[Geoserver-devel] [JIRA] (GEOS-8102) GROUP_ADMIN being able to disable & change non-group members

Rob Langford created an issue

GeoServer / BugGEOS-8102

GROUP_ADMIN being able to disable & change non-group members

Issue Type:

BugBug

Affects Versions:

2.10.2

Assignee:

Unassigned

Created:

21/Apr/17 11:45 AM

Environment:

Windows 2008 R2
Tomcat 7
Oracle Corporation: 1.8.0_121 (Java HotSpot™ 64-Bit Server VM)

Priority:

MediumMedium

Reporter:

Rob Langford

These have only been tested against with the “Default XML user/group service”

Create 2 groups:

  1. group-1
  2. group-2

Create 3 users

  1. group-1-user ; member of group-1 ; add role GROUP_ADMIN
  2. group-2-user ; member of group-2
  3. no-group-user

Disabling non-group users:- Log in to webGUI as group-1-user (GROUP_ADMIN)

  • Open group-2-user
  • Un-tick the “Enabled” check box
  • Click save -> Error message: “An error occurred while saving the user: User […] is member of group(s) not administered by current user and cant be modified.”
  • Navigate back to user list (or press “Cancel”)
  • group-2-user now doesn’t have the “Enabled” tick and cannot log in

Changing non-group users passwords (occurred when Password encryption=Digest, didn’t affect Strong PBE):- Log in to webGUI as group-1-user (GROUP_ADMIN)

  • Open group-2-user
  • Change the password
  • Click save -> Error message: “An error occurred while saving the user: User […] is member of group(s) not administered by current user and cant be modified.”
  • Navigate back to user list (or press “Cancel”)
  • group-2-user tries to log on and gets HTTP 500: “No password decoder for”

Add Comment

Add Comment

This message was sent by Atlassian JIRA (v1000.910.0#100040-sha1:0b083fc)

Atlassian logo