[ https://issues.apache.org/jira/browse/KARAF-4439?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15943445#comment-15943445 ]
ASF subversion and git services commented on KARAF-4439: -------------------------------------------------------- Commit 0e88e07b4d88e350ea09aa2be6b5a0a2800e9e9b in karaf's branch refs/heads/karaf-4.0.x from [~jbonofre] [ https://git-wip-us.apache.org/repos/asf?p=karaf.git;h=0e88e07 ] [KARAF-4439] Prevent user authentication if the user doesn't have any role defined > Prevent user authentication (shell & JMX) if he doesn't have role > ----------------------------------------------------------------- > > Key: KARAF-4439 > URL: https://issues.apache.org/jira/browse/KARAF-4439 > Project: Karaf > Issue Type: Bug > Components: karaf-management, karaf-security, karaf-shell > Reporter: Jean-Baptiste Onofré > Assignee: Jean-Baptiste Onofré > Priority: Critical > Fix For: 4.0.9, 4.1.1 > > > Right now, if an user doesn't have any role defined, he can logon and perform > "non" critical operations (the "critical" operation). > We should define a minimum role required for login and prevent users access > if they don't have the minimum role (before the ACL). -- This message was sent by Atlassian JIRA (v6.3.15#6346)