Wildfly 26.1.0 final + elytron-oidc-client + wont propagate user to EJB + user become anonymous

Question

I am trying to upgrade from WF24 to WF26.1.0 final and migrate from the jboss:domain:keycloak module to elytron-oidc-client.

I have installed WF26.1.0 and configured elytron-oidc-client with secure-deployment to use our Keycloak server for authentication. I can log into my webpages and rest services provided by the WAR deployment, and I get the correct roles listed for my keycloak users.

Here is the log that shows when elytron-oidc-client retrieves the authenticated user and adds it to a generic security domain with the 'virtual' realm:

2022-05-01 06:46:10,652 TRACE [org.wildfly.security] (default task-4) Handling SecurityIdentityCallback: identity = SecurityIdentity{principal=testuser, securityDomain=org.wildfly.security.auth.server.SecurityDomain@3e51905b, authorizationIdentity=EMPTY, realmInfo=RealmInfo{name='virtual', securityRealm=org.wildfly.security.http.oidc.OidcSecurityRealm@796ef014}, creationTime=2022-05-01T04:46:10.651489Z}

The secure deployment look like this in stanalone-full.xml:

<subsystem xmlns="urn:wildfly:elytron-oidc-client:1.0">
                <realm name="MyRealm">
                    <auth-server-url>https://127.0.0.1/auth/</auth-server-url>
                    <ssl-required>NONE</ssl-required>
                    <enable-cors>true</enable-cors>
                    <principal-attribute>preferred_username</principal-attribute>
                </realm>
                <secure-deployment name="farm-application-fleet-jsweb.war">
                    <realm>MyRealm</realm>
                    <resource>MyResource</resource>
                    <public-client>true</public-client>
                </secure-deployment>
                 
            </subsystem>

When a REST service deployed in the WAR tries to connect to a EJB deployed in a different EAR then the user become "anonymous" and access is not allowed.

Here are some of my Wildfly log that shows the authenticated user become anonymous when I am calling the EJB method getAllMvaCodes declared like this:

@RolesAllowed({ "user","appuser" })
public GeneralResponse getAllMvaCodes () {....}

Instead of an correct result because my authenticated user has the correct roles, I get "is not allowed":

2022-05-01 06:46:10,651 TRACE [org.wildfly.security] (default task-4) Role mapping: principal [testuser] -> decoded roles [appuser, workshop, car_booking, plowing, superadmin, triplog, admin, transport, user] -> domain decoded roles [] -> realm mapped roles [appuser, workshop, car_booking, plowing, superadmin, triplog, admin, transport, user] -> domain mapped roles [appuser, workshop, car_booking, plowing, superadmin, triplog, admin, transport, user]

2022-05-01 06:46:10,651 TRACE [org.xnio.nio.selector] (default I/O-19) Selected key channel=java.nio.channels.SocketChannel[connected local=/127.0.0.1:8443 remote=/127.0.0.1:49577], selector=sun.nio.ch.KQueueSelectorImpl@db86f05, interestOps=1, readyOps=1 for java.nio.channels.SocketChannel[connected local=/127.0.0.1:8443 remote=/127.0.0.1:49577]

2022-05-01 06:46:10,651 TRACE [org.wildfly.security] (default task-4) Authorizing principal testuser.

2022-05-01 06:46:10,651 TRACE [org.xnio.nio.selector] (default I/O-19) Calling handleReady key 1 for java.nio.channels.SocketChannel[connected local=/127.0.0.1:8443 remote=/127.0.0.1:49577]

2022-05-01 06:46:10,651 TRACE [org.wildfly.security] (default task-4) Authorizing against the following attributes: [Roles] => [appuser, workshop, car_booking, plowing, superadmin, triplog, admin, transport, user]

2022-05-01 06:46:10,651 TRACE [org.xnio.listener] (default I/O-19) Invoking listener io.undertow.server.protocol.framed.AbstractFramedChannel$FrameReadListener@6a65085c on channel org.xnio.conduits.ConduitStreamSourceChannel@734aed38

2022-05-01 06:46:10,651 TRACE [org.wildfly.security] (default task-4) Authorizing against the following runtime attributes: [] => []

2022-05-01 06:46:10,651 TRACE [io.undertow.request.io] (default I/O-19) Invoking receive listener: io.undertow.server.protocol.http2.Http2ReceiveListener@226d75b6 - receiver: null

2022-05-01 06:46:10,651 TRACE [org.wildfly.security] (default task-4) Permission mapping: identity [testuser] with roles [appuser, workshop, car_booking, plowing, superadmin, triplog, admin, transport, user] implies ("org.wildfly.security.auth.permission.LoginPermission" "") = true

2022-05-01 06:46:10,651 TRACE [org.wildfly.security] (default task-4) Authorization succeed

2022-05-01 06:46:10,651 TRACE [org.xnio.listener] (default I/O-19) Invoking listener io.undertow.server.protocol.http2.Http2ReceiveListener@226d75b6 on channel Http2Channel peer /127.0.0.1:49577 local /127.0.0.1:8443[ No Receiver [] -- [] -- []

2022-05-01 06:46:10,651 ERROR [org.jboss.as.ejb3.invocation] (default task-6) WFLYEJB0034: Jakarta Enterprise Beans Invocation failed on component InvoiceBean for method public abstract no.farm.service.fleet.dto.GeneralResponse no.farm.service.fleet.ejb.InvoiceRemote.getAllMvaCodes(): javax.ejb.EJBAccessException: WFLYEJB0364: Invocation on method: public abstract no.farm.service.fleet.dto.GeneralResponse no.farm.service.fleet.ejb.InvoiceRemote.getAllMvaCodes() of bean: InvoiceBean is not allowed

Is there a way that I can configure Wildfly to propagate the user correctly from the WEB to the EJB?

Answer 1

The elytron-oidc-client subsystem makes use of a virtual security domain. Currently, this virtual security domain can't be referenced from other deployments.

However, the identity would get propagated to EJBs within the same deployment.