[JBoss JIRA] Created: (JBPORTAL-1514) Could not assign selective permissions when securing cms repositories
2:15 p.m.
Could not assign selective permissions when securing cms repositories
---------------------------------------------------------------------
Key: JBPORTAL-1514
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1514
Project: JBoss Portal
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: Portal CMS
Reporter: Rajesh Rajasekaran
Assigned To: Julien Viet
Fix For: 2.6 Final
What i am trying to do here:
1.Create a new repository and a new user when logged in as admin.
2.Secure the cms repository and assign only read permissions to that user on that
repository and block write and manage permissions.
In step 2, the user is totally blocked access to the repository. he is not able to read
the repository.
3.I gave read and write permissions but blocked manage permissions.
In step 3, i was able to read and write to the cms repository and also was able to manage
(secure permissions).
Just wanted to check if this is a valid use case and i am doing it right.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
2:36 p.m.
New subject: [JBoss JIRA] Commented: (JBPORTAL-1514) Could not assign selective permissions when securing cms repositories
[ http://jira.jboss.com/jira/browse/JBPORTAL-1514?page=comments#action_1236... ]
Sohil Shah commented on JBPORTAL-1514:
--------------------------------------
In step 2, the user is totally blocked access to the repository. he is
not able to read the repository.
Yes this is as expected. Typically read access means you have access to read the actual
document when grabbing it via the CMSPortlet from the CMS repository.
Read access does not mean, ability to browse the CMSAdmin tool in read-only mode. The
security system does not have support for that usecase right now
In step 3, i was able to read and write to the cms repository and also
was able to manage (secure permissions).
Were you able to do this when logged in as
that user who was granted only "read"/"write" permissions, or were you
able to do this when logged in as an "admin".
If its first case, then thats a bug, if its the latter then thats expected
Could not assign selective permissions when securing cms
repositories
---------------------------------------------------------------------
Key: JBPORTAL-1514
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1514
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal CMS
Reporter: Rajesh Rajasekaran
Assigned To: Julien Viet
Fix For: 2.6 Final
What i am trying to do here:
1.Create a new repository and a new user when logged in as admin.
2.Secure the cms repository and assign only read permissions to that user on that
repository and block write and manage permissions.
In step 2, the user is totally blocked access to the repository. he is not able to read
the repository.
3.I gave read and write permissions but blocked manage permissions.
In step 3, i was able to read and write to the cms repository and also was able to manage
(secure permissions).
Just wanted to check if this is a valid use case and i am doing it right.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
2:44 p.m.
New subject: [JBoss JIRA] Commented: (JBPORTAL-1514) Could not assign selective permissions when securing cms repositories
[ http://jira.jboss.com/jira/browse/JBPORTAL-1514?page=comments#action_1236... ]
Rajesh Rajasekaran commented on JBPORTAL-1514:
----------------------------------------------
In step 3, i had logged in as the user i had created. The user had an
'Administrator' role, as that was the only way i could access the cms as that
user.
However i had logged in as admin before that and removed 'Manage' permissions for
both 'the_user_i_created' and 'Administrator' role.
I could be doing something tricky.
Could not assign selective permissions when securing cms
repositories
---------------------------------------------------------------------
Key: JBPORTAL-1514
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1514
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal CMS
Reporter: Rajesh Rajasekaran
Assigned To: Julien Viet
Fix For: 2.6 Final
What i am trying to do here:
1.Create a new repository and a new user when logged in as admin.
2.Secure the cms repository and assign only read permissions to that user on that
repository and block write and manage permissions.
In step 2, the user is totally blocked access to the repository. he is not able to read
the repository.
3.I gave read and write permissions but blocked manage permissions.
In step 3, i was able to read and write to the cms repository and also was able to manage
(secure permissions).
Just wanted to check if this is a valid use case and i am doing it right.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
3:03 p.m.
New subject: [JBoss JIRA] Commented: (JBPORTAL-1514) Could not assign selective permissions when securing cms repositories
[ http://jira.jboss.com/jira/browse/JBPORTAL-1514?page=comments#action_1236... ]
Sohil Shah commented on JBPORTAL-1514:
--------------------------------------
ah ok.
This is fine. "Manage" permission does not control the accessibility of the
"Security Console where permissions are specified".
See here for explanation of what actions fall under "Read", 'Write",
and "Manage" permissions. http://wiki.jboss.org/wiki/Wiki.jsp?page=CMS_Security
As far as the "Security Console" access goes, its accessible as long as you are
in "Admin" role.
So in your usecase:
In Step 3: since you were logged in as a user that belonged to the "Admin" role,
you were allowed to access the 'Security Console". So this is expected behavior.
Just a note that you shouldn't force a User into an "Admin" role just to get
access to CMS Tool.
The "admin" account shipped with Portal is treated as root for CMS Tool, so if
you are logged in with that account, you have root access.
Note: only the "admin" account is treated as root, not any account that has
"Admin" role
Could not assign selective permissions when securing cms
repositories
---------------------------------------------------------------------
Key: JBPORTAL-1514
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1514
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal CMS
Reporter: Rajesh Rajasekaran
Assigned To: Julien Viet
Fix For: 2.6 Final
What i am trying to do here:
1.Create a new repository and a new user when logged in as admin.
2.Secure the cms repository and assign only read permissions to that user on that
repository and block write and manage permissions.
In step 2, the user is totally blocked access to the repository. he is not able to read
the repository.
3.I gave read and write permissions but blocked manage permissions.
In step 3, i was able to read and write to the cms repository and also was able to manage
(secure permissions).
Just wanted to check if this is a valid use case and i am doing it right.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
3:10 p.m.
New subject: [JBoss JIRA] Commented: (JBPORTAL-1514) Could not assign selective permissions when securing cms repositories
[ http://jira.jboss.com/jira/browse/JBPORTAL-1514?page=comments#action_1236... ]
Sohil Shah commented on JBPORTAL-1514:
--------------------------------------
Also, by default the CMS Tool is packaged under the "Admin" portal and not in
the "Default" portal, so only way to access is to log in as Admin role.
But you can change that by adding the CMS Tool to any other page in your
"Default" Portal.
Once you do that, the CMS Tool will allow access based on your Role.
For instance, when you are logged in as "User", You will be able to browse the
repository, but you will not have access to "Delete" files etc
Could not assign selective permissions when securing cms
repositories
---------------------------------------------------------------------
Key: JBPORTAL-1514
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1514
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal CMS
Reporter: Rajesh Rajasekaran
Assigned To: Julien Viet
Fix For: 2.6 Final
What i am trying to do here:
1.Create a new repository and a new user when logged in as admin.
2.Secure the cms repository and assign only read permissions to that user on that
repository and block write and manage permissions.
In step 2, the user is totally blocked access to the repository. he is not able to read
the repository.
3.I gave read and write permissions but blocked manage permissions.
In step 3, i was able to read and write to the cms repository and also was able to manage
(secure permissions).
Just wanted to check if this is a valid use case and i am doing it right.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
3:13 p.m.
New subject: [JBoss JIRA] Resolved: (JBPORTAL-1514) Could not assign selective permissions when securing cms repositories
[ http://jira.jboss.com/jira/browse/JBPORTAL-1514?page=all ]
Sohil Shah resolved JBPORTAL-1514.
----------------------------------
Resolution: Cannot Reproduce Bug
This is expected behavior
Could not assign selective permissions when securing cms
repositories
---------------------------------------------------------------------
Key: JBPORTAL-1514
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1514
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal CMS
Reporter: Rajesh Rajasekaran
Assigned To: Julien Viet
Fix For: 2.6 Final
What i am trying to do here:
1.Create a new repository and a new user when logged in as admin.
2.Secure the cms repository and assign only read permissions to that user on that
repository and block write and manage permissions.
In step 2, the user is totally blocked access to the repository. he is not able to read
the repository.
3.I gave read and write permissions but blocked manage permissions.
In step 3, i was able to read and write to the cms repository and also was able to manage
(secure permissions).
Just wanted to check if this is a valid use case and i am doing it right.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
3:26 p.m.
New subject: [JBoss JIRA] Closed: (JBPORTAL-1514) Could not assign selective permissions when securing cms repositories
[ http://jira.jboss.com/jira/browse/JBPORTAL-1514?page=all ]
Rajesh Rajasekaran closed JBPORTAL-1514.
----------------------------------------
Could not assign selective permissions when securing cms
repositories
---------------------------------------------------------------------
Key: JBPORTAL-1514
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1514
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal CMS
Reporter: Rajesh Rajasekaran
Assigned To: Julien Viet
Fix For: 2.6 Final
What i am trying to do here:
1.Create a new repository and a new user when logged in as admin.
2.Secure the cms repository and assign only read permissions to that user on that
repository and block write and manage permissions.
In step 2, the user is totally blocked access to the repository. he is not able to read
the repository.
3.I gave read and write permissions but blocked manage permissions.
In step 3, i was able to read and write to the cms repository and also was able to manage
(secure permissions).
Just wanted to check if this is a valid use case and i am doing it right.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6894
days inactive
6894
days old
6 comments
2 participants
participants (2)
-
Rajesh Rajasekaran (JIRA) -
Sohil Shah (JIRA)