Uploaded image for project: 'Crowd Data Center'
  1. Crowd Data Center
  2. CWD-163

Administration Console allows login of unauthorized users

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: High High
    • 1.0.3
    • 0.4.4
    • Core features
    • None

      When a valid (but unauthorized) principal (user) of Crowd tries to login to the Administration Console after an (authorized) administrator has been logged in and then logged out on the same computer, this unauthorized principal will be granted access to the Administration Console during some time window (approx. 5 minutes).

      Clearing all cookies in the browser when the authorized admin has logged out doesn't help to avoid the problem. Expiring the session in the Administration Console doesn't help either - the login will be successful again when performed within the time window.

      Ironically if this unauthorized principal (when being logged in) surfs to Applications - Crowd - Config Test and provides his credentials there, he is (correctly) rejected ("Invalid verification").

            [CWD-163] Administration Console allows login of unauthorized users

            shihab added a comment -

            Yes this bug has been fixed since the implementation of CWD-216.

            Unfortunately this issue hadn't been closed in JIRA. Closing now.

            shihab added a comment - Yes this bug has been fixed since the implementation of CWD-216 . Unfortunately this issue hadn't been closed in JIRA. Closing now.

            Bernd Rinn added a comment -

            I can confirm that the bug is no longer present in version 1.0.3 (which is the version that we are using). So probably this bug is a duplicate of CWD-216.

            Bernd Rinn added a comment - I can confirm that the bug is no longer present in version 1.0.3 (which is the version that we are using). So probably this bug is a duplicate of CWD-216 .

            kgbvax added a comment -

            May I ask what the status of this is?

            kgbvax added a comment - May I ask what the status of this is?

            Justen Stepka [Atlassian] added a comment -

            May be caused by.

            Justen Stepka [Atlassian] added a comment - May be caused by.

              shamid@atlassian.com shihab
              cd6347d59f92 Bernd Rinn
              Affected customers:
              1 This affects my team
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: