Security

To avoid logged in users bypassing password requirement and changing identity:

  1. Disable Config:/server/filters/login/form (info.magnolia.cms.security.auth.login.FormLogin) handler
  2. Split info.magnolia.jaas.sp.jcr.JCRAuthenticationModule and info.magnolia.jaas.sp.ldap.ADAuthenticationModulejaas into separate jaas login chains
  3. For example, add jaasChain property to Config:/server/filters/login/ntlm/ with value magnolia-ntlm. Then change your jaas.config to:

There's extra '3' which could be misleading. Otherwise seems OK.

Change By: Roman Kovařík (22/Oct/13 9:28 AM)
Resolution: Fixed
Status: Resolved Reopened
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira



----------------------------------------------------------------
For list details, see: http://www.magnolia-cms.com/community/mailing-lists.html
Alternatively, use our forums: http://forum.magnolia-cms.com/
To unsubscribe, E-mail to: <[email protected]>
----------------------------------------------------------------

Reply via email to