PUBLIC - Liferay Portal Community Edition

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Duplicate
• Affects Version/s: 5.1.2
• Fix Version/s: None
• Component/s: Authentication
• Labels:

  None
• Environment:

  tomcat6, vista, windows2003 R2 server domain

User can login in portal entering wrong password.

I enable NTLM autentication,
and LDAP importing users from my AD.

Open browser (firefox, safari) outside domain
click on sign in and the browser asks for username and password
via browser standard form
now insert a correct username and a wrong password
portal recognize me without checking password

I think this is a big security problem.

How can I force password checking keeping NTLM authentication active?
Am I missing something?

Final note: AD keeps password encripted
and disabling NTLM i cannot login in portal, so i need NTLM.

Regards,
Luca
found was already in forum but cannot find solutions
http://www.liferay.com/web/guest/community/forums/-/message_boards/message/310580

• Assignee:

  SE Support

  Reporter:

  Luca Costa

• Created:

  11/Feb/09 1:16 AM

  Updated:

  11/Jan/11 10:56 AM

  Resolved:

  05/Mar/10 6:41 AM