Grouper Users - Open Discussion List

[Gagné Sébastien <>]

Hi,

In media.properties we defined a group required for logins :

media.properties:require.group.for.logins=etc:GroupeAccesUI

 

But the behaviour is “leaky”. A user out of this group can access and modify groups using the lite UI. Here is our use case :

 

Connect to grouper UI

Authenticate with CAS with a user NOT in GroupeAccesUI

Error message is shown that I must be in the group

Click on the Lite UI Link (clicking on other AdminUI’s functions still gives me the message)

Select Group members

Then in the search box the user can search and select any group where “GrouperAll”/EveryEntity has Admin or Optin privilege.

Then in manageMemberLite the user that shouldn’t have any access to the Grouper UI can modify the groups or the members.

 

Is it possible to block this ? This is a serious security concern here and prevents us from going in production for the moment.

 

Thanks

 

 

Sébastien Gagné,     | Analyste en informatique

514-343-6111 x33844  | Université de Montréal,

                     | Pavillon Roger-Gaudry, local X-100-11