Kevin O'Toole created KARAF-4636:
------------------------------------
Summary: karaf.secured.command.compulsory.roles does not work
Key: KARAF-4636
URL: https://issues.apache.org/jira/browse/KARAF-4636
Project: Karaf
Issue Type: Bug
Components: karaf-security
Affects Versions: 4.0.5, 4.0.4, 4.0.3, 4.0.2, 4.0.1
Reporter: Kevin O'Toole
Priority: Critical
The karaf.secured.command.compulsory.roles property in system.properties does
not work in Karaf [4.0.1, 4.0.5].
It does work in Karaf [3.0.5, 3.0.7].
Easy way to test this is modify users.properties with the following:
viewer = karaf,_g_:viewergroup
_g_\:viewergroup = group,viewer
And then add
karaf.secured.command.compulsory.roles=admin
to
system.properties.
If you log in as viewer, it will allow the execution of commands that do not
have ACL defined.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
