Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ELY-1422] SASL Scram+GS2 - posibility to not force channel binding #1034

Closed
wants to merge 1 commit into from
Closed

Conversation

hkalina
Copy link

@hkalina hkalina commented Nov 14, 2017

Added SASL property for Scram and GS2 allowing to use non-PLUS variant of mechanism
event when binding data are present - for situations when PLUS variant is disabled by mechanism selector, but without this property client thinks non-PLUS variant was chosen because PLUS is not supported by server - and when tell it to the server, server kills connection as downgrade attack, because it supports PLUS.

The same property is needed on server side when PLUS is disabled on server.

https://issues.jboss.org/browse/ELY-1422
https://issues.jboss.org/browse/JBEAP-12894

@dmlloyd
Copy link
Contributor

dmlloyd commented Nov 22, 2017

I think the point of PLUS is that there is no reason not to use it with TLS, and these mechanisms should never be disabled if TLS is in use. Is there a legitimate use case for allowing non-PLUS mechanisms in the TLS case, other than a configuration problem on the server?

@wildfly-ci
Copy link

Linux - JDK9 Build 80 outcome was FAILURE using a merge of 5629ea0
Summary: Compilation error: Compiler (new) Build time: 00:00:13

@wildfly-ci
Copy link

Linux Build 2058 outcome was FAILURE using a merge of 5629ea0
Summary: Compilation error: Compiler (new) Build time: 00:00:15

@wildfly-ci
Copy link

Windows Build 2048 outcome was FAILURE using a merge of 5629ea0
Summary: Compilation error: Compiler (new) Build time: 00:00:24

@hkalina hkalina closed this Nov 27, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
3 participants