Fish 8925 adding epicyro implementation #7068

breakponchito · 2024-11-15T04:28:30Z

Implementing epicyro on Payara 7

Description

We are trying to decouple the Jakarta Authentication by using epicyro provider. Epicyro provideds most of the functionality needed to provide Jakarta Authentication mechanism.

Important Info

Blockers

Testing

New tests

Testing Performed

Manual testing by starting and deploying a web applications on payara:

Testing Environment

Windows 11, azul jdk 21, maven 3.9.5

Documentation

Notes for Reviewers

Signed-off-by: Andrew Pielage <[email protected]>

…ntation' into FISH-8925-adding-epicyro-implementation # Conflicts: # core/pom.xml # nucleus/common/internal-api/src/main/java/fish/payara/internal/notification/EventLevel.java

breakponchito · 2024-11-15T04:30:08Z

For now I can build the server but I have osgi issue to run server

Signed-off-by: Andrew Pielage <[email protected]>

FISH-9630 Use UserPrincipal instead of PrincipalImpl

…cation with epicyro

breakponchito · 2024-11-19T04:54:54Z

Now the server can run but any of the web applications can be seen

…arta-xml-binding-api-4.0.2-p7 FISH-9165 : upgrade jaxb version to 4.0.2

…-Shim Security API downgrade shim

breakponchito · 2024-11-27T05:18:22Z

From last changes I tried to set the exousia DefaultPolicy to fix an issue from authentication part that cause to not load any web application. Still in progress because now when trying to load default web application I'm seeing the following exception:

`
[#|2024-11-26T23:10:00.915-0600|ADVERTENCIA|Payara 7.2024.1.Alpha3|jakarta.enterprise.web|_ThreadID=217;_ThreadName=Thread-23;_TimeMillis=1732684200915;_LevelValue=900;|
java.lang.IllegalStateException: ContainerBase.addChild: start: org.apache.catalina.LifecycleException: org.glassfish.deployment.common.DeploymentException: Error in generating security policy for __admingui -- Cannot invoke "jakarta.security.jacc.Policy.refresh()" because the return value of "org.glassfish.exousia.AuthorizationService.getPolicy()" is null
java.lang.IllegalStateException: ContainerBase.addChild: start: org.apache.catalina.LifecycleException: org.glassfish.deployment.common.DeploymentException: Error in generating security policy for __admingui -- Cannot invoke "jakarta.security.jacc.Policy.refresh()" because the return value of "org.glassfish.exousia.AuthorizationService.getPolicy()" is null

`

breakponchito · 2024-11-28T03:12:13Z

I added more changes to set the default providers from exousia instead of our version and now partially load the resources of the admin console page:

still dealing with an issue to get the following two resources:

com_sun_faces_ajax.js
and the result after calling the j_security_check

…cation with epicyro

… more removals

breakponchito · 2024-11-28T22:57:35Z

finally the server is running again after latest changes to fix the callback handler validation for credentials:

breakponchito · 2024-11-29T03:23:51Z

@Pandrex247 right now checking how to fix some quicklook tests failures:

breakponchito · 2024-11-29T18:10:46Z

Jenkins test please

Signed-off-by: Andrew Pielage <[email protected]>

Pandrex247 · 2024-12-02T11:43:45Z

Run against all currently passing TCKs kicked off here: https://jenkins.payara.fish/blue/organizations/jenkins/JakartaEE-11-TCK/detail/JakartaEE-11-TCK/90/pipeline

It seems that this causes quite a few other TCKs to start failing:

Concurrency
JAX-RS
WebSockets

Pandrex247 · 2024-12-02T12:07:12Z

From the authentication TCK runner, there appears to be numerous issues with deployment (which look similar to what's happening with the other TCKs):

org.apache.catalina.LifecycleException: org.glassfish.deployment.common.DeploymentException: Error in generating security policy for test.war -- State could not be DELETED but actual state is
	at org.apache.catalina.core.StandardContext.start(StandardContext.java:5775)
	at com.sun.enterprise.web.WebModule.start(WebModule.java:619)
	at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:982)
	at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:965)
	at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:694)
	at com.sun.enterprise.web.WebContainer.loadWebModule(WebContainer.java:1811)
	at com.sun.enterprise.web.WebContainer.loadWebModule(WebContainer.java:1563)
	at com.sun.enterprise.web.WebApplication.start(WebApplication.java:107)
	at org.glassfish.internal.data.EngineRef.start(EngineRef.java:123)
	at org.glassfish.internal.data.ModuleInfo.start(ModuleInfo.java:292)
	at org.glassfish.internal.data.ApplicationInfo.start(ApplicationInfo.java:361)
	at com.sun.enterprise.v3.server.ApplicationLifecycle.initialize(ApplicationLifecycle.java:633)
	at org.glassfish.deployment.admin.DeployCommand.execute(DeployCommand.java:571)

… SecurityManager

…hub.com/breakponchito/Payara into FISH-8925-adding-epicyro-implementation

breakponchito · 2024-12-04T00:07:06Z

Jenkins test please

breakponchito · 2024-12-04T01:26:53Z

@Pandrex247 still with 2 errors on the side of quicklook tests but now the TCK is passing: https://jenkins.payara.fish/blue/organizations/jenkins/JakartaEE-11-TCK/detail/JakartaEE-11-TCK/93/pipeline

Pandrex247 · 2024-12-04T10:05:54Z

Ran against the authentication TCK as well here: https://jenkins.payara.fish/job/JakartaEE-11-TCK/94/
All the failures apart from the two modules which were failing before the Epicyro implementation are passing again now.
The two failing modules are "Profile SPI Servlet" and "Profile SPI SOAP".

The former fails oddly, it seems to fail to write to the authentication-trace-log.xml file for some reason.
The latter does manage to write to said file, but seems to hit some class loader issues when trying to deploy the app:

java.lang.ClassCastException: class com.sun.enterprise.security.webservices.WebServicesDelegateImpl cannot be cast to class org.glassfish.epicyro.services.RegistrationWrapperRemover (com.sun.enterprise.security.webservices.WebServicesDelegateImpl is in unnamed module of loader org.apache.felix.framework.BundleWiringImpl$BundleClassLoader @4b758edb; org.glassfish.epicyro.services.RegistrationWrapperRemover is in unnamed module of loader org.apache.felix.framework.BundleWiringImpl$BundleClassLoader @66543cf)

Pandrex247 · 2024-12-04T10:07:36Z

appserver/tests/quicklook/cluster/clustersetup/src/test/clustersetup/ClusterSetupTest.java

@@ -108,7 +108,7 @@ public void createInstanceTest() throws Exception {
        Assert.assertEquals(retStatus, true, "Create instance failed ...");
    }

-    @Test(dependsOnMethods = { "createInstanceTest" })
+    //@Test(dependsOnMethods = { "createInstanceTest" })


This is testing a fairly fundamental aspect of the server - I wouldn't skip this because if we can't create and start instances I wouldn't say the server is in a releasable state (even as an alpha)

On review, this failures only seems to affect clustered instances.
Standalone instances and instances in a deployment group are able to start correctly.

Reasons

Pandrex247

This is too large for me to really review in detail, but it's making its way through the TCKs and the server is operational 👍

I've spotted a couple of follow ups and have raised issues for them to be tackled later

breakponchito and others added 5 commits October 30, 2024 23:45

FISH-8925: starting changes to use epicyro

94296f9

Security API downgrade shim

911a08b

Signed-off-by: Andrew Pielage <[email protected]>

FISH-8925: rebasing last changes from Payara7 branch

b51a9ff

Merge remote-tracking branch 'origin/FISH-8925-adding-epicyro-impleme…

21a1a22

…ntation' into FISH-8925-adding-epicyro-implementation # Conflicts: # core/pom.xml # nucleus/common/internal-api/src/main/java/fish/payara/internal/notification/EventLevel.java

FISH-8925: introducing epicyro for jakarta authentication in payara 7

5627fea

breakponchito added the PR: DO NOT MERGE Don't merge PR until further notice label Nov 15, 2024

kalinchan and others added 6 commits November 15, 2024 09:29

FISH-9630 Use UserPrincipal instead of PrincipalImpl

70835b7

Correct comment name

78126c4

Add soteria downgrade shim

79f2fd8

Signed-off-by: Andrew Pielage <[email protected]>

Bundle name correction and missing ';'

9afed1f

Signed-off-by: Andrew Pielage <[email protected]>

Merge pull request payara#7069 from kalinchan/FISH-9630

345626f

FISH-9630 Use UserPrincipal instead of PrincipalImpl

FISH-8925: fixing osgi issues and adding more changes tu run authenti…

d8175ad

…cation with epicyro

luiseufrasio and others added 5 commits November 20, 2024 09:25

FISH-9165 : upgrade jaxb version to 4.0.2

cd530f5

Merge pull request payara#7076 from luiseufrasio/FISH-9165-update-jak…

89b45e2

…arta-xml-binding-api-4.0.2-p7 FISH-9165 : upgrade jaxb version to 4.0.2

Merge pull request payara#7066 from Pandrex247/Add-Security-Downgrade…

de796c9

…-Shim Security API downgrade shim

FISH-8925: trying to fix error to render pages

a8ab4fe

FISH-8925: trying to set starting policy factory for exousia

81c94f9

FISH-8925: partially load of resources for admin console page

5c0b928

breakponchito added 8 commits November 27, 2024 21:39

FISH-8925: rebasing last changes from Payara7 branch

6cfd0bf

FISH-8925: rebasing changes

45b26bd

FISH-8925: introducing epicyro for jakarta authentication in payara 7

6f2192b

FISH-8925: fixing osgi issues and adding more changes tu run authenti…

9d483a6

…cation with epicyro

FISH-8925: trying to fix error to render pages

ff2e31a

FISH-8925: trying to set starting policy factory for exousia

97caef7

FISH-8925: partially load of resources for admin console page

5109bce

FISH-8925: fixing changes when merging

920e923

Pandrex247 and others added 4 commits November 28, 2024 09:34

Remove unused imports

7c726c4

Remove usage of security manager

58c6d12

Remove unused imports

4ebe367

FISH-8925: changes to fix callback handler credentials validation and…

d600f29

… more removals

Don't exclude from semantic versioning

cf189d1

Signed-off-by: Andrew Pielage <[email protected]>

Pandrex247 mentioned this pull request Dec 2, 2024

FISH-9002 Adjust EE11 Authentication Runner for Epicyro payara/jakartaee-10-tck-runners#119

Merged

breakponchito added 3 commits December 2, 2024 19:26

FISH-8925: fix for invalid reference for policy and code removals for…

3032e36

… SecurityManager

Merge branch 'FISH-8925-adding-epicyro-implementation' of https://git…

8f2d603

…hub.com/breakponchito/Payara into FISH-8925-adding-epicyro-implementation

FISH-8925: fixing deployment issue for applications

ffb2f27

FISH-8925: skipping failing tests from quicklook

26b052d

breakponchito requested review from Pandrex247, aubi, luiseufrasio and Viii3 December 4, 2024 01:57

Correct property name

092f1b6

Pandrex247 previously requested changes Dec 4, 2024

View reviewed changes

Pandrex247 self-requested a review December 4, 2024 12:15

breakponchito removed the PR: DO NOT MERGE Don't merge PR until further notice label Dec 4, 2024

Update embedded domain.xml

8aa5e8b

Pandrex247 approved these changes Dec 5, 2024

View reviewed changes

breakponchito merged commit 47d01a7 into payara:Payara7 Dec 5, 2024
1 check passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fish 8925 adding epicyro implementation #7068

Fish 8925 adding epicyro implementation #7068

breakponchito commented Nov 15, 2024 •

edited

Loading

breakponchito commented Nov 15, 2024

breakponchito commented Nov 19, 2024

breakponchito commented Nov 27, 2024

breakponchito commented Nov 28, 2024

breakponchito commented Nov 28, 2024

breakponchito commented Nov 29, 2024

breakponchito commented Nov 29, 2024

Pandrex247 commented Dec 2, 2024

Pandrex247 commented Dec 2, 2024

breakponchito commented Dec 4, 2024

breakponchito commented Dec 4, 2024

Pandrex247 commented Dec 4, 2024

Pandrex247 Dec 4, 2024

Pandrex247 Dec 4, 2024

Pandrex247 left a comment

Fish 8925 adding epicyro implementation #7068

Fish 8925 adding epicyro implementation #7068

Conversation

breakponchito commented Nov 15, 2024 • edited Loading

Description

Important Info

Blockers

Testing

New tests

Testing Performed

Testing Environment

Documentation

Notes for Reviewers

breakponchito commented Nov 15, 2024

breakponchito commented Nov 19, 2024

breakponchito commented Nov 27, 2024

breakponchito commented Nov 28, 2024

breakponchito commented Nov 28, 2024

breakponchito commented Nov 29, 2024

breakponchito commented Nov 29, 2024

Pandrex247 commented Dec 2, 2024

Pandrex247 commented Dec 2, 2024

breakponchito commented Dec 4, 2024

breakponchito commented Dec 4, 2024

Pandrex247 commented Dec 4, 2024

Pandrex247 Dec 4, 2024

Choose a reason for hiding this comment

Pandrex247 Dec 4, 2024

Choose a reason for hiding this comment

Pandrex247 left a comment

Choose a reason for hiding this comment

breakponchito commented Nov 15, 2024 •

edited

Loading