Uploaded image for project: 'Crowd Data Center'
  1. Crowd Data Center
  2. CWD-2917

Possibility to Access Restricted Pages With Recreated Group

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Timed out
    • Icon: Low Low
    • None
    • 2.4
    • None
    • None

      Delete a group, then recreate it, with the same name that used to be used to restrict pages. Once the user do that, and make himself a member of the group, once Crowd does its synchronization he is accessing pages that he shouldn't gain access based on the restrictions.

            [CWD-2917] Possibility to Access Restricted Pages With Recreated Group

            Chad Barnes added a comment -

            This is related to Confluence and external Crowd groups. Confluence page restrictions are based on group names. So, if the group is ever removed, via external synchronization, and later recreated with the same name then it is possible a different set of users gains access to restricted content.

            Instead, it seems more secure to control access via a group's globally unique identifier. A unique number that can never be re-used after a group is deleted. Thus, even if a same-named group is created it will not be applicable to any legacy page restrictions.

            I'm not sure this is so much a Crowd issue as it is a group permission issue across all the tools.

            Chad Barnes added a comment - This is related to Confluence and external Crowd groups. Confluence page restrictions are based on group names . So, if the group is ever removed, via external synchronization, and later recreated with the same name then it is possible a different set of users gains access to restricted content. Instead, it seems more secure to control access via a group's globally unique identifier. A unique number that can never be re-used after a group is deleted. Thus, even if a same-named group is created it will not be applicable to any legacy page restrictions. I'm not sure this is so much a Crowd issue as it is a group permission issue across all the tools.

              Unassigned Unassigned
              gdecampos Giuliano C.
              Affected customers:
              1 This affects my team
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: