Site Search - Liferay Learn

How to review User Permissions on Freemarker and Velocity templates

Issue After applying the fix for LSV-658, how can I see which users have permissions for (which) Freemarker/Velocity templates, i.e. via the user interface or by a database query? The Mitigation Notes of LSV-658 suggests that we review the owners of existing templates as they have full...

The Forget Password page is vulnerable to CSRF attack

legacy

Issue The Forget Password form can be re-submitted with different cookies which lead to the CSRF issue. Environment Liferay DXP 7.2 Resolution This is considered as a False Positive, as the user is not logged into Liferay when accessing the Forget password page. CSRF is meant to protect...

Page version control information is accessible in sitemap.xml

legacy

Issue Page version control information is accessible in sitemap.xml - such information shall not be exposed for security reasons. Reproduction: 1) Start up bundle 2) Access sitemap (e.g. http://localhost:8080/sitemap.xml) 3) From the site map, open one of the URLs within <loc>...

Changing password forces users to log in again

legacy Troubleshooting

Issue Changing password invalidates current sessions and the users have to log in again. 2020-02-07 13:08:37.558 ERROR [http-nio-8080-exec-2][PortletServlet:112] javax.portlet.PortletException: java.lang.IllegalStateException: getAttribute: Session already invalidated Environment Liferay...

Session Hijacking issue with https connection

legacy

Issue By replacing the sessionId of a logged-in user, the user's session from another browser is replicated. Steps to reproduce Create 2 users like u1, u2 Assign the role for the u1 as "Power user", u2 as "Portal Content Reviewer" Create 2 pages like Page1, Page2 Click on the permission...

Integration of SiteMinder SSO

legacy How To

Issue How to integrate the SiteMinder SSO with Liferay Environment Liferay DXP 7.0 Resolution By default, Token based authentication is disabled in the Liferay. To manage the same, refer to this document Token-based Single Sign-On Authentication which describes the Token SSO...

Using Active directory, after changing the user password, still user is able to login using the old password

legacy Troubleshooting

Issue Using Active directory, after changing the user password, still, a user is able to login using the old password Environment Liferay portal 6.2 Resolution Under Control Panel -> Portal Settings -> Authentication -> LDAP, if the "required" checkbox is not selected then the expected...

404 error when downloading module "com.liferay.saml.opensaml.integration" from Release Notes page

legacy Troubleshooting

Issue Getting a 404 error when downloading module "com.liferay.saml.opensaml.integration" from Release Notes page. Environment Liferay DXP 7.2 Resolution The module for "com.liferay.saml.opensaml.integration" can be found on Marketplace. Please download SAML 2.0 from Liferay Marketplace...

The /dtd/ folder of the war with sensitive information is exposed when deploying a portal on Weblogic 12c R2

legacy Troubleshooting

Liferay Support does not recommend or endorse specific third-party products over others. The information provided about products not created by Liferay is for reference purposes only, and any implementation of these principles will be at your team's discretion. Issue After the creation...

Module download link can not be opened on Liferay DXP Release Notes page with 404 error

legacy Troubleshooting

Issue When trying to download modules like "com.liferay.saml.opensaml.integration" from Liferay DXP Release Notes page, the download link can not be opened with a 404 error. Environment Liferay DXP 7.2 Resolution Modules like "com.liferay.saml.opensaml.integration" is included...

Is Liferay Product affected by OpenSSL security issue CVE-2020-1967 ?

legacy

Issue Is Liferay Product affected by OpenSSL security issue CVE-2020-1967 ? Environment Liferay DXP 7.1 Resolution Since Liferay products do not come with OpenSSL built-in, Liferay is not affected by CVE-2020-1967 out of the box. If you have implemented OpenSSL into your project, your...

No administrative options can be accessed when an F5 load balancer is in front of Liferay forcing a secure protocol

legacy Troubleshooting

Issue When a F5 load balancer is in front of Liferay and is forcing a secure protocol, no administrative options can be selected and accessed. On Liferay the following options are configured on the portal-ext.properties web.server.https.port = 443 web.server.host = [A host is specified...

Liferay redirects to iframe source URL upon logging in

legacy Troubleshooting

Issue After adding an Iframe to a Liferay page and set the Source URL of that Iframe to e.g. /web/guest/page2, Liferay will redirect to /web/guest/page2 when logging in through the Welcome homepage. Environment Liferay Portal 6.2 Liferay DXP 7.0+ Resolution The above has to be considered...

When authorizing OAuth2 applications HTTP is used instead of HTTPS

legacy Troubleshooting

Issue If there's a web server in front of Liferay, when clicking on the Authorize button to authorize OAuth2 applications HTTP is used instead of HTTPS and the following WARNs are displayed in the log. 2019-11-08 09:37:05.000 WARN [http-nio-8080-exec-63][AbstractOAuthService:88] Unsecure...

Is it possible to set different Authentication methods for different sites in the same portal instance

legacy

Issue Is it possible to set different Authentication methods for different sites in the same portal instance? Environment Liferay DXP 7.2 Resolution Currently, it is not possible to use different authentication methods for different Sites in one Portal Instance on Liferay DXP 7.2. The...

LDAP server is unreachable when "Required" option is enabled

legacy Troubleshooting

Issue For any virtual instances apart from a default instance, if the "Required" option in LDAP is enabled, only LDAP users can log in to the portal. When the LDAP server is down/unreachable, none of the users able to log in. In that case, how to login to the portal to make the changes...

Why the error "Failed to bind to the LDAP server with userDN" is thrown in the logs

legacy Troubleshooting

Issue What is the reason behind the following error which is thrown in the logs? [LDAPAuth:198] Failed to bind to the LDAP server with userDN CN=VERMA BRIJESH KUMAR (MR.),OU=USERS,OU=RND,DC=DS,DC=INDIANOIL,DC=IN and password Me4Sharom@15012020 javax.naming.AuthenticationException: [LDAP:...

Why can't I see the name of the resource in the Audit app?

legacy

Issue I am an Administrator in Liferay DXP Someone deleted an asset (for example an Organization) I check the events in the Audit app (Control Panel > Configuration > Audit) I open the delete event I can only see the Resource ID of the Organization but not its name Since it was removed...

Impact of Google Chrome 80 and changes in the default behavior of the SameSite cookie setting on SAML

legacy Troubleshooting

Issue Updated (May 31, 2021): The behavior is enabled by default since Chrome 84. Updated (April 3, 2020): Chrome is Temporarily rolling back SameSite Cookie Changes Updated (June 12, 2020): Added information about the fixed versions of the SAML 2.0 connector. With the release of Chrome...

Why certain Security Headers are not included in the HTTP Request and Response of Liferay DXP

legacy

Issue The following headers are missing in Liferay: Missing ”X-Content-Type-Options” header Missing ”X-XSS Protection” header Missing ”X-Frame-Options” header Missing ”Content-Security-Policy” header Missing ”Strict-Transport-Security” header Missing cross-origin resource...

Encryption keys can be used at Liferay

legacy How To

Issue How to disable/stop using DES as it possesses Security Threat. Environment Liferay DXP 7.0 Resolution Encryption keys can be used at Liferay end are: # For more details about encryption keys, see the Java Cryptography # Extension documentation. # ...

Can SAML or LDAP be accessed via Liferay APIs?

legacy

Issue We would like to remotely configure SAML and/or LDAP authentication using Liferay APIs. Environment Liferay DXP 7.0 Liferay DXP 7.1 Liferay DXP 7.2 Resolution Neither SAML or LDAP APIs are publicly exposed so it is not possible to remotely configure them via APIs. Additional...

Configuring Liferay to display CAPTCHA's with numbers only - 7.2

Issue Configuring Liferay to display CAPTCHA's with numbers only instead of alphanumeric characters. Environment This issue affects Liferay 7.2 Resolution While the default CAPTCHAs in Liferay generated by SimpleCaptcha contain alphanumeric combinations it is possible to configure them...

Will Liferay DXP 7.1 support X-Frame-Options, X-XSS-Protection, X-Content-Type-Options headers?

legacy How To

Issue Will Liferay DXP 7.1 support X-Frame-Options, X-XSS-Protection, X-Content-Type-Options headers? If yes, how to enable the same. Environment Liferay DXP 7.1 Resolution Liferay DXP 7.1 is already secured with the following headers and it is enabled by default. These values are found...

Security Vulnerability: Remote-Code-Execution (RCE) With ImageMagick

legacy Troubleshooting

Issue Symptom: CVE-2016-3714 - Insufficient shell characters filtering leads to potentially remote-code-execution vulnerability in ImageMagick. Environment ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 Resolution Liferay does not endorse or support any specific third-party...

Import nested groups and users from Microsoft Active Directory

legacy How To

Issue What configuration is needed in Liferay so that the nested groups and the users are imported from AD? Environment DXP 7.2 DXP 7.1 DXP 7.0 Resolution Change the User attribute of the Group Mapping in the LDAP server configuration page to member:1.2.840.113556.1.4.1941:. Additional...

Users are being logged in as some other user

legacy Troubleshooting

Issue When any user logs into the portal, they see the user profile of another user instead of seeing their own profile. Environment Liferay DXP 7.0 Resolution There are usually two root causes for the reported behavior: 1. Session ID conflict, and 2. Incorrect cache configuration....

Liferay's OpenID Connect implementation and Single Logout

legacy

Issue Does Liferay's OpenID Connect implementation support Single Logout? Environment Liferay DXP 7.1/7.2 Resolution Liferay's current OpenID Connect (OIDC) integration only implements parts of the Final specifications, specifically "Core" and "Discovery". While single-logout (SLO)...

Using one user's JSessionID any logged in user can access the respective user's session

legacy

Issue One user's session is accessed by knowing the respective user's JSessionID. Steps for reference: 1) 2 users (say: User A and User B) 2) User "A" logs-in to the system 3) Now, user "A" has one Jession ID(0D13262EDECBA19E93D5A753FC34E03A) and shares his JSessionID to user "B" 4)...

When SAML is enabled, logging out from particular Site should stay at the respective site itself

legacy

Issue When SAML is enabled, logging out from "SITE A" is not redirecting/stays at the respective site's home page itself. Environment Liferay DXP 7.1 SAML plugin Resolution The ideal scenario is authentication functions at the entire portal level and not at the site level due to which...

LDAP users are unable to log in

legacy Troubleshooting

Issue Users who are present in LDAP are unable to perform login into Liferay and the below error was observed at the server console. ERROR [liferay/scheduler_dispatch-4][PortalLDAPImporterImpl:717] Unable to import user CN=abdulfar: null:null:{samaccountname=sAMAccountName: abdulfar}...

Does Liferay DXP 7.1 support HTTP headers?

legacy

Issue Does Liferay DXP 7.1 support the following HTTP headers: "X-Frame-Options", "X-XSS-Protection" and "X-Content-Type-Options"? If not, what changes have to be done from the application side to enable the same Environment Liferay DXP 7.1 Resolution Liferay portal is already secured...

TLS v1.2 in Liferay DXP 7.1

legacy

Issue Due to some security vulnerable in TLS v1.0, it should be upgraded to TLS v1.2. 1. Does Liferay DXP 7.1 support TLS v1.2? 2. If it supports, then how to use/upgrade the same in Liferay DXP 7.1? Environment Liferay DXP 7.1 Resolution Liferay 7.1 supports TLS v1.2 as it requires...

Unable to import LDAP telephoneNumber into Liferay phone in the Contact page

legacy Troubleshooting

Issue Unable to import LDAP telephoneNumber (in Microsoft Active Directory) into Liferay Contact Information -> Phone Numbers on the Contact page. Environment Liferay DXP 7.1 Resolution Only attributes listed in ContactModel.java can be imported through LDAP "contact mapping". Since...

Https Access Portal Problems

legacy Troubleshooting

Issue When users are trying to access to portal using https protocol, portal is redirecting to http protocol and pages are not showed right. Https protocol was configured in load balancers and application servers but not in Liferay portal. Environment Liferay DXP 7.1 Application server:...

NTLM authenticate failed due to " Logon failure: unknown user name or bad password error "

legacy Troubleshooting

Issue Users are unable to login through NTML due to the following WARN: 2019-08-29 05:55:28.671 WARN [http-nio-8080-exec-5][Netlogon:104] Unable to authenticate user emma: Logon failure: unknown user name or bad password. Environment Liferay DXP 7.0 Liferay DXP 7.1 Resolution The error...

Password is visible as a plain text in the user's browser console

legacy

Issue When a user tries to log in to Liferay via Liferay's default Sign-In portlet, the user's password shows in the browser console as a plain text. Environment Liferay DXP 7.0-7.4 Resolution This is not a Liferay issue. When submitting the login credentials in the browser, the browser...

SAML SLO is not working when using two Liferay servers in my machine

legacy Troubleshooting

Issue We configured 2 Liferay Servers in my machine, one as Service Provider and the other as Identity Provider. We managed to perform the login through IdP. The issue happens when we try to logout the user in SP. Environment Liferay DXP 7.0, Liferay DXP 7.1 Resolution If IdP and SP use...

Possible Mismatch Between the Real LDAP Import Time and Import Interval Set on Instance Settings after LPS-98420

legacy Troubleshooting

Issue After LPS-98420, there might be a mismatch between the real LDAP Import trigger time and Import Interval set on instance settings. For example: Set “System Settings -> LDAP -> Import Interval” to 2. Set “Instance Settings -> LDAP -> Import Interval” to 3. Expected Result: The...

Resolving errors when using Liferay JSON Web Service to do the searching

legacy Troubleshooting

Issue When invoking Liferay JSON Web Service to do the searching, you may encounter errors like the following: com.liferay.portal.kernel.dao.orm.ORMException: org.hibernate.exception.SQLGrammarException: could not execute query user lacks privilege or object not found:...

LDAP users are unable to log in(Caused by: java.net.SocketException: Connection reset)

legacy Troubleshooting

Issue If the LDAP is configured and when the LDAP users are trying to log in, authentication fails and started getting the following error in the server console. ERROR [liferay/scheduler_dispatch-4][PortalLDAPImporterImpl:717] Unable to import user CN=makansal:...

Unable to handle SAML Request

legacy Troubleshooting

Issue After enabling the SAML, when the user is trying to log in, authentication failed with the following message in UI and in Server console. UI: "Unable to handle SAML Request" Server Console: ERROR [http-nio-443-exec-81][BaseSamlStrutsAction:54]...

Authentication through LDAP when SAML is enabled

legacy Troubleshooting

Issue Liferay has to authenticate the user through SAML as well as LDAP when SAML is enabled Environment Liferay Portal 6.2 Liferay DXP 7.0 Liferay DXP 7.1 Resolution Authenticating users from LDAP when the SAML is enabled is not currently available as an out of the box feature in...

LDAP users are able to login with Default User Password

legacy

Issue Users from LDAP are able to login with the value which is defined in "Default User Password" field under the LDAP import/export settings. Environment Liferay DXP 7.0 Resolution Liferay will allow the LDAP users to login using the defined value in the "Default User Password" field...

[LES] Issues reinstalling Liferay Connector to X-Pack Security

legacy How To

Issue I'm having issues reinstalling X-Pack Security How do I reinstall X-Pack Security? Environment DXP 7.2 DXP 7.1 DXP 7.0 + Fix Pack 54 onwards (de-54) Resolution To Install Add Liferay Connector to X-Pack Security [Elastic Stack 6.x].lpkg to deploy folder here:...

CSRF (p_auth) token is not included in portlet ResourceURLs

legacy

Issue p_auth token is not included in the resourceURL. Environment Liferay DXP Liferay 6.2 EE Resolution ResourceURLs (resource serving phase) was introduced in Portlet 2.0 to be able to serve resources (images, etc...) without having to reload the whole page. Therefore serveResource...

Preventing host header attack vulnerabilities

legacy How To

Issue Adjusting the Host header in the request can impact page rendering, redirections, and other server-side behaviors. This manipulation could potentially lead to Cross-Site Scripting (XSS) for example. Environment Liferay Quarterly Release and 7.4. Liferay DXP 7.0, 7.1, 7.2, 7.3...

[LES] How to reinstall Liferay Connector to X-Pack Security

legacy How To

Issue How can I reinstall x-pack security? Environment DXP 7.2 DXP 7.1 DXP 7.0 + Fix Pack 54 onward (de-54) Resolution When we uninstall X-Pack security, an entry is added to Bundle Blacklist at this location: Control Panel > Configuration > System Settings > Bundle Blacklist To...

Antisamy - Document description field not sanitized

legacy

Issue While the title of a document cannot contain a tag or script in the description section tags and scripts can be published. Environment Liferay DXP 7.0 Resolution The AntiSamy module filters on specific HTML/CSS fragments and removes suspect JavaScript code from them. This means...

How to reproduce https:// problems on localhost

legacy How To

Issue If we are using https protocol the related use cases are hard to proof on localhost Environment Liferay DXP 7.0 Liferay DXP 7.1 Use Firefox (Firefox is recommended, as Chrome does not allow self-signed certificates on localhost) Use Docker Use Nginx Resolution Download and...

Security Advisory for CVE-2019-2729 for Oracle WebLogic

legacy Troubleshooting

Issue Oracle has issued a security alert for Oracle WebLogic wherein a deserialization vulnerability via XMLDecoder in Oracle WebLogic Server Web Services has been detected. The following resource and information are obtained from Oracle's Tech Network, and is intended for subscribers...

How to configure the "check-auth-token" parameter within an OSGi portlet?

legacy How To

Issue The current Liferay DXP portal properties file contains the following for the "check-auth-token" parameter: # # Set this to true to enable authentication token security checks. The # checks can be disabled for specific actions via the property # "auth.token.ignore.actions" or for...

Is request-based p_auth token supported to prevent CSRF attack?

legacy

Issue To prevent CSRF attacks, Liferay provides options to enable authentication token security checks. The current token is session-based token. Is request-based p_auth token supported? Environment Liferay DXP 7.1 Resolution Currently, the p_auth token is generated based on the user...

The Password Reset Screen is no longer showing the "Please set a new password" description

legacy

Issue After upgrading from 6.x to 7.x, the Password Reset Screen is no longer showing the "Please set a new password" description text. Environment Liferay DXP 7.0 Liferay DXP 7.1 Liferay DXP 7.2 Resolution The "Please set a New Password" text has been removed intentionally (LPS-58716)...

How to upload authentication XML file from Bing ownership verification

legacy How To

Issue One of the methods to complete the verification process required to add a website to a Bing Webmaster Tools account is uploading a XML file to the root directory of the website and make it available on a specific URL. Environment Liferay 6.2 Liferay DXP Resolution Upload the XML...

Apply button in OAuth 2 Administration is not working

legacy Troubleshooting

Issue When making changes under OAuth 2 Administration, such as generating a new client secret or editing Client ID, the Apply button may not respond when clicked. When viewing the browser console, you will see: Uncaught TypeError: component.simulate is not a function Environment Liferay...

Password is visible as a plain text in LDAP request

legacy Troubleshooting

Issue When intercepting the LDAP request using any third party tool(ex. Wireshark) password is visible as a plain text Environment Liferay 7.0 Resolution Enabling LDAP over SSL will transmit the credentials with encryption format in LDAP request i.e. ldaps://ipaddress:port Additional...

Whether to use OpenSSL

legacy

Please be aware that the page you are viewing has been machine translated from Japanese into English and may contain some translation errors. If you observe any issues with the translation, please contact us. Issue In addition to updating the OpenSSL version on theweb server and AP...

Unable to process SAML SSO request

legacy Troubleshooting

Issue After configuring SAML SSO successfully, the user is unable to perform login and getting the following error in UI and Server console. UI Error: "Unable to process SAML request" Server Console: ERROR [http-nio-8080-exec-1][MandatoryAuthenticatedMessageRule:37] Inbound message...

AWS S3 Signature Version 2 Discontinued

legacy How To

Please be aware that the page you are viewing has been machine translated from Japanese into English and may contain some translation errors. If you observe any issues with the translation, please contact us. Issue AWS S3 signature version 2 is scheduled to be discontinued, will this...

Search Results