Issue Details (XML | Word | Printable)

Key: GLASSFISH-17263
Type: Bug Bug
Status: Closed Closed
Resolution: Fixed
Priority: Major Major
Assignee: Jason Lee
Reporter: Anissa Lam
Votes: 0
Watchers: 1

If you were logged in you would be able to see more operations.

GUI should give appropriate access denied msg

Created: 31/Aug/11 05:47 PM   Updated: 20/Jan/12 12:30 AM   Resolved: 30/Nov/11 08:40 PM
Component/s: admin_gui
Affects Version/s: 3.1.1
Fix Version/s: 3.1.2_b13

Time Tracking:
Not Specified

Tags: 3_1_2-review 3_1_2-verified
Participants: Anissa Lam, Jason Lee, shaline and Tim Quinn

 Description  « Hide

secure admin needs to be enabled to allow user to use the Admin Console remotely.
The enforcement is checked in since in r49138 trunk, r49145 branch.
However, when access is denied, console always shows login error. Without differentiating whether it is login error or access denied.

In AdminConsoleAuthModule,
we should be able to distinguish the response by calling restResp.getResponseCode(). If it is 401, need to display a login page. If it is 403, let user know that remote access is denied.

Tim Quinn added a comment - 30/Nov/11 04:50 PM

For what it's worth, the AdminAdapter (which handles asadmin requests) returns the top-level message in the ActionReport (which is in the HTTP response payload) as "Remote configuration is currently disabled"

Maybe the console adapter can do the same? I'm not sure what the console does with the ActionReport message, if anything.

Just a thought.

Ideally, the adapter that's providing the response status will set a useful message, rather than the client having to assume that 403 always means that remote config is turned off. That might be valid today, but that could change.

Jason Lee added a comment - 30/Nov/11 08:40 PM

Fix committed to branch (r51210) and trunk (r51211).

shaline added a comment - 20/Jan/12 12:30 AM

Verified in GF 3.1.2 b18.