[OpenNMS/opennms] 3f4aee: Update wsman to 1.3.4 and wire Kerberos message en...

  Branch: refs/heads/dcy/wsman-134-updates-f2026
  Home:   https://github.com/OpenNMS/opennms
  Commit: 3f4aee77dfd8fee08219adc7bb18c46f08f4f41c
      https://github.com/OpenNMS/opennms/commit/3f4aee77dfd8fee08219adc7bb18c46f08f4f41c
  Author: Dino <[email protected]>
  Date:   2026-09-02 (Wed, 02 Sep 2026)

  Changed paths:
    M docs/modules/reference/pages/performance-data-collection/collectors/wsman.adoc
    A features/wsman/src/main/java/org/opennms/core/wsman/utils/CachingWSManClientFactory.java
    M features/wsman/src/main/java/org/opennms/netmgt/collectd/WsManCollector.java
    M features/wsman/src/main/java/org/opennms/netmgt/config/wsman/credentials/Definition.java
    M features/wsman/src/main/java/org/opennms/netmgt/config/wsman/credentials/WsmanAgentConfig.java
    M features/wsman/src/main/java/org/opennms/netmgt/config/wsman/credentials/WsmanConfig.java
    M features/wsman/src/main/java/org/opennms/netmgt/dao/WSManConfigDao.java
    M features/wsman/src/main/java/org/opennms/netmgt/poller/monitors/WsManMonitor.java
    M features/wsman/src/main/java/org/opennms/netmgt/provision/detector/wsman/WsManDetector.java
    M features/wsman/src/main/java/org/opennms/netmgt/provision/detector/wsman/WsManDetectorFactory.java
    M features/wsman/src/main/java/org/opennms/netmgt/provision/detector/wsman/WsManWQLDetector.java
    M features/wsman/src/main/java/org/opennms/netmgt/provision/detector/wsman/WsManWQLDetectorFactory.java
    M features/wsman/src/main/java/org/opennms/netmgt/provision/detector/wsman/WsmanEndpointUtils.java
    M features/wsman/src/main/resources/xsds/wsman-config.xsd
    A features/wsman/src/test/java/org/opennms/core/wsman/utils/CachingWSManClientFactoryTest.java
    M features/wsman/src/test/java/org/opennms/netmgt/config/wsman/credentials/WsmanConfigTest.java
    M features/wsman/src/test/java/org/opennms/netmgt/dao/jaxb/WSManConfigDaoJaxbTest.java
    M features/wsman/src/test/java/org/opennms/netmgt/provision/detector/wsman/WsmanEndpointUtilsTest.java
    A features/wsman/src/test/resources/wsman-config-endpoints.xml
    M features/wsman/src/test/resources/wsman-config.xml
    M integrations/opennms-wsman-asset-provisioning-adapter/src/main/java/org/opennms/netmgt/provision/WsManAssetProvisioningAdapter.java
    M pom.xml

  Log Message:
  -----------
  Update wsman to 1.3.4 and wire Kerberos message encryption

Bump wsmanVersion to 1.3.4, which adds Kerberos message encryption
(MS-WSMV 2.2.9.1), WinRS command execution, and makes WSManClient
AutoCloseable.

Add a kerberos-encryption attribute to wsman-config.xml (schema, JAXB
model, WsmanAgentConfig) and carry it through WsmanEndpointUtils and
WSManConfigDao.getEndpoint. It implies gss-auth and uses the canonical
host name like gss-auth does.

Close clients with try-with-resources in the collector, monitor, both
detectors, and the asset provisioning adapter. Add
CachingWSManClientFactory, now the default factory for all of them: it
keeps one client per Kerberos-encrypted endpoint so the JAAS login, GSS
context, and connection are reused across polls instead of rebuilt and
torn down each time. Endpoints without Kerberos encryption pass straight
through unchanged.


  Commit: 6502998a23b02de1c3a45e6b19857906bd9910a4
      https://github.com/OpenNMS/opennms/commit/6502998a23b02de1c3a45e6b19857906bd9910a4
  Author: Dino <[email protected]>
  Date:   2026-09-02 (Wed, 02 Sep 2026)

  Changed paths:
    M docs/modules/reference/nav.adoc
    A docs/modules/reference/pages/provisioning/detectors/WsmanShellDetector.adoc
    A docs/modules/reference/pages/service-assurance/monitors/WsManShellMonitor.adoc
    A features/wsman/src/main/java/org/opennms/core/wsman/utils/ShellCommandUtils.java
    A features/wsman/src/main/java/org/opennms/netmgt/poller/monitors/WsManShellMonitor.java
    A features/wsman/src/main/java/org/opennms/netmgt/provision/detector/wsman/WsManShellDetector.java
    A features/wsman/src/main/java/org/opennms/netmgt/provision/detector/wsman/WsManShellDetectorFactory.java
    M features/wsman/src/main/resources/OSGI-INF/blueprint/blueprint.xml
    A features/wsman/src/test/java/org/opennms/core/wsman/utils/ShellCommandUtilsTest.java
    A features/wsman/src/test/java/org/opennms/netmgt/poller/monitors/WsManShellMonitorTest.java
    A features/wsman/src/test/java/org/opennms/netmgt/provision/detector/wsman/WsManShellDetectorTest.java
    M smoke-test/src/test/java/org/opennms/smoketest/minion/DetectorsCommandIT.java
    M smoke-test/src/test/java/org/opennms/smoketest/minion/MonitorsListCommandIT.java

  Log Message:
  -----------
  Add WsManShellMonitor and WsManShellDetector

Run a command on a Windows host through WinRS (wsman 1.3.4 runCommand)
and check its output against a banner: plain text is a substring match,
a value starting with ~ is a regex matched against the whole output with
DOTALL. The exit code is ignored unless exit-code (monitor) or exitCode
(detector) is set. Shell options no-profile, codepage, and
working-directory are exposed. Defaults follow the other monitors and
detectors: 3000 ms and 2000 ms timeouts, no retries.

Endpoint details come from wsman-config.xml through the same runtime
attribute path as WsManMonitor and the existing detectors, so both run
on Minion and support metadata interpolation.


  Commit: a8a68165461e722d34f84bd2f1d428cbf53098fe
      https://github.com/OpenNMS/opennms/commit/a8a68165461e722d34f84bd2f1d428cbf53098fe
  Author: Dino <[email protected]>
  Date:   2026-09-02 (Wed, 02 Sep 2026)

  Changed paths:
    M docs/modules/reference/pages/provisioning/detectors/WsmanShellDetector.adoc
    M docs/modules/reference/pages/service-assurance/monitors/WsManShellMonitor.adoc
    M features/wsman/src/main/java/org/opennms/core/wsman/utils/CachingWSManClientFactory.java
    M features/wsman/src/main/java/org/opennms/netmgt/collectd/WsManCollector.java
    M features/wsman/src/main/java/org/opennms/netmgt/poller/monitors/WsManMonitor.java
    M features/wsman/src/main/java/org/opennms/netmgt/poller/monitors/WsManShellMonitor.java
    M features/wsman/src/main/java/org/opennms/netmgt/provision/detector/wsman/WsManDetectorFactory.java
    M features/wsman/src/main/java/org/opennms/netmgt/provision/detector/wsman/WsManShellDetector.java
    M features/wsman/src/main/java/org/opennms/netmgt/provision/detector/wsman/WsManShellDetectorFactory.java
    M features/wsman/src/main/java/org/opennms/netmgt/provision/detector/wsman/WsManWQLDetectorFactory.java
    M features/wsman/src/main/java/org/opennms/netmgt/provision/detector/wsman/WsmanEndpointUtils.java
    M features/wsman/src/main/resources/META-INF/services/org.opennms.netmgt.poller.ServiceMonitor
    M features/wsman/src/main/resources/OSGI-INF/blueprint/blueprint.xml
    M features/wsman/src/test/java/org/opennms/core/wsman/utils/CachingWSManClientFactoryTest.java
    M features/wsman/src/test/java/org/opennms/netmgt/poller/monitors/WsManShellMonitorTest.java
    M features/wsman/src/test/java/org/opennms/netmgt/provision/detector/wsman/WsManShellDetectorTest.java

  Log Message:
  -----------
  Harden WsManShellMonitor/Detector

Register WsManShellMonitor in META-INF/services so core, which loads the
wsman feature from lib/ rather than Karaf, can find it; without this every
poll failed with "Monitor not found".

Bound every exchange with the host by the poll or detector timeout: the
endpoint's connection and receive timeouts are set to the same value as
the WinRS command budget. Take timeout and retry defaults from
wsman-config.xml when the service definition does not set them, as
snmp-config.xml does.

Drop placeholder substitution for command and args, which reach cmd.exe
verbatim, so node-controlled text such as the node label cannot inject
commands. Validate codepage, and return down instead of throwing when a
client cannot be created.

Close cached Kerberos clients on bundle stop: CachingWSManClientFactory
is AutoCloseable and the collector, monitors, and detector factories
expose destroy(), wired as blueprint destroy-method. Add a concurrency
test for the factory and update docs for the new semantics.

Update docs and document Kerberos message encryption.


  Commit: 379e45133dfb32b0076fa63371d8e0f429a45646
      https://github.com/OpenNMS/opennms/commit/379e45133dfb32b0076fa63371d8e0f429a45646
  Author: Dino <[email protected]>
  Date:   2026-09-02 (Wed, 02 Sep 2026)

  Changed paths:
    M docs/modules/reference/nav.adoc
    A docs/modules/reference/pages/configuration/wsman-kerberos.adoc
    M docs/modules/reference/pages/performance-data-collection/collectors/wsman.adoc
    M docs/modules/reference/pages/provisioning/detectors/WsmanDetector.adoc
    M docs/modules/reference/pages/provisioning/detectors/WsmanShellDetector.adoc
    M docs/modules/reference/pages/provisioning/detectors/WsmanWqlDetector.adoc
    M docs/modules/reference/pages/service-assurance/monitors/WsManMonitor.adoc
    M docs/modules/reference/pages/service-assurance/monitors/WsManShellMonitor.adoc
    M features/wsman/src/main/java/org/opennms/netmgt/provision/detector/wsman/WsmanEndpointUtils.java
    M features/wsman/src/test/java/org/opennms/netmgt/provision/detector/wsman/WsmanEndpointUtilsTest.java

  Log Message:
  -----------
  Actually add docs + endpoint fix

Actually add the docs. Break wsman kerberos out into its own section
and link all the monitors, detectors, and collector back to it.

End to end testing uncovered that username and password auth is broken
for kerberos-encryption=true, as WsmanEndpointUtils.toMap copied the username
and password only when isBasicAuth() was true, and that is false whenever GSS
is on. So with gss-auth or kerberos-encryption, monitors and detectors
silently dropped the credentials and fell back to the JAAS entry with "No
LoginModules configured for WSManClient". Plumb these through if they
are set, instead.


Compare: https://github.com/OpenNMS/opennms/compare/3f4aee77dfd8%5E...379e45133dfb

To unsubscribe from these emails, change your notification settings at https://github.com/OpenNMS/opennms/settings/notifications


_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/wiki/index.php?page=MailingListFaq
opennms-cvs mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-cvs