Bug 797992

Summary:	User still able to perform REST operations after deleted or permissions revoked
Product:	[JBoss] JBoss Enterprise Portal Platform 6	Reporter:	Tomas Kyjovsky <tkyjovsk>
Component:	Portal	Assignee:	Default User <jbpapp-maint>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	6.0.x	CC:	epp-bugs, hfnukal, jpallich
Target Milestone:	---
Target Release:	6.0.x
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-11-06 17:54:12 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Tomas Kyjovsky 2012-02-27 18:15:53 UTC

Description of problem:
https://issues.jboss.org/browse/GTNMGMT-39

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1) access MOP resource through REST API: http://<host>:8080/rest/private/managed-components/mop
2) authenticate as user john
 HTTP 200
3)
 a) delete user john via OrganizationManagement portlet
 b) remove john's membership in administrators group
4) access MOP resource again

Actual results:
HTTP 200  

Expected results:
a) HTTP 401 Unauthorized 
b) HTTP 403 Forbidden

Additional info:
Similar issue occurs when adding permissions to users: access still denied after permissions have been granted.

OrganizationManagement portlet should flush edited/deleted user from JAAS cache.
https://community.jboss.org/wiki/CachingLoginCredentials

Comment 2 Jared MORGAN 2013-11-05 23:17:23 UTC

Based on age of this bug, I'm setting Release Notes Not Required. When the issue is eventually fixed, please re-evaluate this status.

Comment 3 Jiri Pallich 2013-11-06 17:54:12 UTC

This is an EAP feature (known and proper behaviour).