Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[WFCORE-7153] Don't test reload-enhanced if it's not an available operation #6331

Merged
merged 2 commits into from
Jan 31, 2025
Merged

[WFCORE-7153] Don't test reload-enhanced if it's not an available operation #6331

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e929278
[WFCORE-7153] Add RBAC checks to ServerSuspendHandler and ServerResum…
bstansberry Jan 28, 2025
d7d77a5
[WFCORE-7153] Don't test reload-enhanced if it's not an available ope…
bstansberry Jan 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion server/src/main/java/org/jboss/as/server/operations/ServerResumeHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,20 @@
package org.jboss.as.server.operations;


import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.OP;
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.RESUME;
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.RUNNING_SERVER;

import java.util.EnumSet;

import org.jboss.as.controller.OperationContext;
import org.jboss.as.controller.OperationFailedException;
import org.jboss.as.controller.OperationStepHandler;
import org.jboss.as.controller.SimpleOperationDefinition;
import org.jboss.as.controller.SimpleOperationDefinitionBuilder;
import org.jboss.as.controller.access.Action;
import org.jboss.as.controller.access.AuthorizationResult;
import org.jboss.as.controller.logging.ControllerLogger;
import org.jboss.as.server.controller.descriptions.ServerDescriptions;
import org.jboss.as.server.logging.ServerLogger;
import org.jboss.as.server.suspend.ServerSuspendController;
Expand Down Expand Up @@ -45,7 +51,12 @@ public void execute(OperationContext context, ModelNode operation) throws Operat
context.acquireControllerLock();
context.addStep(new OperationStepHandler() {
@Override
public void execute(OperationContext context, ModelNode operation) throws OperationFailedException {
public void execute(OperationContext context, ModelNode operation) {
AuthorizationResult authorizationResult = context.authorize(operation, EnumSet.of(Action.ActionEffect.WRITE_RUNTIME));
if (authorizationResult.getDecision() == AuthorizationResult.Decision.DENY) {
throw ControllerLogger.ACCESS_LOGGER.unauthorized(operation.get(OP).asString(),
context.getCurrentAddress(), authorizationResult.getExplanation());
}
context.completeStep(new OperationContext.ResultHandler() {
@Override
public void handleResult(OperationContext.ResultAction resultAction, OperationContext context, ModelNode operation) {
Expand Down
13 changes: 12 additions & 1 deletion server/src/main/java/org/jboss/as/server/operations/ServerSuspendHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,13 @@
package org.jboss.as.server.operations;


import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.OP;
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.RUNNING_SERVER;
import static org.jboss.as.server.controller.resources.ServerRootResourceDefinition.SUSPEND_TIMEOUT;
import static org.jboss.as.server.controller.resources.ServerRootResourceDefinition.TIMEOUT;
import static org.jboss.as.server.controller.resources.ServerRootResourceDefinition.renameTimeoutToSuspendTimeout;

import java.util.EnumSet;
import java.util.concurrent.CancellationException;
import java.util.concurrent.CompletableFuture;
import java.util.concurrent.TimeUnit;
Expand All @@ -20,7 +22,10 @@
import org.jboss.as.controller.OperationStepHandler;
import org.jboss.as.controller.SimpleOperationDefinition;
import org.jboss.as.controller.SimpleOperationDefinitionBuilder;
import org.jboss.as.controller.access.Action;
import org.jboss.as.controller.access.AuthorizationResult;
import org.jboss.as.controller.descriptions.ModelDescriptionConstants;
import org.jboss.as.controller.logging.ControllerLogger;
import org.jboss.as.server.controller.descriptions.ServerDescriptions;
import org.jboss.as.server.logging.ServerLogger;
import org.jboss.as.server.suspend.ServerSuspendController;
Expand Down Expand Up @@ -57,7 +62,13 @@ public void execute(final OperationContext context, ModelNode operation) throws

context.addStep(new OperationStepHandler() {
@Override
public void execute(final OperationContext context, ModelNode operation) throws OperationFailedException {
public void execute(final OperationContext context, ModelNode operation) {
AuthorizationResult authorizationResult = context.authorize(operation, EnumSet.of(Action.ActionEffect.WRITE_RUNTIME));
if (authorizationResult.getDecision() == AuthorizationResult.Decision.DENY) {
throw ControllerLogger.ACCESS_LOGGER.unauthorized(operation.get(OP).asString(),
context.getCurrentAddress(), authorizationResult.getExplanation());
}

final ServerSuspendController suspendController = ServerSuspendHandler.this.suspendController;
ServerLogger.ROOT_LOGGER.suspendingServer(seconds, TimeUnit.SECONDS);
CompletableFuture<Void> suspend = suspendController.suspend(ServerSuspendController.Context.RUNNING).toCompletableFuture();
Expand Down
99 changes: 77 additions & 22 deletions ...c/src/test/java/org/jboss/as/test/integration/mgmt/access/StandardRolesBasicTestCase.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,15 +18,19 @@
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.READ_CHILDREN_NAMES_OPERATION;
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.READ_CONFIG_AS_XML_FILE_OPERATION;
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.READ_CONFIG_AS_XML_OPERATION;
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.READ_OPERATION_NAMES_OPERATION;
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.READ_RESOURCE_OPERATION;
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.RELOAD;
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.RELOAD_ENHANCED;
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.REMOVE;
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.RESULT;
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.RESUME;
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.SHUTDOWN;
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.SUBSYSTEM;
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.SUCCESS;
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.SUSPEND;
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.TYPE;
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.UNDEFINE_ATTRIBUTE_OPERATION;
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.UPLOAD_DEPLOYMENT_BYTES;
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.USER;
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.USERNAME;
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.VALUE;
Expand All @@ -43,8 +47,10 @@

import java.io.IOException;
import java.nio.charset.Charset;
import java.util.List;

import org.jboss.as.controller.PathAddress;
import org.jboss.as.controller.descriptions.ModelDescriptionConstants;
import org.jboss.as.controller.operations.common.Util;
import org.jboss.as.test.integration.management.interfaces.ManagementInterface;
import org.jboss.as.test.integration.management.rbac.Outcome;
Expand Down Expand Up @@ -73,12 +79,12 @@ public abstract class StandardRolesBasicTestCase extends AbstractManagementInter
protected static final String EXAMPLE_DS = "subsystem=rbac/rbac-constrained=default";
private static final String TEST_PATH = "path=rbac.test";

private static final ModelNode WFLY_1916_OP;
private static final ModelNode UPLOAD_DEPLOYMENT_BYTES;

static {
WFLY_1916_OP = Util.createEmptyOperation(UPLOAD_DEPLOYMENT_BYTES, PathAddress.EMPTY_ADDRESS);
WFLY_1916_OP.get(BYTES).set(new byte[64]);
WFLY_1916_OP.protect();
UPLOAD_DEPLOYMENT_BYTES = Util.createEmptyOperation(ModelDescriptionConstants.UPLOAD_DEPLOYMENT_BYTES, PathAddress.EMPTY_ADDRESS);
UPLOAD_DEPLOYMENT_BYTES.get(BYTES).set(new byte[64]);
UPLOAD_DEPLOYMENT_BYTES.protect();
}

protected static void deployDeployment1(ManagementClient client) throws IOException {
Expand Down Expand Up @@ -141,10 +147,15 @@ public void testMonitor() throws Exception {
addDeployment2(client, Outcome.UNAUTHORIZED);
addPath(client, Outcome.UNAUTHORIZED);

testWFLY1916(client, Outcome.UNAUTHORIZED);
uploadDeploymentBytes(client, Outcome.UNAUTHORIZED);

// Monitor can't shutdown
testWCORE1067(client);
suspend(client, Outcome.UNAUTHORIZED);
resume(client, Outcome.UNAUTHORIZED);

// Monitor can't shut down or reload
shutdownUnauthorized(client);
reloadUnauthorized(client);
reloadEnhancedUnauthorized(client);
}

@Test
Expand All @@ -164,7 +175,10 @@ public void testOperator() throws Exception {
addDeployment2(client, Outcome.UNAUTHORIZED);
addPath(client, Outcome.UNAUTHORIZED);

testWFLY1916(client, Outcome.SUCCESS);
uploadDeploymentBytes(client, Outcome.SUCCESS);

suspend(client, Outcome.SUCCESS);
resume(client, Outcome.SUCCESS);
}

@Test
Expand All @@ -184,7 +198,10 @@ public void testMaintainer() throws Exception {
addDeployment2(client, Outcome.SUCCESS);
addPath(client, Outcome.SUCCESS);

testWFLY1916(client, Outcome.SUCCESS);
uploadDeploymentBytes(client, Outcome.SUCCESS);

suspend(client, Outcome.SUCCESS);
resume(client, Outcome.SUCCESS);
}

@Test
Expand All @@ -204,10 +221,15 @@ public void testDeployer() throws Exception {
addDeployment2(client, Outcome.SUCCESS);
addPath(client, Outcome.UNAUTHORIZED);

testWFLY1916(client, Outcome.SUCCESS);
uploadDeploymentBytes(client, Outcome.SUCCESS);

// Deployer can't shutdown
testWCORE1067(client);
suspend(client, Outcome.UNAUTHORIZED);
resume(client, Outcome.UNAUTHORIZED);

// Deployer can't shut down or reload
shutdownUnauthorized(client);
reloadUnauthorized(client);
reloadEnhancedUnauthorized(client);
}

@Test
Expand All @@ -229,7 +251,10 @@ public void testAdministrator() throws Exception {
addDeployment2(client, Outcome.SUCCESS);
addPath(client, Outcome.SUCCESS);

testWFLY1916(client, Outcome.SUCCESS);
uploadDeploymentBytes(client, Outcome.SUCCESS);

suspend(client, Outcome.SUCCESS);
resume(client, Outcome.SUCCESS);
}

@Test
Expand All @@ -250,10 +275,15 @@ public void testAuditor() throws Exception {
addDeployment2(client, Outcome.UNAUTHORIZED);
addPath(client, Outcome.UNAUTHORIZED);

testWFLY1916(client, Outcome.UNAUTHORIZED);
uploadDeploymentBytes(client, Outcome.UNAUTHORIZED);

// Auditor can't shutdown
testWCORE1067(client);
suspend(client, Outcome.UNAUTHORIZED);
resume(client, Outcome.UNAUTHORIZED);

// Auditor can't shut down or reload
shutdownUnauthorized(client);
reloadUnauthorized(client);
reloadEnhancedUnauthorized(client);
}

@Test
Expand All @@ -274,7 +304,7 @@ public void testSuperUser() throws Exception {
addDeployment2(client, Outcome.SUCCESS);
addPath(client, Outcome.SUCCESS);

testWFLY1916(client, Outcome.SUCCESS);
uploadDeploymentBytes(client, Outcome.SUCCESS);
}

private static void whoami(ManagementInterface client, String expectedUsername) throws IOException {
Expand Down Expand Up @@ -335,7 +365,7 @@ private static ModelNode readResource(ManagementInterface client, String address
}

private static ModelNode readAttribute(ManagementInterface client, String address, String attributeName,
Outcome expectedOutcome) throws IOException {
Outcome expectedOutcome) throws IOException {
ModelNode op = createOpNode(address, READ_ATTRIBUTE_OPERATION);
op.get(NAME).set(attributeName);

Expand Down Expand Up @@ -438,14 +468,39 @@ private static void addRemoveIncldueForRole(final ManagementInterface client, fi
}
}

private void testWFLY1916(ManagementInterface client, Outcome expected) throws IOException {
ModelNode op = WFLY_1916_OP.clone();
private static void uploadDeploymentBytes(ManagementInterface client, Outcome expected) throws IOException {
ModelNode op = UPLOAD_DEPLOYMENT_BYTES.clone();
RbacUtil.executeOperation(client, op, expected);
}

private static void suspend(ManagementInterface client, Outcome expected) throws IOException {
ModelNode op = Util.createEmptyOperation(SUSPEND, PathAddress.EMPTY_ADDRESS);
RbacUtil.executeOperation(client, op, expected);
}

private void testWCORE1067(ManagementInterface client) throws IOException {
private static void resume(ManagementInterface client, Outcome expected) throws IOException {
ModelNode op = Util.createEmptyOperation(RESUME, PathAddress.EMPTY_ADDRESS);
RbacUtil.executeOperation(client, op, expected);
}

private static void shutdownUnauthorized(ManagementInterface client) throws IOException {
ModelNode op = Util.createEmptyOperation(SHUTDOWN, PathAddress.EMPTY_ADDRESS);
RbacUtil.executeOperation(client, op, Outcome.UNAUTHORIZED);
}

private static void reloadUnauthorized(ManagementInterface client) throws IOException {
ModelNode op = Util.createEmptyOperation(RELOAD, PathAddress.EMPTY_ADDRESS);
RbacUtil.executeOperation(client, op, Outcome.UNAUTHORIZED);
}

private static void reloadEnhancedUnauthorized(ManagementInterface client) throws IOException {
ModelNode opNames = Util.createEmptyOperation(READ_OPERATION_NAMES_OPERATION, PathAddress.EMPTY_ADDRESS);
List<ModelNode> ops = RbacUtil.executeOperation(client, opNames, Outcome.SUCCESS)
.get(RESULT).asList();
if (ops.contains(new ModelNode(RELOAD_ENHANCED))) {
ModelNode op = Util.createEmptyOperation(RELOAD_ENHANCED, PathAddress.EMPTY_ADDRESS);
RbacUtil.executeOperation(client, op, Outcome.UNAUTHORIZED);
}
}

}
Loading