Re: Security probs upg from 2.4.100 to 2.5.107

That's a good tip...thanks

I have now reproduced on JBoss 4.0.5, so it's definitely something to do 
with jspwiki 2.5.x.

I'm not running with any installed java security policy, so I enabled 
that in JBoss by enabling the default security manager, and then setting 
java.security.policy=jspwiki-container.policy  (the stuff that used to 
be in jspwiki.policy), but I'm not sure this is taking effect properly. 
Switching on debug info for security policy doesn't show anything new!

I did also manage to get this all happening under the debugger, but had 
a little difficulty following the flow of control around the login form. 
Not sure where to breakpoint it to see what's going on.

I'll keep plugging....




Alex Samad wrote:
> Can I suggest having a look in jspwiki.properties
> 
> 
> log4j.logger.SecurityLog=INFO, SecurityAppender
> 
> change the above to debug and it should give you an idea of what is happening
> 
> 
> 
> On Sat, Jul 28, 2007 at 09:25:57AM +1000, Milt Taylor wrote:
>> No I don't think it's the same problem...I have now run an out of the box 
>> clean install of jspwiki under jboss 4.2 and I still get the same problem 
>> immediately following the login form.
>>
>> I'm now trying under jboss 4.0.5, because the version of tomcat is much 
>> more recent in jboss 4.2.
>>
>> Also still could be something configurational that has changed between wiki 
>> 2.4. and 2.5.x
>>
>>
>>
>> Claudia Frers wrote:
>>> Hi again Milt:
>>> I corrected my problem.
>>> I forced a recompile by stopping Tomcat and deleting the contents of the
>>> TOMCAT_HOME/work directory. This forces Tomcat to recompile everything.
>>> Don't recall how its done in JBoss. Now all the permissions are working as
>>> expected
>>> and I finally don't need the ACL's. Don't know if this helps you in any 
>>> way
>>> but it seems
>>> my problem was a caching thing :-(
>>> Claudia
>>> On 7/27/07, Claudia Frers <[email protected]> wrote:
>>>> Hi Milt:
>>>> Check my post Testing Security 2.5.
>>>> Wouldn't you say I have the same or at least similar issues?
>>>> I got around it by using ACL's but as I remember this wasn't necessary
>>>> with the 2.4 version.
>>>> Maybe
>>>>
>>>>> Even adding AllPermissions
>>>> to Authenticated makes no difference.
>>>>
>>>> Correct.
>>>>
>>>>>> I will run this in a dev environment with totally out of the box
>>>> settings and see what happens.
>>>>
>>>> Am currently doing that. No difference there.
>>>>
>>>> I think Andrew is the expert on this...
>>>> I have not been able to assess if the ACL are mandatory but the policy
>>>> file should suffice
>>>> you'd think. I am using the default policy file. No changes to the
>>>> container policy file.
>>>>
>>>> Claudia
>>>>
>>>>
>>>>
>>>> On 7/27/07, Milt Taylor <[email protected]> wrote:
>>>>> Further to my posting, I have discovered that:
>>>>>
>>>>> 1. By running SecurityConfig.jsp off the URL - which I can get into
>>>>> after logging in - it all looks OK there. Policy seems to be loading
>>>>> correctly.
>>>>>
>>>>> 2. After the error (after login form), I can manually enter the URL for
>>>>> the home page and am able to view and follow hyperlinks. But Edit gives
>>>>> me the error page, same as I get after Login. Even adding AllPermissions
>>>>> to Authenticated makes no difference.
>>>>>
>>>>> I will run this in a dev environment with totally out of the box
>>>>> settings and see what happens.
>>>>>
>>>>> _______________________________________________
>>>>> This is the Jspwiki-users mailing list, in which we discuss the
>>>>> stable release (even-numbered, 2.4.x, 2.6.x), and user-issues.
>>>>> For development discussion, please join jspwiki-dev.
>>>>> http://ecyrd.com/cgi-bin/mailman/listinfo/jspwiki-users
>>>>> http://www.jspwiki.org/JSPWikiMailingList
>>>>>
>> _______________________________________________
>> This is the Jspwiki-users mailing list, in which we discuss the stable 
>> release (even-numbered, 2.4.x, 2.6.x), and user-issues. For development 
>> discussion, please join jspwiki-dev.
>> http://ecyrd.com/cgi-bin/mailman/listinfo/jspwiki-users
>> http://www.jspwiki.org/JSPWikiMailingList
>>