Re: [uportal-dev] Proposed security enhancements to 'switch identity' portlet

2012-07-12 Thread Aaron Grant
Steve, I think that is a great idea and would be useful for us if this was implemented, I can think of 5 or 6 portlets that I could use this on right now. Aaron On Thu, Jul 12, 2012 at 1:30 AM, Steve Swinsburg steve.swinsb...@gmail.comwrote: Hi all, We have been conducting a security audit

Re: [uportal-dev] Proposed security enhancements to 'switch identity' portlet

2012-07-12 Thread Kevin Wilkinson
Is this concerning uPortal versions prior to 4.x? I believe uP4 already has this feature. When managing a portlet there is an option to Hide portlet during impersonation which does exactly what you're describing. - Kevin Wilkinson Student Affairs IT University of

Re: [uportal-dev] Proposed security enhancements to 'switch identity' portlet

2012-07-12 Thread Jen Bourey
Hi Steve, You may already be able to identify a swapped session by looking for the LoginController.SWAP_TARGET_UID attribute in the session. Assuming you find that that's successfully populated for swapped identities, you could create a new UserInfoService to expose a flag to interested

Re: [uportal-dev] Proposed security enhancements to 'switch identity' portlet

2012-07-12 Thread Steve Swinsburg
Hi Kevin, Yes this was for uP 3.2. Thanks for the info about uP4, that's great. cheers, Steve On 13/07/2012, at 1:59 AM, Kevin Wilkinson wrote: Is this concerning uPortal versions prior to 4.x? I believe uP4 already has this feature. When managing a portlet there is an option to Hide

Re: [uportal-dev] Proposed security enhancements to 'switch identity' portlet

2012-07-12 Thread Steve Swinsburg
Hi Jen, Yes, I was thinking that the fragment admin must do something similar since it knows you are swapped. Kevin wrote earlier about the Hide portlet during impersonation, does that feature of uP4 do what we need already? The restriction of access to these functions is certainly something