WildFly 23.0.2 BASIC 身份验证不起作用

Question

I can't understand why the BASIC authentication method isn't working. I tried to secure a resource on the url api/hello-world (it's the first time) with the HTTP BASIC auth method (code below). But, it's completely not working, the resource is not protected when accessed, and browser shows no login form.

jboss-web.xml

<?xml version="1.0" encoding="UTF-8"?>
<jboss-web xmlns="http://www.jboss.com/xml/ns/javaee"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.jboss.com/xml/ns/javaee 
       http://www.jboss.org/j2ee/schema/jboss-web_10_0.xsd"
       version="10.0">
   <security-domain>ApplicationDomain</security-domain>
</jboss-web>

web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
         version="4.0"

    <security-constraint>
        <web-resource-collection>
            <web-resource-name>Hello World</web-resource-name>
            <url-pattern>/api/hello-world</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <role-name>user</role-name>
        </auth-constraint>
    </security-constraint>

    <security-role>
        <role-name>user</role-name>
    </security-role>

    <login-config>
        <auth-method>BASIC</auth-method>
        <realm-name>ApplicationRealm</realm-name>
    </login-config>
</web-app>

Testing with Insomnia, the resource results not protected, responding always with 200.

Answer 1

I had the same problem with Wildfly 26.0.1. In older Versions it worked with this configiration in the standalone.xml (Example from 18.0.1):

<subsystem xmlns="urn:jboss:domain:undertow:10.0" default-security-domain="other">

where other is the default value in the xsd . other is defined as default security domain in the domain::ejb3 section only, not in undertow. This might be wrong, but it worked. In Wildfly 26.0.1 it no longer worked with a similar configuration.

However I got it running by changing the default-security-domain in the undertow section from other to ApplicationDomain .

        <subsystem xmlns="urn:jboss:domain:undertow:12.0" default-server="default-server" default-virtual-host="default-host" default-servlet-container="default" default-security-domain="ApplicationDomain" statistics-enabled="${wildfly.undertow.statistics-enabled:${wildfly.statistics-enabled:false}}">

Don't know if this helps in your case, as well.