This page examines JSPWiki's security configuration and tries to determine if it is working the way it should. Although JSPWiki comes configured with some reasonable default configuration settings out of the box, it's not always obvious what settings to change if you need to customize the security... and sooner or later, just about everyone does.
This page is dynamically generated by JSPWiki. It examines the authentication, authorization and security policy settings. When we think something looks funny, we'll try to communicate what the issue might be, and will make recommendations on how to fix the problem.
Please delete this JSP when you are finished troubleshooting your system. This diagnostic data presented on this page do not represent a security risk to your system per se, but they do provide a significant amount of contextual information that could be useful to an attacker. This page is unconstrained, which means that anyone can view it: nice people, mean people and everyone in between. You have been warned.
I see that you've configured container-managed authentication. Very nice.
<% } else { %>Container-managed authentication appears to be disabled, according to your WEB-INF/web.xml file.
JSPWiki uses JAAS to define the authentication process. We need to be able to locate a JAAS configuration file. The default location is WEB-INF/jspwiki.jaas), and its location is specified by the java.security.auth.login.config system property.
java.security.auth.login.config system property before JSPWiki started up. It could have been done by a prior installation of JSPWiki, or possibly by your web container's startup script. This is not necessary a bad thing, but we thought you should be aware of it in case you are seeing behavior you don't expect. You can ignore this message if we find the JAAS login configurations (below).Inside the JAAS config file, we must be able to find two login configurations: JSPWiki-container and JSPWiki-custom.
WEB-INF/jspwiki.jaas.I see that you've configured container-managed authorization. Very nice.
<% Principal[] roles = verifier.webContainerRoles(); if ( roles.length > 0 ) { %>Your WEB-INF/web.xml file defines the following roles:
WEB-INF/web.xml file does not define any roles. This is an error.Container-managed authorization appears to be disabled, according to your WEB-INF/web.xml file.
JSPWiki's authorizes user actions by consulting a standard Java 2 security policy file. By default, JSPWiki installs its local security policy file at startup time. This policy file is independent of your global, JVM-wide security policy, if you have one. When checking for authorization, JSPWiki consults the global policy first, then the local policy.
Let's validate the local security policy file. To do this, we parse
the security policy and examine each grant block. If we see
a permission entry that is signed, we verify that the certificate
alias exists in our keystore. The keystore itself must also exist in the file system.
And as an additional check, we will try to load each Permission class into memory to verify that JSPWiki's classloader can find them.
Note: JSPWiki's Policy file parser is stricter than the default parser that ships with the JVM. If you encounter parsing errors, make sure you have the correct comma and semicolon delimiters in your policy file grant entries. The grant blocks must follow this format:
grant signedBy "signer_names", codeBase "URL",
principal principal_class_name "principal_name",
principal principal_class_name "principal_name",
... {
permission permission_class_name "target_name", "action";
permission permission_class_name "target_name", "action";
};
Note: JSPWiki versions prior to 2.4.6 accidentally omitted commas after the signedBy entries, so you should fix this if you are using a policy file based on a version earlier than 2.4.6.
Now comes the really fun part. Using the current security policy, we will test the PagePermissions each JSPWiki role possesses for a range of pages. The roles we will test include the standard JSPWiki roles (Authenticated, All, etc.) plus any others you may have listed in the security policy. In addition to the PagePermissions, we will also test the WikiPermissions. The results of these tests should tell you what behaviors you can expect based on your security policy file. If we had problems finding, parsing or verifying the policy file, these tests will likely fail.
The colors in each cell show the results of the test. Green means success; red means failure. Hovering over a role name or individual cell will display more detailed information about the role or test.
<%=verifier.policyRoleTable()%>Edit.jsp possess the container role "Admin," for example, this will override an "edit" PagePermission granted to role "Authenticated." See below.
<%
}
%>
Here is how your web container will control role-based access to some common JSPWiki actions and their assocated JSPs. These restrictions will be enforced even if your Java security policy is more permissive.
The colors in each cell show the results of the test. Green means success; red means failure.
<%=verifier.containerRoleTable()%>Note that your web container will allow access to these pages only if your container's authentication realm returns the roles
<%
Principal[] roles = verifier.webContainerRoles();
for( int i = 0; i < roles.length; i++ )
{
%> <%=(roles[i].getName() + (i<(roles.length-1)?",":""))%><%
}
%>
If your container's realm returns other role names, users won't be able to access the pages they should be allowed to see -- because the role names don't match. In that case, You should adjust the <role-name> entries in web.xml appropriately to match the role names returned by your container's authorization realm.
Now we are going to compare the roles listed in your security policy with those from your web.xml file. The ones we care about are those that aren't built-in roles like "All", "Anonymous", "Authenticated" or "Asserted". If your policy shows roles other than these, we need to make sure your container knows about them, too. Container roles are defined in web.xml in blocks such as these:
<security-role>
<description>
This logical role includes all administrative users
</description>
<role-name>Admin</role-name>
</security-role>The user database stores user profiles. It's pretty important that it functions properly. We will try to determine what your current UserDatabase implementation is, based on the current value of the jspwiki.userdatabase property in your jspwiki.properties file. In addition, once we establish that the UserDatabase has been initialized properly, we will try to add (then, delete) a random test user. If all of these things work they way they should, then you should have no problems with user self-registration.
The group database stores wiki groups. It's pretty important that it functions properly. We will try to determine what your current GroupDatabase implementation is, based on the current value of the jspwiki.groupdatabase property in your jspwiki.properties file. In addition, once we establish that the GroupDatabase has been initialized properly, we will try to add (then, delete) a random test group. If all of these things work they way they should, then you should have no problems with wiki group creation and editing.