1 2 Previous Next 17 Replies Latest reply on Sep 2, 2014 11:21 AM by jamezp

Error to list security via ModelControllerClient

ofbizbrazil Aug 28, 2014 11:00 AM

Hi all,

I have a client that lists a security section via ModelControllerClient on Jboss 7, but when I try to migrate to Widlfy 8.1 I got an error saying that key does not exist.

Could anyone help on it?

Code:

	final ModelNode request = new ModelNode();
	request.get(ClientConstants.OP).set("read-resource");
	request.get("recursive").set(true);
	request.get(ClientConstants.OP_ADDR).add("subsystem", "security");

	final ModelControllerClient client = ModelControllerClient.Factory.create(InetAddress.getByName("127.0.0.1"), 9999);
	final ModelNode response = client.execute(new OperationBuilder(request).build());

Result

{

"outcome" => "failed",

"failure-description" => "JBAS014807: Management resource '[(\"subsystem\" => \"security\")]' not found",

"rolled-back" => true

}

Thanks a lot!

Cheers,

1. Re: Error to list security via ModelControllerClient

jamezp Aug 28, 2014 4:52 PM (in response to ofbizbrazil)

I just started WildFly 8.1.0.Final and the security subsystem is definitely there. Are you possibly booting with a configuration file that doesn't have the extension installed?

--
James R. Perkins
Actions
2. Re: Error to list security via ModelControllerClient

ofbizbrazil Aug 28, 2014 7:51 PM (in response to jamezp)

Hi James, I have the configuration file with security-domain setup, cause my datasource uses it.
When test the datasource, it can establish communication with database using the password encrypted in security / security-domain,
So I wonder why via Java API CLI gives this error, considering it works fine in JBoss 7.1.1.
Actions

3. Re: Re: Error to list security via ModelControllerClient

jamezp Aug 28, 2014 8:15 PM (in response to ofbizbrazil)

I'm not sure it worked fine for me.

This is what I used

public static void main(final String[] args) throws Exception {
    try (final ModelControllerClient client = ModelControllerClient.Factory.create(InetAddress.getLocalHost(), 9990)) {
        final ModelNode op = Operations.createReadResourceOperation(new ModelNode().addEmptyList().add("subsystem", "security"));
        op.get("recursive").set(true);
        final ModelNode result = client.execute(op);
        if (Operations.isSuccessfulOutcome(result)) {
            System.out.println(Operations.readResult(result));
        } else {
            System.out.println(Operations.getFailureDescription(result));
        }
    }
}

The one thing I did notice is you are still using port 9999. The new port is 9990 unless you changed that. Though that shouldn't be giving an error like you're seeing.

James R. Perkins

4. Re: Error to list security via ModelControllerClient

ofbizbrazil Aug 29, 2014 10:27 AM (in response to jamezp)

Hi James,

I tried your code but same error:
{
    "outcome" => "failed",
    "failure-description" => "JBAS014807: Management resource '[(\"subsystem\" => \"security\")]' not found",
    "rolled-back" => true
}

Is there any difference in standalone.xml that i need to put, because I migrated mine from jboss 7.1.1 to wildfly?

By the way, I changed the default port to 9999.

Take a look at my security section:
---------------------------------------------------
<subsystem xmlns="urn:jboss:domain:security:1.2">
    <security-domains>
        <security-domain name="pw_encrypted_MSSQL_CAS_DS" cache-type="default">
            <authentication>
                <login-module code="org.picketbox.datasource.security.SecureIdentityLoginModule" flag="required">
                    <module-option name="username" value="XXXX"/>
                    <module-option name="password" value="XXX"/>
                    <module-option name="managedConnectionFactoryName" value="jboss.jca:service=TxCM,name=MSSQL_CAS_DS"/>
                </login-module>
            </authentication>
        </security-domain>
        <security-domain name="other" cache-type="default">
            <authentication>
                <login-module code="Remoting" flag="optional">
                    <module-option name="password-stacking" value="useFirstPass"/>
                </login-module>
                <login-module code="RealmDirect" flag="required">
                    <module-option name="password-stacking" value="useFirstPass"/>
                </login-module>
            </authentication>
        </security-domain>
        <security-domain name="jboss-web-policy" cache-type="default">
            <authorization>
                <policy-module code="Delegating" flag="required"/>
            </authorization>
        </security-domain>
        <security-domain name="jboss-ejb-policy" cache-type="default">
            <authorization>
                <policy-module code="Delegating" flag="required"/>
            </authorization>
        </security-domain>
    </security-domains>
</subsystem>

What tricks much more me, it is the fact via CLI console I can find security section.
Seems just Java API can not do it
Why?

C:\wildfly-8.1.0.Final\bin>jboss-cli.bat --connect --controller=localhost:9029
[standalone@localhost:9029 /] ./subsystem=security:read-resource(recursive=true)
{
    "outcome" => "success",
    "result" => {
        "deep-copy-subject-mode" => false,
        "security-domain" => {
            "pw_encrypted_MSSQL_CAS_DS" => {
                "cache-type" => "default",
                "acl" => undefined,
                "audit" => undefined,
                "authentication" => {"classic" => {
                    "login-modules" => [{
                        "code" => "org.picketbox.datasource.security.SecureIdentityLoginModule",
                        "flag" => "required",
                        "module" => undefined,
                        "module-options" => {
                            "username" => "XXXX",
                            "password" => "XXXX",
                            "managedConnectionFactoryName" => "jboss.jca:service=TxCM,name=MSSQL_CAS_DS"
                        }
                    }],
                    "login-module" => {"org.picketbox.datasource.security.SecureIdentityLoginModule" => {
                        "code" => "org.picketbox.datasource.security.SecureIdentityLoginModule",
                        "flag" => "required",
                        "module" => undefined,
                        "module-options" => {
                            "username" => "XXXX",
                            "password" => "XXXX",
                            "managedConnectionFactoryName" => "jboss.jca:service=TxCM,name=MSSQL_CAS_DS"
                        }
                    }}
                }},
                "authorization" => undefined,
                "identity-trust" => undefined,
                "jsse" => undefined,
Cheers
Actions
5. Re: Re: Error to list security via ModelControllerClient

jamezp Aug 29, 2014 11:23 AM (in response to ofbizbrazil)

To address the easy question, Operations is just a helper class in the wildfly-controller-client or I think EAP 6.1+ in jboss-as-controller-client.

One thing I notice in your post. You're attempting to connect to port 9999 with the Java API, but when you execute the CLI command you're using port 9029. The CLI command essentially just turns into the DMR operation you create via the Java API. So if you can see it in CLI there's no reason you shouldn't be able to see it with the Java API.

I'd start by try port 9029 from the Java API and see if you get the same result. You definitely should be getting the same result.

--
James R. Perkins
Actions
6. Re: Error to list security via ModelControllerClient

dlofthouse Aug 29, 2014 11:40 AM (in response to ofbizbrazil)

If you attach your complete standalone.xml here we can check if there is anything out of place.
Actions

7. Re: Error to list security via ModelControllerClient

ofbizbrazil Aug 29, 2014 1:41 PM (in response to jamezp)

Hi James / Darran,

Yes, sorry I meant to be 9999 the port, my fault!

Look how I set up my pom.xml, it always says to Wildfly uses your own jars.

	<dependency>
		<groupId>org.jboss</groupId>
		<artifactId>jboss-dmr</artifactId>
		<version>1.2.0.Final</version>
		<scope>provided</scope>
	</dependency>
	<dependency>
		<groupId>org.jboss.as</groupId>
		<artifactId>jboss-as-controller-client</artifactId>
		<version>7.2.0.Final</version>
		<scope>provided</scope>
	</dependency>

As I described earlier, via CLI I can list my security section, but via Java API it does not find.

Do you have any idea?

Please see my full standalone.xml

<?xml version="1.0" ?>

</extensions>

<system-properties>

</system-properties>

<security-realms>

<security-realm name="ManagementRealm">

</authentication>

</authorization>

</security-realm>

<security-realm name="ApplicationRealm">

</authentication>

</authorization>

</security-realm>

<security-realm name="ejb-security-realm">

<server-identities>

</server-identities>

</security-realm>

<security-realm name="UndertowRealm">

<server-identities>

<ssl>

</ssl>

</server-identities>

</security-realm>

</security-realms>

<audit-log>

<json-formatter name="json-formatter"/>

</formatters>

<file-handler name="file" formatter="json-formatter" path="audit-log.log" relative-to="jboss.server.data.dir"/>

</handlers>

</handlers>

</logger>

</audit-log>

<management-interfaces>

<http-interface security-realm="ManagementRealm" http-upgrade-enabled="true">

<socket-binding http="management-http"/>

</http-interface>

</management-interfaces>

<access-control provider="simple">

<role-mapping>

</include>

</role>

</role-mapping>

</access-control>

</management>

<console-handler name="CONSOLE">

<named-formatter name="COLOR-PATTERN"/>

</formatter>

</console-handler>

<periodic-rotating-file-handler name="FILE" autoflush="true">

<named-formatter name="PATTERN"/>

</formatter>

</periodic-rotating-file-handler>

</logger>

</logger>

</logger>

</logger>

</logger>

</logger>

</logger>

</logger>

</logger>

<root-logger>

</handlers>

</root-logger>

<pattern-formatter pattern="%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c] (%t) %s%E%n"/>

</formatter>

<pattern-formatter pattern="%K{level}%d{HH:mm:ss,SSS} %-5p [%c] (%t) %s%E%n"/>

</formatter>

</subsystem>

<job-repository>

<in-memory/>

</job-repository>

<thread-pool>

<max-threads count="10"/>

<keepalive-time time="30" unit="seconds"/>

</thread-pool>

</subsystem>

<connection-url>jdbc:jtds:sqlserver://myhost.com:5150;domain=DOMAINUAT</connection-url>

<driver>jtds.driver</driver>

<transaction-isolation>TRANSACTION_READ_COMMITTED</transaction-isolation>

<pool>

<min-pool-size>1</min-pool-size>

<max-pool-size>5</max-pool-size>

<use-strict-min>false</use-strict-min>

<flush-strategy>FailingConnectionOnly</flush-strategy>

</pool>

<security-domain>pw_encrypted_MSSQL_CAS_DS</security-domain>

</security>

<check-valid-connection-sql>select 1</check-valid-connection-sql>

<background-validation>true</background-validation>

<background-validation-millis>3600000</background-validation-millis>

</validation>

<set-tx-query-timeout>true</set-tx-query-timeout>

<blocking-timeout-millis>5000</blocking-timeout-millis>

<idle-timeout-minutes>15</idle-timeout-minutes>

</timeout>

</datasource>

</drivers>

</datasources>

</subsystem>

<deployment-scanner path="deployments" relative-to="jboss.server.base.dir" scan-interval="5000" auto-deploy-exploded="true" deployment-timeout="1800"/>

</subsystem>

<spec-descriptor-property-replacement>false</spec-descriptor-property-replacement>

<context-services>

<context-service name="default" jndi-name="java:jboss/ee/concurrency/context/default" use-transaction-setup-provider="true"/>

</context-services>

<managed-thread-factories>

<managed-thread-factory name="default" jndi-name="java:jboss/ee/concurrency/factory/default" context-service="default"/>

</managed-thread-factories>

<managed-executor-services>

<managed-executor-service name="default" jndi-name="java:jboss/ee/concurrency/executor/default" context-service="default" hung-task-threshold="60000" core-threads="5" max-threads="25" keepalive-time="5000"/>

</managed-executor-services>

<managed-scheduled-executor-services>

<managed-scheduled-executor-service name="default" jndi-name="java:jboss/ee/concurrency/scheduler/default" context-service="default" hung-task-threshold="60000" core-threads="2" keepalive-time="3000"/>

</managed-scheduled-executor-services>

</concurrent>

</subsystem>

<session-bean>

</session-bean>

<pools>

<bean-instance-pools>

<strict-max-pool name="slsb-strict-max-pool" max-pool-size="20" instance-acquisition-timeout="5" instance-acquisition-timeout-unit="MINUTES"/>

<strict-max-pool name="mdb-strict-max-pool" max-pool-size="20" instance-acquisition-timeout="5" instance-acquisition-timeout-unit="MINUTES"/>

</bean-instance-pools>

</pools>

</caches>

<passivation-stores>

<passivation-store name="infinispan" cache-container="ejb" max-size="10000"/>

</passivation-stores>

<timer-service thread-pool-name="default" default-data-store="default-file-store">

<data-stores>

<file-data-store name="default-file-store" path="timer-service-data" relative-to="jboss.server.data.dir"/>

</data-stores>

</timer-service>

<thread-pools>

<thread-pool name="default">

<max-threads count="10"/>

<keepalive-time time="100" unit="milliseconds"/>

</thread-pool>

</thread-pools>

<default-security-domain value="other"/>

<default-missing-method-permissions-deny-access value="true"/>

</subsystem>

<buffer-pool name="default"/>

</subsystem>

<cache-container name="web" default-cache="passivation" module="org.wildfly.clustering.web.infinispan">

<local-cache name="passivation" batching="true">

<file-store passivation="true" purge="false"/>

</local-cache>

<local-cache name="persistent" batching="true">

<file-store passivation="false" purge="false"/>

</local-cache>

</cache-container>

<cache-container name="ejb" default-cache="passivation" module="org.wildfly.clustering.ejb.infinispan" aliases="sfsb">

<local-cache name="passivation" batching="true">

<file-store passivation="true" purge="false"/>

</local-cache>

<local-cache name="persistent" batching="true">

<file-store passivation="false" purge="false"/>

</local-cache>

</cache-container>

<cache-container name="hibernate" default-cache="local-query" module="org.hibernate">

<local-cache name="entity">

</local-cache>

<local-cache name="local-query">

</local-cache>

<local-cache name="timestamps">

</local-cache>

</cache-container>

</subsystem>

<archive-validation enabled="true" fail-on-error="true" fail-on-warn="false"/>

<bean-validation enabled="true"/>

<default-workmanager>

<short-running-threads>

<core-threads count="50"/>

<queue-length count="50"/>

<max-threads count="50"/>

<keepalive-time time="10" unit="seconds"/>

</short-running-threads>

<long-running-threads>

<core-threads count="50"/>

<queue-length count="50"/>

<max-threads count="50"/>

<keepalive-time time="10" unit="seconds"/>

</long-running-threads>

</default-workmanager>

<cached-connection-manager/>

</subsystem>

<expose-resolved-model/>

<expose-expression-model/>

<remoting-connector/>

</subsystem>

</subsystem>

<mail-session name="default" jndi-name="java:jboss/mail/Default">

<smtp-server outbound-socket-binding-ref="mail-smtp"/>

</mail-session>

</subsystem>

</bindings>

<remote-naming/>

</subsystem>

<http-connector name="http-remoting-connector" connector-ref="default" security-realm="ApplicationRealm"/>

<outbound-connections>

<remote-outbound-connection name="remote-ejb-connection" outbound-socket-binding-ref="remote-ejb" username="ejbuser" security-realm="ejb-security-realm" protocol="http-remoting">

</properties>

</remote-outbound-connection>

</outbound-connections>

</subsystem>

<security-domains>

<security-domain name="pw_encrypted_MSSQL_CAS_DS" cache-type="default">

<login-module code="org.picketbox.datasource.security.SecureIdentityLoginModule" flag="required">

<module-option name="username" value="username"/>

<module-option name="password" value="password"/>

<module-option name="managedConnectionFactoryName" value="jboss.jca:service=TxCM,name=MSSQL_CAS_DS"/>

</login-module>

</authentication>

</security-domain>

<security-domain name="other" cache-type="default">

<login-module code="Remoting" flag="optional">

<module-option name="password-stacking" value="useFirstPass"/>

</login-module>

<login-module code="RealmDirect" flag="required">

<module-option name="password-stacking" value="useFirstPass"/>

</login-module>

</authentication>

</security-domain>

<security-domain name="jboss-web-policy" cache-type="default">

<policy-module code="Delegating" flag="required"/>

</authorization>

</security-domain>

<security-domain name="jboss-ejb-policy" cache-type="default">

<policy-module code="Delegating" flag="required"/>

</authorization>

</security-domain>

</security-domains>

</subsystem>

<core-environment>

<process-id>

<uuid/>

</process-id>

</core-environment>

<recovery-environment socket-binding="txn-recovery-environment" status-socket-binding="txn-status-manager"/>

</subsystem>

<buffer-cache name="default"/>

<http-listener name="default" socket-binding="http"/>

<https-listener name="https" socket-binding="https" security-realm="UndertowRealm"/>

<filter-ref name="server-header"/>

<filter-ref name="x-powered-by-header"/>

</host>

</server>

<servlet-container name="default">

<jsp-config/>

</servlet-container>

<response-header name="server-header" header-name="Server" header-value="WildFly/8"/>

<response-header name="x-powered-by-header" header-name="X-Powered-By" header-value="Undertow/1"/>

</filters>

</subsystem>

<wsdl-host>${jboss.bind.address:127.0.0.1}</wsdl-host>

<endpoint-config name="Standard-Endpoint-Config"/>

<endpoint-config name="Recording-Endpoint-Config">

<pre-handler-chain name="recording-handlers" protocol-bindings="##SOAP11_HTTP ##SOAP11_HTTP_MTOM ##SOAP12_HTTP ##SOAP12_HTTP_MTOM">

</pre-handler-chain>

</endpoint-config>

<client-config name="Standard-Client-Config"/>

</subsystem>

</profile>

<inet-address value="${jboss.bind.address.management:0.0.0.0}"/>

</interface>

<inet-address value="${jboss.bind.address:0.0.0.0}"/>

</interface>

<inet-address value="${jboss.bind.address.unsecure:127.0.0.1}"/>

</interface>

</interfaces>

<socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:0}">

<socket-binding name="management-http" interface="management" port="${jboss.management.http.port:9999}"/>

<socket-binding name="management-https" interface="management" port="${jboss.management.https.port:9030}"/>

<socket-binding name="http" port="${jboss.http.port:9021}"/>

<socket-binding name="https" port="${jboss.https.port:9022}"/>

<socket-binding name="txn-recovery-environment" port="9025"/>

<socket-binding name="txn-status-manager" port="9026"/>

<outbound-socket-binding name="mail-smtp">

<remote-destination host="mailserver.com" port="9028"/>

</outbound-socket-binding>

<outbound-socket-binding name="remote-ejb">

<remote-destination host="localhost" port="9021"/>

</outbound-socket-binding>

</socket-binding-group>

</server>

Thanks!

8. Re: Error to list security via ModelControllerClient

dlofthouse Aug 29, 2014 1:43 PM (in response to ofbizbrazil)
Your best option is to do one or both of the following: -
Attach the standalone.xml from your failing installation here so we can take a look.
Obtain a clean standalone.xml from the WildFly 8.1.0.Final distribution and start your server using it and then check if your client experiences the same error.

The purpose of both of these actions is to try and eliminate if there is anything else in your configuration that could be influencing the outcome of this test.
Actions
9. Re: Error to list security via ModelControllerClient

dlofthouse Aug 29, 2014 1:46 PM (in response to dlofthouse)

Sorry looks like our paths crossed - looking at the config
Actions
10. Re: Error to list security via ModelControllerClient

dlofthouse Aug 29, 2014 1:51 PM (in response to dlofthouse)

One other question, are you 100% certain that this is the only WildFly process running on this machine?
Actions
11. Re: Error to list security via ModelControllerClient

jamezp Aug 29, 2014 2:09 PM (in response to ofbizbrazil)

FWIW I test your configuration on Linux and it worked fine for me. I did have to change the ModelControllerClient connection to ModelControllerClient.Factory.create("http-remoting", InetAddress.getLocalHost(), 9999) as by default 9999 tries to use the remoting connection. I didn't see the same error you got, but it did get a connection timeout.

--
James R. Perkins
Actions
12. Re: Error to list security via ModelControllerClient

ofbizbrazil Aug 29, 2014 2:34 PM (in response to jamezp)

Jammes,

I tried to start Wildfly either via Eclipse Tools or standalone.bat (console), and gets the same error.

One thing that's weird is sometimes the port 9999 doesn't work and gives timeout error.

Please try to set as 9029 to replicate the original error.
<socket-binding name="management-http" interface="management" port="${jboss.management.http.port:9029}"/>

Java code:
final ModelNode op = Operations.createReadResourceOperation(new ModelNode().addEmptyList().add("subsystem","security"));
op.get("recursive").set(true);

final ModelControllerClient client = ModelControllerClient.Factory.create(InetAddress.getByName("localhost"),9029);

final ModelNode result = client.execute(op);

if (Operations.isSuccessfulOutcome(result)) {
System.out.println(Operations.readResult(result));
} else {
System.out.println(Operations.getFailureDescription(result));
}

@Darran
Yes, I am sure, by the way running on Windows 7 and Java 1.7.0_67
Actions
13. Re: Re: Error to list security via ModelControllerClient

jamezp Aug 29, 2014 5:10 PM (in response to ofbizbrazil)
Something doesn't seem right. Maybe you have an old process running somewhere or something. For me it works on Fedora and Windows 7. I'm attaching a sample runner jar that will downdload WildFly, if it can't be found in your ~/.m2 directory, start it and execute the command. This worked fine for me on both Linux and in a Windows VM. You can pass -p <port-number> to change the port if you need.

I've attached the source file too. It's not pretty, but it does the job

--
James R. Perkins

wildfly-runner.jar 1.5 MB

Main.java 6.7 KB
Actions

14. Re: Error to list security via ModelControllerClient

ofbizbrazil Aug 29, 2014 6:02 PM (in response to jamezp)

James,

I noticed the method signature you're using is different from mine.

You: ModelControllerClient.Factory.create("http-remoting", InetAddress.getLocalHost(), port)

Me: ModelControllerClient.Factory.create(InetAddress.getLocalHost(), port)

I can't find a method to use String parameter as first, do you know what Maven depedency should I include into my pom?

	<dependency>
		<groupId>org.jboss</groupId>
		<artifactId>jboss-dmr</artifactId>
		<version>1.2.0.Final</version>
		<scope>provided</scope>
	</dependency>
	<dependency>
		<groupId>org.jboss.as</groupId>
		<artifactId>jboss-as-controller-client</artifactId>
		<version>7.2.0.Final</version>
		<scope>provided</scope>
	</dependency>

FIX: I found out which dependency to use, but error still carries on.

	<dependency>
		<groupId>org.wildfly</groupId>
		<artifactId>wildfly-controller-client</artifactId>
		<version>8.1.0.Final</version>
		<scope>provided</scope>
	</dependency>

One thing I'd like to tell, I am calling this java CLI since an EJB.

Should it be the cause?

@Startup

@Singleton

@Remote

public class SmbConfigBean {

private static final long serialVersionUID = 1L;

@PostConstruct

private void init() throws Exception {

final ModelControllerClient client = ModelControllerClient.Factory.create("http-remoting",

InetAddress.getLocalHost(), 9029);

final ModelNode op = Operations.createReadResourceOperation(new ModelNode().addEmptyList().add("subsystem",

"security"));

op.get("recursive").set(true);

final ModelNode result = client.execute(op);

if (Operations.isSuccessfulOutcome(result)) {

System.out.println(Operations.readResult(result));

} else {

System.out.println(Operations.getFailureDescription(result));

}

1 2 Previous Next

Go to original post