Site Search - Liferay Learn

Vulnerable JavaScript dependency Bootstrap-select 1.12.4

Issue The version of bootstrap-select 1.12.4 is vulnerable to attacks. To overcome this, bootstrap-select should be upgraded to a non-vulnerable version. Environment Liferay DXP 7.3 Resolution Liferay does not utilize the 'bootstrap-select' library anywhere. This library does not come...

Email are not sent from Liferay when Office365 is used as the server

legacy Troubleshooting

Issue Emails are not sent out from Liferay In the log, we see the following error: liferay[liferay-7] [dxp] ERROR [liferay/mail-6][MailEngine:74] Unable to send message: 535 5.7.139 Authentication unsuccessful, the request did not meet the criteria to be authenticated successfully....

Is there a way to bypass CAPTCHA without having to disable it?

legacy How To

Issue We will do some Automation tests in our QA environment and would like to know if it is possible to bypass CAPTCHA using configuration settings without having to disable it. Environment Liferay DXP 7.4 Resolution A way out of the box to not require CAPTCHA for authenticated users...

"Text verification failed" Captcha error

legacy Troubleshooting

Issue We are trying to use the Reset Password functionality, but every time we enter the captcha text correctly, we always get an error saying: "Text verification failed". We noticed this same behavior on other pages where captcha is present, e.g. on Forms. Environment DXP 7.4 2023.Q3...

Vulnerability in Apache Tomcat (CVE-2023-46589)

legacy Troubleshooting

Issue This security vulnerability (CVE-2023-46589) has been reported, and it is fixed in Tomcat 9.0.83. However, our current Liferay DXP 7.4 update 67 has a 9.0.71 Tomcat version. Environment Liferay DXP 7.4 Resolution To mitigate this vulnerability, update Liferay DXP 7.4 to Liferay DXP...

Liferay 6.2 EE 173 and CVE-2024-25145

legacy

Issue We have found the following article CVE-2024-25145 Stored XSS with search results if highlighting is disabled, however it does not specify whether Liferay 6.2 EE 173 is affected or not. Environment Liferay 6.2 EE 173 Resolution Liferay 6.2 EE 173 is not affected by CVE-2024-25145....

Can SAML be used to send an attribute that can be used to assign site roles?

legacy

Issue Currently, SAML is not designed to be utilized to send an attribute that can be used to assign site roles. Environment Quarterly Releases Resolution This is an ongoing task, LPD-6336, for Liferay. Liferay is planning on implementing a form of this in the future but this will be...

OpenID Connect Error - "Signed JWT rejected" with CAS

legacy Troubleshooting

Issue When configuring authentication using OpenID Connect, login fails and the following error is reported: Unable to validate tokens: Signed JWT rejected: Another algorithm expected, or no matching key(s) found Environment DXP 7.3 DXP 7.4 Using Apereo CAS as OpenID Provider Resolution...

How to Generate a SAML Tracer Export for Liferay Support

legacy How To

SAML Tracer can be a useful debugging tool for viewing SAML messages sent through the browser during single sign-on and single logout and helps with analyzing both SP- and IdP-initiated SAML flows, including viewing and exporting SAML requests and responses in various browsers. It is a...

Getting 'DuplicateSamlIdpSsoSessionException' in the Debug Logs

legacy Troubleshooting

Issue Users are facing intermittent login issues in the SAML environment; however, the below error is observed frequently in their log files: DEBUG [default task-73687][BaseSamlStrutsAction:61] null com.liferay.saml.persistence.exception.DuplicateSamlIdpSsoSessionException: Duplicate...

Security Vulnerability CVE-2023-28708

legacy How To

Issue This security vulnerability (CVE-2023-28708) has been reported, and it is fixed in Tomcat 9.0.72. However, our current Liferay DXP 7.3 SP1 has a 9.0.40 Tomcat version. Environment Liferay DXP 7.3 Resolution To mitigate this vulnerability, update Liferay DXP 7.3 to Liferay 7.3...

Error: Only known users are allowed to sign in using OpenID Connect.

legacy Troubleshooting

Issue You might encounter an error when using OpenID Connect, and users who are not yet been registered to Liferay are unable to login as they are identified as strangers. The error appears as the company.security.strangers is set to false You can also check this on the UI, by navigating...

X-Xss-Protection response header is not working in DXP 7.4

legacy

Issue To enable X-Xss-Protection, add the below property in system-ext.properties http.header.secure.x.xss.protection=1; mode=block and restarted the server. But it is not working in the Liferay. Environment Liferay DXP 7.4 Resolution The HTTP header X-XSS-Protection set to 1 by default...

How to enable cookies and the banner, consent panel

legacy How To

Issue How to enable the cookie preference handling as well as the configuration options for both the banner and the consent panel. Environment Liferay DXP 7.4 Resolution This feature was introduced in the Liferay DXP 7.4 update 66. To enable this option, follow the below steps: Navigate...

SAML Sessions remain Active despite Logout in Liferay

legacy Troubleshooting

Issue We have integrated SAML with our Liferay configuration. We have noticed that after a User logs out, their session remains active in Liferay. Environment Liferay DXP 7.3 Resolution This issue may occur if the 'SameSite' attribute in the browser cookie is set to 'Strict'. To resolve...

p_auth token missing from GET request

legacy

Issue After enabling CSRF Tokens, a p_auth token is appended to URLs, as expected. However, we noticed that if we manually remove this from the end of a URL and hit enter, we are still able to access the page, even though p_auth is now missing from the request. Does this mean CSRF...

After enabling LDAP authentication, administrator users who do not exist in LDAP can log in

legacy

Issue We have enabled LDAP authentication, checking it as required and we have unchecked Ignore User Search Filter for Authentication. With this configuration applied the administrator users can login even if they do not exist in LDAP. Environment DXP 7.4 Resolution This is the expected...

Setting sameSite attribute in Cookie for header response on JBoss EAP 7.2

legacy How To

Issue How to add the sameSite attribute as 'Strict' on the cookies JSESSIONID,COOKIE_SUPPORT,GUEST_LANGUAGE_ID on JBoss EAP 7.2 Environment Liferay DXP 7.4 JBoss EAP 7.2 Resolution In JBoss, navigate to jboss/standalone/configuration/standalone.xml. Edit standalone.xml and...

Access-control-allow-origin CORS Header not honoring System setting Configuration

legacy

Issue When configuring CORS headers in System Settings we are seeing that access-control-allow-origin header doesn't always have the configured value. Environment Liferay DXP 7.4 Resolution According to the specification, if the request is valid for cors and it has a "Origin" header,...

Security Managers, Vul ID: V-222936 STIG

legacy

Issue Vul ID: V-222936 STIG is flagged when Java Security Managers are not enabled. It states that "The Java Security Manager must be enabled." Environment DXP 7.1 Resolution Liferay DXP does not currently support enabling a security manager, and there are currently no alternative...

Vulnerability issues related to the EJS version in Fragments Toolkit

legacy Troubleshooting

Issue Vulnerability issues (ejs template injection vulnerability) were reported related to the EJS version inside the yarn.lock file while building fragments using the fragments toolkit. The EJS version is below 3.1.9 in many places in this yarn.lock file. Environment Liferay DXP 7.4...

Duplicate user errors when setting up a SAML Authentication to replace an existing Token-Based SSO

legacy Troubleshooting

Issue When trying to set up a SAML authentication to replace existing Token-Based SSO, there are errors that populate stating that the user and/or email address is already in use. A user with company 1xxxx and email address test@liferay.com is already in use Updating the email address...

Can I integrate an additional Captcha Engine?

legacy

Issue Currently, Liferay offers 2 Captcha Engines out of the box: Simple Captcha and Google reCaptcha 2 We would like to use another Captcha service. Environment Liferay DXP 7.4 Resolution At the moment it is not possible to integrate another Captcha Engine out of the box. There is...

Malware detected in Liferay Bundle - eicar.jpg

legacy

Issue We were notified of a possible malware infection. The location is my extracted source code of a Liferay DXP bundle. The file in question is eicar.jpg Environment Liferay DXP 7.4 Resolution EICAR files can be used to verify antivirus integration, and to see if the AV correctly picks...

The Liferay is vulnerable to the CVE-2023-4863?

legacy

Issue How can I mitigate vulnerability with CVE-2023-4863 regarding Liferay DXP? Environment All environments. Resolution Liferay does not use the libwebp library, so are not vulnerable to CVE-2023-4863. Additional Information CVE-2023-4863, content:...

I cannot create new Virtual Instance with error Screen name must not be null

legacy Troubleshooting

Issue When I try to create a new Virtual Instance, the portal displays the error "Your request failed to complete". The portal log shows the following error: ERROR [default task-29][EditInstanceMVCActionCommand:121]...

Importing LDAP settings through osgi/config files does not import password

legacy

Issue LDAP settings can be imported into the Liferay environment using osgi/config files These settings are imported into System Settings, and can then be configured for an individual instance in Instance Settings When adding a LDAP server in Instance Settings, the password field is not...

Content-Security-Policy Header Integration

legacy

Issue How can a CSP (content security policy) HTTP header that enables only specific external resources to be loaded in the frontend be implemented? Environment Liferay DXP 7.2 Resolution CSP is not currently supported by Liferay at the product level. Liferay DXP and its predecessor,...

HTTP Strict Transport Security (HSTS) Header Not Used

legacy How To

Issue The HSTS header cannot completely defend against man-in-the-middle attacks. However, it can be useful in defending against an attack in which an attacker establishes an encrypted connection to the application and presents an unencrypted fraudulent service to the user. This is...

Verbose Error Messages

legacy How To

Issue The name of the technologies used, such as Apache Coyote, Tomcat, etc. are visible. Environment Liferay DXP 7.2, DXP 7.3 Resolution Each application is responsible for allowing its information to be displayed but not Liferay. We can definitely restrict the Verbose related to...

Known Vulnerabilities with Liferay AntiSamy

legacy Troubleshooting

The following issue may compromise the security of your Liferay Digital Experience Platform implementation. Vulnerability Information The Liferay AntiSamy app depends on third party libraries that have known vulnerabilities. Affected Products Liferay AntiSamy 2.0.x (for Liferay Portal...

Avoid or allow that some applications can be dynamically displayed in a page

legacy How To

Issue The permissions system for an application (portlet) includes a security check when the application is going to be displayed in a page. Normally, the users should not be able to see applications if the administrator did not configured/added previously to that page. It is feasible to...

Replacing NTLM SSO with Kerberos in Liferay Portal 6.2

legacy How To

Issue NTLM SSO protocol has some vulnerabilities addressed by Microsoft in CVE-2020-1472 (external link), forcing to use the secure RPC connection. See also How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (external link). It's not possible...

Unable to upload file bigger than 10MB with ClamAVSizeLimitException after enabling Antivirus

legacy Troubleshooting

Issue Unable to upload a file bigger than 10MB after enabling antivirus with the following error in the log 2021-07-19 08:35:43.476 ERROR [http-nio-8080-exec-9][PortletServlet:119] javax.portlet.PortletException: fi.solita.clamav.ClamAVSizeLimitException: Clamd size limit exceeded. Full...

Known Vulnerabilities with Liferay Fjord Theme and 1975 London Theme

legacy Troubleshooting

The following issue may compromise the security of your Liferay Digital Experience Platform implementation. Vulnerability Information The Liferay Fjord Theme and Liferay 1975 London Theme depend on third party libraries that have known vulnerabilities. These vulnerabilities affect the...

How can we get a complete picture of a user's activity history?

legacy How To

Issue Is there a way to find out how and by whom a user was created? Environment Liferay DXP 7.2 Resolution The steps below can be used to track user activity. Log in by 'Test' user (Admin User) Create a new user (Name: user1 u1, Screen Name: user1) and assign Administrator Role to it....

How to set up a Mail Server with DXP to receive email notifications?

legacy How To

Issue This article outlines how to set up a Mail Server and SMTP in Liferay DXP to receive emails. Environment Liferay DXP 7.3 Resolution Liferay DXP uses a mail server and SMTP to get email notifications. Liferay DXP’s built-in mail session is the easiest way to configure mail and it’s...

NTLM and NTLMv2 in Liferay Portal 6.2

legacy

Issue The question is whether Liferay Portal 6.2 supports NTLM and NTLMv2 Environment Liferay Portal 6.2 Resolution The library used in Liferay Portal 6.2 supports both NTLM and NTLMv2 There is a property that can be set in portal-ext.properties to control the LMCompatibility in the...

Session Management in Liferay

legacy

Issue How the sessions are managed in Liferay and what are all the different types to configure the same. Also, whether the Liferay session work for the javascript disabled browsers? Environment Liferay DXP 7.1 Resolution How sessions are managed in Liferay Application server will manage...

Is functionality impacted when upgrading to Bootstrap 5 in portal 6.2 ? Is it supported ?

legacy

Issue Requirement is to upgrade the Bootstrap library. Is functionality impacted when upgrading to Bootstrap 5 in portal 6.2 ? Is Liferay portal 6.2 compatible with Bootstrap 5? Is it supported ? Environment Liferay portal 6.2 Resolution Note: Please choose to follow unofficial...

Forgot Password is not popped up with an error when providing an email address that doesn't exist in the DB

legacy

Issue In the 'Forgot Password' option, while trying to provide an email id that doesn't exist in the database, the user can proceed to answer the security question. Whereas an error is not popped up saying the user's email address does not exist. Also, in this case, the security question...

Is there a way to allow upper cases in a screen name?

legacy

Issue Is there any way to ensure that a user's screen name maintains the same capitalization that is present in the AD (Active Directory) when the user is imported into Liferay? Environment Liferay DXP 7.2 Resolution In DXP, there is no out-of-the-box functionality to support capital...

Password verification needed at time of changing user screen name & email address

legacy

Issue Password verification is required whenever a user needs to update its screen name or email address Environment Liferay DXP 7.3 Resolution A feature request has been already created in order to add a toggle for enabling & disabling this password verification feature. Although the...

When Setting Okta up as an SSO for Liferay PaaS, how can I generate IdP metadata in Okta without first having SP metadata?

legacy Troubleshooting

Note: please note that Liferay has renamed its Liferay Experience Could offerings to Liferay SaaS (formerly LXC) and Liferay PaaS (formerly LXC-SM). Issue The documentation for setting up an SSO with Liferay PaaS instructs clients to provide IdP metadata to the Liferay Cloud team before...

Does the Encryption Key that is generated per company id for the Liferay Installation ever change?

legacy

Issue Does the Encryption Key that is generated per company id for the Liferay Installation ever change? Environment Liferay 7.2 Resolution The following portal properties will alter the encryption key for a Liferay installation: # # Set this to the appropriate encryption algorithm to be...

How to create Custom attribute in MS Active Directory and configure in Liferay

legacy How To

Issue Is there any way to map a custom attribute in Liferay created from MS Active Directory? Environment Liferay Portal 6.2 Resolution Liferay provides an OOTB option to achieve the custom attribute mapping. # # When importing and exporting users, the portal will use this mapping to #...

Externalize Session Management

legacy

Issue The session details should be stored in a centralized server so that it is shared with all the available nodes. Environment Liferay Portal 6.2 Resolution This is a specific business requirement that falls beyond the scope of Liferay support as this is something which is related to...

How to configure liferay to invoke web services with Digest Auth

legacy How To

Issue How to configure Liferay to invoke web services with Digest Auth and use it in a client. As example we'll use POSTMAN Environment Liferay DXP 7.1+ Resolution As example, we are going to configure the access to http://localhost:8080/api/jsonws/company/get-companies method in...

OpenID Connect does not work with Azure AD B2C

legacy Troubleshooting

Please note that this Fast Track applies to versions before our Quarterly Release 2024.Q1. From Quarterly Release 2024.Q1 on, this function is enabled as described in LPD-9397. Please refer to Using OpenID Connect for more information. Issue OpenId Connect (OIDC) authentication does not...

How do I add Captcha in Sign in Portlet?

legacy

Issue I would like to add Captcha in Sign in Portlet, as I can do in Create Account and Forgot Password options. Environment DXP 7.3 Resolution Unfortunately, there is no out-of-the-box feature to enable Captcha validation in the Sign in Portlet in the current version of Liferay....

How to Setup HTTPS on Tomcat for Liferay Portal 6.2 and DXP 7.0

legacy How To

Liferay Support does not recommend or endorse specific third-party products over others. Liferay is not responsible for any instructions herein or referenced regarding these products. Any implementation of these principles is the responsibility of the subscriber. This article will...

Post deployment of SAML plugin the SAML Admin page is blank

legacy Troubleshooting

Issue After deploying the SAML plugin in the Liferay instance, the SAML admin page displayed blank. Below Stack trace occurs in the log at the time of performing the above actions. 2021-03-23 19:14:22.610 WARN [ajp-nio-8009-exec-5][PortalImpl:1030] Redirect...

Restrict guest users from accessing login page when attempting to access a protected page or resource

legacy How To

Issue By default, guest users are prompted to the login page when they are attempting to hit a url or access a resource that is protected and not available to guest users. I do not want guest users to be redirected to the login page. Environment Liferay Portal Liferay DXP Resolution...

What difference is there between System Setting and Instance Setting LDAP configurations?

legacy

Issue There are two locations within Liferay DXP where LDAP configurations can be set. One is the System Settings (Control Panel -> Configuration -> System Settings -> Security -> LDAP) and the other the Instance Settings (Control Panel -> Configuration -> Instance Settings -> Security...

How do I Add More Than One Field To the Custom Mapping Sections in My 7.0 LDAP Setup?

legacy How To

Issue I would like to add multiple fields to the custom mappings section in my LDAP setup. Environment DXP 7.0 Resolution During LDAP setup, navigate to Control Panel > Configuration > Instance Settings, in the Configuration tab scroll down to Authentication > LDAP and select the Add...

New Virtual Instance cannot be created if "passwords.default.policy.check.syntax=" is set to true

legacy Troubleshooting

Issue If I set passwords.default.policy.check.syntax=true in my portal-ext.properties file, I cannot create a New Virtual Instance I get an error in the logs: ERROR [ajp-nio-127.0.0.1-8009-exec-34][EditInstanceMVCActionCommand:121]...

Users without Admin role cannot initiate SSO on the SP when using expando fields

legacy Troubleshooting

Issue When using expando field as "Name Identifier Attribute Name=expando:concurid", user without Administrator role can not initiate SSO. Steps to reproduce: On IdP end Add a custom field 'field1' for user. Go to SAML Admin > Service Provider Connections, make sure the "Name Identifier...

How to resolve "User 'x' must have 'y' permission" errors encountered while performing staging publication processes

legacy Troubleshooting

Issue Our team would like our staging managers to not be administrators, so we are only providing them with select permissions. However, publication attempts encounter errors such as: ERROR [liferay/background_task-1][EventRemotePropagatorExportImportLifecycleListener:222] Unable to...

Sensitive Information disclosed via Application Status 400 Error

legacy Troubleshooting

Issue Application Server errors at times may identify software, software versioning and hint at how user input is processed. This sample trace to demonstrate was triggered by having invalid characters (namely a set of square brackets '[ ]' ) in a given URL. Tomcat considers the address...

Commerce modules fail to deploy due following license expiration

legacy Troubleshooting

Note: please note that Liferay has renamed its Liferay Experience Could offerings to Liferay SaaS (formerly LXC) and Liferay PaaS (formerly LXC-SM). Issue There has been a documented case where Commerce modules fail to deploy following license expiration and redeployment WARN...

Search Results