Bug: Invalid naming assumption when looking up custom mbeans (security providers)

[kenneth-olwing]

To make progress while getting issue #946 sorted, I started loading up my ORACLE_HOME with mbeans/schemas. Regardless, for one authorizer I kept getting this:

WLSDPLY-06779: Unable to complete discover of Security Configuration Provider Proxy for ZiAuthorizationProvider: Name=ZiAuthorizationProvider, Type=Authorizer. The mbean type jar and schema jar must be in the correct locations to discover the custom provider MBean. See documentation for more information.

After several days being certain that I had made some silly error with the schema creation, how the authorizer was written or whatever, and in general poring over my code and mbean creation procedures something finally whispered 'Use the source Luke!'. So I did (and I should have done it waaay earlier), I quickly found this:

(weblogic-deploy\lib\python\wlsdeploy\tool\discover\custom_folder_helper.py, method security_provider_interface_name, line 367 in 1.9.17)

...
        if result.endswith('ProviderMBean'):
            result = mbean_interface_name
            _logger.warning('WLSDPLY-06779', str(mbean_instance), class_name=_class_name, method_name=_method_name)
...

Unfortunately, my Authorizer happened to have the actual name '.ZiAuthorizationProvider' (and hence being found as '.ZiAuthorizationProviderMBean'), and so being incorrectly flagged as a problem. Oops.

While I technically could change the name to avoid this, this particular provider is not created by me so I can't really fix it easily...so please come up with a better method of figuring out how to handle the situation of a custom mbean missing the schema...:-)

Thank you,
ken1

[CarolynRountree]

The value of the Provider Class Name is the value that the bit of code is looking for. If it has the unwanted part, then pass it the real interface name. The problem here is it never gets to that bit of code, it can not find the provider class name. This is because it is not finding the schema file. Can you recheck that you have the schematype jar is in the correct location? Verify the location in a comment please

[kenneth-olwing]

Hi Carolyn,

Here is my analysis of why I believe there's a problem with the code...

We have three providers, an auditor (WlstoolsCfgAuditor), an authenticator (ZiAuthenticator) and an authorizer (ZiAuthorizer).
Here's the relevant parts of the config:

...
    <realm>
    ...
      <sec:auditor xmlns:prov="http://xmlns.oracle.com/oracleas/schema/11/adf/sampleapp/weblogic/providers" xsi:type="prov:wlstools-cfg-auditorType">
        <sec:name>WlstoolsCfgAuditor</sec:name>
      </sec:auditor>
    ...
      <sec:authentication-provider xmlns:ext="http://xmlns.oracle.com/weblogic/security/extension" xsi:type="ext:zi-authenticatorType">
        <sec:name>ZiAuthenticator</sec:name><sec:active-type>X.509</sec:active-type><sec:active-type>ZiTest</sec:active-type><sec:active-type>ZiDriftUser</sec:active-type>
        <ext:control-flag>SUFFICIENT</ext:control-flag>
      </sec:authentication-provider>
    ...
      <sec:authorizer xmlns:ext="http://xmlns.oracle.com/weblogic/security/extension" xsi:type="ext:zi-authorization-providerType">
        <sec:name>ZiAuthorizer</sec:name>
      </sec:authorizer>
    ...
    </realm>
...

Yes, the schemas and mbeans are in place:;

C:\WS\domains\HG>dir ..\wls1221\Oracle_Home\wlserver\server\lib\mbeantypes ..\wls1221\Oracle_Home\oracle_common\lib\schematypes

 Volume in drive C is OSDisk         Serial number is ca6b:21ab
 Directory of  C:\WS\domains\wls1221\Oracle_Home\wlserver\server\lib\mbeantypes\*

2021-08-19  20:58             .
2021-08-19  20:58             ..
2016-04-19  09:48           9 171  commo.dtd
2021-08-13  13:44         201 201  OracleIdentityCloudIntegratorProviders.jar
2019-04-08  18:15         237 908  saml2-security-providers.jar
2018-09-17  17:13          50 007  system-password-validator-provider.jar
2021-07-16  11:54          37 764  WgCfgAuditProvider.jar
2019-07-23  16:51         396 318  wlManagementImplSource.jar
2019-07-23  16:45          83 513  wlManagementMBean.jar
2019-05-30  23:29       1 441 104  wls-security-providers.jar
2018-09-17  17:13         235 625  xacml-security-providers.jar
2021-08-16  16:47          23 591  ZiAuthenticatorProvider.jar
2021-07-07  15:49          41 515  ZiAuthorizerProvider.jar
           2 757 717 bytes in 11 files and 2 dirs    2 785 280 bytes allocated
     162 433 081 344 bytes free

 Volume in drive C is OSDisk         Serial number is ca6b:21ab
 Directory of  C:\WS\domains\wls1221\Oracle_Home\oracle_common\lib\schematypes\*

2021-08-19  20:59             .
2021-08-19  20:59             ..
2019-08-17  09:28          54 619  OracleIdentityCloudIntegratorProviders.schema.jar
2021-08-13  13:28          23 213  WgCfgAuditProvider.schema.jar
2021-08-18  15:56          24 965  ZiAuthenticatorProvider.schema.jar
2021-08-18  15:57          18 467  ZiAuthorizerProvider.schema.jar
             121 264 bytes in 4 files and 2 dirs    131 072 bytes allocated
     162 433 081 344 bytes free

If I instrument the code a little bit (just adding some print statements):

def security_provider_interface_name(mbean_instance, mbean_interface_name):
    """
    Return the name that is used to look up the custom Security Provider MBeanInfo.

    This is too tightly coupled to be in this class.
    This needs something more to differentiate Security Provider Interface which is formatted differently from other
    custom MBean Interface names.
    :param mbean_instance: instance for the current custom MBean
    :param mbean_interface_name: interface for the MBean
    :return: provider class name returned from the massaged MBean name
    """
    print "MBEAN_INSTANCE: " + str(mbean_instance)
    print "MBEAN_INTERFACE_NAME: " + mbean_interface_name
    _method_name = 'security_provider_interface_name'
    try:
        getter = getattr(mbean_instance, 'getProviderClassName')
        result = getter()
        print "RESULT: " + str(result)
        if result.endswith('ProviderMBean'):
            print "FAIL!"
            result = mbean_interface_name
            _logger.warning('WLSDPLY-06779', str(mbean_instance), class_name=_class_name, method_name=_method_name)
    except (Exception, JException):
        _logger.warning('WLSDPLY-06778', mbean_interface_name, class_name=_class_name, method_name=_method_name)
        result = mbean_interface_name
    idx = result.rfind('MBean')
    if idx > 0:
        result = result[:idx]
    return result

And then run it (logging turned off):

C:\ws\domains\wls1221\Oracle_Home\oracle_common\common\bin\wlst.cmd c:\WS\git\WDTGLU~1\wdt\WEBLOG~1.17\lib\python\discover.py -oracle_home C:\ws\domains\wls1221\Oracle_Home -java_home c:\Program\SKVJava\java8 -domain_home DAmT0 -skip_archive -model_file DAmT0.yaml

Initializing WebLogic Scripting Tool (WLST) ...

Welcome to WebLogic Server Administration Scripting Shell

Type help() for help on available commands

MBEAN_INSTANCE: Proxy for WlstoolsCfgAuditor: Name=WlstoolsCfgAuditor, Type=Auditor
MBEAN_INTERFACE_NAME: se.rsv.wlstools.audit.providers.WlstoolsCfgAuditorMBean
RESULT: se.rsv.wlstools.audit.providers.WlstoolsCfgAuditorMBean
MBEAN_INSTANCE: Proxy for ZiAuthenticator: Name=ZiAuthenticator, Type=AuthenticationProvider
MBEAN_INTERFACE_NAME: se.rsv.zi.security.authentication.ZiAuthenticatorMBean
RESULT: se.rsv.zi.security.authentication.ZiAuthenticatorMBean
MBEAN_INSTANCE: Proxy for ZiAuthorizer: Name=ZiAuthorizer, Type=Authorizer
MBEAN_INTERFACE_NAME: se.rsv.zi.security.authorization.ZiAuthorizationProviderMBean
RESULT: se.rsv.zi.security.authorization.ZiAuthorizationProviderMBean
FAIL!
####<2021-aug-19 20:52:13>     

Issue Log for discoverDomain version 1.9.17 running WebLogic version 12.2.1.4.0 offline mode:

VARNING Messages:

        1. WLSDPLY-06779: Unable to complete discover of Security Configuration Provider Proxy for ZiAuthorizer: Name=ZiAuthorizer, Type=Authorizer. The mbean type jar and schema jar must be in the correct locations to discover the custom provider MBean. See documentation for more information.

Total:       WARNING :     1    SEVERE :     0

discoverDomain.cmd completed successfully (exit code = 0)

AFAICT, it does reach that code and it does find it fine. The problem is just that the class name actually ends with 'ProviderMBean' and thus gets interpreted as faulty. I check my assumption by removing the authorizer mbean/schema and running the discover again:

C:\WS\domains\HG>cmd /cdiscoverDomain -oracle_home C:\ws\domains\wls1221\Oracle_Home -java_home c:\Program\SKVJava\java8 -domain_home DAmT0 -skip_archive -model_file DAmT0.yaml
JDK version is 1.8.0_301, setting JAVA_VENDOR to Sun...
JAVA_HOME = C:\Program\SKVJava\java8
WLST_EXT_CLASSPATH = c:\WS\git\WDTGLU~1\wdt\WEBLOG~1.17\lib\weblogic-deploy-core.jar
CLASSPATH = c:\WS\git\WDTGLU~1\wdt\WEBLOG~1.17\lib\weblogic-deploy-core.jar
WLST_PROPERTIES = -Dcom.oracle.cie.script.throwException=true -Djava.util.logging.config.class=oracle.weblogic.deploy.logging.WLSDeployCustomizeLoggingConfig
C:\ws\domains\wls1221\Oracle_Home\oracle_common\common\bin\wlst.cmd c:\WS\git\WDTGLU~1\wdt\WEBLOG~1.17\lib\python\discover.py -oracle_home C:\ws\domains\wls1221\Oracle_Home -java_home c:\Program\SKVJava\java8 -domain_home DAmT0 -skip_archive -model_file DAmT0.yaml

Initializing WebLogic Scripting Tool (WLST) ...

Welcome to WebLogic Server Administration Scripting Shell

Type help() for help on available commands

MBEAN_INSTANCE: Proxy for WlstoolsCfgAuditor: Name=WlstoolsCfgAuditor, Type=Auditor
MBEAN_INTERFACE_NAME: se.rsv.wlstools.audit.providers.WlstoolsCfgAuditorMBean
RESULT: se.rsv.wlstools.audit.providers.WlstoolsCfgAuditorMBean
MBEAN_INSTANCE: Proxy for ZiAuthenticator: Name=ZiAuthenticator, Type=AuthenticationProvider
MBEAN_INTERFACE_NAME: se.rsv.zi.security.authentication.ZiAuthenticatorMBean
RESULT: se.rsv.zi.security.authentication.ZiAuthenticatorMBean
MBEAN_INSTANCE: Proxy for ZiAuthorizer: Name=ZiAuthorizer, Type=Authorizer
MBEAN_INTERFACE_NAME: weblogic.management.security.authorization.AuthorizerMBean
RESULT: weblogic.management.security.ProviderMBean
FAIL!
####<2021-aug-19 21:06:19>     

Issue Log for discoverDomain version 1.9.17 running WebLogic version 12.2.1.4.0 offline mode:

VARNING Messages:

        1. WLSDPLY-06779: Unable to complete discover of Security Configuration Provider Proxy for ZiAuthorizer: Name=ZiAuthorizer, Type=Authorizer. The mbean type jar and schema jar must be in the correct locations to discover the custom provider MBean. See documentation for more information.

Total:       WARNING :     1    SEVERE :     0

discoverDomain.cmd completed successfully (exit code = 0)

As expected it now doesn't find that class name and instead returns the generic 'weblogic.management.security.ProviderMBean' as the result.

I obviously can't tell if there are other wrinkles here, but should the test be "if result.endswith('.ProviderMBean'):" instead (note the extra period in front. Or perhaps the full name as an indicator.

Thoughts?

[CarolynRountree]

Thanks for your indepth analysis. From what you state, it works but has the warning message. I would rather start with the warning message. Trying to find the interface name is tricky enough. But would you be willing to try a one off without the message and see if what you believe should be in the config.xml when you run createDomain?

[kenneth-olwing]

Hi,

I'm not entirely sure I'm clear on what you mean exactly - 'start with the warning message', 'try without the message'...?

But yes, regardless of the warning, the resulting yaml seems to be correct, and also, it seems to generate the correct stuff with createDomain (this effort spawned issue #970). I say 'seems' since the provider has no attributes or so, so technically I have no idea if there would've been a problem down the road if that were so.

Generally though, I assume the warning is supposedly there for a reason, but in this case it is unarguably detecting an error (well, warning) where it shouldn't. It does take an alternate code path to replace result with the original interface name for some reason...would this give problems later in the code, e.g. if there actually was attributes and whatnot for the provider. So I'm confused - the if statement, as it is, is plainly wrong to my eyes. Maybe there's some weird problem with the provider mbean/schema that could be the root cause...?

Maybe I am completely misunderstanding something here?

[CarolynRountree]

I mainly wanted to see if the resulting config.xml after a create domain is correct.

[kenneth-olwing]

Ok!

If it helps I'm attaching two zips with src and build stuff and prebuilt sample 'fake' authorizers (mbean+schema), basically identical and functional (they say yes to anything ;-), and also added some attributes, just to verify that that works too. Add to mbeantypes and schematypes dir in ORACLE_HOME and they should be deployable and attributes editable.

I created the most default domain possible with the graphical config, started it and deployed them, restarted and edited some attribs. Stopped it, and do a discover. As expected, the FakeAuthorizerProvider produces a warning due to the naming during discovery, but yaml looks good, including attribs. A createDomain also seems to do the right thing with the yaml.

So it merely remains to figure out how to best avoid the the WLSDPLY-06779 warning I guess...

FakeZiAuthorization.zip
FakeZiAuthorizationProvider.zip

[robertpatrick]

Closing, will address documentation recommendations in #946