Bug 797992 - User still able to perform REST operations after deleted or permissions revoked
Summary: User still able to perform REST operations after deleted or permissions revoked
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: JBoss Enterprise Portal Platform 6
Classification: JBoss
Component: Portal
Version: 6.0.x
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
: 6.0.x
Assignee: Default User
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-02-27 18:15 UTC by Tomas Kyjovsky
Modified: 2013-11-06 17:54 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-11-06 17:54:12 UTC
Type: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description Tomas Kyjovsky 2012-02-27 18:15:53 UTC 
Description of problem:
https://issues.jboss.org/browse/GTNMGMT-39

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1) access MOP resource through REST API: http://<host>:8080/rest/private/managed-components/mop
2) authenticate as user john
 HTTP 200
3)
 a) delete user john via OrganizationManagement portlet
 b) remove john's membership in administrators group
4) access MOP resource again

Actual results:
HTTP 200  

Expected results:
a) HTTP 401 Unauthorized 
b) HTTP 403 Forbidden

Additional info:
Similar issue occurs when adding permissions to users: access still denied after permissions have been granted.

OrganizationManagement portlet should flush edited/deleted user from JAAS cache.
https://community.jboss.org/wiki/CachingLoginCredentials
Comment 2 Jared MORGAN 2013-11-05 23:17:23 UTC 
Based on age of this bug, I'm setting Release Notes Not Required. When the issue is eventually fixed, please re-evaluate this status.
Comment 3 Jiri Pallich 2013-11-06 17:54:12 UTC 
This is an EAP feature (known and proper behaviour).
Note You need to log in before you can comment on or make changes to this bug.