Topic: smeserver-userpanel 0.9-10 Problem in SME 7.1.3

[Lucky Dragon]

Just installed this today. Then I configured a user in User Panel Access under the Security section. I then logged out and logged back in to https://servername/server-manager/ with that ID instead of admin. The initial html login form with the SME logo took my ID/pw fine, but then a Firefox"Authentication Required" dialog box pops up, asking me to Enter username for "" at https://servername. I tried entering my username/pw, admin, and root but the box just comes back. If I cancel, i get:

_____
Authorization Required

This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required.
_____

Subsequent attempts to access https://servername/server-manager/ skip right past the initial html logon screen and bring the "Authentication Required" dialog box up again.
I went to  Tools > Clear Private Data in Firefox and cleared cookies, cache, and authenticated sessions, then reloaded https://servername/server-manager/ again, then login with admin as normal.
I did a search in the bug tracker and forums but found nothing like this. Am I doing something wrong or is this a bug?

[Franco]

You stumbled in the same problem I did here http://forums.contribs.org/index.php?topic=35924.0

I asked the same question: report a bug or a feature request
I never got the answer needed...

Hard to say since the logout piece is part of the main project and user-manager is a contrib.

[Lucky Dragon]

I didn't attempt to log into https://servername/user-manager/. I was logging into https://servername/server-manager/, so different issue.
But you're right: I can login to user-manager with an ID/PW other than admin, but there's no logout. I would have to use Firefox's Clear Private Data function if I wanted to prevent someone else from modifying things with my login... that or close the browser. Maybe these two issues are related?

[bpivk]

This is a common problem and should be reported.
If you login (from the new login form) as any user other then admin you get the old login box that doesn't allow you to enter server manager even if you enter admin and your username.

[Lucky Dragon]

Bug 2865

Suggested solution:

• Don't allow access to server-manager except with admin ID
• Add a logoff fucntion to user-manager contrib that clears user's login info. Maybe even a timeout that de-authorizes it automatically after x amount of inactivity.
• Don't allow changes to user Admin in User Panel Access... that's just asking for trouble.