Develop Reference

How to migrate legacy login module to jaas-realm

I am trying to find a way to migrate our security solution from WildFly 22 to WildFly 26, where the legacy way with custom login modules is no longer supported. I found for example this blog post https://wildfly-security.github.io/wildfly-elytron/blog/jaas-realm/ suggesting to use jaas-realm, but I am not able to configure it to be honest.
What exactly should I do, if I want to migrate this example? This was in earlier versions of WildFly defined like this:
<security-domain name="my-form-auth" cache-type="default">
<authentication>
<login-module name="FirstLoginModule" code="my.first.lm.FirstLoginModule" flag="sufficient">
<module-option name="config.filename" value=".first_lm_props" />
</login-module>
<login-module name="SecondLoginModule" code="my.second.lm.SecondLoginModule" flag="sufficient">
<module-option name="config.filename" value=".second_lm_props" />
</login-module>
</authentication>
</security-domain>
Actual code of these login modules was available to WildFly as a dependency of deployed application.
So far, I managed to set configuration of WildFly 26 like this (with basic scenario - just one login module):
<security-domains>
...
<security-domain name="mySD" default-realm="myJaasRealm" permission-mapper="default-permission-mapper">
<realm name="myJaasRealm"/>
</security-domain>
</security-domains>
<security-realms>
...
<jaas-realm name="myJaasRealm" entry="myEntry" module="my.module.with.lm">
<file path="D:\APP\Wildfly\wildfly-26.0.1.Final\bin\elytron\JAAS-login-module.conf"/>
</jaas-realm>
</security-realms>
....
<http>
<http-authentication-factory name="example-loginconfig-http-auth" security-domain="mySD" http-server-mechanism-factory="global">
<mechanism-configuration>
<mechanism mechanism-name="FORM">
<mechanism-realm realm-name="myJaasRealm"/>
</mechanism>
</mechanism-configuration>
</http-authentication-factory>
</http>
....
<subsystem xmlns="urn:jboss:domain:undertow:12.0" default-server="default-server" default-virtual-host="default-host" default-servlet-container="default" default-security-domain="other" statistics-enabled="${wildfly.undertow.statistics-enabled:${wildfly.statistics-enabled:false}}">
...
<application-security-domains>
<application-security-domain name="other" http-authentication-factory="example-loginconfig-http-auth"/>
</application-security-domains>
</subsystem>
JAAS-login-module.conf:
MyEntry {
my.first.lm.FirstLoginModule sufficient;
};
jboss-web.xml:
<jboss-web>
<context-root>${context-root}</context-root>
<security-domain>other</security-domain>
</jboss-web>
Still, I am not able to get it to work.

<jboss-web>
<context-root>${context-root}</context-root>
<security-domain>mySD</security-domain>
</jboss-web>
In web.xml also you have to configure your realm name like
<login-config>
<auth-method>FORM</auth-method>
<realm-name>myJaasRealm</realm-name>
</login-config>

JBoss authentication when password is encoded by ARGON2id

I have password encrypted by Argon2id in database.
How can I change my configuration to let JBoss know that it have to use Argon2 to verify password?
standalone.xml
<security-domain name="databaseDomain">
<authentication>
<login-module code="Database" flag="required">
<module-option name="dsJndiName" value="java:/datasources/hotel"/>
<module-option name="principalsQuery" value="select password from users where login=?"/>
<module-option name="rolesQuery" value="SELECT employee.position,'Roles' FROM users, employee WHERE employee.id=users.employeeId and login=?"/>
<module-option name="unauthenticatedIdentity" value="guest"/>
</login-module>
</authentication>
</security-domain>
web.xml
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/login.html</form-login-page>
<form-error-page>/error.html</form-error-page>
</form-login-config>
</login-config>
jboss-web.xml
<jboss-web>
<security-domain>databaseDomain</security-domain>
</jboss-web>
I added ARGON2 with
<dependency>
<groupId>de.mkammerer</groupId>
<artifactId>argon2-jvm</artifactId>
<version>2.7</version>
</dependency>
I tried adding to standalone.xml
<module-option name="hashAlgorithm" value="ARGON2id"/>
but it didn't work and I wasn't that suprised about this. My form is calling to j_security_check

You need to implement your own login module, sounds scary, but actually it's not.
Find out which version of Picketbox you're Wildfly is bundled with - look in the modules/system/layers/base/org/picketbox/main directory. I.e. for WF 21 the version of Picketbox is 5.0.3.Final
Add the Picketbox library as a provided-scoped dependency to your project
Implement your custom login module by extending the org.jboss.security.auth.spi.DatabaseServerLoginModule class and overriding the convertRawPassword method - this is where you need to convert the user's input into the Argon2 form
Provide the full class name in the code parameter in your login module configuration in standalone.xml. Wildfly will pick it from your deployment and use your implementation instead of the default one.
This should work.

WIldfly - sql query after successful authentication

I would like to know if it is possible to make an additional query from the wildfly level after correct authentication and authorization. After logging in correctly to the database, I need to add an information record to the database (SQL) about the login date. Is it possible to do this from the xml level?
(I'm using wildfly 17, the configuration works below)
<authentication>
<login-module code="LdapExtended" flag="required">
<module-option name="java.naming.factory.initial" value="com.sun.jndi.ldap.LdapCtxFactory"/>
<module-option name="java.naming.security.protocol" value="ssl"/>
<module-option name="password-stacking" value="useFirstPass"/>
<module-option name="java.naming.security.authentication" value="simple"/>
<module-option name="java.naming.provider.url" value="ldaps://xxx.xxx.xxx:636"/>
<module-option name="bindDN" value="cn=xxx,dc=xxx,dc=xxx"/>
<module-option name="bindCredential" value="xxx"/>
<module-option name="baseCtxDN" value="ou=xxx,dc=xxx,dc=xxx"/>
<module-option name="baseFilter" value="(uid={0})"/>
<module-option name="roleAttributeID" value="cn"/>
<module-option name="searchScope" value="SUBTREE_SCOPE"/>
<module-option name="allowEmptyPasswords" value="true"/>
<module-option name="defaultRole" value="xxx"/>
</login-module>
<login-module code="Database" flag="required">
<module-option name="password-stacking" value="useFirstPass"/>
<module-option name="dsJndiName" value="java:/xxxJNDI"/>
<module-option name="rolesQuery" value="query for roles)"/>
</login-module>
</authentication>

You can't configure it from within the PicketBox (old security module of JBoss/Wildfly) Database LoginModule. You will have to write your own custom LoginModule (see e.g. here: http://www.mastertheboss.com/jboss-server/jboss-security/creating-a-custom-jboss-login-module)
Maybe it is also an opportunity to migrate to the new security module Elytron which no longer provides LoginModules but supports a jdbc-realm where you can directly query against a DB. (see here https://docs.jboss.org/author/display/WFLY/Database+Authentication+Migration)

How to configure multiple Login modules in one security domain in JBOSS EAP 6.3?

I have two groups of users - employees and members, employees are in LDAP server and members are in properties file. I need to configure both of them in a single security domain, which means I need to get authentication from different login modules - employees from LdapExtLoginModule, and, members from UsersRoles login module. Something like this:
<security-domain name="EmpMem" cache-type="default">
<authentication>
<login-module code="UsersRoles" flag="required">
<module-option name="password-stacking" value="useFirstPass"/>
<module-option name="usersProperties" value="app-users.properties"/>
<module-option name="rolesProperties" value="app-roles.properties"/>
</login-module>
<login-module code="org.jboss.security.auth.spi.LdapExtLoginModule" flag="required">
<module-option name="password-stacking" value="useFirstPass"/>
<module-option name="java.naming.provider.url" value="ldap://ha-adds-global.xxx.com:3268"/>
<module-option name="bindDN" value="CN=prodjbsvc,OU=ServiceAccounts,OU=NOPOL,dc=eagle,dc=xxx,dc=com"/>
<module-option name="bindCredential" value="XQtU#1lc"/>
<module-option name="baseCtxDN" value="dc=eagle,dc=xxx,dc=com"/>
<module-option name="baseFilter" value="(sAMAccountName={0})"/>
<module-option name="rolesCtxDN" value="ou=COSAs,dc=eagle,dc=xxx,dc=com"/>
<module-option name="roleFilter" value="(sAMAccountName={0})"/>
<module-option name="roleAttributeID" value="memberOf"/>
<module-option name="roleAttributeIsDN" value="true"/>
<module-option name="roleNameAttributeID" value="cn"/>
<module-option name="roleRecursion" value="-1"/>
<module-option name="searchScope" value="SUBTREE_SCOPE"/>
<module-option name="allowEmptyPasswords" value="false"/>
<module-option name="java.naming.referral" value="follow"/>
</login-module>
</authentication>
</security-domain>
I know that there is a login module called Password Stacking which can chain multiple login modules together, but looks like LdapExtLoginModule doesn't support that? Please suggest a way to accomplish this.
My Requirement:
When the user is employee, he gets authenticated from LDAP server and should be able to to access employee resources (java packages/classes)only, and when the user is member, he gets authenticated from properties file and should be able to access member resources (java packages/classes) only.

If sufficient for your needs use LdapLoginModule instead of LdapExtLoginModule.
Password Stacking is supported by that LoginModule.
However, judging by your Requirement I don't think Password Stacking is what you're looking for ...
If a previous module configured for password stacking has authenticated the user, all the other stacking modules will consider the user authenticated and only attempt to provide a set of roles for the authorization step.
Seems like a User will either be a employee or a member? If so, use "sufficient" as the LoginModule "flag" attribute
sufficient : The login module is not required to succeed. If it does succeed, control immediately returns to the application. If it fails, authentication continues down the login stack.

Wildfly 8.2 SSO logout issue across apps in the same domain

I have some strange behaviour, and I am not sure why. I have two apps that work well in Tomcat 7, but do not behave correctly in Wildfly 8.2 and 9Beta2.
In Tomcat, I can log in on one app, go to the 2nd app and I can see my login state is correct, log out in the 2nd app, return to the 1st app, and I am logged out there. This is correct.
In Tomcat, I can log in on one app, go to the 2nd app and I can see my login state is correct, return to the 1st app, log out in the 1st app, return to the 2nd app, and I am logged out there. This is correct.
In Wildfly, I log in to the 1st app, go to the 2nd app and I can see my login state is correct, log out of the 2nd app, return to the 1st app, but I am still logged in. Incorrect.
In Wildfly, I log in to the 1st app, go to the 2nd app and I can see my login state is correct, return to the 1st app, log out of the 1st app, go to the 2nd app, and I am logged out there as well. Correct.
Why does Wildfly fail the first test (3. above)?
Any pointers would be greatly appreciated.
Here are some of the extracts from my files:
From standalone.xml
<security-realm name="DataSourceRealm">
<authentication>
<jaas name="app"/>
</authentication>
</security-realm>
<security-domain name="app" cache-type="default">
<authentication>
<login-module code="Database" flag="requisite">
<module-option name="password-stacking" value="useFirstPass"/>
<module-option name="dsJndiName" value="jdbc/icedb"/>
<module-option name="principalsQuery" value="select PASSWORD from WSV_USR_PRFL_DEF where USR_PRFL_DEF_ID=?"/>
<module-option name="rolesQuery" value="select USR_GRP_DEF_ID, 'Roles' from WSV_USR_GRP_MAP where USR_PRFL_DEF_ID = ?"/>
<module-option name="unauthenticatedIdentity" value="guest"/>
</login-module>
<login-module code="RoleMapping" flag="requisite">
<module-option name="rolesProperties" value="file:${jboss.server.config.dir}/app.properties"/>
<module-option name="replaceRole" value="false"/>
</login-module>
</authentication>
</security-domain>
<subsystem xmlns="urn:jboss:domain:undertow:2.0">
<buffer-cache name="default"/>
<server name="default-server">
<http-listener name="default" socket-binding="http"/>
<host name="default-host" alias="localhost">
<single-sign-on path="/"/>
.....
from the various applications (WAR) jboss-web.xml:
<jboss-web>
<context-root>/APPNAME</context-root>
<security-domain flushOnSessionInvalidation="true">app</security-domain>
</jboss-web>
From my logout.java:
#WebServlet(name="logout", urlPatterns={"/lo.xhtml"}, loadOnStartup=2)
public class Logout extends HttpServlet{
#Override
protected void doGet(HttpServletRequest request,
HttpServletResponse response) throws ServletException, IOException {
if (request.getSession(false) != null) {
HttpSession ses = request.getSession(false);
ses.invalidate(); // remove session.
}
request.logout();
response.sendRedirect(request.getContextPath());
}
}