Site Search - Liferay Learn

Known Issue: Security Scan Shows Liferay as a Potential Sharepoint Vulnerability - False Positive

Issue There may be some instances where a security scan shows Liferay having a potential Sharepoint endpoint vulnerability. Specifically, the security scan's warning may be related to the /_vti_inf.html file. This is...

Existing users in Liferay can not login through SAML with "Screen name x must not be duplicate ..." error

legacy Troubleshooting

Issue If the user exists in Liferay (service provider), the user cannot log in through SAML due to duplicate screenname ERROR. 2019-04-23 04:29:45.758 ERROR [http-nio-18080-exec-7][BaseSamlStrutsAction:58] Screen name ccc...

Why are user accounts shared when I have multiple LDAP servers configured?

legacy Troubleshooting

Issue When a Liferay DXP bundle is configured to communicate with two or more LDAP servers there can be issues with user importing and users logging in. Example: If Liferay DXP is communicating with two LDAP...

Updated Email Addresses in LDAP are not Imported to Liferay DXP 7.0

legacy How To

Issue This article documents a product limitation and a possible workaround for importing a user whose email address was updated in LDAP into a Liferay DXP instance. Environment Liferay DXP LDAP server Resolution This...

Deployment of SAML plugin does not display SAML admin screen

legacy Troubleshooting

Please be aware that the page you are viewing has been machine translated from Japanese into English and may contain some translation errors. If you observe any issues with the translation, please contact us. Event/Use...

Using Shibboleth 3 as IdP + SAML Integration

legacy How To

Liferay Support does not recommend or endorse specific third-party products over others. Liferay is not responsible for any instructions herein or referenced regarding these products. Any implementation of these...

Users Fail to Import When First Name is Missing in LDAP

legacy

This article discusses an apparent issue when Liferay Portal will throw a ContactFirstNameException error in the console. This error message appears when the first name is left out if importing a user from an LDAP...

Configuring Cookies' httpOnly Status

legacy How To

Description By default, the Liferay platform sets all of its cookies to httpOnly true in its portal.properties file (Liferay 6.2 and earlier) or in its system.properties (starting with Liferay 7.0) files. # #...

How to configure HTTPS in Tomcat for Liferay DXP 7.3

legacy How To

Introduction Liferay Support does not recommend or endorse specific third-party products over others. Liferay is not responsible for any instructions herein or referenced regarding...

FAQ for LDAP on Liferay DXP

legacy

This document has been updated and ported to Liferay Learn and is no longer maintained here. This article documents some of the most frequently asked questions regarding the use of Lightweight Directory Access Protocol...

Authentication Error When Logging In With Google Account

legacy Troubleshooting

This article documents an authentication error when attempting to log in to the portal instance using a google account. Listed below are the steps to resolve the issue or avoid it altogether. Resolution Error:...

AntiSamy Portlet Removes HTML Target Attributes

legacy How To

The AntiSamy portlet is meant to prevent XSS type attacks. One side effect however is that if an HTML target is used, then the portlet will remove it upon publishing the content. Steps to Reproduce Create Web...

Performance Issue With LDAP Imports When Using Oracle Database

legacy Troubleshooting

This article is regarding a performance issue that may surface when executing an LDAP import using the UserGroup method for a large amount of users. Specifically, the issue is that the...

JSON Authentication for Custom Portlets

legacy Troubleshooting

Liferay will support our API and resolve any issues and answer any questions having to do with the API itself or any other part of Liferay's software. Issues and questions regarding custom development may be handled by...

Virtual LDAP Server Plugin Setup

legacy How To

The following article gives a basic use case for Liferay's Virtual LDAP Server Plugin. Liferay's EE Virtual LDAP plugin turns Liferay portal into a virtual LDAP server that can be accessed by external LDAP explorer...

Setting Up OpenAM With Liferay Portal 6 on Tomcat

legacy How To

Liferay Support does not recommend or endorse specific third-party products over others. Liferay is not responsible for any instructions herein or referenced regarding these products. Any implementation of these...

Setting Up NTLM With Liferay

legacy How To

NTLM (NT Lan Manager) is a suite of Microsoft security protocols that provides authentication, integrity, and confidentiality to users. When Liferay Portal is successfully integrated with NTLM, Active Directory users...

Setting Up Liferay Portal with Active Directory Server

legacy How To

The details of this article may also be covered in Configuring Liferay's LDAP Settings to Import Users. This article provides a comprehensive walkthrough for integrating an Active Directory Server with Liferay...

Using Liferay Connector to OAuth 2.0 in Liferay DXP 7.1

legacy How To

What is OAuth? It is a utility that authorizes third party applications to interact with the Liferay platform. The OAuth example from our official documentation is worth repeating here; users can make Twitter or...

LSV-391: Security Advisory for Vulnerability With Pingback in Blogs

legacy How To

This advisory comes in response to the recent public announcement of a potential Server-Side Request Forgery (SSRF) vulnerability in Liferay Portal 7.0.4. The report talks about a perceived vulnerability for the...

Making Liferay CAPTCHA Easier to Read in Liferay Portal 6.1

legacy How To

This article is intended for legacy versions of Liferay Portal CAPTCHA is an industry standard security measure that requires users to enter what they see a small window as part of the validation process when creating an...

Defining Encryption Algorithms for Passwords Stored in the Database

legacy How To

By default, Liferay encrypts the passwords that go into the database. The default algorithm is SHA-1 in 6.0 and 6.1 versions, which changed to PBKDF2WithHmacSHA1/160/128000 in version...

Elasticsearch and Liferay Enterprise Search Security Advisory: CVE-2018-3831

legacy

CVE-2018-3831 reports that, "Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch _cluster/settings...

Excluding User Groups Not Part of the BaseDN In LDAP Import

legacy How To

This article is a legacy article. It applies to previous versions of the Liferay product. While the article is no longer maintained, the information may still be applicable. In older versions of Liferay Portal...

Apache Struts 2 Vulnerability: CVE-2017-9805 and CVE-2017-12611 - REST XStream FreeMarker

legacy

The following Common Vulnerabilities and Exposures (CVE) have been reported for Apache Struts 2: CVE-2017-9805 CVE-2017-12611 CVE-2018-1327 - REST XStream FreeMarker CVE-2018-11776 How are Liferay DXP (both 7.0 and...

JSESSIONID Changes as Part of Liferay Security

legacy

This article documents Liferay's position regarding the Session Identifier (JSESSIONID), including how and why a new JSESSIONID is generated. Resolution Customers doing their own security scan of the Liferay platform...

Java NPEs in the Console When Refreshing the CAPTCHA Image

legacy Troubleshooting

This article documents a known issue where refreshing the CAPTCHA image causes a Java NullPointerException (NPE) to be triggered. Please note that the CAPTCHA image will still be refreshed. Steps to Reproduce Start the...

Open LDAP setup guide

legacy How To

Liferay Support does not recommend or endorse specific third-party products over others. Liferay is not responsible for any instructions herein or referenced regarding these products. Any implementation of these principles...

WeDeploy Auth Admin Portlet in Liferay DXP 7.0 Fix Packs

legacy Troubleshooting

When deploying Liferay DXP 7.0 Fix Pack 24, 25, 26 or 27, the WeDeploy Auth Admin portlet will appear in the Control Panel. WeDeploy is currently a beta product. The addition of this portlet will have no impact or...

Configuring Theme-Embedded Portlets After Deploying Security-Hotfix-11-6012

legacy How To

This article is a legacy article. It applies to previous versions of the Liferay product. While the article is no longer maintained, the information may still be applicable....

Avoiding Authentication Errors With IE8 and IE9

legacy Troubleshooting

This article is a legacy article. It applies to previous versions of the Liferay product. While the article is no longer maintained, the information may still be applicable. When a session of Liferay times-out, an...

Applying Security Update 2012-05-25 requires Tunnel-web

legacy Troubleshooting

This article is a legacy article. It applies to previous versions of the Liferay product. While the article is no longer maintained, the information may still be applicable. When...

SAML Comprehensive Quick Start Guide for Liferay Portal

legacy How To

This is a comprehensive article that documents the steps for how to set up SAML on Liferay Portal 6.2 EE. In addition, this article covers the different ways that SAML can be implemented and utilized. SAML (Security...

Configuring Liferay DXP as SP and OKTA as IdP

legacy How To

This article documents the basic steps users need to execute in order to set up their instance of Liferay DXP as SP, and OKTA as IdP. Resolution OKTA Configuration Log in to OKTA and navigate to Admin > Add Application...

LDAP Import Rejects Users From Certain Domains

legacy Troubleshooting

This article explains why users from specific domains are not imported through LDAP due to the email address validator in the Liferay platform, and provides a solution to resolve this if a specific domain is required...

Using Liferay Connector to OAuth EE

legacy How To

What is OAuth? It is a utility that authorizes third party applications to interact with the Liferay platform. The example from our official documentation is worth repeating here; users can make Twitter or Facebook...

Setting Up ClamAV With the Liferay Platform on Windows

legacy How To

This article documents how to set up Clam Antivirus with the Liferay platform on Windows for testing purposes. The goal is to scan documents for viruses when they are being uploaded. Resolution Download ClamWin for...

Exporting OpenSSO Configuration Settings for Use in Another DXP Environment

legacy How To

If you are migrating your OpenSSO configuration from one environment to another, you don't need to migrate the settings manually. Resolution Login to your Liferay DXP environment. Navigate to Control Panel > Configuration...

Deploying and Managing SAML on Liferay DXP

legacy Troubleshooting

This troubleshooting guide is meant to supplement the existing SAML documentation. The information in this guide explains in more detail to demonstrate the most common use cases. ...

ユーザーグループにユーザーをアサイン後、そのユーザーのSSOログイン直前にアサインを外される

legacy Troubleshooting

, knowledgeArticleType: troubleshooting, legacy: true, name: ユーザーグループにユーザーをアサイン後、そのユーザーのSSOログイン直前にアサインを外される, showDisclaimerMessage: true, sourceTeam: Support, ticketNumber: 128674, title:...

セッションタイムアウトの時間を、インスタンスごとに設定したいです。

legacy

, knowledgeArticleType: reference, legacy: true, name: セッションタイムアウトの時間を、インスタンスごとに設定したいです。, showDisclaimerMessage: true, sourceTeam: Support, ticketNumber: 109505, title: セッションタイムアウトの時間を、インスタンスごとに設定したいです。

「アイデンティティ・プロバイダーへリダイレクトしています...」というメッセージの画面の背景を変更可能ですか。

legacy

, knowledgeArticleType: reference, legacy: true, name: 「アイデンティティ・プロバイダーへリダイレクトしています...」というメッセージの画面の背景を変更可能ですか。, showDisclaimerMessage: true, sourceTeam: Support, ticketNumber: 102179, title:...

LiferayでのSAML設定方法

legacy How To

, knowledgeArticleType: howTo, legacy: true, name: LiferayでのSAML設定方法, showDisclaimerMessage: true, sourceTeam: Support, ticketNumber: , title: LiferayでのSAML設定方法

DXPで「ldap.import.create.role.per.group」を使用する方法

legacy How To

, knowledgeArticleType: howTo, legacy: true, name: DXPで「ldap.import.create.role.per.group」を使用する方法, showDisclaimerMessage: true, sourceTeam: Support, ticketNumber: , title:...

SCIM Support for Microsoft Entra ID

legacy

Issue Is there complete out-of-the-box SCIM support for Microsoft Entra ID in Liferay DXP? Environment Versions before 2025.Q2.0. Resolution Full support for Microsoft Entra ID with Liferay's SCIM functionality was...

Web Content Templates cache Absolute image URLs, not Relative URLs

legacy Troubleshooting

Issue The templates cache absolute image URLs instead of relative URLs. Environment 2024.Q1.12, 2024.Q1.18 Resolution Upgrade to 2024.Q2.0+ or Request a hotfix with LPD-23196, knowledgeArticleType: troubleshooting,...

Does Liferay have an Attestation of Compliance to be PCI certified?

legacy

Issue We are in the process of reviewing application compliance and want to know if Liferay has an attestation of compliance (related to PCI), specifically the Payment Card Industry Data Security Standard? Environment...

B2C SSO Configuration with OpenID Connect Not Working

legacy Troubleshooting

Issue Setting up Business-to-Consumer (B2C) single sign-on (SSO) configuration with Liferay using OpenID Connect (OIDC) in Azure AD B2C is not working as expected. After enabling OpenID under Instance Settings in...

Application Accept Special Characters in Input Fields

legacy

Issue The application accepts special characters in input fields. Ex: " ' ` * ; % _ = & | \ ? ~ < > ^ () [] {} $ \n\ Steps to Reproduce: 1. Start Liferay server. 2. Navigate to the user’s profile. 3. Click on...

Liferay Marketplace App Manager Web XSS Vulnerability (CVE-2025-4388)

legacy Troubleshooting

Issue A reflected cross-site scripting (XSS) vulnerability (CVE-2025-4388) in /o/marketplace-app-manager-web/icon.jsp allows a remote non-authenticated attacker to inject JavaScript into the...

Step-by-Step SAML Integration with Liferay and Keycloak

legacy How To

Issue Is Keycloak supported with Liferay? If yes, how can SAML be configured with Liferay? Environment Lifeary DXP [All versions] Resolution As per Liferay’s official compatibility matrix, Keycloak is not listed as a...

Re-enabling Basic Authentication when Unable to Access the DXP Control Panel

legacy How To

Issue My Basic Authentication was disabled at the Instance Level, and now I am unable to access the DXP Portal because of it. How do I re-enable Basic Authentication without logging in? Environment Quarterly...

Changes to Site Templates are not propagated to pages

legacy Troubleshooting

Issue Changes made to a site template are not propagated to the pages that use the template. We can see the next error in the server log: [LayoutSetPrototypeMergeBackgroundTaskExecutor:219] Merge fail count...

Security scan detected a "Reference to Windows file path is present in HTML"

legacy Troubleshooting

Issue Our security scan detected a "Reference to Windows file path is present in HTML" in the following URL:...

Session lost on page redirect using POST method when request header is SameSite=LAX

legacy Troubleshooting

Issue The problem is happening when using POST method to receive data from another portal on a different domain, which is considered unsafe when request header is SameSite=LAX, that because if this header is not...

HttpOnly flag in JSESSIONID cookie using JBOSS application server

legacy Troubleshooting

Issue JSESSIONID cookie does not contain the HttpOnly flag. Environment Liferay Portal 6.2 JBOSS Resolution You need to change it on your application server configuration, in the...

Do source map (.map) files for JS source code represent a vulnerability issue?

legacy

, knowledgeArticleType: reference, legacy: true, name: Do source map (.map) files for JS source code represent a vulnerability issue?, showDisclaimerMessage: true, sourceTeam: Support, ticketNumber: 76754, title:...

Where is the SAML assertion information stored in Liferay?

legacy

, knowledgeArticleType: reference, legacy: true, name: Where is the SAML assertion information stored in Liferay?, showDisclaimerMessage: true, sourceTeam: Support, ticketNumber: 63806, title:...

Security vulnerability in CBOR 4.2.0 (Multi-Factor Authentication)

legacy Troubleshooting

, knowledgeArticleType: troubleshooting, legacy: true, name: Security vulnerability in CBOR 4.2.0 (Multi-Factor Authentication), showDisclaimerMessage: true, sourceTeam: Support, ticketNumber: , title: CBOR...

/html/common/referer_jsp.jsp vulnerability

legacy

, knowledgeArticleType: troubleshooting, legacy: true, name: /html/common/referer_jsp.jsp vulnerability, showDisclaimerMessage: true, sourceTeam: Support, ticketNumber: 45080, title: /html/common/referer_jsp.jsp...

Search Results