Site Search - Liferay Learn

I would like to control email notifications to Liferay strangers.

Issue How are strangers defined by Liferay? How can I control email notifications to strangers upon signup? Environment DXP 7.3+ Resolution The SAML property defining unknown users as strangers was introduced in DXP 7.3. (1) This property defines if users that do not exist already in the...

How to get rid of SSLHandshakeException?

legacy Troubleshooting

Issue When trying to access the site URL, the console displays the following exception, and the site is inaccessible. javax.net.ssl.SSLHandshakeException: Received fatal alert: handshakefailure javax.net.ssl.SSLHandshakeException: Received fatal alert: handshakefailure at...

Need to hide Liferay Auth token as it is visible in Page source

legacy

Issue When using the burp suite tool to intercept traffic, the Liferay Auth token is visible in the Page Source, which could make the environment vulnerable in the user's view. Environment Liferay DXP 7.0+ Resolution This observed behavior is expected and poses no security risk. The...

When logging in with an OpenID Provider, the portal shows "Internal Server Error"

legacy Troubleshooting

Issue When configuring an OpenID Provider and trying to log in with an user, the callback to the portal shows an error message similar to the one below: Internal Server Error An error occurred while accessing the requested resource....

Is Liferay creating cookies site base?

legacy

Issue Is Liferay creating a cookies site base? If so, where exactly on the Liferay server would all the cookies be physically kept? Environment Liferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 Resolution The majority of Liferay's cookies are of the "Persistent" type. As...

Users who are not registered with Liferay application are able to log in

legacy Troubleshooting

Issue Users who are not registered with the Liferay application are able to log in even though they have no connections. Environment Liferay DXP 7.0 to 7.4 Resolution Users log into Liferay DXP by using the Sign In widget, which uses the database to authenticate the user based on...

Lodash Security Vulnerability

legacy Troubleshooting

Issue In Liferay, a vulnerable version of Lodash 4.17.14 is being used. Environment Liferay DXP 7.0 Resolution The observed behavior is a known issue LPE-17236 and has already been fixed in the latest fix pack de-102-7010. Please raise a ticket including the latest patching-tool.info if...

SSO at site level

legacy

Issue Is there any OOTB option to configure SAML for two sites on the same instance? Whether creating a new instance for a site would help to configure SAML? Environment Liferay DXP 7.2 Liferay DXP 7.3 Resolution Is there any OOTB option to configure SAML for two sites on the same...

Enabling information about server errors in the JSON response

legacy Troubleshooting

Issue There is no error messages from api json services. How to manage the serialization and access to Json services In Liferay Portal 6.2 or DXP7.0 the server response is serialized and shows information related with server errors but now their are empty. Environment Liferay DXP...

Use Custom certificate and Let's encrypt at same time in different domains

legacy How To

Note: please note that Liferay has renamed its Liferay Experience Could offerings to Liferay SaaS (formerly LXC) and Liferay PaaS (formerly LXC-SM). Issue We need to have some domains with custom certificates and others using provided Let's Encrypt certificates. Is it possible setting...

Failed to verify signature and/or establish trust using any KeyInfo-derived credentials

legacy Troubleshooting

Issue SAML has abruptly stopped working, and no user can log in. The Liferay console contains the following errors: DEBUG [ajp-nio-172.1.129.26-8080-exec-351][BaseSignatureTrustEngine:200] Attempting to establish trust of KeyInfo-derived credential DEBUG...

Does CVE-2022-34305 affect Liferay?

legacy

Please be aware that the page you are viewing has been machine translated from Japanese into English and may contain some translation errors. If you observe any issues with the translation, please contact us. Issue Does CVE-2022-34305 affect Liferay? Environment Liferay DXP 7.0+ solution...

Portal prints error stacktrace on the browser, disclosing technical information

legacy Troubleshooting

Note: please note that Liferay has renamed its Liferay Experience Could offerings to Liferay SaaS (formerly LXC) and Liferay PaaS (formerly LXC-SM). Issue When navigating some incorrectly crafted URLs (ex.:...

Error message is not displayed when an error occurs in JSONWS

legacy

Please be aware that the page you are viewing has been machine translated from Japanese into English and may contain some translation errors. If you observe any issues with the translation, please contact us. Issue Error message is not displayed when an error occurs in JSONWS Do not...

Unable to send message: 554 X.X.XXX SendAsDenied

legacy Troubleshooting

Issue When sending emails, the error "unable to send message: 554 X.X.XXX SendAsDenied" occurs. Steps to reproduce: 1. Configure the outlook mail server to send email notifications in Liferay 2. Sometimes, the following errors occurred while sending emails. 2022-06-26 09:55:21.121 ERROR...

JSESSIONID not secure by default

legacy Troubleshooting

Issue The JSESSIONID cookie that comes with Liferay requests in the browser is not secure by default when inspected in the browser. Environment Liferay DXP 7.3 Resolution Set the JSESSIONID in web.xml to secure: <session-config> <cookie-config> <http-only>true</http-only>...

Could not connect to the SMTP host exceptions

legacy Troubleshooting

Issue When sending emails, the error "unable to send message: Could not connect to SMTP host: smtp.office365.com, port: 587" occurs. Steps to reproduce: 1. Configure the outlook mail server to send email notifications in Liferay 2. Sometimes, the following errors occurred while sending...

Can Liferay be affected by the IceApple framework?

legacy

Note: please note that Liferay has renamed its Liferay Experience Could offerings to Liferay SaaS (formerly LXC) and Liferay PaaS (formerly LXC-SM). Issue CrowdStrike’s Falcon Overwatch has discovered a malicious framework that targets Microsoft Exchange servers but it can also run...

How to Update Webserver Credentials

legacy How To

Note: please note that Liferay has renamed its Liferay Experience Could offerings to Liferay SaaS (formerly LXC) and Liferay PaaS (formerly LXC-SM). Issue I would like to change my webserver login credentials. Environment Liferay PaaS Resolution By default, the webserver nginx.conf uses...

OAuth 2.0 with Kerberos

legacy Troubleshooting

Issue You might encounter an issue where after the SSO setup, you start having problems with OAuth 2.0 and the call to /o/oauth2/token is failing with a "401 Unauthorized error". Also if you use Apache you might see the following: "POST /o/oauth2/token HTTP/1.1" 401 381 "-"...

InvalidNameIDPolicy errors

legacy Troubleshooting

Issue The following error occurs while configuring Liferay as SP and ADFS as Idp. At Liferay

Signed SAML response

legacy How To

Issue How can the signed response, which is required by ADFS to complete authentication at the Liferay end, be clarified? Environment Liferay DXP 7.0 Liferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Resolution Requests from ADFS to Liferay must be signed. Run the command below in the...

"Content security policy" header is not available in the application response

legacy

Issue The "Content security policy" header is not available in the application response. How to add or enable the CSP? Environment Liferay DXP 7.3 Resolution Liferay doesn't directly support the CSP as there are no OOTB configurations or UI settings available for configuring the CSP...

Impact of Spring4Shell and Spring Cloud Security Advisory on other libraries related to Spring

legacy

Issue There previously was a Security Advisory regarding a vulnerability for the Spring4Shell and Spring Cloud libraries. These vulnerabilities are detailed in this article here: Spring4Shell and Spring Cloud Security Advisory There are other libraries that Liferay uses that have Spring...

Version of spring-** jars after installing a hotfix

legacy

Issue To address the Spring4Shell vulnerabilities, the patched version of spring-beans.jar should be in its manifest file after the hotfix installation, is spring-webmvc.jar included in this? Environment Liferay DXP 7.2 Resolution Only the spring-beans.jar is patched by the Liferay patch...

Guest users are able to access an endpoint if PortalSessionAuthVerifier is enabled

legacy Troubleshooting

Issue We have followed this How-To article: How to add security, authentication to my REST service? (Section 5.1), but guest users are still able to access our endpoint from a browser. If we enable PortalSessionAuthVerifier, users without an active session are able to access the...

Plain text can still be seen despite SSL

legacy

Issue Even if SSL (or TLS) is enabled, the login credentials are in plain text while intercepting requests with Burp Suite. Environment Liferay DXP 7.3 Resolution If a user utilizes the burp suite as a proxy, they can see plain text in the password since the burp intercepts all traffic...

Error "Invalid domain for site key" when using reCAPTCHA

legacy Troubleshooting

Issue When using Google's reCAPTCHA, the CAPTCHA option won't show, instead the message "Invalid domain for site key" is displayed where the CAPTCHA should be. Environment Any Liferay DXP version with reCAPTCHA configured as the CAPTCHA engine. Resolution reCAPTCHA uses a pair of public...

log4j-core-2.13.3.jar exists inside the fix pack

legacy Troubleshooting

Issue This article highlights the concern with the following path of log4j lower version jars. {liferay_home}/patching-tool/patches/liferay-fix-pack-dxp-16-7210.zip!binaries/MODULES_BASE_PATH/marketplace/Liferay Foundation - Liferay Connector to Elasticsearch 6 -...

After changing the password, site members are not redirected to a page where they don't have the guest view permission

legacy Troubleshooting

Issue After changing the password, site members are not redirected to a page Steps to reproduce: 1) Start the server, login as Admin 2) Create a new page e.g. /testpage and remove the VIEW permission for the Guest user on it 3) Create a new user e.g. user1 and, in the Memberships tab,...

Password reminder answers are not masked

legacy Troubleshooting

Issue As Liferay DXP does not hide password reminder answers, attackers can capture user's password reminder answers through man-in-the-middle or shoulder surfing attacks. Environment Liferay DXP 7.0 Liferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Resolution The portal's observed...

Is there a REST API method to revoke the OAuth2 tokens?

legacy How To

Issue We want to provide a public REST API method to revoke the OAuth2 tokens following the RFC 7009 specification https://datatracker.ietf.org/doc/html/rfc7009#section-2.1 Does Liferay provide this functionality? Environment Liferay DXP 7.3 Liferay DXP 7.4 Resolution Unfortunately,...

New user is not being able to login properly

legacy Troubleshooting

Issue A new user (this also happens to LDAP users) is unable to log-in the first time, but seems to be able to log-in on the second attempt. Steps to reproduce: 1) Create a guest user from Create Account tab at the sign-in page. 2) Click on the sign-in button 3) Type the username and...

The birthday is reset to {01/01/1970} on LDAP import

legacy Troubleshooting

Issue Every time a user is logged in, the birthday is automatically updated to the default value {01-01-1970}. We configured the LDAP server in Instance Settings. Environment Liferay DXP 7.2 Liferay DXP 7.3 Resolution The resolution is to add "birthday" to the list of User Ignore...

Known vulnereabilities in jackson-databind-2.9.6

legacy Troubleshooting

Issue apio-architect-impl has a dependency of jackson-databind-2.9.6 which has the following known vulnerabilities: CVE-2018-19362 CVE-2018-19361 CVE-2018-19360 CVE-2018-14721 CVE-2018-14720 CVE-2018-14719 CVE-2018-1000873 Environment Liferay DXP 7.0 Liferay DXP 7.1 Liferay DXP 7.2...

Apache Log4j 1.x has reached its end-of-life

legacy

Issue Log4j 1.x has reached end-of-life status: https://blogs.apache.org/foundation/entry/apache_logging_services_project_announces Environment Liferay DXP 7.0 Liferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Resolution Liferay is aware of Log4j 1.x's end-of-life and has logged it as a...

CVE-2022-23305, CVE-2022-23307, and CVE-2017-5645

legacy Troubleshooting

Issue This article outlines the concerns of CVE-2022-23305, CVE-2022-23307, and CVE-2017-5645 vulnerabilities with respect to the Liferay DXP Environment Liferay DXP 7.0 Liferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Resolution CVE-2020-9493 or CVE-2022-23307 identified a...

javax.portlet.PortletException: java.lang.IllegalStateException: getAttribute: Session already invalidated error

legacy

Issue Why does this error gets triggered? What would be the cause? INFO [http-nio-8080-exec-2573][CustomLoginPortlet:726] url redirect = https://xxxx/group/yyyy ERROR [http-nio-8080-exec-2573][PortletServlet:112] javax.portlet.PortletException: java.lang.IllegalStateException:...

Error when configuring SAML in a clustered environment for the first time

legacy Troubleshooting

Issue When configuring SAML in a clustered environment and entering the configuration Idp connection an error is shown: java.lang.RuntimeException: java.lang.NullPointerException at com.liferay.portlet.expando.model.impl.ExpandoBridgeImpl.getAttributeType(ExpandoBridgeImpl.java:334) at...

Browser console error : The connection used to load resources from https://www.xxx.yyyy used TLS 1.0 or TLS 1.1, which are deprecated and will be disabled in the future

legacy Troubleshooting

Issue Browser console error as "The connection used to load resources from https://www.xxx.yyyy used TLS 1.0 or TLS 1.1, which are deprecated and will be disabled in the future. Once disabled, users will be prevented from loading these resources. The server should enable TLS 1.2 or...

Getting mixed content on the portal

legacy Troubleshooting

Issue After enabling SSL and routing the domain, getting mixed content on the portal that is the pages in the https://www.abc.in referring the http://www.abc.in for the stylesheet, javascript, and henceforth. Environment Liferay DXP 7.2 Resolution This might be caused when SSL is getting...

Error signing via SAML: com.liferay.saml.runtime.exception.AudienceException: Unable verify audience

legacy Troubleshooting

Issue Liferay is configured as a SAML Service Provider. When trying to sign in to Liferay it is not possible and the following error is shown in the logs: 2022-01-20 11:50:38.554 ERROR [default task-391][BaseSamlStrutsAction:56] com.liferay.saml.runtime.exception.AudienceException:...

Session logs out intermittently after being redirected by the payment link

legacy Troubleshooting

Issue After being redirected by the payment link, the session logs out. Steps to reproduce : 1. Login in Liferay. 2. Call the API in Postman. Request parameters are attached (SSL Commerz Request Parameters.txt) Request Type: x-www-form-urlencoded URL:...

Unable to bind to the LDAP server javax.naming.CommunicationException: [Root exception is java.lang.ClassNotFoundException: javax.net.ssl.SSLSocketFactory cannot be found by com.liferay.saml.web_

legacy Troubleshooting

Issue During the time of portal login using the LDAP users, the user('s) are able to log in successfully, LDAP connections have an active connection but observed the below warnings in the Liferay log. 2021-12-17 01:26:37.412 WARN [tomcat-http--20][DefaultPortalLDAP:178] Unable to bind...

SAML Authentication Issue: Message context was not authenticated when Azure AD as IDP

legacy Troubleshooting

Issue After enabling the SAML, when the user is trying to log in, authentication failed with the following message. ERROR [http-nio-8080-exec-36][BaseSamlStrutsAction:59] org.opensaml.messaging.handler.MessageHandlerException: Message context was not authenticated Caused by:...

Can Multi-Factor Authentication (MFA) be set for specific roles only?

legacy

Issue We want to set up MFA for Administrators only. Is this possible with Liferay out-of-the-box? Can we target specific users to sign in using multi-factor authentication? Environment DXP 7.4 DXP 7.3 DXP 7.2 Resolution Liferay's out-of-the-box functionality for MFA is binary in its...

URL length modification / restriction

legacy

Issue Sometimes we need to modify or restrict the length or URL Liferay generates ( for example for security custom solutions ) but Liferay has no out of the box solution for that. Environment DXP 7.2 Resolution The invoke filter handles the topic. The limit is 4000 chars and it can be...

How to enable CSRF Token in Liferay?

legacy

Issue How to enable CSRF Token in order to prevent CSRF attacks in Liferay? Environment Liferay DXP 7.2 Resolution Liferay's p_auth token protects against CSRF and is enabled by default. Here is the main code that handles the CSRF...

Change the GUEST_LANGUAGE_ID cookie to expire Null

legacy Troubleshooting

Issue The Guest language ID cookie in Liferay has a one-year expiration, whereas the undefined cookie in the F5 balancer caused the conflict. Is there a way to modify the Cookie's duration in Liferay? Environment Liferay DXP 7.0 Resolution The...

dtSa cookies containing special characters

legacy

Issue As dtsa cookies are detected, are these cookies URLs cause for concern? Is there any information concerning these cookies in relation to Liferay? Use Case: As Liferay generated dtSa cookies contain the characters '||', the user wants to whitelist them. Also, if special characters...

How to configure the default timeout value to any value instead of having it capped at 500ms

legacy

Issue The default library timeout until Liferay DXP 7.2 fix pack dxp-3 is 250ms. The default library timeout since Liferay DXP 7.2 fix pack dxp-4 is 500ms. Use Case: The user would like to be able to set/configure the default timeout value to whatever they want instead of having it...

Liferay as SAML SP fails after switching the URL of the virtual instance

legacy Troubleshooting

Issue SAML configuration hasn't been working since the virtual host of the portal instance changed. Caused by: org.opensaml.ws.security.SecurityPolicyException: Request was required to be secured but was not at org.opensaml.ws.security.provider.HTTPRule.evaluateSecured(HTTPRule.java:126)...

How to prevent an AD user from logging into Liferay using the old password if LDAP authentication cannot set to be required

legacy Troubleshooting

Issue After the user changes the password in Microsoft Active Directory (AD), the user can still log into Liferay using the old password. If enabling "Required" option, the issue can be resolved. But users created manually in Liferay (not imported from AD) can not sign into Liferay...

How can the p_auth authorization token be generated?

legacy

Issue Liferay protects itself against CSRF attacks by generating the p_auth authorization token. How can this token be created? Environment DXP 7.0, 7.1, 7.2, 7.3 Resolution When "auth.token.check.enabled=true" is set in portal-ext.properties, the auth token (p_auth value) is generated...

Automated process to remove users from Liferay that are no longer in LDAP?

legacy How To

Issue Is there a way to automatically remove users from Liferay who are no longer in LDAP? Environment Liferay DXP 7.1 Resolution There's no automated process to do this out of the box. However, a feature request for the same has already been submitted and can be tracked here LPS-69061...

Cross Site Scripting Vulnerability report on refererPlid or other parameters

legacy

Issue During a penetration test, a Cross Site Scripting Vulnerability may be reported, indicating that you can inject a script into the refererPlid parameter or into the _com_liferay_login_web_portlet_LoginPortlet_mvcRenderCommandName parameter. Environment Liferay DXP 7.3 Resolution...

When resetting a password, duplicate error messages appear

legacy Troubleshooting

Issue Duplicate error messages show up when resetting the password Steps to reproduce: 1. Start and set up Liferay DXP 7.3 SP1 using the setup wizard. The email can be set as test@liferay.com and the password as a test. 2. Set up an SMTP client to listen to emails. For example: here,...

The behavior of bypassing SAML SSO has changed

legacy Troubleshooting

Issue There is a use case in which a subset of users are meant to bypass SAML SSO and login directly to the Liferay SP. On Liferay 7.2 dxp-8, users successfully used the following URL to achieve this:...

How to resolve users being unable to log out after configuring a Token-Based SSO

legacy Troubleshooting

Issue After configuring and enabling a Token Based SSO in our 7.2 environment (upgraded from 7.0), users are now unable to log out, and they are instead redirected to the home page (still logged in). In our 7.0 environment using the same SSO configurations, our users were logged out as...

CVE-2021-27568 json-smart v2 through v2.4

legacy Troubleshooting

Issue Steps to Reproduce: The json-smart.jar's can be found here: osgi/marketplace/Liferay%20Forms%20and%20Workflow%20-%20Liferay%20Dynamic%20Data%20Mapping%20-%20Impl.lpkg/com.liferay.dynamic.data.mapping.data.provider.impl-3.0.17.jar/lib/json-smart-2.2.1.jar...

Search Results