You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@karaf.apache.org by "Kevin O'Toole (JIRA)" <ji...@apache.org> on 2016/07/25 21:07:20 UTC

[jira] [Created] (KARAF-4636) karaf.secured.command.compulsory.roles does not work

Kevin O'Toole created KARAF-4636:
------------------------------------

             Summary: karaf.secured.command.compulsory.roles does not work
                 Key: KARAF-4636
                 URL: https://issues.apache.org/jira/browse/KARAF-4636
             Project: Karaf
          Issue Type: Bug
          Components: karaf-security
    Affects Versions: 4.0.5, 4.0.4, 4.0.3, 4.0.2, 4.0.1
            Reporter: Kevin O'Toole
            Priority: Critical


The karaf.secured.command.compulsory.roles property in system.properties does not work in Karaf [4.0.1, 4.0.5].

It does work in Karaf [3.0.5, 3.0.7].

Easy way to test this is modify users.properties with the following:
viewer = karaf,_g_:viewergroup
_g_\:viewergroup = group,viewer

And then add
karaf.secured.command.compulsory.roles=admin
to
system.properties.

If you log in as viewer, it will allow the execution of commands that do not have ACL defined.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)