WildFly 18.0.0.Final: issue with security contraints/url-pattern

[fheldt]

Hello all,

I've a problem with WildFly 18.0.0.Final:

when deploying a very simple webapp with 2 subfolders ("/area" and "/area51" in this test) I get an exception:

12:38:37,994 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-3) MSC000001: Failed to start service jboss.deployment.unit."java-web-project.war".jboss.security.jacc: org.jboss.msc.service.StartException in service jboss.deployment.unit."java-web-project.war".jboss.security.jacc: WFLYSEC0012: Unable to start the JaccService service

at [e-mail]//org.jboss.as.security.service.JaccService.start(JaccService.java:107)

at [e-mail]//org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1739)

at [e-mail]//org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1701)

at [e-mail]//org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1559)

at [e-mail]//org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)

at [e-mail]//org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982)

at [e-mail]//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486)

at [e-mail]//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377)

at java.base/java.lang.Thread.run(Thread.java:834)

Caused by: java.lang.IllegalArgumentException: Invalid prefix pattern in URLPatternList

at [e-mail]//javax.security.jacc.URLPatternSpec.setURLPatternArray(URLPatternSpec.java:308)

at [e-mail]//javax.security.jacc.URLPatternSpec.<init>(URLPatternSpec.java:79)

at [e-mail]//javax.security.jacc.WebResourcePermission.<init>(WebResourcePermission.java:160)

at [e-mail]//org.wildfly.extension.undertow.security.jacc.WarJACCService.createPermissions(WarJACCService.java:303)

at [e-mail]//org.wildfly.extension.undertow.security.jacc.WarJACCService.createPermissions(WarJACCService.java:64)

at [e-mail]//org.jboss.as.security.service.JaccService.start(JaccService.java:86)

... 8 more

The same app under WildFly 17 works as expected.

Naming the 2 folders totally different makes the problem go away,

This is from the web.xml:

<security-constraint>

<web-resource-collection>

<web-resource-name>Area</web-resource-name>

<url-pattern>/area/*</url-pattern>

</web-resource-collection>

<auth-constraint>

<role-name>role1</role-name>

<role-name>role2</role-name>

</auth-constraint>

<user-data-constraint>

<transport-guarantee>CONFIDENTIAL</transport-guarantee>

</user-data-constraint>

</security-constraint>

<security-constraint>

<web-resource-collection>

<web-resource-name>Area 51</web-resource-name>

<url-pattern>/area51/*</url-pattern>

</web-resource-collection>

<auth-constraint>

<role-name>role1</role-name>

</auth-constraint>

<user-data-constraint>

<transport-guarantee>CONFIDENTIAL</transport-guarantee>

</user-data-constraint>

</security-constraint>

Does anyone else have this issue?

[ptuomaal]

We almost have the same issue and our app also works well in WLF17. I haven't found workaround for this yet

"ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("deploy") failed - address: ([("deployment" => "XXX.ear")]) - failure description: {"WFLYCTL0080: Failed services" => {"jboss.deployment.subunit.\"XXX.ear\".\"XXX.war\".jboss.security.jacc" => "WFLYSEC0012: Unable to start the JaccService service

   Caused by: java.lang.IllegalArgumentException: Invalid exact pattern in URLPatternList"}}"

[jaikiran]

This does look like a bug. Please create a JIRA here https://issues.jboss.org/browse/WFLY/

[fheldt]

Already done: [WFLY-12655] Exception with web.xml url-pattern - JBoss Issue Tracker

[flavia.rainone]

Hi!  A patch for this has been submitted here:

Resolves eclipse-ee4j#56 At URLPatternSpec.setURLPatternArray, we nee… by fl4via · Pull Request #57 · eclipse-ee4j/jacc …

And here:

Resolves eclipse-ee4j#56 At URLPatternSpec.setURLPatternArray, we nee… by fl4via · Pull Request #4 · jboss/jboss-jakarta…

[flavia.rainone]

Actually, we discovered that the problem is in WildFly itself. The fix is here: [WFLY-12655] If a URL pattern matches all (/*), we need to return it … by jamezp · Pull Request #12729 · wildfly/wildfly…