[jboss-jira] [JBoss JIRA] Commented: (JBPORTAL-2109) CMS Security Issue with LDAP/Clustered mode

CMS Security Issue with LDAP/Clustered mode ------------------------------------------- Key: JBPORTAL-2109 URL: https://jira.jboss.org/jira/browse/JBPORTAL-2109 Project: JBoss Portal Issue Type: Bug Security Level: Public(Everyone can see) Components: Portal CMS Affects Versions: 2.6.6 Final Reporter: Sohil Shah Assignee: Sohil Shah Fix For: 2.6.7 Final Steps to Reproduce: I finally managed to reproduce this. Here's my environment: - EAP 4.3, JBoss Portal 2.6.5.SP1 HA (or 2.6.6 HA) - enabled TC clustered SSO First test: ---------- 1/ start two nodes, one with the Service Binding Manager 2/ check if one is CMS master, other slave 3/ log in as admin:admin 4/ change security setting for the '/default' CMS folder to 'Read=User' 5/ logout 6/ login as user:user on node1 (master): ok, content is displayed 7/ logout 8/ login as user:user on node2 (slave): ok, content is displayed => TEST PASSED Second test: ----------- - same setup as before, but with LDAP: <attribute name="ConfigFile">conf/identity/ldap_identity-config.xml</attribute> - OpenDS is used on localhost with imported identity/src/resources/example/portal-sample-local.ldif structure 1-7 as above 8/ login as user:user on node2 (slave): failed, 404 or Access Denied (depending on Portal version) => TEST FAILED