java.vendor name changed in openj9

[krismarc]

Shouldn't this be considered?
ibmruntimes/Semeru-Runtimes#30

$ ./java -XshowSettings:properties -version 2>&1 | grep java.vendor
ava.vendor = International Business Machines Corporation
java.vendor.url = https://www.ibm.com/semeru-runtimes
java.vendor.url.bug = https://github.com/ibmruntimes/Semeru-Runtimes/issues
java.vendor.version = 11.0.14.1

$ ./java -XshowSettings:properties -version 2>&1 | grep java.vendor
java.vendor = IBM Corporation
java.vendor.url = https://www.ibm.com/semeru-runtimes
java.vendor.url.bug = https://github.com/ibmruntimes/Semeru-Runtimes/issues
java.vendor.version = 17.0.6.0

mssql-jdbc/src/main/java/com/microsoft/sqlserver/jdbc/Util.java

Line 51 in 7e476f4

return SYSTEM_JRE.startsWith("IBM");

mssql-jdbc/src/main/java/com/microsoft/sqlserver/jdbc/JaasConfiguration.java

Line 30 in 7e476f4

final String ibmLoginModule = "com.ibm.security.auth.module.Krb5LoginModule";

if my understanding is correct, starting from version 17 your condition in isIBM method is met so driver stopped using com.sun.* libs and started looking for com.ibm.*

which leads to
javax.security.auth.login.LoginException (No LoginModule found for com.ibm.security.auth.module.Krb5LoginModule)

[krismarc]

https://www.ibm.com/support/pages/semeru-runtimes-security-migration-guide

[pshipton]

The ibm login module should only be used on IBM Java 8, which contains the following settings:
java.vendor = IBM Corporation
java.vm.name = IBM J9 VM

This is different from Semeru builds, which sets the following:
java.vendor = IBM Corporation
java.vm.name = Eclipse OpenJ9 VM

and in some older Semeru builds of jdk8, jdk11
java.vendor = International Business Machines Corporation

i.e. a test for the ibm login module could be if the system property java.vm.name starts with "IBM".

[Jeffery-Wasty]

Hi @krismarc,

Thank you for bringing this to our attention. We'll look more into this, but you appear to be correct that there have been discrepancies with IBM within the driver.

[mstoodle]

Just wanted to suggest that it would be more robust to probe for the thing you're actually concerned about (e.g. some specific com.ibm.security class which indicates the presence of the IBM Java 8 security implementation) rather than checking the vendor/vm property values and assuming that means something about the security implementation. Otherwise you make it hard for a vendor to change anything about their distribution...

[krismarc]

That's what I meant in the other issue. Having a substring of property checked doesn't look good to me and sounds like kind of antipattern.

[Jeffery-Wasty]

The fix is still in development and won't be looked at again until after the 12.4 GA release.

[kadirchisty]

Hi @Jeffery-Wasty - Please let's know when new version-12.4.0 of mssql-jdbc would be available for use?

[Jeffery-Wasty]

Hi @kadirchisty,

The PR still needs changes, and development was halted until 12.4 release was finished. 12.4 will be out today, but the next release to include this fix will be 12.5 (release window to be discussed with team). The next stable release to include this should be early 2024.

[kadirchisty]

Is it possible to provide this fix early in a minor version? We had halted java17 migration due to this Kerberos login issue and were hoping for this fix availability soon in mssql-jdbc driver. Please let us know.. Thanks!!

On Mon, Jul 31, 2023 at 9:01 PM Jeffery Wasty ***@***.***> wrote: Hi @kadirchisty <https://github.com/kadirchisty>, The PR still needs changes, and development was halted until 12.4 release was finished. 12.4 will be out today, but the next release to include this fix will be 12.5 (release window to be discussed with team). The next *stable* release to include this should be early 2024. — Reply to this email directly, view it on GitHub <#2139 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AT53JTE2MCYVLFZWZKM37YDXS7FU7ANCNFSM6AAAAAAY2SKBME> . You are receiving this because you were mentioned.Message ID: ***@***.***>

-- Sent from my iPhone

[Jeffery-Wasty]

We'll look into what we can do about the release schedule. If there is a hotfix for this release, it would include this fix.

[kadirchisty]

Hello @Jeffery-Wasty, Please let's know if the fix would be included in current release?

Thanks!

[Jeffery-Wasty]

We're reviewing the PR now. The plan is for this to be included in a stable hotfix release, planned for August 24.

[Jeffery-Wasty]

This is now included in the 12.4.1 stable hotfix release, set to release on August 24.

EDIT: The release is delayed to August 30.

[kadirchisty]

@Jeffery-Wasty - Wanted to check if 12.4.1 is released?

[Jeffery-Wasty]

Our apologies, the release had to be delayed a week. We're now planning on releasing on August 30.

[lilgreenbird]

re-opening since fix is being reverted