[GLASSFISH-17263] GUI should give appropriate access denied msg Created: 31/Aug/11  Updated: 20/Dec/16  Resolved: 30/Nov/11

Status: Closed
Project: glassfish
Component/s: admin_gui
Affects Version/s: 3.1.1
Fix Version/s: 3.1.2_dev

Type: Bug Priority: Major
Reporter: Anissa Lam Assignee: Jason Lee
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Tags: 3_1_2-review, 3_1_2-verified


secure admin needs to be enabled to allow user to use the Admin Console remotely.
The enforcement is checked in since in r49138 trunk, r49145 branch.
However, when access is denied, console always shows login error. Without differentiating whether it is login error or access denied.

In AdminConsoleAuthModule,
we should be able to distinguish the response by calling restResp.getResponseCode(). If it is 401, need to display a login page. If it is 403, let user know that remote access is denied.

Comment by Tim Quinn [ 30/Nov/11 ]

For what it's worth, the AdminAdapter (which handles asadmin requests) returns the top-level message in the ActionReport (which is in the HTTP response payload) as "Remote configuration is currently disabled"

Maybe the console adapter can do the same? I'm not sure what the console does with the ActionReport message, if anything.

Just a thought.

Ideally, the adapter that's providing the response status will set a useful message, rather than the client having to assume that 403 always means that remote config is turned off. That might be valid today, but that could change.

Comment by Jason Lee [ 30/Nov/11 ]

Fix committed to branch (r51210) and trunk (r51211).

Comment by shaline [ 20/Jan/12 ]

Verified in GF 3.1.2 b18.

Generated at Fri Mar 24 03:55:50 UTC 2017 using JIRA 6.2.3#6260-sha1:63ef1d6dac3f4f4d7db4c1effd405ba38ccdc558.