[JS2-1100] DeveloperBrowser-type portlets for delegated admin can be used to assign global admin role

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.2.0, 2.2.1
• Fix Version/s: 2.2.2
• Component/s: Admin Portlets
• Labels: delegated portlet security
• Assignee: Ate Douma
• Reporter: Paul Anderson
• Created: 05/Feb/10 18:20
• Updated: 27/Sep/11 03:17
• Resolved: 27/Sep/11 03:17

Description

There is no way for a deployer to configure preset lists (or combinations) of allowed roles etc that a delegated administrator can assign to filtered users, or to filter out certain roles from the list of options available. (Also no way to set required attributes like language, which would be useful too).

So a delegated admin can give users full global admin privileges. This makes the portlet unsuitable for production use.

Issue Links

• relates to: JS2-915 Provide admin roles security restriction on admin roles maintenance