DO NOT REPLY [Bug 35466] New: - Security system does not work as "documented"

[bu...@apache.org]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=35466>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.

http://issues.apache.org/bugzilla/show_bug.cgi?id=35466

           Summary: Security system does not work as "documented"
           Product: Slide
           Version: 2.1
          Platform: Other
        OS/Version: Windows 2000
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Security
        AssignedTo: slide-dev@jakarta.apache.org
        ReportedBy: rbrown3@bluebottle.com


PROCEDURE:

1: Install Slide WAR and Slide document WAR file on Tomcat
2: Start Tomcat
3: In the browser, go to the main slide documentation page (Assuming we are 
using Port 8080, we go to: http://localhost:8080/slide-doc)

Note that the Slide documentation identifies 4 standard users that come with 
Slide: root, john, john2, and guest. The documentation suggests that you should 
be able to log in as root.

4. Follow the instructions given in http://localhost:8080/slide-doc/howto-
acl.html to enable athentication on Slide.

5: Attempt to follow the instructions for creating a user as given on the page:
http://localhost:8080/slide-doc/howto-create-users.html
(alternatively, go to http://jakarta.apache.org/slide/howto-create-users.html 
since the pages are the same).

5a. Download and install the DAVExplorer application
5b. Run DAVExplorer
5c. Attempt to connect to localhost:8080/slide

PROBLEM 1: The root login and password does not work. You cannot log in to 
Slide's resources at all!

6. Go to Apache Foundation's Bugzilla, search through Slide's open bugs for the 
keyword "login"

7. Read bug #22409

NOTE: Bug 22409 talks about adding usernames to the tomcat-users.xml file in 
order to log in to Slide. Nowhere in Slide's configuration docmentation is 
there mention of needing to edit anything other than the web.xml file (for 
enabling authentication) and the Domain.xml file (for user information and 
properties). This is just one aspect of some serious documentation bugs which 
will be entered seperately into this Bugzilla system.

8. Based on information in Bug #22409, edit the tomcat-users.xml file and add 
entries for "root" and "john2".

9. Restart Tomcat and DAV Explorer

10. Log in to Slide (this time, the login works)

11. Attempt to add a user as instructed in http://localhost:8080/slide-
doc/howto-create-users.html.

12. Restart Tomcat.

13. Restart DAV Explorer

14. Attempt to log in as the new user.

PROBLEM 2: Login FAILS. Apparently, changes made following the user instruction 
DO NOT WORK.

15. Add a new entry for "test" in the tomcat-users.xml directory.

16. Restart everything and attempt to log in as the new user (test) again.

PROBLEM 3: Login succeeds. This indicates that the security system does not 
work as "documented". According to the "documentation", users are added through 
entries in the /slide/users directory, and the entries in the Domain.xml file 
handle the user' permissions and passwords.

In actuality, it is the tomcat-users.xml file that actually creates users 
recognized by Slide. The users, passwords, and roles entered into that file 
determine who can log in and what their permissions are.

Roles defined in Domain.xml seem to work, though, and testing shows that you do 
apparently need to define entries for a user's permissions in Domain.xml in 
order to log in without errors (Note: creating a new user accordig to the 
instructions in http://localhost:8080/slide-doc/howto-create-users.html doesn't 
work at all because the system apparently ignores any changes made to 
properties that aren't done through editing Domain.xml).

The bottom line is that Slide's security system does not work as it is 
currently documented. The documentation is abysmal as it is, but the fact that 
it is also inaccurate does not help matters.

Either this system must be fixed so that it operates as "documented", or the 
documentation needs to be changed. The way things are now is unacceptable.

-- 
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

---------------------------------------------------------------------
To unsubscribe, e-mail: slide-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: slide-dev-help@jakarta.apache.org