Questions[wildfly](server)

I'm trying to set up container-managed authentication with Wildfly 24 and would like to use an existing (federated) Shibboleth IDP.

I haven't found docs detailing that use case, so I opted for the proxy auth scenario, e.g. Apache + Shibboleth SP connecting via AJP to Wildfly.

The Elytron docs mention "external" http authentication, meaning passing on REMOTE_USER as a principal. What it doesn't include is how to get roles from the SP (or any other authenticating proxy for that matter).

What I want to know is:

• How can I get roles mapped from another AJP attribute / HTTP header without resorting to another data store like LDAP? Can I get additional attributes into the principal as well, like e.g. a mail address?
• Is there an alternative way to set up SAML2 with Wildfly? Keycloak support is rather limited, as it assumes a single (Keycloak) IDP. Picketlink is limited as well and deprecated.
• Alternatively, would OIDC work this way? How would I set this up?

In KeyCLoak 15.0 (that is WildFly 23.0), I’m trying to configure access-log to also include username (or any ID of the user) when a user is logged in. In keycloak/standalone/configuration/standalone.xml, I configured XML:/server/profile/subsystem[@xmlns="urn:jboss:domain:undertow:12.0"]/server/host/access-log/@pattern pattern="%h %l %u %t "%r" %s/%S %b %T %I "%{i,User-Agent}""

The log gets correctly printed in the file I configured. However, the value of %u or %{REMOTE_USER} is always empty (that is -).

The only way to log some user ID I found was logging session cookie value with %{c,KEYCLOAK_SESSION} (it contains realm/user-ID/secret). Which isn’t a good idea to do in production.

Any idea on how to log username or userID in access-log?

Is it a KeyCLoak bug that %u or %{REMOTE_USER} is empty even when there is an active user session in KeyCloak? Or is it possible in KeyCLoak to configure which user attribute value goes in REMOTE_USER?

Alternativelly, how to put the userID in some header to use one of the following?

• %{i,xxx} for incoming headers
• %{o,xxx} for outgoing response headers
• %{c,xxx} for a specific cookie
• %{r,xxx} where xxx is an attribute in the ServletRequest
• %{s,xxx} where xxx is an attribute in the HttpSession

Among others, I tried these. None of them was populated.

%{s,user} 
%{s,userId} 
%{s,client_id} 
%{s,USER_ID} 
%{s,USER} 
%{s,org.keycloak.adapters.spi.KeycloakAccount} 
%{s,KeycloakAccount} 
%{s,org.keycloak.adapters.tomcat.CatalinaSessionTokenStore.SerializableKeycloakAccount} 
%{s,SerializableKeycloakAccount} 
%{s,org.keycloak.adapters.saml.SamlSession} 
%{s,SamlSession} 
%{s,org.keycloak.adapters.undertow.KeycloakUndertowAccount} 
%{s,KeycloakUndertowAccount} 
%{s,org.keycloak.KeycloakSecurityContext} 
%{s,KeycloakSecurityContext} 
%{s,io.undertow.servlet.util.SavedRequest} 
%{s,SavedRequest}

%{r,tokenInfo} 
%{r,KeycloakSecurityContext} 
%{r,ElytronHttpFacade} 
%{r,AdapterDeploymentContext} 
%{r,TOKEN_STORE_NOTE}

I am trying to deploy a web application to WildFly. Right now, I'm simply dropping an ear file in the <JBOSS_HOME>/standalone/deployments directory. When I do, I get the following error message in the marker file:

{"WFLYCTL0080: Failed services" => {"jboss.deployment.unit.\"time4u-assemblies-ear.ear\".STRUCTURE" => "WFLYSRV0153: Failed to process phase STRUCTURE of deployment \"time4u-assemblies-ear.ear\"
    Caused by: org.jboss.as.server.deployment.DeploymentUnitProcessingException: WFLYEE0097: Module may not be a child of the EAR's library directory. Library directory: lib, module file name: lib/time4u-server-api-1.0.4-SNAPSHOT.jar"}}

My initial thought was that the lib/time4u-server-api-1.0.4-SNAPSHOT.jar file was missing. However the file exists in the EAR/lib/ directory.

So what could it mean that the module may not be a child of the EAR's library directory if the file exists? Is this a problem with the application or do I have the wrong approach when trying to deploy it?

I am new to jboss and I did not develop this application myself.

I need to start a service with certain IP using Wildfly

Already follows tutorials

Wildfly start fine with local IP which is 127.0.0.1 also with 0.0.0.0

But when I change into mine or other IP it got error like this

11:12:58,057 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-4) MSC000001: Failed to start service org.wildfly.network.interface.public: org.jboss.msc.service.StartException in service org.wildfly.network.interface.public: WFLYSRV0082: failed to resolve interface public
        at org.jboss.as.server.services.net.NetworkInterfaceService.start(NetworkInterfaceService.java:98)
        at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1739)
        at org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1701)
        at org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1559)
        at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
        at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982)
        at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486)
        at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377)
        at java.lang.Thread.run(Thread.java:748)

11:12:58,123 INFO  [org.wildfly.extension.io] (ServerService Thread Pool -- 53) WFLYIO001: Worker 'default' has auto-configured to 8 IO threads with 64 max task threads based on your 4 available processors
11:12:58,156 INFO  [org.jboss.as.ejb3] (MSC service thread 1-4) WFLYEJB0482: Strict pool mdb-strict-max-pool is using a max instance size of 16 (per class), which is derived from the number of CPUs on this host.
11:12:58,155 INFO  [org.jboss.as.ejb3] (MSC service thread 1-6) WFLYEJB0481: Strict pool slsb-strict-max-pool is using a max instance size of 64 (per class), which is derived from thread worker pool sizing.
11:12:58,224 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-3) WFLYUT0012: Started server default-server.
11:12:58,236 INFO  [org.jboss.remoting] (MSC service thread 1-8) JBoss Remoting version 5.0.18.Final
11:12:58,230 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0018: Host default-host starting
11:12:58,429 INFO  [org.jboss.as.patching] (MSC service thread 1-1) WFLYPAT0050: WildFly Full cumulative patch ID is: base, one-off patches include: none
11:12:58,445 WARN  [org.jboss.as.domain.management.security] (MSC service thread 1-5) WFLYDM0111: Keystore C:\Users\Lenovo\Downloads\wildfly-20.0.0.Final\wildfly-20.0.0.Final\standalone\configuration\application.keystore not found, it will be auto generated on first use with a self signed certificate for host localhost
11:12:58,452 INFO  [org.jboss.as.server.deployment.scanner] (MSC service thread 1-8) WFLYDS0013: Started FileSystemDeploymentService for directory C:\Users\Lenovo\Downloads\wildfly-20.0.0.Final\wildfly-20.0.0.Final\standalone\deployments
11:12:58,759 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address: ([("interface" => "public")]) - failure description: {"WFLYCTL0080: Failed services" => {"org.wildfly.network.interface.public" => "WFLYSRV0082: failed to resolve interface public"}}
11:12:58,827 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address: ([("subsystem" => "jca")]) - failure description: {
    "WFLYCTL0412: Required services that are not installed:" => ["org.wildfly.transactions.global-default-local-provider"],
    "WFLYCTL0180: Services with missing/unavailable dependencies" => ["org.wildfly.jca.transaction-integration is missing [org.wildfly.transactions.global-default-local-provider]"]
}
11:12:58,833 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address: ([
    ("subsystem" => "ejb3"),
    ("service" => "timer-service"),
    ("file-data-store" => "default-file-store")
]) - failure description: {
    "WFLYCTL0412: Required services that are not installed:" => ["org.wildfly.transactions.global-default-local-provider"],
    "WFLYCTL0180: Services with missing/unavailable dependencies" => ["jboss.ejb3.timerService.timerPersistence.default-file-store is missing [org.wildfly.transactions.global-default-local-provider]"]
}
11:12:58,836 ERROR [org.jboss.as.controller] (Controller Boot Thread) WFLYCTL0459: Triggering roll back due to missing management services.
11:12:58,863 INFO  [org.jboss.as.mail.extension] (MSC service thread 1-6) WFLYMAIL0002: Unbound mail session [java:jboss/mail/Default]
11:12:58,881 INFO  [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-6) WFLYJCA0019: Stopped Driver service with driver-name = h2
11:12:58,890 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-5) WFLYUT0019: Host default-host stopping
11:12:58,903 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-1) WFLYUT0004: Undertow 2.1.3.Final stopping
11:12:58,955 FATAL [org.jboss.as.server] (Controller Boot Thread) WFLYSRV0056: Server boot has failed in an unrecoverable manner; exiting. See previous messages for details.
11:12:58,979 INFO  [org.jboss.as] (MSC service thread 1-6) WFLYSRV0050: WildFly Full 20.0.0.Final (WildFly Core 12.0.1.Final) stopped in 14ms
Press any key to continue . . .

I'm new to all this so please help.

I am trying to identify if behaviour that I am observing is correct or if WildFly is leaking file handle descriptors.

During our standard performance testing after upgrading from WildFly 11 to 14 we ran into an issue regarding too many open files. After digging into things a bit more it looks like it is actually the number of pipes that WildFly has open that is increasing.

To help reproduce the problem I have created a simple JSF 2.2 application that contains a large image (100mb to simplify testing). I am retrieving the image using the standard JSF resource URL:

/contextroot/javax.faces.resource/css/images/big-image.png.xhtml

And have also tried adding omnifaces and using the unmapped resource handler URL:

/contextroot/javax.faces.resource/css/images/big-image.png

Adding Omnifaces did not change the behaviour I am seeing, and I have only included it as we first thought that it might have been a contributing factor.

Behaviour I am seeing:
WildFly starts and jstack reports that it has two threads matching default task-* which is the default value for task-core-threads

If I send in 5 concurrent requests for my large image, 3 new default task-* threads are spawned to serve the requests. 3 new Linux pipes will also be created.

If I stop my requests and wait for 2 minutes (the default value for task-keepalive) 3 of the threads will be removed. The pipes remain open.

Periodically - I believe about every 4.5 minutes some kind of clean up occurs and the pipes that were left over from the step above are removed.

However... If one of the original 2 worker threads is removed, e.g. task-1, task-3 and task-4 are removed, leaving task-2 and task-5, the pipe associated with task-1 is never cleaned up.

Over time these pipes add up and as far as I can tell they are never removed. Is this a leak somewhere, and if so where? JSF? WildFly? Undertow?

Things I have tried:
WildFly 14, 17 and 18
With and without Omnifaces (2.7 and 3.3)
Changing the min and max threads to be the same - this prevents handles building up, but I'd rather not go down this route