[JIRA] (SSPCPP-961) Shibboleth SP - Windows - possible Privilege Escalation

[Rod Widdowson (Jira)]

Rod Widdowson ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=59fb32bbc24efb3c4ed3c977 ) *commented* on SSPCPP-961 ( https://shibboleth.atlassian.net/browse/SSPCPP-961?atlOrigin=eyJpIjoiZDMxZjExYWE5NGIzNDBiM2JiZWIyZDg4NjQ5ZTUwNDYiLCJwIjoiaiJ9 )

Re: Shibboleth SP - Windows - possible Privilege Escalation ( https://shibboleth.atlassian.net/browse/SSPCPP-961?atlOrigin=eyJpIjoiZDMxZjExYWE5NGIzNDBiM2JiZWIyZDg4NjQ5ZTUwNDYiLCJwIjoiaiJ9 )

It turns out that on my machine IIS_APOOL doesn’t exist. I have no recollection of what I did to configure the machine but if I can do it anyone can. So the rule is that we add

* Read ACE for USERS
* Read ACE for WEBSERVER_USER (which defaults to USERS)

I had forgotten that the “But the service cannot start” thing is finessed in the SP buy specifying ALWAYS_START_SERVICE=FALSE on the command line. Might wanna add that to the IDP.

I'll commit that and then resolve this, but not close it until we know what the vehicle (if any) for this change will be and then I can document that.

( https://shibboleth.atlassian.net/browse/SSPCPP-961#add-comment?atlOrigin=eyJpIjoiZDMxZjExYWE5NGIzNDBiM2JiZWIyZDg4NjQ5ZTUwNDYiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/SSPCPP-961#add-comment?atlOrigin=eyJpIjoiZDMxZjExYWE5NGIzNDBiM2JiZWIyZDg4NjQ5ZTUwNDYiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100210- sha1:eab5823 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20221126/626d62ac/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-d0057d19-0907-4662-b914-94071244b15e
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221126/626d62ac/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-9f2b9cbd-728b-42e3-aa17-7c3594e6c401
Type: image/png
Size: 345 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221126/626d62ac/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-0a401783-d683-4f87-b21c-3d3cd5934e83
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221126/626d62ac/attachment-0005.png>