Site Search - Liferay Learn

Can SAML or LDAP be accessed via Liferay APIs?

Issue We would like to remotely configure SAML and/or LDAP authentication using Liferay APIs. Environment Liferay DXP 7.0 Liferay DXP 7.1 Liferay DXP 7.2 Resolution Neither SAML or LDAP APIs are publicly exposed...

Configuring Liferay to display CAPTCHA's with numbers only - 7.2

Issue Configuring Liferay to display CAPTCHA's with numbers only instead of alphanumeric characters. Environment This issue affects Liferay 7.2 Resolution While the default CAPTCHAs in Liferay generated by...

Is it possible to set different Authentication methods for different sites in the same portal instance

legacy

Issue Is it possible to set different Authentication methods for different sites in the same portal instance? Environment Liferay DXP 7.2 Resolution Currently, it is not possible to use different authentication methods...

Why the error "Failed to bind to the LDAP server with userDN" is thrown in the logs

legacy Troubleshooting

Issue What is the reason behind the following error which is thrown in the logs? [LDAPAuth:198] Failed to bind to the LDAP server with userDN CN=VERMA BRIJESH KUMAR...

Will Liferay DXP 7.1 support X-Frame-Options, X-XSS-Protection, X-Content-Type-Options headers?

legacy How To

Issue Will Liferay DXP 7.1 support X-Frame-Options, X-XSS-Protection, X-Content-Type-Options headers? If yes, how to enable the same. Environment Liferay DXP 7.1 Resolution Liferay DXP 7.1 is already...

Why can't I see the name of the resource in the Audit app?

legacy

Issue I am an Administrator in Liferay DXP Someone deleted an asset (for example an Organization) I check the events in the Audit app (Control Panel > Configuration > Audit) I open the delete event I can only see the...

Impact of Google Chrome 80 and changes in the default behavior of the SameSite cookie setting on SAML

legacy Troubleshooting

Issue Updated (May 31, 2021): The behavior is enabled by default since Chrome 84. Updated (April 3, 2020): Chrome is Temporarily rolling back SameSite Cookie Changes Updated (June 12, 2020): Added information about...

Why certain Security Headers are not included in the HTTP Request and Response of Liferay DXP

legacy

Issue The following headers are missing in Liferay: Missing ”X-Content-Type-Options” header Missing ”X-XSS Protection” header Missing ”X-Frame-Options” header Missing ”Content-Security-Policy” header...

No administrative options can be accessed when an F5 load balancer is in front of Liferay forcing a secure protocol

legacy Troubleshooting

Issue When a F5 load balancer is in front of Liferay and is forcing a secure protocol, no administrative options can be selected and accessed. On Liferay the following options are configured on the...

Why p_p_auth token is exposed in the URL? Could it be a security risk?

legacy

Issue On Liferay Portal 6.2, p_p_auth token is exposed in the URL. It might be considered as a security risk. Environment Liferay Portal 6.2 Resolution No attacker or other user can use p_p_auth token, only a...

The Forget Password page is vulnerable to CSRF attack

legacy

Issue The Forget Password form can be re-submitted with different cookies which lead to the CSRF issue. Environment Liferay DXP 7.2 Resolution This is considered as a False Positive, as the user is not logged into...

Page version control information is accessible in sitemap.xml

legacy

Issue Page version control information is accessible in sitemap.xml - such information shall not be exposed for security reasons. Reproduction: 1) Start up bundle 2) Access sitemap...

How to configure validation directives in AntiSamy

legacy Troubleshooting

Issue When trying to import content between sites, i.e. knowledge base, a validation error arises: An unexpected error occurred with the publication process. Please check your portal and publishing configuration....

How to review User Permissions on Freemarker and Velocity templates

legacy How To

Issue After applying the fix for LSV-658, how can I see which users have permissions for (which) Freemarker/Velocity templates, i.e. via the user interface or by a database query? The Mitigation Notes of LSV-658...

Integration of SiteMinder SSO

legacy How To

Issue How to integrate the SiteMinder SSO with Liferay Environment Liferay DXP 7.0 Resolution By default, Token based authentication is disabled in the Liferay. To manage the same, refer to this document Token-based...

Using Active directory, after changing the user password, still user is able to login using the old password

legacy Troubleshooting

Issue Using Active directory, after changing the user password, still, a user is able to login using the old password Environment Liferay portal 6.2 Resolution Under Control Panel -> Portal Settings ->...

SAML logout when session expires

legacy

Issue The Single sign-on and Single log out are working fine when the user manually logs out but there is no Single logout happening on the portal session expiry Environment Liferay 7.0 as IdP Resolution Service...

Session Hijacking issue with https connection

legacy

Issue By replacing the sessionId of a logged-in user, the user's session from another browser is replicated. Steps to reproduce Create 2 users like u1, u2 Assign the role for the u1 as "Power user", u2 as "Portal...

Changing password forces users to log in again

legacy Troubleshooting

Issue Changing password invalidates current sessions and the users have to log in again. 2020-02-07 13:08:37.558 ERROR [http-nio-8080-exec-2][PortletServlet:112] javax.portlet.PortletException:...

The /dtd/ folder of the war with sensitive information is exposed when deploying a portal on Weblogic 12c R2

legacy Troubleshooting

Liferay Support does not recommend or endorse specific third-party products over others. The information provided about products not created by Liferay is for reference purposes only, and any implementation of these...

404 error when downloading module "com.liferay.saml.opensaml.integration" from Release Notes page

legacy Troubleshooting

Issue Getting a 404 error when downloading module "com.liferay.saml.opensaml.integration" from Release Notes page. Environment Liferay DXP 7.2 Resolution The module for "com.liferay.saml.opensaml.integration" can be...

Got the error "saml-hook.war does not support this version of Liferay" after deploying the Liferay Connector to SAML 2.0 lpkg

legacy Troubleshooting

Issue Got the error saml-hook.war does not support this version of Liferay in log after deploying the SAML 2.0 lpkg (version 6.0.0) on DXP 7.1 fix pack dxp-18 Environment Liferay DXP 7.1 Resolution The root cause for...

SAML Authentication Issue: Message context was not authenticated

legacy Troubleshooting

Issue After enabling the SAML, when the user is trying to log in, authentication failed with the following message. ERROR [http-nio-8080-exec-36][BaseSamlStrutsAction:59]...

Disable Email Verification in DXP 7.3

legacy How To

Issue In DXP 7.3, new users have to verify their email address in their initial login. I want to disable this verification requirement. Environment DXP 7.3 Resolution In DXP 7.3, the default value for...

Landing page redirection is not working after SAML configuration

legacy Troubleshooting

Issue Once the SAML is configured the Landing Page redirection is not redirecting to the desired page. Environment Liferay DXP 7.1 Resolution The pre and post-login actions (like DefaultLandingPage actions) are not...

DNSName components must begin with a letter error while starting LDAP server in Apache DS

legacy Troubleshooting

Issue During the configuration of Apache DS I encountered an issue that resulted in an IOException that interfered with starting the LDAP server:...

Security Vulnerability: Remote-Code-Execution (RCE) With ImageMagick

legacy Troubleshooting

Issue Symptom: CVE-2016-3714 - Insufficient shell characters filtering leads to potentially remote-code-execution vulnerability in ImageMagick. Environment ImageMagick before 6.9.3-10...

Import nested groups and users from Microsoft Active Directory

legacy How To

Issue What configuration is needed in Liferay so that the nested groups and the users are imported from AD? Environment DXP 7.2 DXP 7.1 DXP 7.0 Resolution Change the User attribute of the Group Mapping in the LDAP server...

Users are being logged in as some other user

legacy Troubleshooting

Issue When any user logs into the portal, they see the user profile of another user instead of seeing their own profile. Environment Liferay DXP 7.0 Resolution There are usually two root causes for the...

Using one user's JSessionID any logged in user can access the respective user's session

legacy

Issue One user's session is accessed by knowing the respective user's JSessionID. Steps for reference: 1) 2 users (say: User A and User B) 2) User "A" logs-in to the system 3) Now, user "A" has one Jession...

Liferay's OpenID Connect implementation and Single Logout

legacy

Issue Does Liferay's OpenID Connect implementation support Single Logout? Environment Liferay DXP 7.1/7.2 Resolution Liferay's current OpenID Connect (OIDC) integration only implements parts of the Final specifications,...

LDAP users are unable to log in

legacy Troubleshooting

Issue Users who are present in LDAP are unable to perform login into Liferay and the below error was observed at the server console. ERROR [liferay/scheduler_dispatch-4][PortalLDAPImporterImpl:717] Unable...

Does Liferay DXP 7.1 support HTTP headers?

legacy

Issue Does Liferay DXP 7.1 support the following HTTP headers: "X-Frame-Options", "X-XSS-Protection" and "X-Content-Type-Options"? If not, what changes have to be done from the application side to enable...

When SAML is enabled, logging out from particular Site should stay at the respective site itself

legacy

Issue When SAML is enabled, logging out from "SITE A" is not redirecting/stays at the respective site's home page itself. Environment Liferay DXP 7.1 SAML plugin Resolution The ideal scenario is...

TLS v1.2 in Liferay DXP 7.1

legacy

Issue Due to some security vulnerable in TLS v1.0, it should be upgraded to TLS v1.2. 1. Does Liferay DXP 7.1 support TLS v1.2? 2. If it supports, then how to use/upgrade the same in Liferay DXP 7.1?...

Apply button in OAuth 2 Administration is not working

legacy Troubleshooting

Issue When making changes under OAuth 2 Administration, such as generating a new client secret or editing Client ID, the Apply button may not respond when clicked. When viewing the browser console, you will see:...

Unable to process SAML SSO request

legacy Troubleshooting

Issue After configuring SAML SSO successfully, the user is unable to perform login and getting the following error in UI and Server console. UI Error: "Unable to process SAML request" Server Console: ...

Configuration of NTLMv2 with Liferay

legacy

Issue How to configure NTLMv2 in Liferay as there is no configuration available in Liferay control panel to differentiate the request/service Environment Liferay 6.x Liferay 7.0 and Liferay 7.1 Resolution...

Security Statement on CVE-2019-11444: Disputed Groovy Script console vulnerability

legacy

Recently, a security vulnerability was filed in Mitre under CVE-2019-11444 arguing that attackers could allegedly use Liferay's Groovy script console to execute OS commands. Liferay disputes this issue because this is...

Liferay Security Development Overview

legacy

This paper provides an overview of the processes used during development and testing of Liferay products. Combined, these processes ensure that Liferay’s customers can have confidence in the security and ongoing...

Search Results