Can't login to Hawtio after upgrade to 3.02 from 2.17

[dabramov1]

We upgraded from 2.17 to 3.0.2 and can no longer log in. We're deploying the hawtio-default.war in a Tomcat 9 (TomEE really) instance.

Are there any differences in the required config for 3.x and 2.x that might help here? Any additional debug we can enable?

Our CATALINA_OPTS includes:

-Djava.security.auth.login.config=$FEVAP_TOMEE_DEPLOY_DIR/conf/login.config \
  -Dhawtio.authenticationEnabled=true -Dhawtio.realm=hawtio -Dhawtio.role=engineers \
    -Dhawtio.rolePrincipalClasses=com.sun.security.auth.UserPrincipal,com.sun.security.auth.LdapPrincipal \

I also tried adding this, but it didn't help:

-Dhawtio.authenticationContainerDiscoveryClasses= \

The conf/login.conf has:

hawtio {
       com.sun.security.auth.module.LdapLoginModule REQUIRED
       userProvider="ldaps://dc1.vapdev.int:636/cn=users,dc=vapdev,dc=int ldaps://dc2.vapdev.int:636/cn=users,dc=vapdev,dc=int"  
       java.naming.security.authentication="simple"
       java.naming.security.principal="<LDAP bind user>"
       java.naming.security.credentials="<LDAP bind password>"
       userFilter="(&(sAMAccountName={USERNAME})(objectClass=user)(memberOf=CN=engineers,CN=Users,DC=vapdev,DC=int))"
       authzIdentity="engineers"
       useSSL=true
       debug=true;
};

With debug on, it looks like things are working, but I'm not sure if there's something additional we should expect to see:

         [LdapLoginModule] user provider: ldaps://dc1.vapdev.int:636/cn=users,dc=vapdev,dc=int ldaps://dc2.vapdev.int:636/cn=users,dc=vapdev,dc=int
                [LdapLoginModule] searching for entry belonging to user: dabramov
                [LdapLoginModule] found entry: CN=Daniel,CN=Users,DC=vapdev,DC=int
                [LdapLoginModule] attempting to authenticate user: dabramov
                [LdapLoginModule] authentication succeeded
                [LdapLoginModule] added LdapPrincipal "CN=Daniel,CN=Users,DC=vapdev,DC=int" to Subject
                [LdapLoginModule] added UserPrincipal "dabramov" to Subject
                [LdapLoginModule] added UserPrincipal "engineers" to Subject

but from the login page you always get "Invalid login credentials" and 403 in the access log for each login attempt.

10.37.105.247 - - [15/Oct/2024:17:13:37 -0400] "POST /hawtio/auth/login HTTP/1.1" 403 - 15079

[tadayosi]

@dabramov1 For the supported configuration for Hawtio 3+, see:
https://hawt.io/docs/configuration.html
https://hawt.io/docs/security.html

And Hawtio 3 is already an outdated version, if there's no specific reason to use it, try the latest Hawtio 4.2.0.

[dabramov1]

We're deploying in a version of Tomcat/TomEE which hasn't transitioned to the new Jakarta namespace, so I don't think Hawtio 4.x will play nice over there.

I've looked at those docs, and I don't see anything obvious to explain what's going wrong.

Any suggestions on what to try next or how to get additional debug info?

Is there an copy of the 2.x docs still kicking around that I can compare with?

[dabramov1]

I found the issue. Hawtio 3.x apparently changed the required role(s) property from:

hawtio.role

to hawtio.roles

We love the tool, but, lacking an upgrade guide, backwards compatibility for the single role property name would have been helpful.

[tadayosi]

Thank you for your investigation. Such documentation would be really great, but unfortunately we are currently short-staffed. We are always accepting contributions.