users@glassfish.java.net

Re: problem with insecure admin console and

From: Wolfram Rittmeyer <w.rittmeyer_at_jsptutorial.org>
Date: Sat, 06 Dec 2008 16:06:01 +0100

Christian Andersson wrote:
> Hi there, I have just taken over an server with Application server
> installed on it (it is about to go into production) by someone else
> (notin our office)
>
> On this server there is application server, accessmanager and portal
> server.
>
> my problemhowever is that when I start the default domain (domain1) and
> surf to the admin console (port 4848) I get directly into the admin
> console, I'm not required to enter username or password..
>

This is configured in the admingui's web.xml. You can find it in
GF_INSTALL/lib/install/applications/admingui/adminGUI_war/WEB-INF

Generally you can find the following configuration in here:
     218 <login-config>
     219 <auth-method>FORM</auth-method>
     220 <realm-name>admin-realm</realm-name>
     221 <form-login-config>
     222 <form-login-page>/login.jsf</form-login-page>
     223 <form-error-page>/loginError.jsf</form-error-page>
     224 </form-login-config>
     225 </login-config>
     226 <security-role>
     227 <role-name>admin</role-name>
     228 </security-role>

Most probably s.o. has changed these lines.


> the person doing the installationis not available right now so I'm
> hoping that anyone here can help me (we must have username/password for
> the admin console)
>
>
> I've loocked over th4 settings and cannot see any directly wrong
>
> I've also created a new domain just to see if I get the login screen
> there, and I do so it is not an application server problem.
>

--
Wolfram Rittmeyer