Legacy security to Elytron Migration

[dnovo]

Hi,

I'm trying to migrate legacy security to Elytron:

In Wildfly 16 i have this security-domain:

<security-domain name="MyDomain" cache-type="default">

<authentication>

<login-module code="Database" flag="sufficient">

<module-option name="dsJndiName" value="java:/MyUsersDS"/>

<module-option name="principalsQuery" value="SELECT password FROM USER WHERE username = ?"/>

<module-option name="rolesQuery" value="SELECT groupname, 'Roles' FROM USERGROUP  WHERE username = ?"/>

<module-option name="hashAlgorithm" value="SHA-256"/>

<module-option name="hashEncoding" value="base64"/>

</login-module>

<login-module code="Ldap" flag="sufficient">

<module-option name="java.naming.provider.url" value="ldap://xxx.xxx.xxx.xxx:389/"/>

<module-option name="principalDNSuffix" value="@mydomain.com"/>

<module-option name="rolesCtxDN" value="DC=MYDOMAIN,DC=COM"/>

<module-option name="uidAttributeID" value="sAMAccountName"/>

<module-option name="roleAttributeID" value="memberOf"/>

<module-option name="roleAttributeIsDN" value="true"/>

</login-module>

</authentication>

</security-domain>

With this configuration, user credentials are validated against login-module that succeeds the first(flag=sufficient).

I'm trying to replicate this config with Elytron using Wildfly 18.0.1.

I already succeed using only ldap-realm or Database. However i need to authenticate in Ldap if Database fails.

How can i do this?

Thanks

[walkerca]

I'm going to have to do this soon and was going to add the JDBC and LDAP Realms to the single security domain.  Have you tried this to see if they behave as "sufficient"?

[dnovo]

Hi Carl,

I've done several tests and it seams like if it fails in first realm, authentication fails. I was unable to reproduce sufficient behavior with Elytron.

Maybe something was wrong with my configuration.

If you succeed let me know.

[walkerca]

I'm getting the same thing.  I created a Two-Realm Security Domain.  Only the first one is being used probably because it's the one referenced in the Default Realm attribute.

I looked into Realm Mappers, but this seems to be for mappings mechanisms (BASIC, CERT, DIGEST) to different Realms within the same Security Domain.

I'm hoping the password stacking feature wasn't dropped. wildfly Elytron Security-Domain with multiple Security-Realm

[walkerca]

This isn't supported, but there's a feature request to add it.  Please vote for it and your specific use case to help justify the change.

[WFCORE-4485] Support for multiple security realms - Distributed Identities - Red Hat Issue Tracker