Mailing-List: contact jackrabbit-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: jackrabbit-dev@incubator.apache.org
Message-ID: <429782416.1142535647940.JavaMail.jira@ajax>
Date: Thu, 16 Mar 2006 19:00:47 +0000 (GMT)
From: "Jukka Zitting (JIRA)" <jira@apache.org>
To: jackrabbit-dev@incubator.apache.org
Subject: [jira] Resolved: (JCR-351) Default to anonymous access when no
 Credentials are given
In-Reply-To: <1559483399.1142257539353.JavaMail.jira@ajax>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit

     [ http://issues.apache.org/jira/browse/JCR-351?page=all ]
     
Jukka Zitting resolved JCR-351:
-------------------------------

    Fix Version: 1.0
     Resolution: Fixed

Patch committed in revision 386415. Merged in the 1.0 branch in revision 386416.

> Default to anonymous access when no Credentials are given
> ---------------------------------------------------------
>
>          Key: JCR-351
>          URL: http://issues.apache.org/jira/browse/JCR-351
>      Project: Jackrabbit
>         Type: Improvement
>   Components: security
>     Versions: 0.9
>     Reporter: Jukka Zitting
>     Assignee: Jukka Zitting
>     Priority: Minor
>      Fix For: 1.0
>  Attachments: null-credentials.patch
>
> Even though JCR-348 made easier to start a Jackrabbit repository with default configuration, the user still needs to take care of the JAAS configuration. It would be more user-friendly to log a warning and default to superuser access rather than throwing a LoginException when JAAS has not been configured. This behaviour should be limited to only default credential logins (Session.login() with null Credentials) and it should be possible to disable it with a configuration option. We could even have this behaviour disabled by default, but enabled in the configuration file used with the JCR-348 automatic configuration.
> This is a case against the "secure by default" design principle, but I think that in this case the benefits in easier setup outweight the security drawbacks, especially if coupled with the above restrictions and a clear documentation note about the insecure default.
> [Update: As mentioned by Stefan, this is  not a JAAS configuration issue but a problem in handling null Credentials. A more proper alternative for superuser access would be to default to anonymous access when credentials are not given.]

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
   http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
   http://www.atlassian.com/software/jira