[ https://issues.apache.org/jira/browse/KARAF-4439?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15943449#comment-15943449 ]
Jean-Baptiste Onofré commented on KARAF-4439: --------------------------------------------- As a possible improvement, we can imagine to define a minimal set of roles (for JMX and SSH) to prevent user authentication. > Prevent user authentication (shell & JMX) if he doesn't have role > ----------------------------------------------------------------- > > Key: KARAF-4439 > URL: https://issues.apache.org/jira/browse/KARAF-4439 > Project: Karaf > Issue Type: Bug > Components: karaf-management, karaf-security, karaf-shell > Reporter: Jean-Baptiste Onofré > Assignee: Jean-Baptiste Onofré > Priority: Critical > Fix For: 4.0.9, 4.1.1 > > > Right now, if an user doesn't have any role defined, he can logon and perform > "non" critical operations (the "critical" operation). > We should define a minimum role required for login and prevent users access > if they don't have the minimum role (before the ACL). -- This message was sent by Atlassian JIRA (v6.3.15#6346)