Issue
- User gets below error while trying to access jsonws API over Liferay PaaS with Basic Auth enabled at Webserver level:
"error": {
"message": "Access denied to xxxx",
"type": "java.lang.SecurityException"
}
Environment
- Liferay DXP 7.0
- Liferay DXP 7.1
- Liferay DXP 7.2
- Liferay DXP 7.3
Resolution
- User needs to remove Basic Auth from Webserver level.
- In order to remove it, user needs to navigate at
webserver/configs/{env}/conf.d/liferay.confin the git repository and comment out the lines with the auth_basic prefix. - Example :
#auth_basic "Authentication Required";
#auth_basic_user_file /var/www/html/.htpasswd;
Additional Information
- Liferay provides Basic Auth at nginx level so the standard test@liferay.com credentials will be user's Liferay admin account. The Basic Auth prevents someone with knowledge of the default Liferay credentials from discovering the non-prod environments and logging in as an administrator to wreak a little havoc.
- Once user logged into Liferay for the first time, Admin credentials should be modified and Basic Auth should then be removed from the nginx level.