[WFLY-4582] Move to Remoting 5 based APIs

appclient/src/main/java/org/jboss/as/appclient/service/LazyConnectionContextSelector.java

@@ -22,6 +22,8 @@
 
 package org.jboss.as.appclient.service;
 
+import static java.security.AccessController.doPrivileged;
+
 import java.io.IOException;
 import java.net.URI;
 import java.net.URISyntaxException;
@@ -36,9 +38,10 @@
 import org.jboss.ejb.client.remoting.IoFutureHelper;
 import org.jboss.remoting3.Connection;
 import org.jboss.remoting3.Endpoint;
-import org.jboss.remoting3.Remoting;
-import org.jboss.remoting3.remote.HttpUpgradeConnectionProviderFactory;
-import org.jboss.remoting3.remote.RemoteConnectionProviderFactory;
+import org.wildfly.security.auth.client.AuthenticationConfiguration;
+import org.wildfly.security.auth.client.AuthenticationContext;
+import org.wildfly.security.auth.client.AuthenticationContextConfigurationClient;
+import org.wildfly.security.auth.client.MatchRule;
 import org.wildfly.security.manager.WildFlySecurityManager;
 import org.xnio.IoFuture;
 import org.xnio.IoUtils;
@@ -54,6 +57,8 @@
  */
 public class LazyConnectionContextSelector implements ContextSelector<EJBClientContext> {
 
+    private static final AuthenticationContextConfigurationClient AUTH_CONFIGURATION_CLIENT = doPrivileged(AuthenticationContextConfigurationClient.ACTION);
+
     private final String hostUrl;
     private final CallbackHandler callbackHandler;
     private final ClassLoader classLoader;
@@ -73,13 +78,15 @@ public LazyConnectionContextSelector(final String hostUrl, final CallbackHandler
 
     private synchronized void createConnection() {
         try {
-            endpoint = Remoting.createEndpoint("endpoint", OptionMap.EMPTY);
-            endpoint.addConnectionProvider("remote", new RemoteConnectionProviderFactory(), OptionMap.create(Options.SSL_ENABLED, Boolean.FALSE));
-            endpoint.addConnectionProvider("http-remoting", new HttpUpgradeConnectionProviderFactory(), OptionMap.create(Options.SSL_ENABLED, Boolean.FALSE));
-            endpoint.addConnectionProvider("https-remoting", new HttpUpgradeConnectionProviderFactory(),  OptionMap.create(Options.SSL_ENABLED, Boolean.TRUE));
+            final URI uri = new URI(hostUrl);
+            AuthenticationContext captured = AuthenticationContext.captureCurrent();
+            AuthenticationConfiguration mergedConfiguration = AUTH_CONFIGURATION_CLIENT.getAuthenticationConfiguration(uri, captured);
+            if (callbackHandler != null) mergedConfiguration = mergedConfiguration.useCallbackHandler(callbackHandler);
+            final AuthenticationContext context = AuthenticationContext.empty().with(MatchRule.ALL, mergedConfiguration);
 
             // open a connection
-            final IoFuture<Connection> futureConnection = endpoint.connect(new URI(hostUrl), OptionMap.create(Options.SASL_POLICY_NOANONYMOUS, Boolean.FALSE, Options.SASL_POLICY_NOPLAINTEXT, Boolean.FALSE), callbackHandler);
+            endpoint = Endpoint.getCurrent();
+            final IoFuture<Connection> futureConnection = endpoint.connect(uri, OptionMap.create(Options.SASL_POLICY_NOANONYMOUS, Boolean.FALSE, Options.SASL_POLICY_NOPLAINTEXT, Boolean.FALSE), context);
             connection = IoFutureHelper.get(futureConnection, 30L, TimeUnit.SECONDS);
 
             final EJBClientContext ejbClientContext = EJBClientContext.create(classLoader);

security/api/src/main/java/org/jboss/as/security/api/ConnectionSecurityContext.java

@@ -25,16 +25,20 @@
 import java.security.Principal;
 import java.util.Collection;
 import java.util.Collections;
+import java.util.HashSet;
+import java.util.stream.StreamSupport;
 
 import javax.security.auth.Subject;
 
-import org.jboss.as.core.security.SubjectUserInfo;
+import org.jboss.as.core.security.RealmGroup;
+import org.jboss.as.core.security.RealmRole;
+import org.jboss.as.core.security.RealmUser;
 import org.jboss.as.security.remoting.RemotingContext;
 import org.jboss.remoting3.Connection;
-import org.jboss.remoting3.security.UserInfo;
 import org.jboss.security.SecurityContext;
 import org.jboss.security.SecurityContextAssociation;
 import org.jboss.security.SecurityContextFactory;
+import org.wildfly.security.auth.server.SecurityIdentity;
 
 /**
  * Utility class to allow inspection and replacement of identity associated with the Connection.
@@ -63,10 +67,15 @@ public static Collection<Principal> getConnectionPrincipals() {
         Connection con = RemotingContext.getConnection();
 
         if (con != null) {
-            UserInfo userInfo = con.getUserInfo();
-            if (userInfo instanceof SubjectUserInfo) {
-                SubjectUserInfo sinfo = (SubjectUserInfo) userInfo;
-                return sinfo.getPrincipals();
+            Collection<Principal> principals = new HashSet<>();
+            SecurityIdentity localIdentity = con.getLocalIdentity();
+            if (localIdentity != null) {
+                principals.add(new RealmUser(localIdentity.getPrincipal().getName()));
+                StreamSupport.stream(localIdentity.getRoles().spliterator(), true).forEach((String role) -> {
+                    principals.add(new RealmGroup(role));
+                    principals.add(new RealmRole(role));
+                });
+                return principals;
             } else {
                 return Collections.emptySet();
             }

security/subsystem/src/main/java/org/jboss/as/security/remoting/RemotingConnectionCredential.java

@@ -24,11 +24,17 @@
 
 package org.jboss.as.security.remoting;
 
+import java.security.Principal;
+import java.util.Set;
+import java.util.stream.StreamSupport;
+
 import javax.security.auth.Subject;
 
-import org.jboss.as.core.security.SubjectUserInfo;
+import org.jboss.as.core.security.RealmGroup;
+import org.jboss.as.core.security.RealmRole;
+import org.jboss.as.core.security.RealmUser;
 import org.jboss.remoting3.Connection;
-import org.jboss.remoting3.security.UserInfo;
+import org.wildfly.security.auth.server.SecurityIdentity;
 
 /**
  * A Credential wrapping a Remoting {@link Connection}.
@@ -42,10 +48,15 @@ public final class RemotingConnectionCredential {
 
     public RemotingConnectionCredential(final Connection connection) {
         this.connection = connection;
-        Subject subject = null;
-        UserInfo userInfo = connection.getUserInfo();
-        if (userInfo instanceof SubjectUserInfo) {
-            subject = ((SubjectUserInfo) userInfo).getSubject();
+        Subject subject = new Subject();
+        SecurityIdentity localIdentity = connection.getLocalIdentity();
+        if (localIdentity != null) {
+            Set<Principal> principals = subject.getPrincipals();
+            principals.add(new RealmUser(localIdentity.getPrincipal().getName()));
+            StreamSupport.stream(localIdentity.getRoles().spliterator(), true).forEach((String role) -> {
+                principals.add(new RealmGroup(role));
+                principals.add(new RealmRole(role));
+            });
         }
         this.subject = subject;
     }

security/subsystem/src/main/java/org/jboss/as/security/remoting/RemotingConnectionPrincipal.java

@@ -23,11 +23,10 @@
 package org.jboss.as.security.remoting;
 
 import java.security.Principal;
-import java.util.Collection;
 
 import org.jboss.as.security.logging.SecurityLogger;
 import org.jboss.remoting3.Connection;
-import org.jboss.remoting3.security.UserPrincipal;
+import org.wildfly.security.auth.server.SecurityIdentity;
 
 /**
  * A {@link Principal} implementation to wrap a Remoting {@link Connection} and represent the identity authenticated against that Connection.
@@ -42,13 +41,10 @@ public final class RemotingConnectionPrincipal implements Principal {
 
     public RemotingConnectionPrincipal(final Connection connection) {
         this.connection = connection;
-        Collection<Principal> principals = connection.getPrincipals();
+        SecurityIdentity localIdentity = connection.getLocalIdentity();
         String userName = null;
-        for (Principal current : principals) {
-            if (current instanceof UserPrincipal) {
-                userName = current.getName();
-                break;
-            }
+        if (localIdentity != null) {
+            userName = localIdentity.getPrincipal().getName();
         }
         if (userName == null) {
             throw SecurityLogger.ROOT_LOGGER.noUserPrincipalFound();

security/subsystem/src/main/java/org/jboss/as/security/remoting/RemotingLoginModule.java

@@ -37,13 +37,11 @@
 import javax.security.auth.login.LoginException;
 
 import org.jboss.as.core.security.RealmUser;
-import org.jboss.as.core.security.SubjectUserInfo;
 import org.jboss.remoting3.Connection;
-import org.jboss.remoting3.security.UserInfo;
-import org.jboss.remoting3.security.UserPrincipal;
 import org.jboss.security.SimpleGroup;
 import org.jboss.security.auth.callback.ObjectCallback;
 import org.jboss.security.auth.spi.AbstractServerLoginModule;
+import org.wildfly.security.auth.server.SecurityIdentity;
 
 /**
  * A simple LoginModule to take the UserPrincipal from the inbound Remoting connection and to use it as an already authenticated
@@ -103,23 +101,9 @@ public boolean login() throws LoginException {
             Connection con = ((RemotingConnectionCredential) credential).getConnection();
             Principal up = null;
 
-            UserInfo userInfo = con.getUserInfo();
-            if (userInfo instanceof SubjectUserInfo) {
-                for (Principal current : ((SubjectUserInfo) userInfo).getPrincipals()) {
-                    if (current instanceof RealmUser) {
-                        up = current;
-                        break;
-                    }
-                }
-            }
-
-            if (up == null) {
-                for (Principal current : con.getPrincipals()) {
-                    if (current instanceof UserPrincipal) {
-                        up = current;
-                        break;
-                    }
-                }
+            SecurityIdentity localIdentity = con.getLocalIdentity();
+            if (localIdentity != null) {
+                up = new RealmUser(localIdentity.getPrincipal().getName());
             }
 
             // If we found a principal from the connection then authentication succeeded.

security/subsystem/src/main/java/org/jboss/as/security/service/SimpleSecurityManager.java

@@ -40,14 +40,11 @@
 import javax.security.jacc.PolicyContext;
 
 import org.jboss.as.core.security.ServerSecurityManager;
-import org.jboss.as.core.security.SubjectUserInfo;
-import org.jboss.as.domain.management.security.PasswordCredential;
 import org.jboss.as.security.logging.SecurityLogger;
 import org.jboss.as.security.remoting.RemotingConnectionCredential;
 import org.jboss.as.security.remoting.RemotingConnectionPrincipal;
 import org.jboss.metadata.javaee.spec.SecurityRolesMetaData;
 import org.jboss.remoting3.Connection;
-import org.jboss.remoting3.security.UserInfo;
 import org.jboss.security.AuthenticationManager;
 import org.jboss.security.ISecurityManagement;
 import org.jboss.security.RunAs;
@@ -69,6 +66,10 @@
 import org.jboss.security.javaee.AbstractEJBAuthorizationHelper;
 import org.jboss.security.javaee.SecurityHelperFactory;
 import org.jboss.security.javaee.SecurityRoleRef;
+import org.wildfly.security.auth.server.IdentityCredentials;
+import org.wildfly.security.auth.server.SecurityIdentity;
+import org.wildfly.security.credential.PasswordCredential;
+import org.wildfly.security.password.interfaces.ClearPassword;
 
 /**
  * @author <a href="mailto:cdewolf@redhat.com">Carlo de Wolf</a>
@@ -298,19 +299,16 @@ public void push(final String securityDomain) {
                 SecurityContextUtil util = current.getUtil();
 
                 Connection connection = SecurityActions.remotingContextGetConnection();
-                UserInfo userInfo = connection.getUserInfo();
                 Principal p = null;
                 Object credential = null;
 
-                if (userInfo instanceof SubjectUserInfo) {
-                    SubjectUserInfo sinfo = (SubjectUserInfo) userInfo;
-                    Subject subject = sinfo.getSubject();
-
-                    Set<PasswordCredential> pcSet = subject.getPrivateCredentials(PasswordCredential.class);
-                    if (pcSet.size() > 0) {
-                        PasswordCredential pc = pcSet.iterator().next();
-                        p = new SimplePrincipal(pc.getUserName());
-                        credential = new String(pc.getCredential());
+                SecurityIdentity localIdentity = connection.getLocalIdentity();
+                if (localIdentity != null) {
+                    p = new SimplePrincipal(localIdentity.getPrincipal().getName());
+                    IdentityCredentials privateCredentials = localIdentity.getPrivateCredentials();
+                    PasswordCredential passwordCredential = privateCredentials.getCredential(PasswordCredential.class, ClearPassword.ALGORITHM_CLEAR);
+                    if (passwordCredential != null) {
+                        credential = new String(passwordCredential.getPassword(ClearPassword.class).getPassword());
                     }
                 }
 

testsuite/integration/basic/src/test/java/org/jboss/as/test/integration/ejb/container/interceptor/security/ServerSecurityInterceptor.java

@@ -30,15 +30,14 @@
 import java.util.Map;
 
 import org.jboss.as.core.security.RealmUser;
-import org.jboss.as.core.security.SubjectUserInfo;
 import org.jboss.as.security.remoting.RemotingContext;
 import org.jboss.logging.Logger;
 import org.jboss.remoting3.Connection;
-import org.jboss.remoting3.security.UserInfo;
 import org.jboss.security.SecurityContext;
 import org.jboss.security.SecurityContextAssociation;
 import org.jboss.security.SecurityContextFactory;
 import org.jboss.security.SimplePrincipal;
+import org.wildfly.security.auth.server.SecurityIdentity;
 
 /**
  * The server side security interceptor responsible for handling any security identity propagated from the client.
@@ -64,15 +63,9 @@ public Object aroundInvoke(final InvocationContext invocationContext) throws Exc
             Connection con = RemotingContext.getConnection();
 
             if (con != null) {
-                UserInfo userInfo = con.getUserInfo();
-                if (userInfo instanceof SubjectUserInfo) {
-                    SubjectUserInfo sinfo = (SubjectUserInfo) userInfo;
-                    for (Principal current : sinfo.getPrincipals()) {
-                        if (current instanceof RealmUser) {
-                            connectionUser = (RealmUser) current;
-                            break;
-                        }
-                    }
+                SecurityIdentity localIdentity = con.getLocalIdentity();
+                if (localIdentity != null) {
+                    connectionUser = new RealmUser(localIdentity.getPrincipal().getName());
                 }
 
             } else {

testsuite/integration/basic/src/test/java/org/jboss/as/test/integration/ejb/security/AnnSBTest.java

@@ -52,13 +52,15 @@
 import org.jboss.logging.Logger;
 import org.jboss.remoting3.Connection;
 import org.jboss.remoting3.Endpoint;
-import org.jboss.remoting3.Remoting;
 import org.jboss.remoting3.remote.HttpUpgradeConnectionProviderFactory;
 import org.jboss.remoting3.remote.RemoteConnectionProviderFactory;
 import org.jboss.shrinkwrap.api.Archive;
 import org.jboss.shrinkwrap.api.ShrinkWrap;
 import org.jboss.shrinkwrap.api.spec.JavaArchive;
 import org.junit.Assert;
+import org.wildfly.security.auth.client.AuthenticationConfiguration;
+import org.wildfly.security.auth.client.AuthenticationContext;
+import org.wildfly.security.auth.client.MatchRule;
 import org.xnio.IoFuture;
 import org.xnio.OptionMap;
 import org.xnio.Options;
@@ -286,9 +288,7 @@ public void testSingleMethodAnnotationsUser2Template(final String MODULE, final
 
     protected ContextSelector<EJBClientContext> setupEJBClientContextSelector(String username, String password) throws IOException {
         // create the endpoint
-        final Endpoint endpoint = Remoting.createEndpoint("remoting-test", OptionMap.create(Options.THREAD_DAEMON, true));
-        endpoint.addConnectionProvider("remote", new RemoteConnectionProviderFactory(), OptionMap.create(Options.SSL_ENABLED, false));
-        endpoint.addConnectionProvider("http-remoting", new HttpUpgradeConnectionProviderFactory(), OptionMap.create(Options.SSL_ENABLED, false));
+        final Endpoint endpoint = Endpoint.getCurrent();
         final URI connectionURI = managementClient.getRemoteEjbURL();
 
         OptionMap.Builder builder = OptionMap.builder().set(Options.SASL_POLICY_NOANONYMOUS, true);
@@ -299,7 +299,12 @@ protected ContextSelector<EJBClientContext> setupEJBClientContextSelector(String
             builder.set(Options.SASL_MECHANISMS, Sequence.of("JBOSS-LOCAL-USER"));
         }
 
-        final IoFuture<Connection> futureConnection = endpoint.connect(connectionURI, builder.getMap(), new AuthenticationCallbackHandler(username, password));
+        final AuthenticationContext authenticationContext = AuthenticationContext.empty()
+                .with(
+                        MatchRule.ALL,
+                        AuthenticationConfiguration.EMPTY
+                                .useCallbackHandler(new AuthenticationCallbackHandler(username, password)));
+        final IoFuture<Connection> futureConnection = endpoint.connect(connectionURI, builder.getMap(), authenticationContext);
         // wait for the connection to be established
         final Connection connection = IoFutureHelper.get(futureConnection, 5000, TimeUnit.MILLISECONDS);
         // create a remoting EJB receiver for this connection