file in domain lib dir, test deleted it, another test created the same file with different content, but as the domain did not restart and classes are still cached by some classloader, boooom!

Such external library is owned by the domain, not by the application, so basically it is a correct behavior, because the test "corrupted" domain's files.

Possible solutions:

  • stop the domain before removing/changing its libraries
  • use unique names for different libraries
  • include the library to the war file (I am not sure if it would work here ... EDIT: It is not, because we use the library for the create-message-security-provider command too).

@dmatej
Using unique module names to avoid jar file caching
731d6a4 
- The file is owned by the domain, not by the application and not by the test.
- The server will notice that the file vanished at some point in time, but we
  cannot rely on that.
- Another reliable solution is to stop-domain - delete lib file - start-domain
- Also it is a bad practice to use the same library name for different
  contents.

Signed-off-by: David Matějček <david.matejcek@omnifish.ee>
@dmatej dmatej marked this pull request as ready for review March 28, 2024 00:36
@dmatej dmatej merged commit 25678fd into eclipse-ee4j:master Mar 28, 2024
2 checks passed
@dmatej dmatej deleted the jmactestfix branch March 28, 2024 09:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@avpinchuk avpinchuk avpinchuk approved these changes

@arjantijms arjantijms Awaiting requested review from arjantijms

@hs536 hs536 Awaiting requested review from hs536

@pzygielo pzygielo Awaiting requested review from pzygielo

@kaido207 kaido207 Awaiting requested review from kaido207

Assignees

@dmatej dmatej

Labels
bug Something isn't working code cleaning
Projects
None yet
Milestone
7.0.14
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@dmatej @avpinchuk